@rubytech/create-maxy 1.0.647 → 1.0.649

package/payload/server/server.js

@@ -1201,14 +1201,14 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path2, app29) {
+  route(path2, app30) {
     const subApp = this.basePath(path2);
-    app29.routes.map((r) => {
+    app30.routes.map((r) => {
       let handler;
-      if (app29.errorHandler === errorHandler) {
+      if (app30.errorHandler === errorHandler) {
         handler = r.handler;
       } else {
-        handler = async (c, next) => (await compose([], app29.errorHandler)(c, () => r.handler(c, next))).res;
+        handler = async (c, next) => (await compose([], app30.errorHandler)(c, () => r.handler(c, next))).res;
         handler[COMPOSED_HANDLER] = r.handler;
       }
       subApp.#addRoute(r.method, r.path, handler);
@@ -2526,7 +2526,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve29) => setTimeout(resolve29));
+            await new Promise((resolve30) => setTimeout(resolve30));
             maxReadCount = 3;
             continue;
           }
@@ -2892,8 +2892,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync25, watchFile } from "fs";
-import { resolve as resolve28, join as join13, basename as basename7 } from "path";
+import { readFileSync as readFileSync25, existsSync as existsSync24, watchFile } from "fs";
+import { resolve as resolve29, join as join13, basename as basename7 } from "path";
 import { homedir as homedir5 } from "os";
 
 // app/lib/vnc-logger.ts
@@ -2982,10 +2982,10 @@ var SCRYPT_R = 8;
 var SCRYPT_P = 1;
 var SCRYPT_KEYLEN = 64;
 function scryptAsync(password, salt) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve30, reject) => {
     scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
       if (err) reject(err);
-      else resolve29(key);
+      else resolve30(key);
     });
   });
 }
@@ -3826,9 +3826,33 @@ Content-Length: 0\r
   socket.destroy();
 }
 
-// server/graph-proxy.ts
+// server/ws-proxy-terminal.ts
 import { createConnection as createConnection2 } from "net";
-var GRAPH_PREFIX = "/graph";
+
+// app/lib/terminal-logger.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { resolve as resolve3 } from "path";
+var TERMINAL_LOG_FILE = resolve3(LOG_DIR, "terminal.log");
+try {
+  mkdirSync2(LOG_DIR, { recursive: true });
+} catch (err) {
+  console.error(`[terminal-log-fail] mkdir ${LOG_DIR} failed: ${err.message}`);
+}
+function terminalLog(phase, fields = {}) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const kv = Object.entries(fields).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" ");
+  const line = kv.length > 0 ? `[${ts}] [terminal-${phase}] ${kv}
+` : `[${ts}] [terminal-${phase}]
+`;
+  try {
+    appendFileSync2(TERMINAL_LOG_FILE, line);
+  } catch (err) {
+    console.error(`[terminal-log-fail] ${err.message} \u2014 dropped: ${line.slice(0, 300).trim()}`);
+  }
+}
+
+// server/ws-proxy-terminal.ts
+var WS_PATH2 = "/admin/terminal/ws";
 var UPSTREAM_TIMEOUT_MS2 = 5e3;
 var HOP_BY_HOP2 = /* @__PURE__ */ new Set([
   "connection",
@@ -3840,194 +3864,225 @@ var HOP_BY_HOP2 = /* @__PURE__ */ new Set([
   "transfer-encoding",
   "upgrade"
 ]);
-var cachedUpstreamPort = null;
-function resolveUpstreamPort() {
-  if (cachedUpstreamPort !== null) return cachedUpstreamPort;
-  const uri = process.env.NEO4J_URI;
-  if (!uri) {
-    throw new Error(
-      "[ui/graph-proxy] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687 (Task 580)"
-    );
-  }
-  const m = uri.match(/:(\d+)$/);
-  const boltPort = m ? parseInt(m[1], 10) : 7687;
-  cachedUpstreamPort = boltPort - 213;
-  console.error(`[ui/graph-proxy] resolved neo4j_uri=${uri} http_port=${cachedUpstreamPort}`);
-  return cachedUpstreamPort;
-}
-var UPSTREAM_HOST = "127.0.0.1";
-function attachGraphHttpRoutes(app29) {
-  const handler = async (c) => {
-    const raw2 = c.req.raw;
-    const url = new URL(raw2.url);
-    const upstreamPort = resolveUpstreamPort();
-    const pathAfterPrefix = url.pathname.slice(GRAPH_PREFIX.length) || "/";
-    const upstreamUrl = `http://${UPSTREAM_HOST}:${upstreamPort}${pathAfterPrefix}${url.search}`;
-    const upstreamHeaders = new Headers(raw2.headers);
-    for (const h of HOP_BY_HOP2) upstreamHeaders.delete(h);
-    upstreamHeaders.set("host", `${UPSTREAM_HOST}:${upstreamPort}`);
-    try {
-      const upstream = await fetch(upstreamUrl, {
-        method: raw2.method,
-        headers: upstreamHeaders,
-        body: raw2.body,
-        // `duplex: 'half'` is required when forwarding a streaming body; TS
-        // typings do not yet expose it but the undici runtime supports it.
-        ...raw2.body ? { duplex: "half" } : {},
-        redirect: "manual"
-      });
-      const resHeaders = new Headers(upstream.headers);
-      for (const h of HOP_BY_HOP2) resHeaders.delete(h);
-      const loc = resHeaders.get("location");
-      if (loc) {
-        const rewritten = rewriteLocation(loc);
-        if (rewritten !== loc) resHeaders.set("location", rewritten);
-      }
-      return new Response(upstream.body, {
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: resHeaders
-      });
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`[graph-proxy] upstream fetch failed for ${upstreamUrl}: ${msg}`);
-      return c.text(`Graph proxy upstream unreachable: ${msg}`, 502);
-    }
-  };
-  app29.all(GRAPH_PREFIX, handler);
-  app29.all(`${GRAPH_PREFIX}/*`, handler);
-}
-function attachGraphWsProxy(server, opts) {
+function attachTerminalWsProxy(server, opts) {
+  const upstreamHost = opts.upstreamHost ?? "127.0.0.1";
+  const upstreamPort = opts.upstreamPort ?? 7681;
   server.on("upgrade", (req, clientSocket, head) => {
     try {
-      const url = req.url ?? "";
-      const qsIndex = url.indexOf("?");
-      const pathname = qsIndex === -1 ? url : url.slice(0, qsIndex);
-      const isGraphPath = pathname === GRAPH_PREFIX || pathname.startsWith(`${GRAPH_PREFIX}/`);
-      if (!isGraphPath) {
-        if (pathname !== "/websockify") {
-          clientSocket.destroy();
-        }
-        return;
-      }
-      const hostHeader = (req.headers.host ?? "").split(":")[0];
-      const remote = req.socket.remoteAddress;
-      const xff = headerString2(req.headers["x-forwarded-for"]);
-      const cookie = headerString2(req.headers.cookie);
-      const decision = opts.canAccessAdmin({
-        host: hostHeader,
-        remoteAddress: remote,
-        xForwardedFor: xff,
-        cookieHeader: cookie,
-        isPublicHost: opts.isPublicHost
-      });
-      if (!decision.allow) {
-        const status = decision.reason === "public-host" ? 404 : 401;
-        writeStatusAndDestroy2(clientSocket, status, decision.reason === "public-host" ? "Not Found" : "Unauthorized");
-        return;
-      }
-      const originHeader = headerString2(req.headers.origin);
-      const originHost = parseOriginHost2(originHeader);
-      if (!originHost || originHost !== hostHeader || opts.isPublicHost(originHost)) {
-        writeStatusAndDestroy2(clientSocket, 403, "Forbidden");
-        return;
-      }
-      const rewrittenPath = pathname === GRAPH_PREFIX ? "/" : pathname.slice(GRAPH_PREFIX.length);
-      const rewrittenUrl = qsIndex === -1 ? rewrittenPath : rewrittenPath + url.slice(qsIndex);
-      const upstreamPort = resolveUpstreamPort();
-      const upstream = createConnection2({ host: UPSTREAM_HOST, port: upstreamPort });
-      upstream.setTimeout(UPSTREAM_TIMEOUT_MS2);
-      upstream.once("connect", () => {
-        upstream.setTimeout(0);
-        const lines = [];
-        lines.push(`${req.method ?? "GET"} ${rewrittenUrl} HTTP/${req.httpVersion}`);
-        lines.push(`host: ${UPSTREAM_HOST}:${upstreamPort}`);
-        for (const [name, value] of Object.entries(req.headers)) {
-          if (name === "host") continue;
-          if (HOP_BY_HOP2.has(name)) continue;
-          if (value == null) continue;
-          if (Array.isArray(value)) {
-            for (const v of value) lines.push(`${name}: ${v}`);
-          } else {
-            lines.push(`${name}: ${value}`);
-          }
-        }
-        const upgradeHeader = headerString2(req.headers.upgrade);
-        const connectionHeader = headerString2(req.headers.connection);
-        if (upgradeHeader) lines.push(`upgrade: ${upgradeHeader}`);
-        if (connectionHeader) lines.push(`connection: ${connectionHeader}`);
-        upstream.write(lines.join("\r\n") + "\r\n\r\n");
-        if (head && head.length > 0) upstream.write(head);
-        clientSocket.pipe(upstream);
-        upstream.pipe(clientSocket);
-        const teardown = () => {
-          clientSocket.destroy();
-          upstream.destroy();
-        };
-        clientSocket.once("close", teardown);
-        upstream.once("close", teardown);
-        clientSocket.once("error", teardown);
-        upstream.once("error", teardown);
-      });
-      upstream.once("timeout", () => {
-        writeStatusAndDestroy2(clientSocket, 504, "Gateway Timeout");
-        upstream.destroy();
-      });
-      upstream.once("error", (err) => {
-        console.error(`[graph-proxy] ws upstream error: ${err.message}`);
-        writeStatusAndDestroy2(clientSocket, 502, "Bad Gateway");
-        upstream.destroy();
+      handleUpgrade2(req, clientSocket, head, {
+        isPublicHost: opts.isPublicHost,
+        upstreamHost,
+        upstreamPort
       });
     } catch (err) {
-      console.error(`[graph-proxy] upgrade handler exception: ${err.message}`);
+      terminalLog("ws-upgrade", {
+        decision: "rejected",
+        reason: "handler-exception",
+        err: err.message
+      });
       clientSocket.destroy();
     }
   });
 }
-function graphAuthMiddleware(opts) {
-  return async (c, next) => {
-    const url = new URL(c.req.raw.url);
-    if (!url.pathname.startsWith(GRAPH_PREFIX)) return next();
-    const hostHeader = (c.req.header("host") ?? "").split(":")[0];
-    const incoming = c.env?.incoming;
-    const remote = incoming?.socket?.remoteAddress;
-    const xff = c.req.header("x-forwarded-for");
-    const cookie = c.req.header("cookie");
-    const decision = opts.canAccessAdmin({
+function handleUpgrade2(req, clientSocket, head, opts) {
+  const url = req.url ?? "";
+  const qsIndex = url.indexOf("?");
+  const pathname = qsIndex === -1 ? url : url.slice(0, qsIndex);
+  if (pathname !== WS_PATH2) {
+    return;
+  }
+  const corrId = newCorrId();
+  const query = qsIndex === -1 ? "" : url.slice(qsIndex + 1);
+  const rawClientCorrId = parseQueryParam2(query, "corrId");
+  const clientCorrId = sanitizeClientCorrId(rawClientCorrId);
+  const hostHeader = (req.headers.host ?? "").split(":")[0];
+  const originHeader = headerString2(req.headers.origin);
+  const remote = req.socket.remoteAddress;
+  const xff = headerString2(req.headers["x-forwarded-for"]);
+  const decision = canAccessAdmin({
+    host: hostHeader,
+    remoteAddress: remote,
+    xForwardedFor: xff,
+    cookieHeader: headerString2(req.headers.cookie),
+    isPublicHost: opts.isPublicHost
+  });
+  if (!decision.allow) {
+    const status = decision.reason === "public-host" ? 404 : 401;
+    terminalLog("ws-upgrade", {
+      corrId,
+      clientCorrId: clientCorrId ?? null,
+      decision: "rejected",
+      reason: decision.reason,
+      ip: remote,
+      xff: xff ?? null,
+      origin: originHeader ?? null,
+      host: hostHeader
+    });
+    writeStatusAndDestroy2(clientSocket, status, decision.reason === "public-host" ? "Not Found" : "Unauthorized");
+    return;
+  }
+  const originHost = parseOriginHost2(originHeader);
+  if (!originHost) {
+    terminalLog("ws-upgrade", {
+      corrId,
+      clientCorrId: clientCorrId ?? null,
+      decision: "rejected",
+      reason: "origin-missing-or-invalid",
+      origin: originHeader ?? null,
       host: hostHeader,
-      remoteAddress: remote,
-      xForwardedFor: xff,
-      cookieHeader: cookie,
-      isPublicHost: opts.isPublicHost
+      ip: remote
     });
-    if (!decision.allow) {
-      return c.text(
-        decision.reason === "public-host" ? "Not Found" : "Unauthorized",
-        decision.reason === "public-host" ? 404 : 401
-      );
+    writeStatusAndDestroy2(clientSocket, 403, "Forbidden");
+    return;
+  }
+  if (originHost !== hostHeader) {
+    terminalLog("ws-upgrade", {
+      corrId,
+      clientCorrId: clientCorrId ?? null,
+      decision: "rejected",
+      reason: "origin-mismatch",
+      origin_host: originHost,
+      host: hostHeader,
+      ip: remote
+    });
+    writeStatusAndDestroy2(clientSocket, 403, "Forbidden");
+    return;
+  }
+  if (opts.isPublicHost(originHost)) {
+    terminalLog("ws-upgrade", {
+      corrId,
+      clientCorrId: clientCorrId ?? null,
+      decision: "rejected",
+      reason: "origin-public-host",
+      origin_host: originHost,
+      host: hostHeader,
+      ip: remote
+    });
+    writeStatusAndDestroy2(clientSocket, 403, "Forbidden");
+    return;
+  }
+  terminalLog("ws-upgrade", {
+    corrId,
+    clientCorrId: clientCorrId ?? null,
+    decision: "accepted",
+    ip: remote,
+    xff: xff ?? null,
+    origin: originHeader ?? null,
+    host: hostHeader,
+    sec_ws_version: headerString2(req.headers["sec-websocket-version"]) ?? null,
+    sec_ws_protocol: headerString2(req.headers["sec-websocket-protocol"]) ?? null
+  });
+  const upstream = createConnection2({ host: opts.upstreamHost, port: opts.upstreamPort });
+  upstream.setTimeout(UPSTREAM_TIMEOUT_MS2);
+  let bytesClientToUpstream = 0;
+  let bytesUpstreamToClient = 0;
+  let closedBy = null;
+  let proxyOpened = false;
+  const finish = (side, reason) => {
+    if (closedBy) return;
+    closedBy = side;
+    if (proxyOpened) {
+      terminalLog("proxy-close", {
+        corrId,
+        closedBy: side,
+        reason,
+        clientBytes: bytesClientToUpstream,
+        upstreamBytes: bytesUpstreamToClient
+      });
     }
-    return next();
+    clientSocket.destroy();
+    upstream.destroy();
   };
+  upstream.once("connect", () => {
+    upstream.setTimeout(0);
+    proxyOpened = true;
+    terminalLog("proxy-open", {
+      corrId,
+      upstream: `${opts.upstreamHost}:${opts.upstreamPort}`
+    });
+    const lines = [];
+    lines.push(`${req.method ?? "GET"} ${WS_PATH2} HTTP/${req.httpVersion}`);
+    lines.push(`host: ${opts.upstreamHost}:${opts.upstreamPort}`);
+    for (const [name, value] of Object.entries(req.headers)) {
+      if (name === "host") continue;
+      if (HOP_BY_HOP2.has(name)) continue;
+      if (value == null) continue;
+      if (Array.isArray(value)) {
+        for (const v of value) lines.push(`${name}: ${v}`);
+      } else {
+        lines.push(`${name}: ${value}`);
+      }
+    }
+    const upgradeHeader = headerString2(req.headers.upgrade);
+    const connectionHeader = headerString2(req.headers.connection);
+    if (upgradeHeader) lines.push(`upgrade: ${upgradeHeader}`);
+    if (connectionHeader) lines.push(`connection: ${connectionHeader}`);
+    upstream.write(lines.join("\r\n") + "\r\n\r\n");
+    if (head && head.length > 0) upstream.write(head);
+    clientSocket.on("data", (chunk) => {
+      bytesClientToUpstream += chunk.length;
+    });
+    upstream.on("data", (chunk) => {
+      bytesUpstreamToClient += chunk.length;
+    });
+    clientSocket.pipe(upstream);
+    upstream.pipe(clientSocket);
+    clientSocket.once("close", (hadError) => {
+      finish("client", hadError ? "error" : "normal");
+    });
+    upstream.once("close", (hadError) => {
+      finish("upstream", hadError ? "error" : "normal");
+    });
+    clientSocket.once("error", (err) => {
+      terminalLog("proxy-error", { corrId, side: "client", err: err.message });
+      finish("client", "error");
+    });
+    upstream.once("error", (err) => {
+      terminalLog("proxy-error", { corrId, side: "upstream", err: err.message });
+      finish("upstream", "error");
+    });
+  });
+  upstream.once("timeout", () => {
+    if (proxyOpened) return;
+    terminalLog("proxy-error", {
+      corrId,
+      side: "upstream-connect",
+      err: "timeout",
+      timeout_ms: UPSTREAM_TIMEOUT_MS2
+    });
+    writeStatusAndDestroy2(clientSocket, 504, "Gateway Timeout");
+    upstream.destroy();
+  });
+  upstream.once("error", (err) => {
+    if (proxyOpened) return;
+    terminalLog("proxy-error", {
+      corrId,
+      side: "upstream-connect",
+      err: err.message
+    });
+    writeStatusAndDestroy2(clientSocket, 502, "Bad Gateway");
+    upstream.destroy();
+  });
+}
+function parseQueryParam2(query, key) {
+  if (!query) return null;
+  for (const pair of query.split("&")) {
+    const eq = pair.indexOf("=");
+    const k = eq === -1 ? pair : pair.slice(0, eq);
+    if (k !== key) continue;
+    const v = eq === -1 ? "" : pair.slice(eq + 1);
+    try {
+      return decodeURIComponent(v);
+    } catch {
+      return null;
+    }
+  }
+  return null;
 }
 function headerString2(value) {
   if (value == null) return void 0;
   return Array.isArray(value) ? value[0] : value;
 }
-function rewriteLocation(location) {
-  try {
-    const parsed = new URL(location);
-    if (parsed.hostname === UPSTREAM_HOST && parsed.port === String(resolveUpstreamPort())) {
-      const pathWithQuery = parsed.pathname + parsed.search + parsed.hash;
-      return pathWithQuery.startsWith(GRAPH_PREFIX) ? pathWithQuery : `${GRAPH_PREFIX}${pathWithQuery}`;
-    }
-    return location;
-  } catch {
-    if (location.startsWith("/") && !location.startsWith(`${GRAPH_PREFIX}/`) && location !== GRAPH_PREFIX) {
-      return `${GRAPH_PREFIX}${location}`;
-    }
-    return location;
-  }
-}
 function parseOriginHost2(origin) {
   if (!origin) return null;
   try {
@@ -4057,9 +4112,9 @@ var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
 import Anthropic2 from "@anthropic-ai/sdk";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { resolve as resolve6, join as join4 } from "path";
+import { resolve as resolve7, join as join4 } from "path";
 import { platform as osPlatform } from "os";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync as unlinkSync2, cpSync, rmSync as rmSync2, appendFileSync as appendFileSync2, openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync5, createWriteStream, statSync as statSync3, unlinkSync as unlinkSync2, cpSync, rmSync as rmSync2, appendFileSync as appendFileSync3, openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
 import { lookup as dnsLookup } from "dns/promises";
 import { createConnection as netConnect } from "net";
 import { StringDecoder } from "string_decoder";
@@ -4068,12 +4123,12 @@ import { StringDecoder } from "string_decoder";
 var import_dist = __toESM(require_dist());
 import {
   existsSync as existsSync4,
-  mkdirSync as mkdirSync2,
+  mkdirSync as mkdirSync3,
   readFileSync as readFileSync3,
   unlinkSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { resolve as resolve3, join as join3, dirname } from "path";
+import { resolve as resolve4, join as join3, dirname } from "path";
 import { homedir as homedir2 } from "os";
 var cachedKeyFilePath = null;
 function resolveKeyFilePath() {
@@ -4104,7 +4159,7 @@ function resolveKeyFilePath() {
       throw err;
     }
   }
-  cachedKeyFilePath = resolve3(homedir2(), configDirName2, ".anthropic-api-key");
+  cachedKeyFilePath = resolve4(homedir2(), configDirName2, ".anthropic-api-key");
   return cachedKeyFilePath;
 }
 function readKey() {
@@ -4391,10 +4446,10 @@ async function ensureAuth() {
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection as createConnection3 } from "net";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve4 } from "path";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
-var VNC_SCRIPT = resolve4(PLATFORM_ROOT2, "scripts/vnc.sh");
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve5 } from "path";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
+var VNC_SCRIPT = resolve5(PLATFORM_ROOT2, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -4506,10 +4561,10 @@ async function waitForPort(port2, timeoutMs = 12e3) {
   return false;
 }
 function ensureLogDir() {
-  mkdirSync3(LOG_DIR, { recursive: true });
+  mkdirSync4(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve4(LOG_DIR, `${name}.log`);
+  return resolve5(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   const up = await waitForPort(5900, 1e3);
@@ -4587,8 +4642,8 @@ function killChromium() {
   spawnSync("pkill", ["-f", "chromium"], { stdio: "pipe" });
 }
 function writeChromiumWrapper() {
-  mkdirSync3(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve4(BIN_DIR, "chromium");
+  mkdirSync4(BIN_DIR, { recursive: true });
+  const wrapperPath = resolve5(BIN_DIR, "chromium");
   writeFileSync4(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
@@ -4674,12 +4729,12 @@ import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
 import { spawn } from "child_process";
 import { readFileSync as readFileSync6, readdirSync, existsSync as existsSync5, openSync, readSync, closeSync, statSync as statSync2, rmSync } from "fs";
-import { resolve as resolve5 } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
+import { resolve as resolve6 } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve5(PLATFORM_ROOT3, "config/.neo4j-password");
+  const passwordFile = resolve6(PLATFORM_ROOT3, "config/.neo4j-password");
   try {
     return readFileSync6(passwordFile, "utf-8").trim();
   } catch {
@@ -5355,7 +5410,7 @@ ${userContent}`;
     "dontAsk",
     prompt
   ];
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     let stdout = "";
     let stderr = "";
     const spawnFn = _spawnOverride ?? spawn;
@@ -5373,35 +5428,35 @@ ${userContent}`;
     const timer = setTimeout(() => {
       proc.kill("SIGTERM");
       console.error("[persist] autoLabel: haiku subprocess timed out");
-      resolve29(null);
+      resolve30(null);
     }, SESSION_LABEL_TIMEOUT_MS);
     proc.on("error", (err) => {
       clearTimeout(timer);
       console.error(`[persist] autoLabel: subprocess error \u2014 ${err.message}`);
-      resolve29(null);
+      resolve30(null);
     });
     proc.on("close", (code) => {
       clearTimeout(timer);
       if (code !== 0) {
         console.error(`[persist] autoLabel: subprocess exited code=${code}${stderr ? ` stderr=${stderr.trim().slice(0, 200)}` : ""}`);
-        resolve29(null);
+        resolve30(null);
         return;
       }
       const text = stdout.trim();
       if (!text) {
         console.error("[persist] autoLabel: haiku returned empty response");
-        resolve29(null);
+        resolve30(null);
         return;
       }
       if (text === "SKIP") {
         console.error("[persist] autoLabel: haiku returned SKIP \u2014 messages too vague");
-        resolve29(null);
+        resolve30(null);
         return;
       }
       const words = text.split(/\s+/).slice(0, SESSION_LABEL_MAX_WORDS);
       const label = words.join(" ");
       console.error(`[persist] autoLabel: haiku response="${label}"`);
-      resolve29(label);
+      resolve30(label);
     });
   });
 }
@@ -5673,9 +5728,9 @@ var MAX_RECENT_TOOL_FAILURES = 3;
 var RECENT_FAILURES_TAIL_BYTES = 10 * 1024;
 function readRecentToolFailures(accountId, conversationId) {
   try {
-    const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
-    const logDir = resolve5(platformRoot3, "..", "data/accounts", accountId, "logs");
-    const logPath2 = resolve5(logDir, `claude-agent-stream-${conversationId}.log`);
+    const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
+    const logDir = resolve6(platformRoot3, "..", "data/accounts", accountId, "logs");
+    const logPath2 = resolve6(logDir, `claude-agent-stream-${conversationId}.log`);
     if (!existsSync5(logPath2)) {
       console.error(`[review-tail-skip] path=${logPath2} reason=file-missing \u2014 first turn of conversation, subprocess not yet spawned, or log rotated`);
       return [];
@@ -5832,13 +5887,13 @@ ${taskLines.join("\n")}`);
     let pendingCount = 0;
     let pendingLines = [];
     try {
-      const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
-      const pendingDir = resolve5(platformRoot3, "..", "data/accounts", accountId, "pending-actions");
+      const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
+      const pendingDir = resolve6(platformRoot3, "..", "data/accounts", accountId, "pending-actions");
       if (existsSync5(pendingDir)) {
         const files = readdirSync(pendingDir).filter((f) => f.endsWith(".json") && !f.startsWith("."));
         for (const file of files) {
           try {
-            const raw2 = readFileSync6(resolve5(pendingDir, file), "utf-8");
+            const raw2 = readFileSync6(resolve6(pendingDir, file), "utf-8");
             const action = JSON.parse(raw2);
             if (action.state === "pending") {
               const inputSummary = JSON.stringify(action.hookPayload?.tool_input ?? {}).slice(0, 150);
@@ -5905,8 +5960,8 @@ ${sections.join("\n\n")}
   }
 }
 async function consumeStep7FlagUI(session, accountId) {
-  const accountDir = resolve5(PLATFORM_ROOT3, "..", "data/accounts", accountId);
-  const flagPath = resolve5(accountDir, "onboarding", "step7-complete");
+  const accountDir = resolve6(PLATFORM_ROOT3, "..", "data/accounts", accountId);
+  const flagPath = resolve6(accountDir, "onboarding", "step7-complete");
   if (!existsSync5(flagPath)) return false;
   let completedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
@@ -6487,20 +6542,20 @@ function agentLogStream(name, accountDir, conversationId) {
   if (!conversationId) {
     throw new Error(`agentLogStream: conversationId is required (name=${name}) \u2014 use preConversationLogStream for pre-session events`);
   }
-  const logDir = resolve6(accountDir, "logs");
-  mkdirSync4(logDir, { recursive: true });
+  const logDir = resolve7(accountDir, "logs");
+  mkdirSync5(logDir, { recursive: true });
   purgeOldLogs(logDir, `${name}-`);
-  const logPath2 = resolve6(logDir, `${name}-${conversationId}.log`);
+  const logPath2 = resolve7(logDir, `${name}-${conversationId}.log`);
   const stream = createWriteStream(logPath2, { flags: "a" });
   registerStreamLog(stream, { path: logPath2, conversationId, name });
   return stream;
 }
 function preConversationLogStream(name, accountDir) {
-  const logDir = resolve6(accountDir, "logs");
-  mkdirSync4(logDir, { recursive: true });
+  const logDir = resolve7(accountDir, "logs");
+  mkdirSync5(logDir, { recursive: true });
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   purgeOldLogs(logDir, `preconversation-${name}-`);
-  const logPath2 = resolve6(logDir, `preconversation-${name}-${date}.log`);
+  const logPath2 = resolve7(logDir, `preconversation-${name}-${date}.log`);
   const stream = createWriteStream(logPath2, { flags: "a" });
   registerStreamLog(stream, { path: logPath2, conversationId: null, name: `preconversation-${name}` });
   return stream;
@@ -6519,7 +6574,7 @@ function sigtermFlushStreamLogs(reason, source) {
     const line = `[${ts}] [server-sigterm] reason=${reason}${convPart} name=${entry.name} source=${source}
 `;
     try {
-      appendFileSync2(entry.path, line);
+      appendFileSync3(entry.path, line);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[server-sigterm-flush-err] path=${entry.path} reason=${msg}`);
@@ -6538,7 +6593,7 @@ function purgeOldLogs(logDir, prefix) {
   }
   for (const file of entries) {
     if (!file.startsWith(prefix)) continue;
-    const filePath = resolve6(logDir, file);
+    const filePath = resolve7(logDir, file);
     try {
       if (statSync3(filePath).mtimeMs < cutoff) unlinkSync2(filePath);
     } catch (err) {
@@ -6656,8 +6711,8 @@ function sampleProcState(pid) {
     return `proc_err=${JSON.stringify(msg.slice(0, 60))}`;
   }
 }
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
-var ACCOUNTS_DIR = resolve6(PLATFORM_ROOT4, "..", "data/accounts");
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve7(process.cwd(), "..");
+var ACCOUNTS_DIR = resolve7(PLATFORM_ROOT4, "..", "data/accounts");
 if (!existsSync6(PLATFORM_ROOT4)) {
   throw new Error(
     `PLATFORM_ROOT does not exist: ${PLATFORM_ROOT4}
@@ -6666,7 +6721,7 @@ Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the plat
 }
 function resolveAccount() {
   if (!existsSync6(ACCOUNTS_DIR)) return null;
-  const usersFilePath = resolve6(PLATFORM_ROOT4, "config", "users.json");
+  const usersFilePath = resolve7(PLATFORM_ROOT4, "config", "users.json");
   let usersJsonUserId = null;
   if (existsSync6(usersFilePath)) {
     try {
@@ -6684,7 +6739,7 @@ function resolveAccount() {
   let fallback = null;
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const configPath2 = resolve6(ACCOUNTS_DIR, entry.name, "account.json");
+    const configPath2 = resolve7(ACCOUNTS_DIR, entry.name, "account.json");
     if (!existsSync6(configPath2)) continue;
     const raw2 = readFileSync7(configPath2, "utf-8");
     let config;
@@ -6701,7 +6756,7 @@ function resolveAccount() {
     }
     const result = {
       accountId: config.accountId,
-      accountDir: resolve6(ACCOUNTS_DIR, entry.name),
+      accountDir: resolve7(ACCOUNTS_DIR, entry.name),
       config
     };
     if (usersJsonUserId && config.admins?.some((a) => a.userId === usersJsonUserId)) {
@@ -6719,7 +6774,7 @@ function resolveAccount() {
   return fallback;
 }
 function readAgentFile(accountDir, agentName, filename) {
-  const filePath = resolve6(accountDir, "agents", agentName, filename);
+  const filePath = resolve7(accountDir, "agents", agentName, filename);
   if (!existsSync6(filePath)) return null;
   return readFileSync7(filePath, "utf-8");
 }
@@ -6737,7 +6792,7 @@ function validateAgentSlug(slug) {
   return true;
 }
 function resolveDefaultAgentSlug(accountDir) {
-  const configPath2 = resolve6(accountDir, "account.json");
+  const configPath2 = resolve7(accountDir, "account.json");
   if (!existsSync6(configPath2)) {
     console.error("[agent-resolve] account.json not found \u2014 cannot resolve defaultAgent");
     return null;
@@ -6753,7 +6808,7 @@ function resolveDefaultAgentSlug(accountDir) {
     console.error("[agent-resolve] defaultAgent not configured in account.json \u2014 set it via the connect-whatsapp skill");
     return null;
   }
-  const agentConfigPath = resolve6(accountDir, "agents", config.defaultAgent, "config.json");
+  const agentConfigPath = resolve7(accountDir, "agents", config.defaultAgent, "config.json");
   if (!existsSync6(agentConfigPath)) {
     console.error(`[agent-resolve] defaultAgent="${config.defaultAgent}" has no config.json at ${agentConfigPath}`);
     return null;
@@ -6826,9 +6881,9 @@ function resolveAgentConfig(accountDir, agentName) {
   }
   let knowledge = null;
   let knowledgeBaked = false;
-  const agentDir = resolve6(accountDir, "agents", agentName);
-  const knowledgePath = resolve6(agentDir, "KNOWLEDGE.md");
-  const summaryPath = resolve6(agentDir, "KNOWLEDGE-SUMMARY.md");
+  const agentDir = resolve7(accountDir, "agents", agentName);
+  const knowledgePath = resolve7(agentDir, "KNOWLEDGE.md");
+  const summaryPath = resolve7(agentDir, "KNOWLEDGE-SUMMARY.md");
   const hasKnowledge = existsSync6(knowledgePath);
   const hasSummary = existsSync6(summaryPath);
   if (hasKnowledge && hasSummary) {
@@ -6864,7 +6919,7 @@ function resolveAgentConfig(accountDir, agentName) {
   return { model, plugins, status, displayName, image, imageShape, showAgentName, knowledge, knowledgeBaked, liveMemory, knowledgeKeywords, budget, accessMode };
 }
 function parsePluginFrontmatter(pluginDir) {
-  const pluginPath = resolve6(PLATFORM_ROOT4, "plugins", pluginDir, "PLUGIN.md");
+  const pluginPath = resolve7(PLATFORM_ROOT4, "plugins", pluginDir, "PLUGIN.md");
   if (!existsSync6(pluginPath)) return null;
   let raw2;
   try {
@@ -6927,14 +6982,14 @@ function parsePluginFrontmatter(pluginDir) {
 function autoDeliverPremiumPlugins(purchasedPlugins) {
   if (!purchasedPlugins || purchasedPlugins.length === 0) return;
   const TAG18 = "[premium-auto-deliver]";
-  const stagingRoot = resolve6(PLATFORM_ROOT4, "../premium-plugins");
-  const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
+  const stagingRoot = resolve7(PLATFORM_ROOT4, "../premium-plugins");
+  const pluginsDir = resolve7(PLATFORM_ROOT4, "plugins");
   if (!existsSync6(stagingRoot)) {
     console.log(`${TAG18} no staging directory \u2014 skipping`);
     return;
   }
   for (const pluginName of purchasedPlugins) {
-    const stagingDir = resolve6(stagingRoot, pluginName);
+    const stagingDir = resolve7(stagingRoot, pluginName);
     if (!existsSync6(stagingDir)) {
       console.log(`${TAG18} ${pluginName}: not in staging \u2014 skipping`);
       continue;
@@ -6975,12 +7030,12 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
       let delivered = 0;
       let skipped = 0;
       for (const sub of subPlugins) {
-        const target = resolve6(pluginsDir, sub);
-        if (existsSync6(resolve6(target, "PLUGIN.md"))) {
+        const target = resolve7(pluginsDir, sub);
+        if (existsSync6(resolve7(target, "PLUGIN.md"))) {
           skipped++;
           continue;
         }
-        const source = resolve6(stagingDir, "plugins", sub);
+        const source = resolve7(stagingDir, "plugins", sub);
         if (!existsSync6(source)) {
           console.log(`${TAG18} ${pluginName}/${sub}: source missing in staging \u2014 skipping`);
           continue;
@@ -6994,8 +7049,8 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
       }
       console.log(`${TAG18} ${pluginName} (bundle): ${delivered} delivered, ${skipped} already present`);
     } else {
-      const target = resolve6(pluginsDir, pluginName);
-      if (existsSync6(resolve6(target, "PLUGIN.md"))) {
+      const target = resolve7(pluginsDir, pluginName);
+      if (existsSync6(resolve7(target, "PLUGIN.md"))) {
         console.log(`${TAG18} ${pluginName}: already present \u2014 skipping`);
         continue;
       }
@@ -7035,7 +7090,7 @@ function migratePluginRenames(accountDir, config) {
     return name;
   });
   if (!changed) return;
-  const configPath2 = resolve6(accountDir, "account.json");
+  const configPath2 = resolve7(accountDir, "account.json");
   try {
     const raw2 = readFileSync7(configPath2, "utf-8");
     const parsed = JSON.parse(raw2);
@@ -7046,9 +7101,9 @@ function migratePluginRenames(accountDir, config) {
   } catch (err) {
     console.error(`${TAG18} failed to update account.json \u2014 ${err instanceof Error ? err.message : String(err)}`);
   }
-  const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
+  const pluginsDir = resolve7(PLATFORM_ROOT4, "plugins");
   for (const oldName of Object.keys(PLUGIN_RENAMES)) {
-    const orphan = resolve6(pluginsDir, oldName);
+    const orphan = resolve7(pluginsDir, oldName);
     if (existsSync6(orphan)) {
       try {
         rmSync2(orphan, { recursive: true });
@@ -7062,13 +7117,13 @@ function migratePluginRenames(accountDir, config) {
 function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   if (!purchasedPlugins || purchasedPlugins.length === 0) return;
   const TAG18 = "[bundle-agent-deliver]";
-  const stagingRoot = resolve6(PLATFORM_ROOT4, "../premium-plugins");
-  const specialistsDir = resolve6(accountDir, "specialists", "agents");
+  const stagingRoot = resolve7(PLATFORM_ROOT4, "../premium-plugins");
+  const specialistsDir = resolve7(accountDir, "specialists", "agents");
   if (!existsSync6(stagingRoot)) return;
   if (!existsSync6(specialistsDir)) {
-    mkdirSync4(specialistsDir, { recursive: true });
+    mkdirSync5(specialistsDir, { recursive: true });
   }
-  const agentsmdPath = resolve6(accountDir, "agents", "admin", "AGENTS.md");
+  const agentsmdPath = resolve7(accountDir, "agents", "admin", "AGENTS.md");
   let agentsmd = "";
   try {
     agentsmd = existsSync6(agentsmdPath) ? readFileSync7(agentsmdPath, "utf-8") : "";
@@ -7076,7 +7131,7 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   }
   let delivered = 0;
   for (const pluginName of purchasedPlugins) {
-    const bundleAgentsDir = resolve6(stagingRoot, pluginName, "agents");
+    const bundleAgentsDir = resolve7(stagingRoot, pluginName, "agents");
     if (!existsSync6(bundleAgentsDir)) continue;
     let entries;
     try {
@@ -7085,9 +7140,9 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
       continue;
     }
     for (const filename of entries) {
-      const target = resolve6(specialistsDir, filename);
+      const target = resolve7(specialistsDir, filename);
       if (existsSync6(target)) continue;
-      const source = resolve6(bundleAgentsDir, filename);
+      const source = resolve7(bundleAgentsDir, filename);
       try {
         cpSync(source, target);
       } catch (err) {
@@ -7127,8 +7182,8 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   }
 }
 function assemblePublicPluginContent(pluginDir) {
-  const pluginRoot = resolve6(PLATFORM_ROOT4, "plugins", pluginDir);
-  const pluginPath = resolve6(pluginRoot, "PLUGIN.md");
+  const pluginRoot = resolve7(PLATFORM_ROOT4, "plugins", pluginDir);
+  const pluginPath = resolve7(pluginRoot, "PLUGIN.md");
   let raw2;
   try {
     raw2 = readFileSync7(pluginPath, "utf-8");
@@ -7140,7 +7195,7 @@ function assemblePublicPluginContent(pluginDir) {
   const parts = [pluginBody];
   let skillCount = 0;
   let refCount = 0;
-  const skillsDir = resolve6(pluginRoot, "skills");
+  const skillsDir = resolve7(pluginRoot, "skills");
   let skillDirs;
   try {
     skillDirs = readdirSync2(skillsDir).sort();
@@ -7148,8 +7203,8 @@ function assemblePublicPluginContent(pluginDir) {
     return { body: pluginBody, skillCount: 0, refCount: 0 };
   }
   for (const skillName of skillDirs) {
-    const skillDir = resolve6(skillsDir, skillName);
-    const skillMdPath = resolve6(skillDir, "SKILL.md");
+    const skillDir = resolve7(skillsDir, skillName);
+    const skillMdPath = resolve7(skillDir, "SKILL.md");
     let skillRaw;
     try {
       skillRaw = readFileSync7(skillMdPath, "utf-8");
@@ -7192,7 +7247,7 @@ function assemblePublicPluginContent(pluginDir) {
     parts.push(`
 <!-- skill: ${skillName} -->`);
     parts.push(skillBody);
-    const refsDir = resolve6(skillDir, "references");
+    const refsDir = resolve7(skillDir, "references");
     let refFiles;
     try {
       refFiles = readdirSync2(refsDir).filter((f) => f.endsWith(".md")).filter((f) => !publicExcludeReferences.includes(f)).sort();
@@ -7203,7 +7258,7 @@ function assemblePublicPluginContent(pluginDir) {
     }
     for (const refFile of refFiles) {
       try {
-        const refContent = readFileSync7(resolve6(refsDir, refFile), "utf-8").trim();
+        const refContent = readFileSync7(resolve7(refsDir, refFile), "utf-8").trim();
         if (refContent) {
           parts.push(`
 <!-- reference: ${refFile} -->`);
@@ -7221,7 +7276,7 @@ function assemblePublicPluginContent(pluginDir) {
   return { body: parts.join("\n"), skillCount, refCount };
 }
 function loadEmbeddedPlugins(agentType, selectedPlugins, enabledPlugins) {
-  const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
+  const pluginsDir = resolve7(PLATFORM_ROOT4, "plugins");
   let dirs;
   try {
     dirs = readdirSync2(pluginsDir);
@@ -7274,7 +7329,7 @@ function loadEmbeddedPlugins(agentType, selectedPlugins, enabledPlugins) {
         console.log(`[plugins] loaded ${dir} for public (${assembled.body.length} chars, ${assembled.skillCount} skills, ${assembled.refCount} refs)`);
       }
     } else {
-      const pluginPath = resolve6(pluginsDir, dir, "PLUGIN.md");
+      const pluginPath = resolve7(pluginsDir, dir, "PLUGIN.md");
       let raw2;
       try {
         raw2 = readFileSync7(pluginPath, "utf-8");
@@ -7301,7 +7356,7 @@ var mcpToolsCache = /* @__PURE__ */ new Map();
 function fetchMcpToolsList(pluginDir) {
   const cached = mcpToolsCache.get(pluginDir);
   if (cached) return Promise.resolve(cached);
-  const serverPath = resolve6(PLATFORM_ROOT4, "plugins", pluginDir, "mcp/dist/index.js");
+  const serverPath = resolve7(PLATFORM_ROOT4, "plugins", pluginDir, "mcp/dist/index.js");
   if (!existsSync6(serverPath)) return Promise.resolve([]);
   const startMs = Date.now();
   return new Promise((resolvePromise) => {
@@ -7414,7 +7469,7 @@ var SPECIALIST_PLUGIN_DOMAINS = {
   // agent, so it retains a full manifest entry for routing clarity.
 };
 async function buildPluginManifest(enabledPlugins) {
-  const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
+  const pluginsDir = resolve7(PLATFORM_ROOT4, "plugins");
   let dirs;
   try {
     dirs = readdirSync2(pluginsDir);
@@ -7501,16 +7556,16 @@ ${specialist}: ${plugins.join(", ")}`);
   for (let j = 0; j < adminPlugins.length; j++) {
     const { dir, parsed } = adminPlugins[j];
     const mcpTools = adminMcpResults[j];
-    const pluginRoot = resolve6(pluginsDir, dir);
+    const pluginRoot = resolve7(pluginsDir, dir);
     const skills = [];
     const references = [];
     const scanDir = (base, prefix, target) => {
-      const scanPath = resolve6(pluginRoot, base);
+      const scanPath = resolve7(pluginRoot, base);
       if (!existsSync6(scanPath)) return;
       try {
         const walk = (current, rel) => {
           for (const entry of readdirSync2(current)) {
-            const full = resolve6(current, entry);
+            const full = resolve7(current, entry);
             try {
               const stat5 = statSync3(full);
               if (stat5.isDirectory()) {
@@ -7538,7 +7593,7 @@ ${specialist}: ${plugins.join(", ")}`);
         toolLines.push(desc ? `  ${tool.name} \u2014 ${desc}` : `  ${tool.name}`);
       }
     } else if (parsed.tools.length > 0) {
-      const serverPath = resolve6(PLATFORM_ROOT4, "plugins", dir, "mcp/dist/index.js");
+      const serverPath = resolve7(PLATFORM_ROOT4, "plugins", dir, "mcp/dist/index.js");
       if (existsSync6(serverPath)) {
         fallbackSourced++;
         console.error(`[plugin-manifest] ${dir}: tools/list empty \u2014 fallback to frontmatter (${parsed.tools.length} tools)`);
@@ -7619,7 +7674,7 @@ function resolveUserAccounts(userId) {
   const entries = readdirSync2(ACCOUNTS_DIR, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const configPath2 = resolve6(ACCOUNTS_DIR, entry.name, "account.json");
+    const configPath2 = resolve7(ACCOUNTS_DIR, entry.name, "account.json");
     if (!existsSync6(configPath2)) continue;
     let config;
     try {
@@ -7632,7 +7687,7 @@ function resolveUserAccounts(userId) {
     if (adminEntry) {
       results.push({
         accountId: config.accountId,
-        accountDir: resolve6(ACCOUNTS_DIR, entry.name),
+        accountDir: resolve7(ACCOUNTS_DIR, entry.name),
         config,
         role: adminEntry.role
       });
@@ -7849,8 +7904,8 @@ function consumeStalledSubagents(sessionKey) {
   return stalls && stalls.length > 0 ? stalls : void 0;
 }
 function streamLogPathFor(accountId, conversationId) {
-  const logDir = resolve6(ACCOUNTS_DIR, accountId, "logs");
-  const streamLogPath = resolve6(logDir, `claude-agent-stream-${conversationId}.log`);
+  const logDir = resolve7(ACCOUNTS_DIR, accountId, "logs");
+  const streamLogPath = resolve7(logDir, `claude-agent-stream-${conversationId}.log`);
   return { logDir, streamLogPath };
 }
 function buildSpawnEnv(accountId, accountDir, conversationId) {
@@ -7871,7 +7926,7 @@ var cachedBrandHostname = null;
 function readBrandHostname() {
   if (cachedBrandHostname !== null) return cachedBrandHostname;
   try {
-    const brandPath = resolve6(PLATFORM_ROOT4, "config", "brand.json");
+    const brandPath = resolve7(PLATFORM_ROOT4, "config", "brand.json");
     const parsed = JSON.parse(readFileSync7(brandPath, "utf-8"));
     cachedBrandHostname = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : "maxy";
   } catch {
@@ -7909,37 +7964,37 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
   const servers = {
     "memory": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js")],
       env: { ...baseEnv, ...userId ? { USER_ID: userId } : {} }
     },
     "contacts": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/contacts/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/contacts/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     "whatsapp": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/whatsapp/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/whatsapp/mcp/dist/index.js")],
       env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
     },
     "admin": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/admin/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/admin/mcp/dist/index.js")],
       env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200", ...userId ? { USER_ID: userId } : {} }
     },
     "scheduling": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/scheduling/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/scheduling/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     "tasks": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/tasks/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/tasks/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     "email": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/email/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/email/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     // Workflows MCP — persistent admin-session server for list/get/update/delete/
@@ -7950,7 +8005,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
     // ToolSearches fruitlessly before degrading to a task-create stand-in (Task 571).
     "workflows": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/workflows/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/workflows/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     // Playwright MCP server — browser automation for browser-specialist.
@@ -7972,7 +8027,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
     // MAXY-PRD.md:627, not in any application-layer filter).
     "graph": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "lib/graph-mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "lib/graph-mcp/dist/index.js")],
       env: {
         ...baseEnv,
         BRAND: readBrandHostname(),
@@ -7988,7 +8043,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
   if (tgBotToken) {
     servers["telegram"] = {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT4, "plugins/telegram/mcp/dist/index.js")],
+      args: [resolve7(PLATFORM_ROOT4, "plugins/telegram/mcp/dist/index.js")],
       env: { ...baseEnv, TELEGRAM_BOT_TOKEN: tgBotToken }
     };
   } else {
@@ -7996,11 +8051,11 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
   }
   servers["cloudflare"] = {
     command: "node",
-    args: [resolve6(PLATFORM_ROOT4, "plugins/cloudflare/mcp/dist/index.js")],
+    args: [resolve7(PLATFORM_ROOT4, "plugins/cloudflare/mcp/dist/index.js")],
     env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
   };
   if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
-    const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
+    const pluginsDir = resolve7(PLATFORM_ROOT4, "plugins");
     let dirs;
     try {
       dirs = readdirSync2(pluginsDir);
@@ -8023,7 +8078,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
           continue;
         }
       }
-      const mcpEntry = resolve6(PLATFORM_ROOT4, "plugins", dir, "mcp/dist/index.js");
+      const mcpEntry = resolve7(PLATFORM_ROOT4, "plugins", dir, "mcp/dist/index.js");
       if (!existsSync6(mcpEntry)) continue;
       servers[dir] = {
         command: "node",
@@ -8158,7 +8213,7 @@ var ADMIN_CORE_TOOLS = [
 function getAdminAllowedTools(enabledPlugins) {
   const tools = [...ADMIN_CORE_TOOLS];
   if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
-    const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
+    const pluginsDir = resolve7(PLATFORM_ROOT4, "plugins");
     let dirs;
     try {
       dirs = readdirSync2(pluginsDir);
@@ -8266,13 +8321,13 @@ ${message.slice(0, QUERY_CLASSIFIER_MSG_CAP)}`
   }
 }
 async function fetchMemoryContext(accountId, query, sessionKey, options) {
-  const serverPath = resolve6(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js");
+  const serverPath = resolve7(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js");
   if (!existsSync6(serverPath)) {
     console.error(`[fetchMemoryContext] MCP server not found: ${serverPath}`);
     return null;
   }
   const startMs = Date.now();
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     const proc = spawn2(process.execPath, [serverPath], {
       env: {
         ...process.env,
@@ -8301,7 +8356,7 @@ async function fetchMemoryContext(accountId, query, sessionKey, options) {
       } else {
         console.error(`[fetchMemoryContext] failed: ${reason} (${elapsed}ms)${stderrBuf ? ` stderr: ${stderrBuf.slice(0, 500)}` : ""}`);
       }
-      resolve29(value);
+      resolve30(value);
     };
     proc.stdout.on("data", (chunk) => {
       buffer += chunk.toString();
@@ -8364,7 +8419,7 @@ async function fetchMemoryContext(accountId, query, sessionKey, options) {
 }
 async function compactTrimmedMessages(accountId, trimmedMessages) {
   if (trimmedMessages.length === 0) return true;
-  const serverPath = resolve6(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js");
+  const serverPath = resolve7(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js");
   if (!existsSync6(serverPath)) return false;
   const briefing = trimmedMessages.map((m) => `[${m.role.toUpperCase()}] ${m.content}`).join("\n\n");
   return new Promise((resolvePromise) => {
@@ -8682,7 +8737,7 @@ Then respond with only: [COMPACTED]`;
 var COMPACTION_TIMEOUT_MS = 45e3;
 async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSessionId, adminModel, conversationId, enabledPlugins) {
   const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, conversationId, void 0, enabledPlugins) });
-  const specialistsDir = resolve6(accountDir, "specialists");
+  const specialistsDir = resolve7(accountDir, "specialists");
   if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir, conversationId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
@@ -8956,7 +9011,7 @@ async function* parseClaudeStream(proc, streamLog, adminModel, conversationId, a
               const { logDir } = streamLogPathFor(accountId, conversationId);
               const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
               for (const s of failed) {
-                const stderrPath = resolve6(logDir, `mcp-${s.name}-stderr-${date}.log`);
+                const stderrPath = resolve7(logDir, `mcp-${s.name}-stderr-${date}.log`);
                 let tail = "(no stderr file)";
                 try {
                   const stats = statSync3(stderrPath);
@@ -9598,7 +9653,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
   }
   const ccUserId = sessionKey ? getUserIdForSession(sessionKey) : void 0;
   const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, spawnConvId, ccUserId, enabledPlugins) });
-  const specialistsDir = resolve6(accountDir, "specialists");
+  const specialistsDir = resolve7(accountDir, "specialists");
   if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-stream", accountDir, spawnConvId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
@@ -9939,7 +9994,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
 `);
   const managedUserId = getUserIdForSession(sessionKey);
   const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedConvId, managedUserId, enabledPlugins) });
-  const specialistsDir = resolve6(accountDir, "specialists");
+  const specialistsDir = resolve7(accountDir, "specialists");
   if (!existsSync6(specialistsDir)) streamLog.write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const fullMessage = attachments.length > 0 ? message + buildAttachmentMetaText(attachments) : message;
@@ -10602,7 +10657,7 @@ ${sessionContext}`;
       console.log(`[onboarding-inject] accountId=${accountId.slice(0, 8)}\u2026 error=neo4j-unreachable injected=false`);
     } else if (onboardingStep < 8) {
       const GENERIC_FALLBACK = "At every session start, call `onboarding-get`. If `currentStep` is less than 8, load the onboarding skill via `plugin-read` (find its path in the manifest under `admin`) and follow it \u2014 before any business setup. If `onboarding-get` fails (Neo4j unreachable), tell the user and skip onboarding for this session \u2014 it resumes automatically when the graph is available.";
-      const skillPath = resolve6(PLATFORM_ROOT4, "plugins/admin/skills/onboarding/SKILL.md");
+      const skillPath = resolve7(PLATFORM_ROOT4, "plugins/admin/skills/onboarding/SKILL.md");
       let skillContent = "";
       try {
         skillContent = readFileSync7(skillPath, "utf-8");
@@ -10655,7 +10710,7 @@ ${body}`;
 
 ${manifest}`;
     }
-    const graphRefPath = resolve6(PLATFORM_ROOT4, "plugins/memory/references/graph-primitives.md");
+    const graphRefPath = resolve7(PLATFORM_ROOT4, "plugins/memory/references/graph-primitives.md");
     try {
       const graphRef = readFileSync7(graphRefPath, "utf-8");
       baseSystemPrompt += `
@@ -10883,8 +10938,8 @@ function getLanIp() {
 import { basename as basename2 } from "path";
 
 // app/lib/review-detector/rules.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, statSync as statSync4, mkdirSync as mkdirSync5, renameSync } from "fs";
-import { resolve as resolve7, dirname as dirname2 } from "path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, statSync as statSync4, mkdirSync as mkdirSync6, renameSync } from "fs";
+import { resolve as resolve8, dirname as dirname2 } from "path";
 var DEFAULT_SCAN_INTERVAL_MS = 5e3;
 var RATE_LIMIT_PATTERN = "rate[- ]?limit(?:ed| reached| hit)|(?:HTTP|status)[^a-z]{0,3}429|too many requests";
 var RATE_LIMIT_PATTERN_V1 = "\\b429\\b|rate.?limit|too.?many.?requests";
@@ -11313,12 +11368,12 @@ function defaultRules() {
   ];
 }
 function rulesFilePath(configDir2) {
-  return resolve7(configDir2, "review-rules.json");
+  return resolve8(configDir2, "review-rules.json");
 }
 function ensureRulesFile(configDir2) {
   const path2 = rulesFilePath(configDir2);
   if (existsSync7(path2)) return { created: false, path: path2 };
-  mkdirSync5(dirname2(path2), { recursive: true });
+  mkdirSync6(dirname2(path2), { recursive: true });
   const body = {
     scanIntervalMs: DEFAULT_SCAN_INTERVAL_MS,
     rules: defaultRules()
@@ -11496,10 +11551,10 @@ function validateRule(input, label, seenIds) {
 }
 
 // app/lib/review-detector/sources.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync6, openSync as openSync3, readSync as readSync3, closeSync as closeSync3, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve8, join as join5, basename, dirname as dirname3 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync7, openSync as openSync3, readSync as readSync3, closeSync as closeSync3, readFileSync as readFileSync9 } from "fs";
+import { resolve as resolve9, join as join5, basename, dirname as dirname3 } from "path";
 function tailStatePath(configDir2) {
-  return resolve8(configDir2, "review-state.json");
+  return resolve9(configDir2, "review-state.json");
 }
 function loadTailState(configDir2) {
   const path2 = tailStatePath(configDir2);
@@ -11523,25 +11578,25 @@ function loadTailState(configDir2) {
 }
 function saveTailState(configDir2, state) {
   const path2 = tailStatePath(configDir2);
-  mkdirSync6(dirname3(path2), { recursive: true });
+  mkdirSync7(dirname3(path2), { recursive: true });
   const tmp = `${path2}.tmp.${process.pid}.${Date.now()}`;
   writeFileSync7(tmp, JSON.stringify(state, null, 2) + "\n", "utf-8");
   renameSync2(tmp, path2);
 }
 function discoverSourceFiles(configDir2, accountLogDir2, logicalSource) {
   if (logicalSource === "server") {
-    const p = resolve8(configDir2, "logs", "server.log");
+    const p = resolve9(configDir2, "logs", "server.log");
     return existsSync8(p) ? [{ logicalSource: "server", filepath: p }] : [];
   }
   if (logicalSource === "vnc") {
-    const p = resolve8(configDir2, "logs", "vnc-boot.log");
+    const p = resolve9(configDir2, "logs", "vnc-boot.log");
     return existsSync8(p) ? [{ logicalSource: "vnc", filepath: p }] : [];
   }
   if (logicalSource === "cloudflared") {
     const files2 = [];
-    const daemon = resolve8(configDir2, "logs", "cloudflared.log");
+    const daemon = resolve9(configDir2, "logs", "cloudflared.log");
     if (existsSync8(daemon)) files2.push({ logicalSource: "cloudflared", filepath: daemon });
-    const login = resolve8(configDir2, "logs", "cloudflared-login.log");
+    const login = resolve9(configDir2, "logs", "cloudflared-login.log");
     if (existsSync8(login)) files2.push({ logicalSource: "cloudflared", filepath: login });
     return files2;
   }
@@ -11668,31 +11723,31 @@ function fileLastWriteMs(path2) {
   }
 }
 function accountLogDir(accountDir) {
-  return resolve8(accountDir, "logs");
+  return resolve9(accountDir, "logs");
 }
 function sourceKey(file) {
   return `${file.logicalSource}:${basename(file.filepath)}`;
 }
 
 // app/lib/review-detector/writer.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync6 } from "fs";
-import { resolve as resolve9, dirname as dirname4 } from "path";
+import { appendFileSync as appendFileSync4, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync6 } from "fs";
+import { resolve as resolve10, dirname as dirname4 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function reviewLogPath(configDir2) {
-  return resolve9(configDir2, "logs", "review.log");
+  return resolve10(configDir2, "logs", "review.log");
 }
 function pendingAlertsPath(configDir2) {
-  return resolve9(configDir2, "review-pending-alerts.jsonl");
+  return resolve10(configDir2, "review-pending-alerts.jsonl");
 }
 function reviewLog(configDir2, event) {
   const path2 = reviewLogPath(configDir2);
   try {
-    mkdirSync7(dirname4(path2), { recursive: true });
+    mkdirSync8(dirname4(path2), { recursive: true });
     const line = `${new Date(
       typeof event.ts === "number" ? event.ts : Date.now()
     ).toISOString()} [review] ${JSON.stringify(event)}
 `;
-    appendFileSync3(path2, line, "utf-8");
+    appendFileSync4(path2, line, "utf-8");
   } catch (err) {
     console.error(`[review] failed to write review log at ${path2}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -11804,9 +11859,9 @@ async function upsertReviewAlert(accountId, match2) {
 function queueAlert(configDir2, accountId, match2) {
   const path2 = pendingAlertsPath(configDir2);
   try {
-    mkdirSync7(dirname4(path2), { recursive: true });
+    mkdirSync8(dirname4(path2), { recursive: true });
     const line = JSON.stringify({ accountId, match: match2 }) + "\n";
-    appendFileSync3(path2, line, "utf-8");
+    appendFileSync4(path2, line, "utf-8");
   } catch (err) {
     console.error(`[review] failed to queue alert at ${path2}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -11937,7 +11992,7 @@ async function bootDetector() {
 }
 
 // app/lib/review-detector/scan-loop.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 
 // app/lib/review-detector/evaluator.ts
 var SAMPLE_MAX_CHARS = 500;
@@ -12231,14 +12286,14 @@ async function runScanCycle(runtime) {
           match2 = result.match;
         }
       } else if (rule.type === "file-write-storm") {
-        const dir = resolve10(runtime.configDir, rule.watchPath ?? "");
+        const dir = resolve11(runtime.configDir, rule.watchPath ?? "");
         const sinceMs = cycleStart - rule.thresholdWindowMinutes * 6e4;
         const count = countRecentWrites(dir, sinceMs);
         const result = evaluateFileWriteStormRule(rule, count, state, cycleStart);
         state = result.state;
         match2 = result.match;
       } else if (rule.type === "stale-log") {
-        const trackedPath = resolve10(runtime.configDir, rule.watchPath ?? "");
+        const trackedPath = resolve11(runtime.configDir, rule.watchPath ?? "");
         const lastMs = fileLastWriteMs(trackedPath);
         const result = evaluateStaleLogRule(rule, lastMs, state, cycleStart);
         state = result.state;
@@ -12478,10 +12533,10 @@ var WhatsAppConfigSchema = z.object({
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync11, writeFileSync as writeFileSync9, existsSync as existsSync10 } from "fs";
-import { resolve as resolve11, join as join6 } from "path";
+import { resolve as resolve12, join as join6 } from "path";
 var TAG2 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve11(accountDir, "account.json");
+  return resolve12(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
@@ -12936,7 +12991,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG4} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve29) => setTimeout(() => resolve29("timeout"), timeoutMs)
+    (resolve30) => setTimeout(() => resolve30("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -13064,11 +13119,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve30, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve30();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -13182,14 +13237,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve30, reject) => {
     const timer = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve29(value);
+        resolve30(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -14389,11 +14444,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve29) => {
-        const timer = setTimeout(resolve29, delay);
+      await new Promise((resolve30) => {
+        const timer = setTimeout(resolve30, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve29();
+          resolve30();
         }, { once: true });
       });
     }
@@ -14401,16 +14456,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     if (!conn.sock) {
-      resolve29();
+      resolve30();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve30();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -14620,8 +14675,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve29) => {
-      resolvePending = resolve29;
+    const sttPending = new Promise((resolve30) => {
+      resolvePending = resolve30;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -14728,20 +14783,20 @@ async function probeApiKey() {
   return result.status;
 }
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     const socket = createConnection4(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve29(true);
+      resolve30(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve29(false);
+      resolve30(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve29(false);
+      resolve30(false);
     });
   });
 }
@@ -14838,14 +14893,14 @@ app.get("/", async (c) => {
 var health_default = app;
 
 // server/routes/session.ts
-import { resolve as resolve12 } from "path";
-import { existsSync as existsSync12, writeFileSync as writeFileSync10, mkdirSync as mkdirSync8 } from "fs";
+import { resolve as resolve13 } from "path";
+import { existsSync as existsSync12, writeFileSync as writeFileSync10, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve12(MAXY_DIR, "branding-cache", accountId);
-    mkdirSync8(cacheDir, { recursive: true });
-    writeFileSync10(resolve12(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    const cacheDir = resolve13(MAXY_DIR, "branding-cache", accountId);
+    mkdirSync9(cacheDir, { recursive: true });
+    writeFileSync10(resolve13(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -14915,8 +14970,8 @@ app2.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve12(account.accountDir, "agents", agentSlug);
-    const agentConfigPath = resolve12(agentDir, "config.json");
+    const agentDir = resolve13(account.accountDir, "agents", agentSlug);
+    const agentConfigPath = resolve13(agentDir, "config.json");
     if (!existsSync12(agentDir) || !existsSync12(agentConfigPath)) {
       return c.json({ error: "Agent not found" }, 404);
     }
@@ -15163,9 +15218,9 @@ ${raw2}`;
 import { randomUUID as randomUUID6 } from "crypto";
 import { mkdir as mkdir2, readFile, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { realpathSync } from "fs";
-import { resolve as resolve13, extname, basename as basename3 } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve13(PLATFORM_ROOT5, "..", "data/uploads");
+import { resolve as resolve14, extname, basename as basename3 } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "../platform");
+var ATTACHMENTS_ROOT = resolve14(PLATFORM_ROOT5, "..", "data/uploads");
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -15189,11 +15244,11 @@ function assertSupportedMime(mimeType) {
 }
 async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
   const attachmentId = randomUUID6();
-  const dir = resolve13(ATTACHMENTS_ROOT, scope, attachmentId);
+  const dir = resolve14(ATTACHMENTS_ROOT, scope, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve13(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve13(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve14(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve14(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope,
@@ -15871,13 +15926,13 @@ var group_default = app4;
 // app/lib/access-gate.ts
 import neo4j2 from "neo4j-driver";
 import { readFileSync as readFileSync13 } from "fs";
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 import { randomUUID as randomUUID7, randomInt } from "crypto";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
 var driver2 = null;
 function readPassword2() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve14(PLATFORM_ROOT6, "config/.neo4j-password");
+  const passwordFile = resolve15(PLATFORM_ROOT6, "config/.neo4j-password");
   try {
     return readFileSync13(passwordFile, "utf-8").trim();
   } catch {
@@ -16190,17 +16245,17 @@ async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
 }
 
 // app/lib/brevo-sms.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, existsSync as existsSync13, chmodSync } from "fs";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync11, mkdirSync as mkdirSync10, existsSync as existsSync13, chmodSync } from "fs";
 import { dirname as dirname5 } from "path";
-import { resolve as resolve15 } from "path";
-var BREVO_API_KEY_FILE = resolve15(MAXY_DIR, ".brevo-api-key");
+import { resolve as resolve16 } from "path";
+var BREVO_API_KEY_FILE = resolve16(MAXY_DIR, ".brevo-api-key");
 var BREVO_API_URL = "https://api.brevo.com/v3/transactionalSMS/sms";
 var BREVO_TIMEOUT_MS = 1e4;
 var BREVO_SENDER = "Maxy";
 var platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
 if (platformRoot2) {
   try {
-    const brandPath = resolve15(platformRoot2, "config", "brand.json");
+    const brandPath = resolve16(platformRoot2, "config", "brand.json");
     if (existsSync13(brandPath)) {
       const brand = JSON.parse(readFileSync14(brandPath, "utf-8"));
       if (brand.productName) BREVO_SENDER = brand.productName;
@@ -16837,7 +16892,7 @@ app6.post("/webhook", async (c) => {
 var telegram_default = app6;
 
 // server/routes/whatsapp.ts
-import { join as join9, resolve as resolve16, basename as basename4 } from "path";
+import { join as join9, resolve as resolve17, basename as basename4 } from "path";
 import { readFile as readFile2, stat as stat3 } from "fs/promises";
 import { realpathSync as realpathSync2, readdirSync as readdirSync4, readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
 
@@ -16945,8 +17000,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve29, reject) => {
-    resolveQr = resolve29;
+  const qrPromise = new Promise((resolve30, reject) => {
+    resolveQr = resolve30;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -17317,14 +17372,14 @@ app7.post("/config", async (c) => {
         return c.json({ ok: true, slug: currentSlug });
       }
       case "list-public-agents": {
-        const agentsDir = resolve16(account.accountDir, "agents");
+        const agentsDir = resolve17(account.accountDir, "agents");
         const agents = [];
         if (existsSync15(agentsDir)) {
           try {
             const entries = readdirSync4(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve16(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve17(agentsDir, entry.name, "config.json");
               if (!existsSync15(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync16(configPath2, "utf-8"));
@@ -17402,7 +17457,7 @@ app7.post("/send-document", async (c) => {
     if (!maxyAccountId || !PLATFORM_ROOT7) {
       return c.json({ error: "Cannot validate file path: missing account or platform context" }, 400);
     }
-    const accountDir = resolve16(PLATFORM_ROOT7, "..", "data/accounts", maxyAccountId);
+    const accountDir = resolve17(PLATFORM_ROOT7, "..", "data/accounts", maxyAccountId);
     let resolvedPath;
     try {
       resolvedPath = realpathSync2(filePath);
@@ -17539,8 +17594,8 @@ var whatsapp_default = app7;
 
 // server/routes/onboarding.ts
 import { spawn as spawn3, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync4, closeSync as closeSync4, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync17, unlinkSync as unlinkSync3 } from "fs";
-import { resolve as resolve17, dirname as dirname6 } from "path";
+import { openSync as openSync4, closeSync as closeSync4, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync17, unlinkSync as unlinkSync3 } from "fs";
+import { resolve as resolve18, dirname as dirname6 } from "path";
 import { createHash, randomUUID as randomUUID9 } from "crypto";
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
 function hashPin(pin) {
@@ -17653,7 +17708,7 @@ app8.post("/set-pin", async (c) => {
   }
   const hash = hashPin(body.pin);
   const userId = randomUUID9();
-  mkdirSync10(dirname6(USERS_FILE), { recursive: true });
+  mkdirSync11(dirname6(USERS_FILE), { recursive: true });
   writeFileSync12(USERS_FILE, JSON.stringify([{ userId, name: "Owner", pin: hash }]), { mode: 384 });
   console.log(`[set-pin] created users.json: userId=${userId.slice(0, 8)}\u2026 hash=${hash.slice(0, 8)}\u2026`);
   const account = resolveAccount();
@@ -17714,7 +17769,7 @@ app8.post("/skip", async (c) => {
   }
   const { accountId, accountDir } = account;
   let agentName = "Maxy";
-  const brandPath = PLATFORM_ROOT8 ? resolve17(PLATFORM_ROOT8, "config", "brand.json") : "";
+  const brandPath = PLATFORM_ROOT8 ? resolve18(PLATFORM_ROOT8, "config", "brand.json") : "";
   if (brandPath && existsSync16(brandPath)) {
     try {
       const brand = JSON.parse(readFileSync17(brandPath, "utf-8"));
@@ -17723,9 +17778,9 @@ app8.post("/skip", async (c) => {
       console.error(`[onboarding-skip] brand.json read failed: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  const soulPath = resolve17(accountDir, "agents", "admin", "SOUL.md");
+  const soulPath = resolve18(accountDir, "agents", "admin", "SOUL.md");
   try {
-    mkdirSync10(dirname6(soulPath), { recursive: true });
+    mkdirSync11(dirname6(soulPath), { recursive: true });
     writeFileSync12(soulPath, `You are ${agentName}, an AI operations manager.
 `);
     console.log(`[onboarding-skip] wrote SOUL.md: ${soulPath}`);
@@ -17764,7 +17819,7 @@ app8.post("/skip", async (c) => {
 var onboarding_default = app8;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync17, renameSync as renameSync4, statSync as statSync7 } from "fs";
+import { appendFileSync as appendFileSync5, existsSync as existsSync17, renameSync as renameSync4, statSync as statSync7 } from "fs";
 import { join as join10 } from "path";
 var CLIENT_ERRORS_LOG = join10(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -17892,7 +17947,7 @@ app9.post("/", async (c) => {
       tag: typeof body.tag === "string" ? truncate(body.tag, 32) : void 0,
       status: typeof body.status === "number" ? body.status : void 0
     };
-    appendFileSync4(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
+    appendFileSync5(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
   } catch (err) {
     console.error(`[client-error] append failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -18004,12 +18059,14 @@ app10.post("/", async (c) => {
 var session_default2 = app10;
 
 // server/routes/admin/chat.ts
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 
 // app/lib/script-stream-tailer.ts
-import { createReadStream as createReadStream2, statSync as statSync8 } from "fs";
+import * as childProcess from "child_process";
+import { appendFileSync as appendFileSync6, createReadStream as createReadStream2, mkdirSync as mkdirSync12, statSync as statSync8 } from "fs";
+import { dirname as dirname7 } from "path";
 import { StringDecoder as StringDecoder2 } from "string_decoder";
-var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[(setup-tunnel|reset-tunnel)((?::[^\]]+)?)\] (.*)$/;
+var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
 function parseLine(line) {
   const m = line.match(SCRIPT_STREAM_RE);
   if (!m) return void 0;
@@ -18102,6 +18159,106 @@ function startScriptStreamTailer(opts) {
     }
   };
 }
+var SCOPE_TOKEN_RE = /^[a-z][a-z0-9-]*$/;
+function writeRouteMilestone(streamLogPath, scope, line) {
+  if (!SCOPE_TOKEN_RE.test(scope)) {
+    throw new Error(
+      `writeRouteMilestone: scope "${scope}" must match [a-z][a-z0-9-]* \u2014 the tailer regex won't match otherwise`
+    );
+  }
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  try {
+    mkdirSync12(dirname7(streamLogPath), { recursive: true });
+    appendFileSync6(streamLogPath, `[${ts}] [${scope}] ${line}
+`);
+  } catch (err) {
+    console.error(
+      `[script-stream-tailer] writeRouteMilestone failed path=${streamLogPath} scope=${scope}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function runFormSpawn(opts) {
+  const { scriptPath, args, streamLogPath, correlationId, timeoutMs, log, logErr, broadcast } = opts;
+  return new Promise((resolveP) => {
+    let tailer = null;
+    try {
+      tailer = startScriptStreamTailer({
+        path: streamLogPath,
+        onEvent: (event) => {
+          try {
+            broadcast(correlationId, event);
+          } catch (e) {
+            logErr(
+              `phase=tailer-broadcast-failed detail="${e instanceof Error ? e.message : String(e)}"`
+            );
+          }
+        },
+        onError: (e) => {
+          logErr(`phase=tailer-error message="${e.message.slice(0, 160).replace(/"/g, "'")}"`);
+        }
+      });
+      log(`phase=tailer-started`);
+    } catch (e) {
+      logErr(`phase=tailer-start-failed detail="${e instanceof Error ? e.message : String(e)}"`);
+      tailer = null;
+    }
+    const child = childProcess.spawn(scriptPath, args, {
+      env: { ...process.env, STREAM_LOG_PATH: streamLogPath },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    log(`phase=script-spawn pid=${child.pid ?? "unknown"} args="${args.join(" ")}"`);
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const killer = setTimeout(() => {
+      timedOut = true;
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString("utf-8");
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString("utf-8");
+    });
+    let finalized = false;
+    const finalize = async (result) => {
+      if (finalized) return;
+      finalized = true;
+      if (tailer) {
+        try {
+          await tailer.stop();
+          log(`phase=tailer-stopped`);
+        } catch (e) {
+          logErr(
+            `phase=tailer-stop-failed detail="${e instanceof Error ? e.message : String(e)}"`
+          );
+        }
+      }
+      resolveP(result);
+    };
+    child.on("error", (e) => {
+      clearTimeout(killer);
+      void finalize({
+        code: null,
+        signal: null,
+        stdout,
+        stderr: `${stderr}
+${e.message}`,
+        timedOut: false
+      });
+    });
+    child.on("exit", (code, signal) => {
+      clearTimeout(killer);
+      log(
+        `phase=script-exit code=${code ?? "null"} signal=${signal ?? "null"} timedOut=${timedOut}`
+      );
+      void finalize({ code, signal, stdout, stderr, timedOut });
+    });
+  });
+}
 
 // app/lib/admin-sse-registry.ts
 var activeAdminSSEControllers = /* @__PURE__ */ new Set();
@@ -18136,6 +18293,19 @@ function broadcastAdminShutdown(reason) {
   }
   activeAdminSSEControllers.clear();
 }
+function broadcastToConversation(conversationId, event) {
+  const encoder = new TextEncoder();
+  const frame = encoder.encode(`data: ${JSON.stringify(event)}
+
+`);
+  for (const entry of activeAdminSSEControllers) {
+    if (entry.conversationId !== conversationId) continue;
+    try {
+      entry.controller.enqueue(frame);
+    } catch {
+    }
+  }
+}
 
 // server/routes/admin/chat.ts
 function isComponentDone(parsed) {
@@ -18329,7 +18499,7 @@ app11.post("/", requireAdminSession, async (c) => {
       try {
         registerAdminSSE(sseEntry);
         if (sseConvId) {
-          const streamLogPath = resolve18(account.accountDir, "logs", `claude-agent-stream-${sseConvId}.log`);
+          const streamLogPath = resolve19(account.accountDir, "logs", `claude-agent-stream-${sseConvId}.log`);
           tailer = startScriptStreamTailer({
             path: streamLogPath,
             onEvent: (event) => {
@@ -18455,7 +18625,7 @@ var compact_default = app12;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync19, readdirSync as readdirSync5, readFileSync as readFileSync19, statSync as statSync9 } from "fs";
-import { resolve as resolve19, basename as basename5 } from "path";
+import { resolve as resolve20, basename as basename5 } from "path";
 var TAIL_BYTES = 8192;
 var app13 = new Hono2();
 app13.get("/", async (c) => {
@@ -18464,13 +18634,13 @@ app13.get("/", async (c) => {
   const conversationIdParam = c.req.query("conversationId");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir2 = account ? resolve19(account.accountDir, "logs") : null;
+  const accountLogDir2 = account ? resolve20(account.accountDir, "logs") : null;
   if (fileParam) {
     const safe = basename5(fileParam);
     const searched = [];
     for (const dir of [accountLogDir2, LOG_DIR]) {
       if (!dir) continue;
-      const filePath = resolve19(dir, safe);
+      const filePath = resolve20(dir, safe);
       searched.push(filePath);
       try {
         const content = readFileSync19(filePath, "utf-8");
@@ -18512,7 +18682,7 @@ app13.get("/", async (c) => {
     const searched = [];
     for (const dir of [accountLogDir2, LOG_DIR]) {
       if (!dir) continue;
-      const filePath = resolve19(dir, fileName);
+      const filePath = resolve20(dir, fileName);
       searched.push(filePath);
       try {
         const content = readFileSync19(filePath, "utf-8");
@@ -18539,10 +18709,10 @@ app13.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve20(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync19(resolve19(dir, name));
+        const content = readFileSync19(resolve20(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -18583,7 +18753,7 @@ var claude_info_default = app14;
 // server/routes/admin/attachment.ts
 import { readFile as readFile3, readdir } from "fs/promises";
 import { existsSync as existsSync20 } from "fs";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 var app15 = new Hono2();
 app15.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -18595,11 +18765,11 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve20(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve21(ATTACHMENTS_ROOT, accountId, attachmentId);
   if (!existsSync20(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve20(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve21(dir, `${attachmentId}.meta.json`);
   if (!existsSync20(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
@@ -18614,7 +18784,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve20(dir, dataFile);
+  const filePath = resolve21(dir, dataFile);
   const buffer = await readFile3(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -18628,7 +18798,7 @@ var attachment_default = app15;
 
 // server/routes/admin/account.ts
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync13 } from "fs";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 var VALID_CONTEXT_MODES = ["managed", "claude-code"];
 var app16 = new Hono2();
 app16.patch("/", requireAdminSession, async (c) => {
@@ -18644,7 +18814,7 @@ app16.patch("/", requireAdminSession, async (c) => {
   }
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account configured" }, 500);
-  const configPath2 = resolve21(account.accountDir, "account.json");
+  const configPath2 = resolve22(account.accountDir, "account.json");
   try {
     const raw2 = readFileSync20(configPath2, "utf-8");
     const config = JSON.parse(raw2);
@@ -18660,13 +18830,13 @@ app16.patch("/", requireAdminSession, async (c) => {
 var account_default = app16;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve22 } from "path";
+import { resolve as resolve23 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync21, existsSync as existsSync21, rmSync as rmSync3 } from "fs";
 var app17 = new Hono2();
 app17.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve22(account.accountDir, "agents");
+  const agentsDir = resolve23(account.accountDir, "agents");
   if (!existsSync21(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -18674,7 +18844,7 @@ app17.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve22(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve23(agentsDir, entry.name, "config.json");
       if (!existsSync21(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync21(configPath2, "utf-8"));
@@ -18703,7 +18873,7 @@ app17.delete("/:slug", (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve22(account.accountDir, "agents", slug);
+  const agentDir = resolve23(account.accountDir, "agents", slug);
   if (!existsSync21(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -18719,74 +18889,27 @@ app17.delete("/:slug", (c) => {
 var agents_default = app17;
 
 // server/routes/admin/version.ts
-import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync23, statSync as statSync10, writeFileSync as writeFileSync14, readFileSync as readFileSync23, openSync as openSync5, closeSync as closeSync5 } from "fs";
-import { resolve as resolve23, join as join11 } from "path";
-
-// app/lib/upgrade-progress-parser.ts
 import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
-var STEP_RE = /\[(\d+)\/(\d+)\]\s+(.+)/;
-var ANSI_RE = /\x1b\[[0-9;?]*[a-zA-Z]/g;
-var stripAnsi = (s) => s.replace(ANSI_RE, "").replace(/\r/g, "").trimEnd();
-var MAX_SUBSTEPS = 20;
-function parseUpgradeProgress(content) {
-  const rawLines = content.split("\n");
-  let step = 0;
-  let total = 0;
-  let label = "";
-  let markerIdx = -1;
-  for (let i = rawLines.length - 1; i >= 0; i--) {
-    const match2 = rawLines[i].match(STEP_RE);
-    if (match2) {
-      step = parseInt(match2[1], 10);
-      total = parseInt(match2[2], 10);
-      label = match2[3].replace(/\.{3}$/, "").trim();
-      markerIdx = i;
-      break;
-    }
-  }
-  const subSteps = markerIdx >= 0 ? rawLines.slice(markerIdx + 1).map(stripAnsi).filter((l) => l.length > 0).slice(-MAX_SUBSTEPS) : [];
-  const tail = rawLines.slice(-20).join("\n");
-  const finished = tail.includes("Open in your browser:");
-  const failed = tail.includes("Setup failed:");
-  return { step, total, label, started: true, finished, failed, subSteps };
-}
-function readProgressLog(path2) {
-  if (!existsSync22(path2)) {
-    return { step: 0, total: 0, label: "", started: false, subSteps: [] };
-  }
-  let content;
-  try {
-    content = readFileSync22(path2, "utf-8");
-  } catch {
-    return { step: 0, total: 0, label: "", started: false, subSteps: [] };
-  }
-  return parseUpgradeProgress(content);
-}
-
-// server/routes/admin/version.ts
-var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
+import { resolve as resolve24, join as join11 } from "path";
+var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandNpmPackage = "@rubytech/create-maxy";
 var brandJsonPath = join11(PLATFORM_ROOT9, "config", "brand.json");
-if (existsSync23(brandJsonPath)) {
+if (existsSync22(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync23(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync22(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
     if (brand.npm?.packageName) brandNpmPackage = brand.npm.packageName;
   } catch {
   }
 }
-var VERSION_FILE = resolve23(PLATFORM_ROOT9, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve24(PLATFORM_ROOT9, `config/.${brandHostname}-version`);
 var NPM_PACKAGE = brandNpmPackage;
 var REGISTRY_URL = `https://registry.npmjs.org/${NPM_PACKAGE}/latest`;
 var FETCH_TIMEOUT_MS = 5e3;
-var LOCK_FILE = `/tmp/${brandHostname}-upgrade.lock`;
-var LOG_FILE = `/tmp/${brandHostname}-upgrade.log`;
-var LOCK_MAX_AGE_MS = 20 * 60 * 1e3;
 function readInstalled() {
-  if (!existsSync23(VERSION_FILE)) return "unknown";
-  const content = readFileSync23(VERSION_FILE, "utf-8").trim();
+  if (!existsSync22(VERSION_FILE)) return "unknown";
+  const content = readFileSync22(VERSION_FILE, "utf-8").trim();
   return content || "unknown";
 }
 async function fetchLatest() {
@@ -18824,23 +18947,6 @@ function isNewer(latest, installed) {
   }
   return false;
 }
-function isLockFresh() {
-  if (!existsSync23(LOCK_FILE)) return false;
-  try {
-    const st = statSync10(LOCK_FILE);
-    if (Date.now() - st.mtimeMs >= LOCK_MAX_AGE_MS) return false;
-    if (existsSync23(LOG_FILE)) {
-      const content = readFileSync23(LOG_FILE, "utf-8");
-      const tail = content.slice(-4e3);
-      if (tail.includes("Setup failed:") || tail.includes("Open in your browser:")) {
-        return false;
-      }
-    }
-    return true;
-  } catch {
-    return false;
-  }
-}
 var app18 = new Hono2();
 app18.get("/", async (c) => {
   const installed = readInstalled();
@@ -18853,56 +18959,6 @@ app18.get("/", async (c) => {
   );
   return c.json({ installed, latest, updateAvailable, clientErrors24h });
 });
-app18.post("/upgrade", requireAdminSession, (c) => {
-  if (isLockFresh()) {
-    return c.json({ ok: false, error: "upgrade already in progress" }, 409);
-  }
-  const installerScope = `upgrade-${brandHostname}`;
-  try {
-    writeFileSync14(LOCK_FILE, String(Date.now()));
-  } catch (err) {
-    console.error("[admin/version/upgrade] failed to write lock file:", err);
-  }
-  try {
-    writeFileSync14(LOG_FILE, "");
-  } catch (err) {
-    console.error("[admin/version/upgrade] failed to truncate upgrade log:", err);
-    return c.json(
-      { ok: false, error: err instanceof Error ? err.message : "failed to prepare upgrade log" },
-      500
-    );
-  }
-  try {
-    const logFd = openSync5(LOG_FILE, "a");
-    const child = spawn4("systemd-run", [
-      "--user",
-      "--scope",
-      `--unit=${installerScope}`,
-      "--",
-      "npx",
-      "-y",
-      `${NPM_PACKAGE}@latest`
-    ], {
-      detached: true,
-      stdio: ["ignore", logFd, logFd],
-      env: { ...process.env, npm_config_yes: "true" },
-      cwd: resolve23(process.cwd(), "..")
-    });
-    child.unref();
-    closeSync5(logFd);
-    console.log(`[admin/version/upgrade] spawned upgrade process (pid ${child.pid} scope ${installerScope})`);
-    return c.json({ ok: true, started: true });
-  } catch (err) {
-    console.error("[admin/version/upgrade] failed to spawn upgrade process:", err);
-    return c.json(
-      { ok: false, error: err instanceof Error ? err.message : "failed to start upgrade" },
-      500
-    );
-  }
-});
-app18.get("/upgrade/progress", (c) => {
-  return c.json(readProgressLog(LOG_FILE));
-});
 app18.post("/alert-surfaced", async (c) => {
   let installed = "unknown";
   let latest = null;
@@ -19286,10 +19342,9 @@ app22.post("/", async (c) => {
 var events_default = app22;
 
 // server/routes/admin/cloudflare.ts
-import * as childProcess from "child_process";
 import { homedir as homedir4 } from "os";
-import { resolve as resolve25 } from "path";
-import { readFileSync as readFileSync25 } from "fs";
+import { resolve as resolve26 } from "path";
+import { readFileSync as readFileSync24 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -19305,14 +19360,14 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync24, writeFileSync as writeFileSync15 } from "fs";
-import { dirname as dirname7 } from "path";
-import { resolve as resolve24 } from "path";
-var ALIAS_DOMAINS_PATH = resolve24(MAXY_DIR, "alias-domains.json");
+import { existsSync as existsSync23, mkdirSync as mkdirSync13, readFileSync as readFileSync23, writeFileSync as writeFileSync14 } from "fs";
+import { dirname as dirname8 } from "path";
+import { resolve as resolve25 } from "path";
+var ALIAS_DOMAINS_PATH = resolve25(MAXY_DIR, "alias-domains.json");
 function readExisting() {
-  if (!existsSync24(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+  if (!existsSync23(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync24(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync23(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -19323,17 +19378,18 @@ function addAliasDomain(hostname2) {
   const existing = readExisting();
   if (existing.has(hostname2)) return;
   existing.add(hostname2);
-  mkdirSync11(dirname7(ALIAS_DOMAINS_PATH), { recursive: true });
-  writeFileSync15(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
+  mkdirSync13(dirname8(ALIAS_DOMAINS_PATH), { recursive: true });
+  writeFileSync14(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
 // server/routes/admin/cloudflare.ts
-var SCRIPT_TIMEOUT_MS = 10 * 60 * 1e3;
+var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
+var DOMAINS_TIMEOUT_MS = 40 * 1e3;
 function loadBrandInfo() {
-  const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
-  const brandPath = resolve25(platformRoot3, "config", "brand.json");
+  const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
+  const brandPath = resolve26(platformRoot3, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync25(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync24(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -19376,42 +19432,116 @@ function validateBody(body) {
   }
   return null;
 }
-function runScript(scriptPath, args, streamLogPath, log) {
-  return new Promise((resolveP) => {
-    const child = childProcess.spawn(scriptPath, args, {
-      env: { ...process.env, STREAM_LOG_PATH: streamLogPath },
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    log(`phase=script-spawn pid=${child.pid ?? "unknown"} args="${args.join(" ")}"`);
-    let stdout = "";
-    let stderr = "";
-    let timedOut = false;
-    const killer = setTimeout(() => {
-      timedOut = true;
-      try {
-        child.kill("SIGTERM");
-      } catch {
-      }
-    }, SCRIPT_TIMEOUT_MS);
-    child.stdout?.on("data", (chunk) => {
-      stdout += chunk.toString("utf-8");
-    });
-    child.stderr?.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    child.on("error", (e) => {
-      clearTimeout(killer);
-      resolveP({ code: null, signal: null, stdout, stderr: `${stderr}
-${e.message}`, timedOut: false });
-    });
-    child.on("exit", (code, signal) => {
-      clearTimeout(killer);
-      log(`phase=script-exit code=${code ?? "null"} signal=${signal ?? "null"} timedOut=${timedOut}`);
-      resolveP({ code, signal, stdout, stderr, timedOut });
-    });
-  });
-}
 var app23 = new Hono2();
+function fieldFromReason(reason) {
+  switch (reason) {
+    case "not-signed-in":
+      return "dashboard";
+    case "cdp-unreachable":
+    case "target-create-failed":
+    case "ws-connect-failed":
+    case "navigate-failed":
+    case "runtime-error":
+    case "table-wait-timeout":
+    case "entry-missing":
+    case "wrapper-timeout":
+    default:
+      return "script";
+  }
+}
+app23.get("/domains", requireAdminSession, async (c) => {
+  const started = Date.now();
+  const sessionKey = c.var.sessionKey;
+  let correlationId;
+  let sessionKeyTail;
+  let streamLogPath;
+  function tag() {
+    if (!correlationId) return "";
+    return ` conversationId=${correlationId} session_key=${sessionKeyTail ?? "unknown"}`;
+  }
+  function log(line) {
+    console.log(`[cloudflare-domains] ${line}${tag()}`);
+  }
+  function logErr(line) {
+    console.error(`[cloudflare-domains] ${line}${tag()}`);
+  }
+  function err(field, message, output) {
+    logErr(`phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`);
+    if (streamLogPath) {
+      writeRouteMilestone(
+        streamLogPath,
+        "cloudflare-domains",
+        `phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`
+      );
+    }
+    const body = {
+      ok: false,
+      field,
+      message,
+      output,
+      correlationId,
+      streamLogPath
+    };
+    return c.json(body, 200);
+  }
+  const accountId = getAccountIdForSession(sessionKey);
+  correlationId = getConversationIdForSession(sessionKey);
+  sessionKeyTail = sessionKey.slice(-8);
+  if (!accountId) return err("session", "No account bound to session \u2014 refresh chat.");
+  if (!correlationId) return err("session", "No active conversation for session \u2014 refresh chat.");
+  streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
+  log(`phase=stream-log-resolved path=${streamLogPath}`);
+  const brand = loadBrandInfo();
+  const scriptPath = resolve26(homedir4(), "list-cf-domains.sh");
+  const result = await runFormSpawn({
+    scriptPath,
+    args: [brand.hostname],
+    streamLogPath,
+    correlationId,
+    timeoutMs: DOMAINS_TIMEOUT_MS,
+    log,
+    logErr,
+    broadcast: broadcastToConversation
+  });
+  const combined = `${result.stdout}${result.stderr ? `
+---
+${result.stderr}` : ""}`;
+  if (result.code !== 0) {
+    const reasonMatch = result.stderr.match(/reason=([a-z0-9-]+)/);
+    const reason = reasonMatch ? reasonMatch[1] : void 0;
+    const field = fieldFromReason(reason);
+    const message = reason ? `Domain discovery failed: ${reason}` : result.timedOut ? `Domain discovery timed out after ${DOMAINS_TIMEOUT_MS / 1e3}s` : `Domain discovery exited with code ${result.code ?? "null"}${result.signal ? ` (signal ${result.signal})` : ""}`;
+    return err(field, message, combined);
+  }
+  let domains;
+  try {
+    const parsed = JSON.parse(result.stdout.trim());
+    if (!Array.isArray(parsed) || !parsed.every((d) => typeof d === "string")) {
+      throw new Error("response is not string[]");
+    }
+    domains = parsed;
+  } catch (e) {
+    return err(
+      "script",
+      `Domain discovery returned malformed output: ${e instanceof Error ? e.message : String(e)}`,
+      combined
+    );
+  }
+  const success = {
+    ok: true,
+    domains,
+    correlationId,
+    streamLogPath
+  };
+  const total = Date.now() - started;
+  log(`phase=response-sent total_ms=${total} count=${domains.length}`);
+  writeRouteMilestone(
+    streamLogPath,
+    "cloudflare-domains",
+    `phase=response-sent total_ms=${total} count=${domains.length}`
+  );
+  return c.json(success, 200);
+});
 app23.post("/setup", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
@@ -19430,6 +19560,13 @@ app23.post("/setup", requireAdminSession, async (c) => {
   }
   function err(field, message, output) {
     logErr(`phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`);
+    if (streamLogPath) {
+      writeRouteMilestone(
+        streamLogPath,
+        "cloudflare-setup",
+        `phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`
+      );
+    }
     const body2 = {
       ok: false,
       field,
@@ -19480,16 +19617,25 @@ app23.post("/setup", requireAdminSession, async (c) => {
   }
   streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
   log(`phase=stream-log-resolved path=${streamLogPath}`);
-  const scriptPath = resolve25(homedir4(), "setup-tunnel.sh");
+  const scriptPath = resolve26(homedir4(), "setup-tunnel.sh");
   const args = [brand.hostname, String(port2), adminFqdn];
   if (publicFqdn) args.push(publicFqdn);
   if (apex) args.push(apex);
-  const result = await runScript(scriptPath, args, streamLogPath, log);
+  const result = await runFormSpawn({
+    scriptPath,
+    args,
+    streamLogPath,
+    correlationId,
+    timeoutMs: SETUP_TIMEOUT_MS,
+    log,
+    logErr,
+    broadcast: broadcastToConversation
+  });
   const combined = `${result.stdout}${result.stderr ? `
 ---
 ${result.stderr}` : ""}`;
   if (result.code !== 0) {
-    const reason = result.timedOut ? `Timed out after ${SCRIPT_TIMEOUT_MS / 1e3}s` : `Exited with code ${result.code ?? "null"}${result.signal ? ` (signal ${result.signal})` : ""}`;
+    const reason = result.timedOut ? `Timed out after ${SETUP_TIMEOUT_MS / 1e3}s` : `Exited with code ${result.code ?? "null"}${result.signal ? ` (signal ${result.signal})` : ""}`;
     return err("script", reason, combined);
   }
   const candidates = [publicFqdn, apex].filter((h) => typeof h === "string" && h.length > 0);
@@ -19517,6 +19663,11 @@ ${result.stderr}` : ""}`;
   }
   const total = Date.now() - started;
   log(`phase=done total_ms=${total} aliases=${aliasesWritten.length}`);
+  writeRouteMilestone(
+    streamLogPath,
+    "cloudflare-setup",
+    `phase=done total_ms=${total} aliases=${aliasesWritten.length}`
+  );
   const success = {
     ok: true,
     output: combined,
@@ -19535,17 +19686,17 @@ var cloudflare_default = app23;
 import { createReadStream as createReadStream3 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename6, join as join12, resolve as resolve27, sep as sep2 } from "path";
+import { basename as basename6, join as join12, resolve as resolve28, sep as sep2 } from "path";
 import { Readable as Readable3 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve26, normalize, sep, relative } from "path";
-var PLATFORM_ROOT10 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "../platform");
-var DATA_ROOT = resolve26(PLATFORM_ROOT10, "..", "data");
+import { resolve as resolve27, normalize, sep, relative } from "path";
+var PLATFORM_ROOT10 = process.env.MAXY_PLATFORM_ROOT ?? resolve27(process.cwd(), "../platform");
+var DATA_ROOT = resolve27(PLATFORM_ROOT10, "..", "data");
 function resolveDataPath(raw2) {
   const cleaned = normalize("/" + (raw2 ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve26(DATA_ROOT, cleaned);
+  const absolute = resolve27(DATA_ROOT, cleaned);
   let dataRootReal;
   try {
     dataRootReal = realpathSync3(DATA_ROOT);
@@ -19754,8 +19905,8 @@ app24.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve27(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve27(destDir, finalName);
+  const destDir = resolve28(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve28(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -19813,9 +19964,152 @@ app25.get("/", requireAdminSession, async (c) => {
 });
 var graph_search_default = app25;
 
-// server/routes/admin/file-attach.ts
+// app/lib/graph-labels.ts
+var GRAPH_LABEL_COLOURS = {
+  // Business identity
+  LocalBusiness: "#2E5090",
+  Service: "#3A6BB0",
+  PriceSpecification: "#5B8DD0",
+  OpeningHoursSpecification: "#7AAFE8",
+  // People
+  Person: "#C2410C",
+  UserProfile: "#EA580C",
+  Preference: "#F97316",
+  AdminUser: "#9A3412",
+  AccessGrant: "#7C2D12",
+  // Knowledge
+  KnowledgeDocument: "#16A34A",
+  Section: "#22C55E",
+  Chunk: "#4ADE80",
+  DigitalDocument: "#15803D",
+  CreativeWork: "#86EFAC",
+  Question: "#A7F3D0",
+  FAQPage: "#34D399",
+  DefinedTerm: "#10B981",
+  Review: "#059669",
+  ImageObject: "#6EE7B7",
+  // Conversational
+  Conversation: "#7C3AED",
+  Message: "#A78BFA",
+  ToolCall: "#C4B5FD",
+  // Tasks / projects / events
+  Task: "#DB2777",
+  Project: "#BE185D",
+  Event: "#EC4899",
+  // Workflows
+  Workflow: "#0891B2",
+  WorkflowStep: "#06B6D4",
+  WorkflowRun: "#22D3EE",
+  StepResult: "#67E8F9",
+  // Onboarding
+  OnboardingState: "#8B5CF6",
+  // Email
+  Email: "#65A30D",
+  EmailAccount: "#84CC16"
+};
+var ALL_GRAPH_LABELS = Object.freeze(
+  Object.keys(GRAPH_LABEL_COLOURS)
+);
+function isKnownLabel(label) {
+  return Object.prototype.hasOwnProperty.call(GRAPH_LABEL_COLOURS, label);
+}
+
+// server/routes/admin/graph-subgraph.ts
+var DEFAULT_LIMIT2 = 200;
+var MAX_LIMIT2 = 500;
+var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
+  "embedding",
+  "passwordHash",
+  "magicToken",
+  "otpCode",
+  "sessionKey"
+]);
 var app26 = new Hono2();
-app26.post("/", async (c) => {
+app26.get("/", requireAdminSession, async (c) => {
+  const sessionKey = c.var.sessionKey;
+  const accountId = getAccountIdForSession(sessionKey);
+  if (!accountId) {
+    console.error('[graph-page] auth-rejected reason="no account for session"');
+    return c.json({ error: "Account not found for session" }, 401);
+  }
+  const rawLimit = c.req.query("limit");
+  const parsedLimit = rawLimit ? parseInt(rawLimit, 10) : DEFAULT_LIMIT2;
+  const limit = Number.isFinite(parsedLimit) && parsedLimit > 0 ? Math.min(parsedLimit, MAX_LIMIT2) : DEFAULT_LIMIT2;
+  const rawLabels = c.req.query("labels");
+  const labels = rawLabels ? rawLabels.split(",").map((s) => s.trim()).filter(Boolean) : [];
+  for (const label of labels) {
+    if (!isKnownLabel(label)) {
+      return c.json(
+        { error: `unknown label "${label}" \u2014 not registered in graph-labels.ts` },
+        400
+      );
+    }
+  }
+  const started = Date.now();
+  const session = getSession();
+  try {
+    const cypher = labels.length > 0 ? buildCypher(true) : buildCypher(false);
+    const params = { accountId, limit };
+    if (labels.length > 0) params.labels = labels;
+    const result = await session.run(cypher, params);
+    const record = result.records[0];
+    const rawNodes = record?.get("nodes") ?? [];
+    const rawEdges = record?.get("edges") ?? [];
+    const nodes = rawNodes.map(pruneNode);
+    const edges = rawEdges.filter((e) => e && e.id != null);
+    const elapsed = Date.now() - started;
+    console.error(
+      `[graph-page] load account=${accountId} nodes=${nodes.length} edges=${edges.length} ms=${elapsed}`
+    );
+    return c.json({ nodes, edges });
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[graph-page] error stage=fetch reason="${message}" ms=${elapsed}`);
+    return c.json({ error: `Graph data unavailable: ${message}` }, 503);
+  } finally {
+    try {
+      await session.close();
+    } catch {
+    }
+  }
+});
+function buildCypher(filtered) {
+  const labelGuard = filtered ? "AND any(lbl IN labels(n) WHERE lbl IN $labels)" : "";
+  return `
+    MATCH (n)
+    WHERE n.accountId = $accountId ${labelGuard}
+    WITH n ORDER BY coalesce(n.updatedAt, n.createdAt, '') DESC
+    LIMIT toInteger($limit)
+    WITH collect(n) AS nodes, collect(elementId(n)) AS nodeIds
+    UNWIND nodes AS n
+    OPTIONAL MATCH (n)-[r]-(m)
+      WHERE elementId(m) IN nodeIds
+    WITH nodes,
+         collect(DISTINCT CASE WHEN r IS NULL THEN null ELSE {
+           id: elementId(r),
+           from: elementId(startNode(r)),
+           to: elementId(endNode(r)),
+           type: type(r)
+         } END) AS rawEdges
+    RETURN
+      [x IN nodes | {id: elementId(x), labels: labels(x), properties: properties(x)}] AS nodes,
+      [e IN rawEdges WHERE e IS NOT NULL] AS edges
+  `;
+}
+function pruneNode(node) {
+  const properties = {};
+  for (const [key, value] of Object.entries(node.properties ?? {})) {
+    if (STRIPPED_PROPERTIES.has(key)) continue;
+    properties[key] = value;
+  }
+  return { id: node.id, labels: node.labels, properties };
+}
+var graph_subgraph_default = app26;
+
+// server/routes/admin/file-attach.ts
+var app27 = new Hono2();
+app27.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -19838,39 +20132,40 @@ app26.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app26;
+var file_attach_default = app27;
 
 // server/routes/admin/index.ts
-var app27 = new Hono2();
-app27.route("/session", session_default2);
-app27.route("/chat", chat_default2);
-app27.route("/compact", compact_default);
-app27.route("/logs", logs_default);
-app27.route("/claude-info", claude_info_default);
-app27.route("/attachment", attachment_default);
-app27.route("/account", account_default);
-app27.route("/agents", agents_default);
-app27.route("/version", version_default);
-app27.route("/sessions", sessions_default);
-app27.route("/browser", browser_default);
-app27.route("/device-browser", device_browser_default);
-app27.route("/events", events_default);
-app27.route("/cloudflare", cloudflare_default);
-app27.route("/files", files_default);
-app27.route("/graph-search", graph_search_default);
-app27.route("/file-attach", file_attach_default);
-var admin_default = app27;
+var app28 = new Hono2();
+app28.route("/session", session_default2);
+app28.route("/chat", chat_default2);
+app28.route("/compact", compact_default);
+app28.route("/logs", logs_default);
+app28.route("/claude-info", claude_info_default);
+app28.route("/attachment", attachment_default);
+app28.route("/account", account_default);
+app28.route("/agents", agents_default);
+app28.route("/version", version_default);
+app28.route("/sessions", sessions_default);
+app28.route("/browser", browser_default);
+app28.route("/device-browser", device_browser_default);
+app28.route("/events", events_default);
+app28.route("/cloudflare", cloudflare_default);
+app28.route("/files", files_default);
+app28.route("/graph-search", graph_search_default);
+app28.route("/graph-subgraph", graph_subgraph_default);
+app28.route("/file-attach", file_attach_default);
+var admin_default = app28;
 
 // server/index.ts
 var PLATFORM_ROOT11 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT11 ? join13(PLATFORM_ROOT11, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync25(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync25(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -19892,8 +20187,8 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH2 = join13(homedir5(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync25(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync26(ALIAS_DOMAINS_PATH2, "utf-8"));
+    if (!existsSync24(ALIAS_DOMAINS_PATH2)) return null;
+    const parsed = JSON.parse(readFileSync25(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -19917,9 +20212,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app28 = new Hono2();
-app28.use("*", clientIpMiddleware);
-app28.use("*", async (c, next) => {
+var app29 = new Hono2();
+app29.use("*", clientIpMiddleware);
+app29.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -19942,7 +20237,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/g/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app28.use("*", async (c, next) => {
+app29.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -19982,7 +20277,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app28.post("/__remote-auth/login", async (c) => {
+app29.post("/__remote-auth/login", async (c) => {
   const clientIp = c.var.clientIp || "unknown";
   const rateLimited = checkRateLimit(clientIp);
   if (rateLimited) {
@@ -20018,7 +20313,7 @@ app28.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app28.get("/__remote-auth/logout", (c) => {
+app29.get("/__remote-auth/logout", (c) => {
   const cookieHeader = c.req.header("cookie");
   const token = parseCookie(cookieHeader, "__remote_session");
   if (token) invalidateRemoteSession(token);
@@ -20031,7 +20326,7 @@ app28.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app28.post("/__remote-auth/change-password", async (c) => {
+app29.post("/__remote-auth/change-password", async (c) => {
   const clientIp = c.var.clientIp || "unknown";
   const rateLimited = checkRateLimit(clientIp);
   if (rateLimited) {
@@ -20080,13 +20375,13 @@ app28.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app28.get("/__remote-auth/setup", (c) => {
+app29.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app28.post("/__remote-auth/set-initial-password", async (c) => {
+app29.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -20122,10 +20417,10 @@ app28.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app28.get("/api/remote-auth/status", (c) => {
+app29.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app28.post("/api/remote-auth/set-password", async (c) => {
+app29.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -20155,9 +20450,9 @@ app28.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app28.route("/api/_client-error", client_error_default);
+app29.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app28.use("*", async (c, next) => {
+app29.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -20197,15 +20492,15 @@ function parseCookie(cookieHeader, name) {
     return null;
   }
 }
-app28.route("/api/health", health_default);
-app28.route("/api/session", session_default);
-app28.route("/api/chat", chat_default);
-app28.route("/api/group", group_default);
-app28.route("/api/access", access_default);
-app28.route("/api/telegram", telegram_default);
-app28.route("/api/whatsapp", whatsapp_default);
-app28.route("/api/onboarding", onboarding_default);
-app28.route("/api/admin", admin_default);
+app29.route("/api/health", health_default);
+app29.route("/api/session", session_default);
+app29.route("/api/chat", chat_default);
+app29.route("/api/group", group_default);
+app29.route("/api/access", access_default);
+app29.route("/api/telegram", telegram_default);
+app29.route("/api/whatsapp", whatsapp_default);
+app29.route("/api/onboarding", onboarding_default);
+app29.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -20217,7 +20512,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app28.get("/agent-assets/:slug/:filename", (c) => {
+app29.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -20233,26 +20528,26 @@ app28.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve28(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve29(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve29(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync25(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync26(filePath);
+  const body = readFileSync25(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app28.get("/generated/:filename", (c) => {
+app29.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -20263,20 +20558,20 @@ app28.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "generated", filename);
-  const expectedDir = resolve28(account.accountDir, "generated");
+  const filePath = resolve29(account.accountDir, "generated", filename);
+  const expectedDir = resolve29(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync25(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync26(filePath);
+  const body = readFileSync25(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -20285,9 +20580,9 @@ app28.get("/generated/:filename", (c) => {
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync25(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync25(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -20305,8 +20600,8 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT11) return "unknown";
     const versionFile = join13(PLATFORM_ROOT11, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync25(versionFile)) return "unknown";
-    const content = readFileSync26(versionFile, "utf-8").trim();
+    if (!existsSync24(versionFile)) return "unknown";
+    const content = readFileSync25(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -20347,7 +20642,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync26(resolve28(process.cwd(), "public", file), "utf-8");
+    html = readFileSync25(resolve29(process.cwd(), "public", file), "utf-8");
     html = html.replace("<title>Maxy</title>", `<title>${escapeHtml2(BRAND.productName)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml2(brandFaviconPath)}"`);
     const headInjection = file === "index.html" ? `${brandScript}
@@ -20365,13 +20660,13 @@ function loadBrandingCache(agentSlug) {
   const configDir2 = join13(homedir5(), BRAND.configDir);
   try {
     const accountJsonPath = join13(configDir2, "account.json");
-    if (!existsSync25(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));
+    if (!existsSync24(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync25(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join13(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync25(cachePath)) return null;
-    return JSON.parse(readFileSync26(cachePath, "utf-8"));
+    if (!existsSync24(cachePath)) return null;
+    return JSON.parse(readFileSync25(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -20380,8 +20675,8 @@ function resolveDefaultSlug() {
   try {
     const configDir2 = join13(homedir5(), BRAND.configDir);
     const accountJsonPath = join13(configDir2, "account.json");
-    if (!existsSync25(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));
+    if (!existsSync24(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync25(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -20417,7 +20712,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml2(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app28.get("/", (c) => {
+app29.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -20425,12 +20720,12 @@ app28.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app28.get("/public", (c) => {
+app29.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app28.get("/chat", (c) => {
+app29.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -20449,12 +20744,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app28.use("/vnc-viewer.html", logViewerFetch);
-app28.use("/vnc-popout.html", logViewerFetch);
-app28.get("/vnc-popout.html", (c) => {
+app29.use("/vnc-viewer.html", logViewerFetch);
+app29.use("/vnc-popout.html", logViewerFetch);
+app29.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync26(resolve28(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync25(resolve29(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml2(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -20464,7 +20759,7 @@ app28.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app28.post("/api/vnc/client-event", async (c) => {
+app29.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -20485,18 +20780,20 @@ app28.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app28.get("/g/:slug", (c) => {
+app29.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app28.use("/graph/*", graphAuthMiddleware({ isPublicHost, canAccessAdmin }));
-app28.use("/graph", graphAuthMiddleware({ isPublicHost, canAccessAdmin }));
-attachGraphHttpRoutes(app28);
-app28.get("/data", (c) => {
+app29.get("/graph", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("graph.html"));
+});
+app29.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app28.get("/:slug", async (c, next) => {
+app29.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -20505,16 +20802,20 @@ app28.get("/:slug", async (c, next) => {
   }
   await next();
 });
-app28.use("/*", serveStatic({ root: "./public" }));
+app29.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.PORT ?? "19200", 10);
 var hostname = process.env.HOSTNAME ?? "0.0.0.0";
-var httpServer = serve({ fetch: app28.fetch, port, hostname });
+var httpServer = serve({ fetch: app29.fetch, port, hostname });
 attachVncWsProxy(httpServer, {
   isPublicHost,
   upstreamHost: "127.0.0.1",
   upstreamPort: 6080
 });
-attachGraphWsProxy(httpServer, { isPublicHost, canAccessAdmin });
+attachTerminalWsProxy(httpServer, {
+  isPublicHost,
+  upstreamHost: "127.0.0.1",
+  upstreamPort: 7681
+});
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 var SUBAPP_MANIFEST = [
   { prefix: "/api/health", file: "server/routes/health.ts", subapp: health_default },
@@ -20534,7 +20835,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app28.routes ?? []) {
+  for (const r of app29.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -20548,8 +20849,8 @@ try {
 (async () => {
   try {
     let userId = "";
-    if (existsSync25(USERS_FILE)) {
-      const users = JSON.parse(readFileSync26(USERS_FILE, "utf-8").trim() || "[]");
+    if (existsSync24(USERS_FILE)) {
+      const users = JSON.parse(readFileSync25(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);
@@ -20575,7 +20876,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve28(process.env.MAXY_PLATFORM_ROOT ?? join13(__dirname, "..")),
+  platformRoot: resolve29(process.env.MAXY_PLATFORM_ROOT ?? join13(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     try {