@rubytech/create-maxy 1.0.892 → 1.0.894

package/payload/server/chunk-FSJLLIEA.js

@@ -0,0 +1,3570 @@
+import {
+  createNewAdminConversation,
+  ensureConversation,
+  getSession,
+  isMessageUseful,
+  persistMessage,
+  setConversationAgentSessionId,
+  setSessionStoreRef
+} from "./chunk-FBTNBSB4.js";
+
+// app/lib/claude-agent/client-pool.ts
+import { query } from "@anthropic-ai/claude-agent-sdk";
+
+// app/lib/claude-agent/logging.ts
+import { spawnSync } from "child_process";
+import { resolve } from "path";
+import { platform as osPlatform, devNull } from "os";
+import { readFileSync, readdirSync, mkdirSync, createWriteStream, statSync, unlinkSync, appendFileSync } from "fs";
+import { lookup as dnsLookup } from "dns/promises";
+import { createConnection as netConnect } from "net";
+import { StringDecoder } from "string_decoder";
+var LOG_RETENTION_DAYS = 7;
+var isoTs = () => (/* @__PURE__ */ new Date()).toISOString();
+var BROWSER_TOOL_PREFIXES = [
+  "mcp__plugin_playwright_playwright__",
+  "mcp__plugin_chrome-devtools-mcp_chrome-devtools__"
+];
+function isBrowserTool(name) {
+  return BROWSER_TOOL_PREFIXES.some((p) => name.startsWith(p));
+}
+var DIAG_HARD_CAP_MS = 5e3;
+var DIAG_DNS_TIMEOUT_MS = 2e3;
+var DIAG_TCP_TIMEOUT_MS = 3e3;
+var DIAG_HTTP_TIMEOUT_MS = 4e3;
+function quoteDiag(value) {
+  return JSON.stringify(value);
+}
+function extractUrl(toolName, input) {
+  if (input === null || typeof input !== "object") return void 0;
+  const obj = input;
+  if (toolName === "WebFetch" && typeof obj.url === "string") return obj.url;
+  if (isBrowserTool(toolName) && typeof obj.url === "string") return obj.url;
+  if (typeof obj.url === "string" && /^https?:\/\//.test(obj.url)) return obj.url;
+  return void 0;
+}
+var FULL_REDACT_ENV_VARS = /* @__PURE__ */ new Set(["HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY"]);
+function redactEnvField(name) {
+  const value = process.env[name];
+  if (!value) return `${name.toLowerCase()}=absent`;
+  if (FULL_REDACT_ENV_VARS.has(name)) {
+    return `${name.toLowerCase()}=present`;
+  }
+  const suffix = value.length > 40 ? value.slice(-40) : value;
+  return `${name.toLowerCase()}=present suffix=${quoteDiag(suffix)}`;
+}
+async function probeDns(host, family) {
+  const label = family === 4 ? "dns_a" : "dns_aaaa";
+  const start = Date.now();
+  let timer;
+  try {
+    const result = await Promise.race([
+      dnsLookup(host, { family, verbatim: true }),
+      new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error("timeout")), DIAG_DNS_TIMEOUT_MS);
+      })
+    ]);
+    if (timer) clearTimeout(timer);
+    const ms = Date.now() - start;
+    return `${label}=${result.address} ${label}_ms=${ms}`;
+  } catch (err) {
+    if (timer) clearTimeout(timer);
+    const ms = Date.now() - start;
+    const msg = err instanceof Error ? err.message : String(err);
+    return `${label}=err ${label}_err=${quoteDiag(msg.slice(0, 60))} ${label}_ms=${ms}`;
+  }
+}
+async function probeTcp(host, port) {
+  const start = Date.now();
+  return new Promise((resolvePromise) => {
+    let settled = false;
+    const sock = netConnect({ host, port, family: 0 });
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      try {
+        sock.destroy();
+      } catch {
+      }
+      resolvePromise(result);
+    };
+    const timer = setTimeout(() => finish(`tcp=timeout tcp_ms=${Date.now() - start}`), DIAG_TCP_TIMEOUT_MS);
+    sock.once("connect", () => {
+      clearTimeout(timer);
+      finish(`tcp=ok tcp_ms=${Date.now() - start}`);
+    });
+    sock.once("error", (err) => {
+      clearTimeout(timer);
+      const msg = err instanceof Error ? err.message : String(err);
+      finish(`tcp=err tcp_err=${quoteDiag(msg.slice(0, 60))} tcp_ms=${Date.now() - start}`);
+    });
+  });
+}
+async function probeHttp(url) {
+  const start = Date.now();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DIAG_HTTP_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, { method: "HEAD", redirect: "manual", signal: controller.signal });
+    clearTimeout(timer);
+    return `http_status=${res.status} http_ms=${Date.now() - start}`;
+  } catch (err) {
+    clearTimeout(timer);
+    const msg = err instanceof Error ? err.message : String(err);
+    return `http_status=err http_err=${quoteDiag(msg.slice(0, 60))} http_ms=${Date.now() - start}`;
+  }
+}
+async function runFailureDiagnostic(toolName, toolInput) {
+  const inputKeys = toolInput !== null && typeof toolInput === "object" ? Object.keys(toolInput).join(",") : "";
+  const envFields = [
+    redactEnvField("HTTPS_PROXY"),
+    redactEnvField("HTTP_PROXY"),
+    redactEnvField("NO_PROXY"),
+    redactEnvField("NODE_OPTIONS")
+  ].join(" ");
+  const url = extractUrl(toolName, toolInput);
+  if (!url) {
+    return `diag_url=none input_keys=[${inputKeys}] ${envFields}`;
+  }
+  let host;
+  let port;
+  try {
+    const parsed = new URL(url);
+    host = parsed.hostname;
+    port = parsed.port ? Number(parsed.port) : parsed.protocol === "https:" ? 443 : 80;
+  } catch {
+    return `diag_url=unparseable input_keys=[${inputKeys}] ${envFields}`;
+  }
+  const probes = Promise.allSettled([
+    probeDns(host, 4),
+    probeDns(host, 6),
+    probeTcp(host, port),
+    probeHttp(url)
+  ]);
+  let capTimer;
+  const capped = await Promise.race([
+    probes,
+    new Promise((resolvePromise) => {
+      capTimer = setTimeout(() => resolvePromise("__diag_timeout__"), DIAG_HARD_CAP_MS);
+    })
+  ]);
+  if (capTimer) clearTimeout(capTimer);
+  if (capped === "__diag_timeout__") {
+    return `diag_host=${host} diag_port=${port} diag_timeout=true input_keys=[${inputKeys}] ${envFields}`;
+  }
+  const fields = capped.map((r) => r.status === "fulfilled" ? r.value : `probe_err=${quoteDiag(String(r.reason).slice(0, 40))}`).join(" ");
+  return `diag_host=${host} diag_port=${port} ${fields} input_keys=[${inputKeys}] ${envFields}`;
+}
+function agentLogStream(name, accountDir, sessionKey) {
+  if (!sessionKey) {
+    throw new Error(`agentLogStream: sessionKey is required (name=${name}) \u2014 chat-route entry binds it for every channel`);
+  }
+  const filenameBytes = Buffer.byteLength(name) + Buffer.byteLength(sessionKey) + 5;
+  if (filenameBytes > 240) {
+    logTeeLog(
+      `[log-tee] writer-bind-rejected reason=key-too-long sessionKey-bytes=${Buffer.byteLength(sessionKey)} name=${name} filename-bytes=${filenameBytes}`
+    );
+    return openNoOpStream(sessionKey, name);
+  }
+  const logDir = resolve(accountDir, "logs");
+  mkdirSync(logDir, { recursive: true });
+  purgeOldLogs(logDir, `${name}-`);
+  const logPath = resolve(logDir, `${name}-${sessionKey}.log`);
+  const stream = createWriteStream(logPath, { flags: "a" });
+  stream.once("error", (err) => {
+    logTeeLog(
+      `[log-tee] writer-bind-failed sessionKey=${sessionKey.slice(0, 8)} name=${name} errno=${err.code ?? "unknown"} path=${JSON.stringify(logPath)}`
+    );
+    openStreamLogs.delete(stream);
+  });
+  registerStreamLog(stream, { path: logPath, sessionKey, name });
+  return stream;
+}
+function openNoOpStream(sessionKey, name) {
+  const stream = createWriteStream(devNull, { flags: "a" });
+  stream.once("error", (err) => {
+    logTeeLog(`[log-tee] devnull-error sessionKey=${sessionKey.slice(0, 8)} name=${name} errno=${err.code ?? "unknown"}`);
+    openStreamLogs.delete(stream);
+  });
+  registerStreamLog(stream, { path: devNull, sessionKey, name });
+  return stream;
+}
+var openStreamLogs = /* @__PURE__ */ new Map();
+function registerStreamLog(stream, entry) {
+  openStreamLogs.set(stream, entry);
+  stream.once("close", () => {
+    openStreamLogs.delete(stream);
+    logTeeLog(`[log-tee] deregister sessionKey=${entry.sessionKey.slice(0, 8)} path=${JSON.stringify(entry.path)}`);
+  });
+  logTeeLog(`[log-tee] file-created sessionKey=${entry.sessionKey.slice(0, 8)} path=${JSON.stringify(entry.path)} first-token-at=${isoTs()}`);
+}
+var LOG_TEE_TAG_RE = /^\[[a-zA-Z][a-zA-Z0-9:_\-]*\]/;
+var originalConsoleError = null;
+var originalConsoleLog = null;
+var logTeeInstalled = false;
+var logTeeCycleTimer = null;
+var logTeeAdherenceTimer = null;
+var logTeeLinesEmitted = 0;
+var logTeeLinesRouted = 0;
+var logTeeBytesRouted = 0;
+var logTeeFailCount = 0;
+function logTeeLog(line) {
+  (originalConsoleError ?? console.error.bind(console))(line);
+}
+function appendToActiveStreams(line) {
+  if (openStreamLogs.size === 0) return;
+  const ts = isoTs();
+  const teeLine = `[${ts}] ${line.replace(/\n$/, "")}
+`;
+  let routed = 0;
+  for (const entry of openStreamLogs.values()) {
+    try {
+      appendFileSync(entry.path, teeLine);
+      routed++;
+      logTeeBytesRouted += teeLine.length;
+    } catch (err) {
+      logTeeFailCount++;
+      const msg = err instanceof Error ? err.message : String(err);
+      logTeeLog(`[log-tee] FAIL emit reason=${JSON.stringify(msg.slice(0, 80))} path=${JSON.stringify(entry.path)}`);
+    }
+  }
+  if (routed > 0) {
+    logTeeLinesRouted += routed;
+    logTeeLinesEmitted++;
+  }
+}
+function installLogTee() {
+  if (logTeeInstalled) return;
+  logTeeInstalled = true;
+  originalConsoleError = console.error.bind(console);
+  originalConsoleLog = console.log.bind(console);
+  const wrap = (orig) => {
+    return (...args) => {
+      orig(...args);
+      const rendered = args.map((a) => typeof a === "string" ? a : safeStringify(a)).join(" ");
+      if (LOG_TEE_TAG_RE.test(rendered)) {
+        appendToActiveStreams(rendered);
+      }
+    };
+  };
+  console.error = wrap(originalConsoleError);
+  console.log = wrap(originalConsoleLog);
+  logTeeCycleTimer = setInterval(() => {
+    const active = openStreamLogs.size;
+    logTeeLog(
+      `[log-tee] cycle activeSessions=${active} linesEmitted=${logTeeLinesEmitted} linesRouted=${logTeeLinesRouted} bytesRouted=${logTeeBytesRouted} failCount=${logTeeFailCount}`
+    );
+  }, 3e4);
+  logTeeCycleTimer.unref?.();
+  logTeeAdherenceTimer = setInterval(() => {
+    runAdherenceCheck();
+  }, 60 * 60 * 1e3);
+  logTeeAdherenceTimer.unref?.();
+  logTeeLog(`[log-tee] installed pid=${process.pid}`);
+}
+function safeStringify(value) {
+  try {
+    if (value instanceof Error) return value.stack ?? value.message;
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function emitMissingOnResolve(sessionKey, surface, reason) {
+  logTeeLog(`[log-tee] missing-on-resolve sessionKey=${sessionKey.slice(0, 8)} surface=${surface} reason=${JSON.stringify(reason.slice(0, 120))}`);
+}
+function runAdherenceCheck() {
+  const start = Date.now();
+  let sessions = 0;
+  let misses = 0;
+  try {
+    const accountsRoot = resolveAccountsRoot();
+    if (!accountsRoot) {
+      logTeeLog(`[log-tee] adherence-check window=24h sessions=0 misses=0 ts=${isoTs()} note=accounts-root-unresolved`);
+      return;
+    }
+    const sessionKeysOnDisk = collectSessionKeysFromOpenStreams();
+    sessions = sessionKeysOnDisk.size;
+    for (const key of sessionKeysOnDisk) {
+      if (!resolveStreamLogPath(accountsRoot, key)) {
+        misses++;
+        emitMissingOnResolve(key, "adherence-check", "file-not-on-disk");
+      }
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    logTeeLog(`[log-tee] adherence-check-err reason=${JSON.stringify(msg.slice(0, 120))}`);
+    return;
+  }
+  const ms = Date.now() - start;
+  logTeeLog(`[log-tee] adherence-check window=24h sessions=${sessions} misses=${misses} ms=${ms} ts=${isoTs()}`);
+}
+function collectSessionKeysFromOpenStreams() {
+  const keys = /* @__PURE__ */ new Set();
+  for (const entry of openStreamLogs.values()) {
+    keys.add(entry.sessionKey);
+  }
+  return keys;
+}
+function resolveAccountsRoot() {
+  const envRoot = process.env.ADHERENCE_INSTALL_DIR;
+  if (envRoot) return resolve(envRoot, "data", "accounts");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
+  if (platformRoot2) return resolve(platformRoot2, "..", "data", "accounts");
+  return resolve(process.cwd(), "..", "..", "data", "accounts");
+}
+function resolveStreamLogPath(accountsRoot, sessionKey) {
+  let entries;
+  try {
+    entries = readdirSync(accountsRoot);
+  } catch {
+    return null;
+  }
+  for (const acct of entries) {
+    const logsDir = resolve(accountsRoot, acct, "logs");
+    let logFiles;
+    try {
+      logFiles = readdirSync(logsDir);
+    } catch {
+      continue;
+    }
+    const wanted = `claude-agent-stream-${sessionKey}.log`;
+    if (logFiles.includes(wanted)) return resolve(logsDir, wanted);
+  }
+  return null;
+}
+if (process.env.NODE_ENV !== "test") {
+  installLogTee();
+}
+function sigtermFlushStreamLogs(reason, source) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  for (const entry of openStreamLogs.values()) {
+    const line = `[${ts}] [server-sigterm] reason=${reason} sessionKey=${entry.sessionKey} name=${entry.name} source=${source}
+`;
+    try {
+      appendFileSync(entry.path, line);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`[server-sigterm-flush-err] path=${entry.path} reason=${msg}`);
+    }
+  }
+}
+function purgeOldLogs(logDir, prefix) {
+  const cutoff = Date.now() - LOG_RETENTION_DAYS * 24 * 60 * 60 * 1e3;
+  let entries;
+  try {
+    entries = readdirSync(logDir);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[log-purge-err] readdir dir=${logDir} prefix=${prefix} reason=${msg}`);
+    return;
+  }
+  for (const file of entries) {
+    if (!file.startsWith(prefix)) continue;
+    const filePath = resolve(logDir, file);
+    try {
+      if (statSync(filePath).mtimeMs < cutoff) unlinkSync(filePath);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`[log-purge-err] file=${file} reason=${msg}`);
+    }
+  }
+}
+
+// app/lib/claude-agent/session-store.ts
+import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync2, mkdirSync as mkdirSync4 } from "fs";
+import { dirname as dirname2 } from "path";
+
+// app/lib/claude-agent/stream-log-writer.ts
+import { createWriteStream as createWriteStream2, mkdirSync as mkdirSync3 } from "fs";
+import { devNull as devNull2 } from "os";
+import { resolve as resolve7 } from "path";
+import { appendFileSync as appendFileSyncForAdminTelemetry } from "fs";
+import { dirname } from "path";
+
+// app/lib/claude-agent/spawn-env.ts
+import { resolve as resolve6 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync4, statSync as statSync4 } from "fs";
+import { execFileSync } from "child_process";
+
+// app/lib/claude-agent/account.ts
+import { resolve as resolve3 } from "path";
+import { readFileSync as readFileSync4, readdirSync as readdirSync2, existsSync as existsSync3, statSync as statSync2 } from "fs";
+
+// ../lib/brand-templating/src/index.ts
+import { join } from "path";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+var PLACEHOLDER = "{{productName}}";
+var cachedProductName = null;
+function brandJsonPath() {
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot2) {
+    throw new Error(
+      "[skill-loader] MAXY_PLATFORM_ROOT not set \u2014 cannot resolve brand.json"
+    );
+  }
+  return join(platformRoot2, "config", "brand.json");
+}
+function getBrandProductName() {
+  if (cachedProductName !== null) return cachedProductName;
+  const path = brandJsonPath();
+  if (!existsSync(path)) {
+    throw new Error(`[skill-loader] brand.json missing at ${path}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(path, "utf-8"));
+  } catch (err) {
+    throw new Error(
+      `[skill-loader] brand.json unreadable at ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const value = parsed.productName;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(
+      `[skill-loader] brand.json at ${path} has missing or empty productName`
+    );
+  }
+  cachedProductName = value;
+  return value;
+}
+function substituteBrandPlaceholders(content, sourcePath) {
+  if (!content.includes(PLACEHOLDER)) return content;
+  let productName;
+  try {
+    productName = getBrandProductName();
+  } catch (err) {
+    console.error(
+      `[skill-loader] ERROR: brand.json missing \u2014 cannot resolve productName for skill ${sourcePath}`
+    );
+    throw err;
+  }
+  const occurrences = content.split(PLACEHOLDER).length - 1;
+  const substituted = content.split(PLACEHOLDER).join(productName);
+  console.log(
+    `[skill-loader] brand-substituted productName=${productName} skill=${sourcePath} occurrences=${occurrences}`
+  );
+  return substituted;
+}
+
+// app/lib/paths.ts
+import { homedir } from "os";
+import { resolve as resolve2, join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3 } from "fs";
+var configDirName = ".maxy";
+var commercialMode = false;
+var vncDisplayNum = 99;
+var rfbPortNum = 5900;
+var websockifyPortNum = 6080;
+var cdpPortNum = 9222;
+var portSource = "dev-default";
+var platformRoot = process.env.MAXY_PLATFORM_ROOT;
+if (platformRoot) {
+  const brandPath = join2(platformRoot, "config", "brand.json");
+  if (existsSync2(brandPath)) {
+    let brand;
+    try {
+      brand = JSON.parse(readFileSync3(brandPath, "utf-8"));
+    } catch (err) {
+      const detail = (err instanceof Error ? err.message : String(err)).slice(0, 160);
+      console.error(`[paths] error reason=brand-config-missing path=${brandPath} detail="parse failed: ${detail.replace(/"/g, "'")}"`);
+      throw err;
+    }
+    if (typeof brand.configDir === "string") configDirName = brand.configDir;
+    if (brand.commercialMode === true) commercialMode = true;
+    if (typeof brand.vncDisplay === "number") vncDisplayNum = brand.vncDisplay;
+    const brandLabel = configDirName.replace(/^\./, "");
+    const required = [
+      ["rfbPort", brand.rfbPort],
+      ["websockifyPort", brand.websockifyPort],
+      ["cdpPort", brand.cdpPort]
+    ];
+    for (const [field, value] of required) {
+      if (typeof value !== "number") {
+        const keys = Object.keys(brand).join(",");
+        console.error(`[paths] error reason=cdp-port-unresolved brand=${brandLabel} path=${brandPath} field=${field} json_keys=${keys}`);
+        throw new Error(`brand.json at ${brandPath} missing required field: ${field}`);
+      }
+    }
+    rfbPortNum = brand.rfbPort;
+    websockifyPortNum = brand.websockifyPort;
+    cdpPortNum = brand.cdpPort;
+    portSource = "brand.json";
+  }
+}
+var MAXY_DIR = resolve2(homedir(), configDirName);
+var BRAND_NAME = configDirName.replace(/^\./, "");
+var COMMERCIAL_MODE = commercialMode;
+var VNC_DISPLAY = `:${vncDisplayNum}`;
+var RFB_PORT = rfbPortNum;
+var WEBSOCKIFY_PORT = websockifyPortNum;
+var CDP_PORT = cdpPortNum;
+console.log(
+  `[paths] brand=${configDirName.replace(/^\./, "")} vncDisplay=${vncDisplayNum} rfbPort=${RFB_PORT} websockifyPort=${WEBSOCKIFY_PORT} cdpPort=${CDP_PORT} source=${portSource}`
+);
+var CHROMIUM_PROFILE_DIR = resolve2(homedir(), configDirName, "chromium-profile");
+var PLATFORM_ROOT = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
+var USERS_FILE = resolve2(MAXY_DIR, "users.json");
+var LOG_DIR = resolve2(MAXY_DIR, "logs");
+var BIN_DIR = resolve2(MAXY_DIR, "bin");
+var REMOTE_PASSWORD_FILE = resolve2(MAXY_DIR, ".remote-password");
+var REMOTE_SESSION_SECRET_FILE = resolve2(MAXY_DIR, "credentials", "remote-session-secret");
+var ADMIN_SESSION_SECRET_FILE = resolve2(MAXY_DIR, "credentials", "admin-session-secret");
+var TELEGRAM_WEBHOOK_SECRET_FILE = resolve2(MAXY_DIR, ".telegram-webhook-secret");
+var TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE = resolve2(MAXY_DIR, ".telegram-admin-webhook-secret");
+var CLAUDE_CREDENTIALS_FILE = resolve2(MAXY_DIR, ".claude", ".credentials.json");
+
+// app/lib/claude-agent/account.ts
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
+var ACCOUNTS_DIR = resolve3(PLATFORM_ROOT2, "..", "data/accounts");
+if (!existsSync3(PLATFORM_ROOT2)) {
+  throw new Error(
+    `PLATFORM_ROOT does not exist: ${PLATFORM_ROOT2}
+Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the platform directory.`
+  );
+}
+function hasStubAccountDir() {
+  if (!existsSync3(ACCOUNTS_DIR)) return { stub: false, dirs: [] };
+  const stubs = [];
+  const entries = readdirSync2(ACCOUNTS_DIR, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    if (entry.name.startsWith(".")) continue;
+    const configPath = resolve3(ACCOUNTS_DIR, entry.name, "account.json");
+    if (!existsSync3(configPath)) stubs.push(entry.name);
+  }
+  return { stub: stubs.length > 0, dirs: stubs };
+}
+function resolveAccount() {
+  if (!existsSync3(ACCOUNTS_DIR)) return null;
+  let usersJsonUserId = null;
+  if (existsSync3(USERS_FILE)) {
+    try {
+      const raw = readFileSync4(USERS_FILE, "utf-8").trim();
+      if (raw) {
+        const users = JSON.parse(raw);
+        if (users.length > 0) {
+          usersJsonUserId = users[0].userId;
+        }
+      }
+    } catch {
+    }
+  }
+  const entries = readdirSync2(ACCOUNTS_DIR, { withFileTypes: true });
+  let fallback = null;
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const configPath = resolve3(ACCOUNTS_DIR, entry.name, "account.json");
+    if (!existsSync3(configPath)) continue;
+    const raw = readFileSync4(configPath, "utf-8");
+    let config;
+    try {
+      config = JSON.parse(raw);
+    } catch {
+      console.error(`[maxy] account.json is corrupt at ${configPath} \u2014 skipping`);
+      continue;
+    }
+    if (!config.adminModel || !config.publicModel) {
+      throw new Error(
+        `[maxy] account.json at ${configPath} is missing required model fields (adminModel / publicModel). Update account.json with valid model identifiers.`
+      );
+    }
+    const result = {
+      accountId: config.accountId,
+      accountDir: resolve3(ACCOUNTS_DIR, entry.name),
+      config
+    };
+    if (usersJsonUserId && config.admins?.some((a) => a.userId === usersJsonUserId)) {
+      return result;
+    }
+    if (!fallback) {
+      fallback = result;
+    }
+  }
+  if (usersJsonUserId && fallback) {
+    console.warn(
+      `[maxy] resolveAccount: no account matches users.json userId ${usersJsonUserId} \u2014 falling back to ${fallback.accountId}`
+    );
+  }
+  return fallback;
+}
+function readAgentFile(accountDir, agentName, filename) {
+  const filePath = resolve3(accountDir, "agents", agentName, filename);
+  if (!existsSync3(filePath)) return null;
+  const raw = readFileSync4(filePath, "utf-8");
+  if (filename.endsWith(".md")) {
+    return substituteBrandPlaceholders(raw, filePath);
+  }
+  return raw;
+}
+function readIdentity(accountDir, agentName) {
+  return readAgentFile(accountDir, agentName, "IDENTITY.md");
+}
+var RESERVED_SLUGS = /* @__PURE__ */ new Set(["admin", "api", "assets", "brand", "bot", "privacy"]);
+var SLUG_PATTERN = /^[a-z][a-z0-9-]{2,49}$/;
+function validateAgentSlug(slug) {
+  if (!SLUG_PATTERN.test(slug)) return false;
+  if (RESERVED_SLUGS.has(slug)) return false;
+  return true;
+}
+function resolveDefaultAgentSlug(accountDir) {
+  const configPath = resolve3(accountDir, "account.json");
+  if (!existsSync3(configPath)) {
+    console.error("[agent-resolve] account.json not found \u2014 cannot resolve defaultAgent");
+    return null;
+  }
+  let config;
+  try {
+    config = JSON.parse(readFileSync4(configPath, "utf-8"));
+  } catch (err) {
+    console.error("[agent-resolve] failed to read account.json:", err);
+    return null;
+  }
+  if (!config.defaultAgent) {
+    console.error("[agent-resolve] defaultAgent not configured in account.json \u2014 set it via the connect-whatsapp skill");
+    return null;
+  }
+  const agentConfigPath = resolve3(accountDir, "agents", config.defaultAgent, "config.json");
+  if (!existsSync3(agentConfigPath)) {
+    console.error(`[agent-resolve] defaultAgent="${config.defaultAgent}" has no config.json at ${agentConfigPath}`);
+    return null;
+  }
+  return config.defaultAgent;
+}
+function estimateTokens(text) {
+  return Math.ceil(text.length / 4);
+}
+function resolveAgentConfig(accountDir, agentName) {
+  let model = null;
+  let plugins = null;
+  let status = null;
+  let displayName = null;
+  let image = null;
+  let imageShape = null;
+  let showAgentName = false;
+  let liveMemory = false;
+  let knowledgeKeywords = null;
+  let accessMode = "open";
+  const MAX_KNOWLEDGE_KEYWORDS = 5;
+  const configRaw = readAgentFile(accountDir, agentName, "config.json");
+  if (configRaw) {
+    let parsed;
+    try {
+      parsed = JSON.parse(configRaw);
+    } catch {
+      console.warn(`[agent-config] ${agentName}/config.json: invalid JSON \u2014 using defaults`);
+      parsed = {};
+    }
+    model = typeof parsed.model === "string" ? parsed.model : null;
+    plugins = Array.isArray(parsed.plugins) ? parsed.plugins : null;
+    status = typeof parsed.status === "string" ? parsed.status : null;
+    displayName = typeof parsed.displayName === "string" ? parsed.displayName : null;
+    image = typeof parsed.image === "string" ? parsed.image : null;
+    if (typeof parsed.imageShape === "string" && ["circle", "rounded"].includes(parsed.imageShape)) {
+      imageShape = parsed.imageShape;
+    }
+    if (parsed.showAgentName === true) {
+      showAgentName = true;
+    } else if (parsed.showAgentName === "none") {
+      showAgentName = "none";
+    }
+    if (image || imageShape || showAgentName) {
+      console.log(`[agent-config] ${agentName}: image=${image || "(none)"} imageShape=${imageShape || "(none)"} showAgentName=${showAgentName}`);
+    }
+    if (typeof parsed.accessMode === "string" && ["gated", "paid"].includes(parsed.accessMode)) {
+      accessMode = parsed.accessMode;
+    }
+    if (typeof parsed.liveMemory === "boolean") {
+      liveMemory = parsed.liveMemory;
+    } else if (typeof parsed.liveMemory === "string") {
+      const lower = parsed.liveMemory.toLowerCase();
+      if (lower === "true") {
+        liveMemory = true;
+        console.warn(`[agent-config] ${agentName}: liveMemory is string "true" \u2014 coercing to boolean. Fix the config to use a boolean value.`);
+      } else if (lower === "false") {
+        liveMemory = false;
+        console.warn(`[agent-config] ${agentName}: liveMemory is string "false" \u2014 coercing to boolean. Fix the config to use a boolean value.`);
+      } else {
+        throw new Error(`[agent-config] ${agentName}: liveMemory has invalid string value "${parsed.liveMemory}" \u2014 expected boolean or "true"/"false"`);
+      }
+    } else if (parsed.liveMemory !== void 0 && parsed.liveMemory !== null) {
+      throw new Error(`[agent-config] ${agentName}: liveMemory has invalid type ${typeof parsed.liveMemory} \u2014 expected boolean or "true"/"false"`);
+    }
+    if (Array.isArray(parsed.knowledgeKeywords) && parsed.knowledgeKeywords.length > 0) {
+      const filtered = parsed.knowledgeKeywords.filter((k) => typeof k === "string" && k.trim()).map((k) => k.replace(/,/g, "").trim().toLowerCase()).filter(Boolean);
+      if (filtered.length > MAX_KNOWLEDGE_KEYWORDS) {
+        console.warn(`[agent-config] ${agentName}: knowledgeKeywords has ${filtered.length} entries \u2014 capping at ${MAX_KNOWLEDGE_KEYWORDS}`);
+      }
+      knowledgeKeywords = filtered.length > 0 ? filtered.slice(0, MAX_KNOWLEDGE_KEYWORDS) : null;
+    }
+  }
+  let knowledge = null;
+  let knowledgeBaked = false;
+  const agentDir = resolve3(accountDir, "agents", agentName);
+  const knowledgePath = resolve3(agentDir, "KNOWLEDGE.md");
+  const summaryPath = resolve3(agentDir, "KNOWLEDGE-SUMMARY.md");
+  const hasKnowledge = existsSync3(knowledgePath);
+  const hasSummary = existsSync3(summaryPath);
+  if (hasKnowledge && hasSummary) {
+    const knowledgeMtime = statSync2(knowledgePath).mtimeMs;
+    const summaryMtime = statSync2(summaryPath).mtimeMs;
+    if (summaryMtime >= knowledgeMtime) {
+      knowledge = readFileSync4(summaryPath, "utf-8");
+    } else {
+      console.warn(`[agent-config] ${agentName}: KNOWLEDGE-SUMMARY.md is stale (KNOWLEDGE.md is newer) \u2014 using full knowledge`);
+      knowledge = readFileSync4(knowledgePath, "utf-8");
+    }
+    knowledgeBaked = true;
+  } else if (hasKnowledge) {
+    knowledge = readFileSync4(knowledgePath, "utf-8");
+    knowledgeBaked = true;
+  }
+  let budget = null;
+  const identityRaw = readAgentFile(accountDir, agentName, "IDENTITY.md");
+  const soulRaw = readAgentFile(accountDir, agentName, "SOUL.md");
+  if (identityRaw || soulRaw || knowledge) {
+    const identityTokens = identityRaw ? estimateTokens(identityRaw) : 0;
+    const soulTokens = soulRaw ? estimateTokens(soulRaw) : 0;
+    const knowledgeTokens = knowledge ? estimateTokens(knowledge) : 0;
+    budget = {
+      identity: identityTokens,
+      soul: soulTokens,
+      knowledge: knowledgeTokens,
+      plugins: 0,
+      total: identityTokens + soulTokens + knowledgeTokens
+    };
+  }
+  return { model, plugins, status, displayName, image, imageShape, showAgentName, knowledge, knowledgeBaked, liveMemory, knowledgeKeywords, budget, accessMode };
+}
+function getDefaultAccountId() {
+  return resolveAccount()?.accountId ?? null;
+}
+function resolveUserAccounts(userId) {
+  if (!existsSync3(ACCOUNTS_DIR)) return [];
+  const results = [];
+  const entries = readdirSync2(ACCOUNTS_DIR, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const configPath = resolve3(ACCOUNTS_DIR, entry.name, "account.json");
+    if (!existsSync3(configPath)) continue;
+    let config;
+    try {
+      config = JSON.parse(readFileSync4(configPath, "utf-8"));
+    } catch {
+      console.error(`[session] account.json corrupt at ${configPath} \u2014 skipping`);
+      continue;
+    }
+    const adminEntry = config.admins?.find((a) => a.userId === userId);
+    if (adminEntry) {
+      results.push({
+        accountId: config.accountId,
+        accountDir: resolve3(ACCOUNTS_DIR, entry.name),
+        config,
+        role: adminEntry.role
+      });
+    }
+  }
+  return results;
+}
+
+// app/lib/claude-agent/neo4j-uri.ts
+import { resolve as resolve4 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { createConnection as netConnect2 } from "net";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
+var cachedBrandHostname = null;
+function readBrandHostname() {
+  if (cachedBrandHostname !== null) return cachedBrandHostname;
+  try {
+    const brandPath = resolve4(PLATFORM_ROOT3, "config", "brand.json");
+    const parsed = JSON.parse(readFileSync5(brandPath, "utf-8"));
+    cachedBrandHostname = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : "maxy";
+  } catch {
+    cachedBrandHostname = "maxy";
+  }
+  return cachedBrandHostname;
+}
+var DEFAULT_NEO4J_PORT = 7687;
+function parseBrandNeo4jPort(rawJson) {
+  if (rawJson === null) return DEFAULT_NEO4J_PORT;
+  try {
+    const parsed = JSON.parse(rawJson);
+    const n = parsed.neo4jPort;
+    return typeof n === "number" && Number.isInteger(n) && n > 0 && n <= 65535 ? n : DEFAULT_NEO4J_PORT;
+  } catch {
+    return DEFAULT_NEO4J_PORT;
+  }
+}
+var cachedBrandNeo4jPort = null;
+function readBrandNeo4jPort() {
+  if (cachedBrandNeo4jPort !== null) return cachedBrandNeo4jPort;
+  try {
+    const raw = readFileSync5(resolve4(PLATFORM_ROOT3, "config", "brand.json"), "utf-8");
+    cachedBrandNeo4jPort = parseBrandNeo4jPort(raw);
+  } catch (err) {
+    const code = err.code;
+    if (code !== "ENOENT") throw err;
+    cachedBrandNeo4jPort = DEFAULT_NEO4J_PORT;
+  }
+  return cachedBrandNeo4jPort;
+}
+var NEO4J_URI_SCHEMES = /* @__PURE__ */ new Set([
+  "bolt:",
+  "bolt+s:",
+  "bolt+ssc:",
+  "neo4j:",
+  "neo4j+s:",
+  "neo4j+ssc:"
+]);
+function extractNeo4jPort(uri) {
+  try {
+    const url = new URL(uri);
+    if (!NEO4J_URI_SCHEMES.has(url.protocol)) return null;
+    if (url.port === "") return null;
+    const n = Number(url.port);
+    return Number.isInteger(n) && n > 0 && n <= 65535 ? n : null;
+  } catch {
+    return null;
+  }
+}
+function validateNeo4jUri(uri, brandPort, envFilePath) {
+  if (!uri) {
+    throw new Error(
+      "NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687. Set NEO4J_URI in the gateway's env (systemd EnvironmentFile or shell .env)."
+    );
+  }
+  const safeUri = JSON.stringify(uri);
+  const uriPort = extractNeo4jPort(uri);
+  if (uriPort === null) {
+    throw new Error(
+      `NEO4J_URI=${safeUri} has no explicit port on a recognised Neo4j scheme; brand.json declares neo4jPort :${brandPort}. Edit ${envFilePath} NEO4J_URI or correct BRAND.neo4jPort.`
+    );
+  }
+  if (uriPort !== brandPort) {
+    throw new Error(
+      `NEO4J_URI=${safeUri} port :${uriPort} disagrees with brand.json neo4jPort :${brandPort}. Edit ${envFilePath} NEO4J_URI or correct BRAND.neo4jPort.`
+    );
+  }
+  return uri;
+}
+function decideNeo4jUri(uri, listeningPorts, brandPort, envFilePath) {
+  if (!uri) {
+    throw new Error(
+      "NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687. Set NEO4J_URI in the gateway's env (systemd EnvironmentFile or shell .env)."
+    );
+  }
+  const count = listeningPorts.size;
+  if (count === 0) {
+    const probedCsv = Array.from(listeningPorts).join(",");
+    throw new Error(
+      `NEO4J_URI=${JSON.stringify(uri)} \u2014 no Neo4j listening on [${probedCsv}]; start neo4j.service or neo4j-${readBrandHostname()}.service, or edit ${envFilePath} to name a port a Neo4j is bound to.`
+    );
+  }
+  if (count === 1) {
+    const uriPort = extractNeo4jPort(uri);
+    if (uriPort === null) {
+      throw new Error(
+        `NEO4J_URI=${JSON.stringify(uri)} has no explicit port on a recognised Neo4j scheme. Edit ${envFilePath} NEO4J_URI.`
+      );
+    }
+    const [listening] = listeningPorts;
+    if (uriPort !== listening) {
+      throw new Error(
+        `NEO4J_URI=${JSON.stringify(uri)} port :${uriPort} not listening; only :${listening} is live on this device. Edit ${envFilePath} to match, or start neo4j-${readBrandHostname()}.service.`
+      );
+    }
+    return uri;
+  }
+  return validateNeo4jUri(uri, brandPort, envFilePath);
+}
+async function detectListeningNeo4jPorts(ports, timeoutMs, host) {
+  if (ports.size === 0) return /* @__PURE__ */ new Set();
+  const probes = Array.from(ports).map(
+    (port) => new Promise((resolvePromise) => {
+      let settled = false;
+      const sock = netConnect2({ host, port, family: 0 });
+      const finish = (listening) => {
+        if (settled) return;
+        settled = true;
+        try {
+          sock.destroy();
+        } catch {
+        }
+        resolvePromise({ port, listening });
+      };
+      const timer = setTimeout(() => finish(false), timeoutMs);
+      sock.once("connect", () => {
+        clearTimeout(timer);
+        finish(true);
+      });
+      sock.once("error", () => {
+        clearTimeout(timer);
+        finish(false);
+      });
+    })
+  );
+  const results = await Promise.all(probes);
+  return new Set(results.filter((r) => r.listening).map((r) => r.port));
+}
+var cachedListeningPortsPromise = null;
+async function requireNeo4jUri() {
+  const envUri = process.env.NEO4J_URI;
+  const brandPort = readBrandNeo4jPort();
+  const envFilePath = resolve4(MAXY_DIR, ".env");
+  const candidates = /* @__PURE__ */ new Set([brandPort, DEFAULT_NEO4J_PORT]);
+  const uriPort = envUri ? extractNeo4jPort(envUri) : null;
+  if (uriPort !== null) candidates.add(uriPort);
+  if (cachedListeningPortsPromise === null) {
+    cachedListeningPortsPromise = (async () => {
+      let listening = await detectListeningNeo4jPorts(candidates, 250, "127.0.0.1");
+      if (listening.size === 0) {
+        listening = await detectListeningNeo4jPorts(candidates, 1e3, "127.0.0.1");
+      }
+      if (listening.size === 0) {
+        listening = await detectListeningNeo4jPorts(candidates, 1e3, "::1");
+      }
+      return listening;
+    })();
+  }
+  const listeningPorts = await cachedListeningPortsPromise;
+  const listeningCsv = Array.from(listeningPorts).sort((a, b) => a - b).join(",");
+  const mode = listeningPorts.size === 0 ? "none" : listeningPorts.size === 1 ? "single" : "co-tenant";
+  console.error(
+    `[neo4j-probe] listening=[${listeningCsv}] envPort=${uriPort ?? "unset"} brandPort=${brandPort} mode=${mode}`
+  );
+  return decideNeo4jUri(envUri, listeningPorts, brandPort, envFilePath);
+}
+
+// app/lib/claude-agent/plugin-manifest.ts
+import { resolve as resolve5, join as join3 } from "path";
+import {
+  readFileSync as readFileSync6,
+  writeFileSync,
+  readdirSync as readdirSync3,
+  existsSync as existsSync4,
+  mkdirSync as mkdirSync2,
+  statSync as statSync3,
+  cpSync,
+  rmSync
+} from "fs";
+import { spawn as spawn2 } from "child_process";
+
+// app/lib/specialist-domains-clause.ts
+var SPECIALIST_DOMAINS_ROUTING_CLAUSE = "Specialist subagents own these domains. Match user intent to a tool below and delegate to the specialist. Fall back to memory-search only when no tool here matches. ToolSearch is a last-resort escape hatch for tools not listed in any domain \u2014 not a routing mechanism; prefer admitting ignorance over discovering.";
+
+// app/lib/claude-agent/plugin-manifest.ts
+function isMissingPluginDir(pluginDir) {
+  if (parsePluginFrontmatter(pluginDir)) return false;
+  const mcpEntry = resolve5(PLATFORM_ROOT2, "plugins", pluginDir, "mcp/dist/index.js");
+  return !existsSync4(mcpEntry);
+}
+function findMissingPlugins(enabledPlugins) {
+  if (!Array.isArray(enabledPlugins) || enabledPlugins.length === 0) return [];
+  return enabledPlugins.filter(isMissingPluginDir);
+}
+function parsePluginFrontmatter(pluginDir) {
+  const pluginPath = resolve5(PLATFORM_ROOT2, "plugins", pluginDir, "PLUGIN.md");
+  if (!existsSync4(pluginPath)) return null;
+  let raw;
+  try {
+    raw = readFileSync6(pluginPath, "utf-8");
+  } catch {
+    console.warn(`[plugins] cannot read ${pluginPath}`);
+    return null;
+  }
+  const fmMatch = raw.match(/^---\n([\s\S]*?)\n---/);
+  if (!fmMatch) return null;
+  const fm = fmMatch[1];
+  const nameMatch = fm.match(/^name:\s*(.+)$/m);
+  const descRaw = fm.match(/^description:\s*(.+)$/m)?.[1]?.trim() ?? "";
+  const description = descRaw.replace(/^"(.*)"$/, "$1");
+  const fmLines = fm.split("\n");
+  function parseYamlList(fieldName) {
+    const items = [];
+    let inside = false;
+    for (const line of fmLines) {
+      if (new RegExp(`^${fieldName}:`).test(line)) {
+        if (new RegExp(`^${fieldName}:\\s*\\[]`).test(line)) break;
+        inside = true;
+        continue;
+      }
+      if (inside) {
+        const m = line.match(/^  - (.+)/);
+        if (m) {
+          items.push(m[1].trim());
+        } else {
+          break;
+        }
+      }
+    }
+    return items;
+  }
+  const tools = parseYamlList("tools");
+  const hidden = parseYamlList("hidden");
+  const requires = parseYamlList("requires");
+  let platform = {};
+  const metaMatch = fm.match(/^metadata:\s*(.+)$/m);
+  if (metaMatch) {
+    try {
+      const metadata = JSON.parse(metaMatch[1]);
+      if (metadata.platform && typeof metadata.platform === "object") {
+        platform = metadata.platform;
+      }
+    } catch {
+      console.warn(`[plugins] ${pluginDir}/PLUGIN.md: invalid metadata JSON`);
+    }
+  }
+  return { name: nameMatch?.[1]?.trim() ?? pluginDir, description, tools, hidden, requires, platform };
+}
+function readBundleSubPlugins(bundlePath) {
+  if (!existsSync4(bundlePath)) return [];
+  let raw;
+  try {
+    raw = readFileSync6(bundlePath, "utf-8");
+  } catch {
+    return [];
+  }
+  const fm = raw.match(/^---\n([\s\S]*?)\n---/);
+  if (!fm) return [];
+  const subs = [];
+  let inPlugins = false;
+  for (const line of fm[1].split("\n")) {
+    if (/^plugins:/.test(line)) {
+      inPlugins = true;
+      continue;
+    }
+    if (inPlugins) {
+      const m = line.match(/^\s+- (.+)/);
+      if (m) subs.push(m[1].trim());
+      else break;
+    }
+  }
+  return subs;
+}
+function walkPremiumBundles() {
+  if (BRAND_NAME === "maxy") return [];
+  const stagingRoot = resolve5(PLATFORM_ROOT2, "../premium-plugins");
+  if (!existsSync4(stagingRoot)) return [];
+  let entries;
+  try {
+    entries = readdirSync3(stagingRoot);
+  } catch {
+    return [];
+  }
+  const result = [];
+  for (const bundle of entries) {
+    const bundleDir = resolve5(stagingRoot, bundle);
+    try {
+      if (!statSync3(bundleDir).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    const declared = readBundleSubPlugins(join3(bundleDir, "BUNDLE.md"));
+    result.push({ bundle, subs: declared.length > 0 ? declared : [bundle] });
+  }
+  return result;
+}
+function autoDeliverPremiumPlugins() {
+  const TAG = "[premium-auto-deliver]";
+  const bundles = walkPremiumBundles();
+  if (bundles.length === 0) return;
+  const stagingRoot = resolve5(PLATFORM_ROOT2, "../premium-plugins");
+  const pluginsDir = resolve5(PLATFORM_ROOT2, "plugins");
+  for (const { bundle, subs } of bundles) {
+    const stagingDir = resolve5(stagingRoot, bundle);
+    const bundlePath = join3(stagingDir, "BUNDLE.md");
+    const isBundle = existsSync4(bundlePath);
+    if (isBundle) {
+      let delivered = 0;
+      let skipped = 0;
+      for (const sub of subs) {
+        const target = resolve5(pluginsDir, sub);
+        if (existsSync4(resolve5(target, "PLUGIN.md"))) {
+          skipped++;
+          continue;
+        }
+        const source = resolve5(stagingDir, "plugins", sub);
+        if (!existsSync4(source)) {
+          console.log(`${TAG} ${bundle}/${sub}: source missing in staging \u2014 skipping`);
+          continue;
+        }
+        try {
+          cpSync(source, target, { recursive: true });
+          delivered++;
+        } catch (err) {
+          console.log(`${TAG} ${bundle}/${sub}: copy failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      console.log(`${TAG} ${bundle} (bundle): ${delivered} delivered, ${skipped} already present`);
+    } else {
+      const target = resolve5(pluginsDir, bundle);
+      if (existsSync4(resolve5(target, "PLUGIN.md"))) {
+        console.log(`${TAG} ${bundle}: already present \u2014 skipping`);
+      } else {
+        try {
+          cpSync(stagingDir, target, { recursive: true });
+          console.log(`${TAG} ${bundle} (standalone): delivered`);
+        } catch (err) {
+          console.log(`${TAG} ${bundle}: copy failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+    }
+  }
+}
+function reconcileEnabledPlugins(accountDir, config) {
+  const TAG = "[premium-auto-deliver]";
+  if (!accountDir || !config) return;
+  const bundles = walkPremiumBundles();
+  const pluginsDir = resolve5(PLATFORM_ROOT2, "plugins");
+  const bundleNames = [];
+  const allSubs = [];
+  for (const { bundle, subs } of bundles) {
+    bundleNames.push(bundle);
+    for (const sub of subs) {
+      if (!existsSync4(resolve5(pluginsDir, sub, "PLUGIN.md"))) continue;
+      allSubs.push(sub);
+    }
+  }
+  const current = Array.isArray(config.enabledPlugins) ? config.enabledPlugins : [];
+  const currentSet = new Set(current);
+  const added = [];
+  for (const sub of allSubs) {
+    if (currentSet.has(sub)) continue;
+    currentSet.add(sub);
+    added.push(sub);
+  }
+  console.log(`${TAG} brand=${BRAND_NAME} bundles=[${bundleNames.join(",")}] subs=[${allSubs.join(",")}] stamped=${added.length}`);
+  if (added.length === 0) return;
+  const merged = [...currentSet];
+  const configPath = resolve5(accountDir, "account.json");
+  try {
+    const raw = readFileSync6(configPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    parsed.enabledPlugins = merged;
+    writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n");
+    config.enabledPlugins = merged;
+  } catch (err) {
+    console.error(`${TAG} enabled-stamp write failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+var USER_MIRROR_MARKER = ".user-mirror";
+function autoDeliverUserPlugins(accountDir) {
+  const TAG = "[user-plugins-deliver]";
+  const userPluginsDir = resolve5(accountDir, "plugins");
+  if (!existsSync4(userPluginsDir)) return;
+  const pluginsDir = resolve5(PLATFORM_ROOT2, "plugins");
+  let entries;
+  try {
+    entries = readdirSync3(userPluginsDir);
+  } catch (err) {
+    console.log(`${TAG} accountDir=${accountDir} read-failed reason=${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
+  let mirrored = 0;
+  let skipped = 0;
+  for (const pluginName of entries) {
+    const source = resolve5(userPluginsDir, pluginName);
+    const sourcePluginMd = resolve5(source, "PLUGIN.md");
+    if (!existsSync4(sourcePluginMd)) continue;
+    const sourceMarker = resolve5(source, USER_MIRROR_MARKER);
+    if (!existsSync4(sourceMarker)) {
+      try {
+        writeFileSync(sourceMarker, `pluginName=${pluginName}
+source=${source}
+`);
+        console.log(`${TAG} ${pluginName}: canonical missing marker \u2014 stamped`);
+      } catch (err) {
+        console.error(`${TAG} ${pluginName}: marker stamp failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+    const target = resolve5(pluginsDir, pluginName);
+    const targetMarker = resolve5(target, USER_MIRROR_MARKER);
+    if (existsSync4(target) && !existsSync4(targetMarker)) {
+      console.log(`${TAG} ${pluginName}: shipped plugin owns this name \u2014 skipping user mirror`);
+      skipped++;
+      continue;
+    }
+    try {
+      cpSync(source, target, { recursive: true, force: true });
+      mirrored++;
+    } catch (err) {
+      console.error(`${TAG} ${pluginName}: copy failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+  console.log(`${TAG} accountDir=${accountDir} mirrored=${mirrored} skipped=${skipped}`);
+}
+var PLUGIN_RENAMES = {
+  "real-agency-loop": "loop",
+  "real-agency-sales": "estate-sales",
+  "real-agency-vendors": "vendors",
+  "real-agency-buyers": "buyers",
+  "real-agency-listings": "listings",
+  "real-agency-leads": "leads",
+  "real-agency-coaching": "estate-coaching",
+  "real-agency-business": "estate-business",
+  "real-agency-onboarding": "estate-onboarding",
+  "real-agency-teaching": "estate-teaching"
+};
+function migratePluginRenames(accountDir, config) {
+  if (!Array.isArray(config.enabledPlugins) || config.enabledPlugins.length === 0) return;
+  const TAG = "[plugin-rename-migrate]";
+  let changed = false;
+  const migrated = config.enabledPlugins.map((name) => {
+    const newName = PLUGIN_RENAMES[name];
+    if (newName) {
+      console.log(`${TAG} ${name} \u2192 ${newName}`);
+      changed = true;
+      return newName;
+    }
+    return name;
+  });
+  if (!changed) return;
+  const configPath = resolve5(accountDir, "account.json");
+  try {
+    const raw = readFileSync6(configPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    parsed.enabledPlugins = migrated;
+    writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n");
+    config.enabledPlugins = migrated;
+    console.log(`${TAG} account.json updated (${migrated.length} plugins)`);
+  } catch (err) {
+    console.error(`${TAG} failed to update account.json \u2014 ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const pluginsDir = resolve5(PLATFORM_ROOT2, "plugins");
+  for (const oldName of Object.keys(PLUGIN_RENAMES)) {
+    const orphan = resolve5(pluginsDir, oldName);
+    if (!existsSync4(orphan)) continue;
+    try {
+      rmSync(orphan, { recursive: true });
+      console.log(`${TAG} removed orphan: ${oldName}`);
+    } catch (err) {
+      console.log(`${TAG} orphan removal failed: ${oldName} \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+function autoDeliverBundleAgents(accountDir) {
+  const TAG = "[bundle-agent-deliver]";
+  const bundles = walkPremiumBundles();
+  if (bundles.length === 0) return;
+  const stagingRoot = resolve5(PLATFORM_ROOT2, "../premium-plugins");
+  const specialistsDir = resolve5(accountDir, "specialists", "agents");
+  if (!existsSync4(specialistsDir)) mkdirSync2(specialistsDir, { recursive: true });
+  const agentsmdPath = resolve5(accountDir, "agents", "admin", "AGENTS.md");
+  let agentsmd = "";
+  try {
+    agentsmd = existsSync4(agentsmdPath) ? readFileSync6(agentsmdPath, "utf-8") : "";
+  } catch {
+  }
+  let delivered = 0;
+  for (const { bundle } of bundles) {
+    const bundleAgentsDir = resolve5(stagingRoot, bundle, "agents");
+    if (!existsSync4(bundleAgentsDir)) continue;
+    let entries;
+    try {
+      entries = readdirSync3(bundleAgentsDir).filter((f) => f.endsWith(".md"));
+    } catch {
+      continue;
+    }
+    for (const filename of entries) {
+      const target = resolve5(specialistsDir, filename);
+      if (existsSync4(target)) continue;
+      const source = resolve5(bundleAgentsDir, filename);
+      try {
+        cpSync(source, target);
+      } catch (err) {
+        console.log(`${TAG} copy failed: ${filename} \u2014 ${err instanceof Error ? err.message : String(err)}`);
+        continue;
+      }
+      try {
+        const content = readFileSync6(target, "utf-8");
+        const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
+        if (fmMatch) {
+          const nameMatch = fmMatch[1].match(/^name:\s*(.+)/m);
+          const descMatch = fmMatch[1].match(/^description:\s*"?([^"\n]+)"?/m);
+          if (nameMatch && descMatch) {
+            const agentName = nameMatch[1].trim();
+            const agentDesc = descMatch[1].trim();
+            if (!agentsmd.includes(`specialists:${agentName}`)) agentsmd += `- **specialists:${agentName}**: ${agentDesc}
+`;
+          }
+        }
+      } catch {
+        console.log(`${TAG} ${filename}: delivered but frontmatter parse failed`);
+      }
+      delivered++;
+      console.log(`${TAG} ${filename}: delivered`);
+    }
+  }
+  if (delivered > 0) {
+    try {
+      writeFileSync(agentsmdPath, agentsmd);
+      console.log(`${TAG} AGENTS.md updated (${delivered} agents added)`);
+    } catch (err) {
+      console.error(`${TAG} AGENTS.md update failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+function assemblePublicPluginContent(pluginDir) {
+  const pluginRoot = resolve5(PLATFORM_ROOT2, "plugins", pluginDir);
+  const pluginPath = resolve5(pluginRoot, "PLUGIN.md");
+  let raw;
+  try {
+    raw = readFileSync6(pluginPath, "utf-8");
+  } catch {
+    return null;
+  }
+  const pluginBodyRaw = raw.replace(/^---\n[\s\S]*?\n---\n*/, "").trim();
+  if (!pluginBodyRaw) return null;
+  const pluginBody = substituteBrandPlaceholders(pluginBodyRaw, pluginPath);
+  const parts = [pluginBody];
+  let skillCount = 0;
+  let refCount = 0;
+  const skillsDir = resolve5(pluginRoot, "skills");
+  let skillDirs;
+  try {
+    skillDirs = readdirSync3(skillsDir).sort();
+  } catch {
+    return { body: pluginBody, skillCount: 0, refCount: 0 };
+  }
+  for (const skillName of skillDirs) {
+    const skillDir = resolve5(skillsDir, skillName);
+    let skillRaw;
+    try {
+      skillRaw = readFileSync6(resolve5(skillDir, "SKILL.md"), "utf-8");
+    } catch {
+      continue;
+    }
+    const fmMatch = skillRaw.match(/^---\n([\s\S]*?)\n---/);
+    let publicEmbed = true;
+    const publicExcludeReferences = [];
+    if (fmMatch) {
+      const fm = fmMatch[1];
+      const embedMatch = fm.match(/^publicEmbed:\s*(.+)$/m);
+      if (embedMatch && embedMatch[1].trim() === "false") publicEmbed = false;
+      let insideExclude = false;
+      for (const line of fm.split("\n")) {
+        if (/^publicExcludeReferences:/.test(line)) {
+          if (/^publicExcludeReferences:\s*\[]/.test(line)) break;
+          insideExclude = true;
+          continue;
+        }
+        if (insideExclude) {
+          const m = line.match(/^  - (.+)/);
+          if (m) {
+            publicExcludeReferences.push(m[1].trim());
+          } else {
+            break;
+          }
+        }
+      }
+    }
+    if (!publicEmbed) {
+      console.log(`[plugins] ${pluginDir}/skills/${skillName}: publicEmbed=false \u2014 skipping for public`);
+      continue;
+    }
+    const skillBodyRaw = skillRaw.replace(/^---\n[\s\S]*?\n---\n*/, "").trim();
+    if (!skillBodyRaw) continue;
+    const skillPath = resolve5(skillDir, "SKILL.md");
+    const skillBody = substituteBrandPlaceholders(skillBodyRaw, skillPath);
+    parts.push(`
+<!-- skill: ${skillName} -->`);
+    parts.push(skillBody);
+    const refsDir = resolve5(skillDir, "references");
+    let refFiles;
+    try {
+      refFiles = readdirSync3(refsDir).filter((f) => f.endsWith(".md")).filter((f) => !publicExcludeReferences.includes(f)).sort();
+    } catch {
+      parts.push(`<!-- /skill: ${skillName} -->`);
+      skillCount++;
+      continue;
+    }
+    for (const refFile of refFiles) {
+      try {
+        const refPath = resolve5(refsDir, refFile);
+        const refRaw = readFileSync6(refPath, "utf-8").trim();
+        if (refRaw) {
+          const refContent = substituteBrandPlaceholders(refRaw, refPath);
+          parts.push(`
+<!-- reference: ${refFile} -->`);
+          parts.push(refContent);
+          parts.push(`<!-- /reference: ${refFile} -->`);
+          refCount++;
+        }
+      } catch {
+        console.warn(`[plugins] ${pluginDir}/skills/${skillName}/references/${refFile}: unreadable \u2014 skipping`);
+      }
+    }
+    parts.push(`<!-- /skill: ${skillName} -->`);
+    skillCount++;
+  }
+  return { body: parts.join("\n"), skillCount, refCount };
+}
+function loadEmbeddedPlugins(agentType, selectedPlugins, enabledPlugins) {
+  const pluginsDir = resolve5(PLATFORM_ROOT2, "plugins");
+  let dirs;
+  try {
+    dirs = readdirSync3(pluginsDir);
+  } catch {
+    console.warn(`[plugins] cannot read plugins directory: ${pluginsDir}`);
+    return [];
+  }
+  const results = [];
+  for (const dir of dirs) {
+    const parsed = parsePluginFrontmatter(dir);
+    if (!parsed) continue;
+    const { platform } = parsed;
+    const embed = platform.embed;
+    if (!Array.isArray(embed) || !embed.includes(agentType)) {
+      if (typeof embed === "boolean") {
+        console.warn(`[plugins] ${dir}/PLUGIN.md: embed must be an array of agent types, got boolean \u2014 skipping`);
+      } else {
+        console.log(`[plugins] ${dir}: no embed for agentType=${agentType} (embed=${JSON.stringify(embed)}) \u2014 skipping`);
+      }
+      continue;
+    }
+    if (platform.optional) {
+      const enabled = Array.isArray(enabledPlugins) ? enabledPlugins : [];
+      if (!enabled.includes(dir)) {
+        console.log(`[plugins] ${dir}: optional plugin not enabled \u2014 skipping embed`);
+        continue;
+      }
+    }
+    if (parsed.requires.length > 0) {
+      const enabled = Array.isArray(enabledPlugins) ? enabledPlugins : [];
+      const missing = parsed.requires.filter((req) => {
+        if (enabled.includes(req)) return false;
+        const reqParsed = parsePluginFrontmatter(req);
+        return !(reqParsed && !reqParsed.platform.optional);
+      });
+      if (missing.length > 0) {
+        console.warn(`[plugins] ${dir}: requires [${missing.join(", ")}] but they are not enabled \u2014 skipping`);
+        continue;
+      }
+    }
+    if (selectedPlugins && !selectedPlugins.includes(dir)) {
+      console.log(`[plugins] ${dir}: not in selectedPlugins for agentType=${agentType} \u2014 skipping`);
+      continue;
+    }
+    if (agentType === "public") {
+      const assembled = assemblePublicPluginContent(dir);
+      if (assembled) {
+        results.push({ name: dir, chars: assembled.body.length, body: assembled.body });
+        console.log(`[plugins] loaded ${dir} for public (${assembled.body.length} chars, ${assembled.skillCount} skills, ${assembled.refCount} refs)`);
+      }
+    } else {
+      const pluginPath = resolve5(pluginsDir, dir, "PLUGIN.md");
+      let raw;
+      try {
+        raw = readFileSync6(pluginPath, "utf-8");
+      } catch (err) {
+        console.warn(`[plugins] ${dir}: failed to read PLUGIN.md for ${agentType} embed: ${String(err)}`);
+        continue;
+      }
+      const bodyRaw = raw.replace(/^---\n[\s\S]*?\n---\n*/, "").trim();
+      const body = bodyRaw ? substituteBrandPlaceholders(bodyRaw, pluginPath) : "";
+      if (body) {
+        results.push({ name: dir, chars: body.length, body });
+        console.log(`[plugins] loaded ${dir} for ${agentType} (${body.length} chars)`);
+      }
+    }
+  }
+  if (results.length === 0) {
+    console.log(`[plugins] no embedded plugins for agentType=${agentType}`);
+  } else if (agentType === "public") {
+    const totalChars = results.reduce((sum, r) => sum + r.chars, 0);
+    console.log(`[plugins] total embedded for public: ${totalChars} chars across ${results.length} plugins`);
+  }
+  return results;
+}
+var mcpToolsCache = /* @__PURE__ */ new Map();
+function fetchMcpToolsList(pluginDir) {
+  const cached = mcpToolsCache.get(pluginDir);
+  if (cached) return Promise.resolve(cached);
+  const serverPath = resolve5(PLATFORM_ROOT2, "plugins", pluginDir, "mcp/dist/index.js");
+  if (!existsSync4(serverPath)) return Promise.resolve([]);
+  const startMs = Date.now();
+  console.error(`[spawn-env] STREAM_LOG_PATH=unset site=toolslist pluginDir=${pluginDir} reason=discovery-no-conversation`);
+  return new Promise((resolvePromise) => {
+    const proc = spawn2(process.execPath, [serverPath], {
+      env: { ...process.env, PLATFORM_ROOT: PLATFORM_ROOT2, ACCOUNT_ID: "__toolslist__", PLATFORM_PORT: process.env.PORT ?? "19200" }
+    });
+    let buffer = "";
+    let stderrBuf = "";
+    let settled = false;
+    const TOOLS_LIST_ID = 2;
+    const settle = (tools, reason) => {
+      if (settled) return;
+      settled = true;
+      proc.kill();
+      const elapsed = Date.now() - startMs;
+      if (tools.length > 0) {
+        mcpToolsCache.set(pluginDir, tools);
+        console.error(`[plugin-manifest] ${pluginDir}: ${tools.length} tools via MCP (${elapsed}ms)`);
+      } else {
+        console.error(`[plugin-manifest] ${pluginDir}: tools/list failed (${reason}) (${elapsed}ms)${stderrBuf ? ` stderr: ${stderrBuf.slice(0, 300)}` : ""}`);
+      }
+      resolvePromise(tools);
+    };
+    proc.stdout.on("data", (chunk) => {
+      buffer += chunk.toString();
+      const lines = buffer.split("\n");
+      buffer = lines.pop() ?? "";
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        let msg;
+        try {
+          msg = JSON.parse(line);
+        } catch {
+          continue;
+        }
+        if (msg.id === 1) {
+          proc.stdin.write(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\n");
+          proc.stdin.write(JSON.stringify({ jsonrpc: "2.0", id: TOOLS_LIST_ID, method: "tools/list", params: {} }) + "\n");
+        } else if (msg.id === TOOLS_LIST_ID) {
+          const result = msg.result;
+          const rawTools = result?.tools;
+          if (Array.isArray(rawTools)) {
+            const tools = rawTools.filter((t) => typeof t.name === "string" && t.name.length > 0).map((t) => ({ name: t.name, description: typeof t.description === "string" ? t.description : "" }));
+            settle(tools, "success");
+          } else {
+            settle([], "no tools array in response");
+          }
+        }
+      }
+    });
+    proc.stderr.on("data", (chunk) => {
+      stderrBuf += chunk.toString();
+    });
+    proc.on("error", (err) => settle([], `spawn error: ${err.message}`));
+    proc.on("close", (code) => {
+      if (!settled) settle([], `process exited with code ${code}`);
+    });
+    proc.stdin.write(JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: { protocolVersion: "2024-11-05", capabilities: {}, clientInfo: { name: "maxy-manifest", version: "1.0" } }
+    }) + "\n");
+    setTimeout(() => settle([], "timeout (5s)"), 5e3);
+  });
+}
+var SPECIALIST_PLUGIN_DOMAINS = {
+  scheduling: ["personal-assistant"],
+  cloudflare: ["personal-assistant"],
+  telegram: ["personal-assistant"],
+  whatsapp: ["personal-assistant"],
+  anthropic: ["personal-assistant"],
+  email: ["personal-assistant"],
+  contacts: ["personal-assistant"],
+  tasks: ["project-manager"],
+  projects: ["project-manager"],
+  workflows: ["project-manager"],
+  waitlist: ["project-manager"],
+  "deep-research": ["research-assistant"],
+  replicate: ["research-assistant", "content-producer"],
+  loop: ["negotiator", "valuer"]
+};
+async function buildPluginManifest(enabledPlugins) {
+  const pluginsDir = resolve5(PLATFORM_ROOT2, "plugins");
+  let dirs;
+  try {
+    dirs = readdirSync3(pluginsDir);
+  } catch {
+    return "";
+  }
+  const enabled = Array.isArray(enabledPlugins) ? enabledPlugins : [];
+  const activePlugins = [];
+  for (const dir of dirs.sort()) {
+    const parsed = parsePluginFrontmatter(dir);
+    if (!parsed) continue;
+    if (parsed.platform.optional && !enabled.includes(dir)) continue;
+    if (parsed.requires.length > 0) {
+      const missing = parsed.requires.filter((req) => {
+        if (enabled.includes(req)) return false;
+        const reqParsed = parsePluginFrontmatter(req);
+        return !reqParsed || !!reqParsed.platform.optional;
+      });
+      if (missing.length > 0) continue;
+    }
+    activePlugins.push({ dir, parsed });
+  }
+  const specialistPlugins = [];
+  const adminPlugins = [];
+  for (const { dir, parsed } of activePlugins) {
+    const specialists = SPECIALIST_PLUGIN_DOMAINS[dir];
+    if (specialists) {
+      specialistPlugins.push({ dir, parsed, specialists });
+    } else {
+      adminPlugins.push({ dir, parsed });
+    }
+  }
+  const [adminMcpResults, specialistMcpResults] = await Promise.all([
+    Promise.all(adminPlugins.map(({ dir }) => fetchMcpToolsList(dir))),
+    Promise.all(specialistPlugins.map(({ dir }) => fetchMcpToolsList(dir)))
+  ]);
+  const lines = ["<plugin-manifest>"];
+  lines.push('\nPlugin skills and references live in the bundled npm package, not on disk under `<accountDir>/agents/admin/plugins/`. Load skills with `mcp__admin__skill-load skillName="<name>"` and references with `mcp__admin__plugin-read`. `Read`/`Glob`/`Bash` against these paths will fail.');
+  let totalTools = 0;
+  let mcpSourced = 0;
+  let fallbackSourced = 0;
+  let noServer = 0;
+  const specialistGroups = /* @__PURE__ */ new Map();
+  for (const { dir, specialists } of specialistPlugins) {
+    for (const specialist of specialists) {
+      const existing = specialistGroups.get(specialist) ?? [];
+      existing.push(dir);
+      specialistGroups.set(specialist, existing);
+    }
+  }
+  const specialistToolDetails = /* @__PURE__ */ new Map();
+  let specialistMcpCount = 0;
+  for (let i = 0; i < specialistPlugins.length; i++) {
+    const { dir, parsed } = specialistPlugins[i];
+    const mcpTools = specialistMcpResults[i];
+    if (mcpTools.length > 0) {
+      specialistMcpCount++;
+      const hiddenSet = new Set(parsed.hidden);
+      const visibleTools = mcpTools.filter((t) => !hiddenSet.has(t.name));
+      totalTools += visibleTools.length;
+      if (visibleTools.length > 0) {
+        const desc = parsed.description ? parsed.description.split(/\.\s/)[0].replace(/\.$/, "") : "";
+        specialistToolDetails.set(dir, { desc, tools: visibleTools });
+      }
+    }
+  }
+  if (specialistGroups.size > 0) {
+    lines.push("\n<specialist-domains>");
+    lines.push(SPECIALIST_DOMAINS_ROUTING_CLAUSE);
+    for (const [specialist, plugins] of specialistGroups) {
+      lines.push(`
+specialists:${specialist}: ${plugins.join(", ")}`);
+      for (const plugin of plugins) {
+        const details = specialistToolDetails.get(plugin);
+        if (!details) continue;
+        for (const tool of details.tools) {
+          const toolDesc = tool.description ? tool.description.split(/\.\s/)[0].replace(/\.$/, "") : "";
+          if (!toolDesc) {
+            console.error(`[plugin-manifest] WARN: specialist tool missing description plugin=${plugin} tool=${tool.name}`);
+          }
+          lines.push(toolDesc ? `  ${tool.name} \u2014 ${toolDesc}` : `  ${tool.name}`);
+        }
+      }
+    }
+    lines.push("</specialist-domains>");
+  }
+  for (let j = 0; j < adminPlugins.length; j++) {
+    const { dir, parsed } = adminPlugins[j];
+    const mcpTools = adminMcpResults[j];
+    const pluginRoot = resolve5(pluginsDir, dir);
+    const skills = [];
+    const references = [];
+    const scanDir = (base, prefix, target) => {
+      const scanPath = resolve5(pluginRoot, base);
+      if (!existsSync4(scanPath)) return;
+      try {
+        const walk = (current, rel) => {
+          for (const entry of readdirSync3(current)) {
+            const full = resolve5(current, entry);
+            try {
+              const stat = statSync3(full);
+              if (stat.isDirectory()) walk(full, `${rel}${entry}/`);
+              else if (entry.endsWith(".md")) target.push(`${prefix}${rel}${entry}`);
+            } catch {
+            }
+          }
+        };
+        walk(scanPath, "");
+      } catch {
+      }
+    };
+    scanDir("skills", "skills/", skills);
+    scanDir("references", "references/", references);
+    const hiddenSet = new Set(parsed.hidden);
+    let toolLines = [];
+    if (mcpTools.length > 0) {
+      mcpSourced++;
+      for (const tool of mcpTools) {
+        if (hiddenSet.has(tool.name)) continue;
+        const desc = tool.description ? tool.description.split(/\.\s/)[0].replace(/\.$/, "") : "";
+        toolLines.push(desc ? `  ${tool.name} \u2014 ${desc}` : `  ${tool.name}`);
+      }
+    } else if (parsed.tools.length > 0) {
+      const serverPath = resolve5(PLATFORM_ROOT2, "plugins", dir, "mcp/dist/index.js");
+      if (existsSync4(serverPath)) {
+        fallbackSourced++;
+        console.error(`[plugin-manifest] ${dir}: tools/list empty \u2014 fallback to frontmatter (${parsed.tools.length} tools)`);
+      }
+      for (const name of parsed.tools) {
+        if (hiddenSet.has(name)) continue;
+        toolLines.push(`  ${name}`);
+      }
+    } else {
+      noServer++;
+    }
+    totalTools += toolLines.length;
+    lines.push(`
+## ${dir}`);
+    if (parsed.description) lines.push(parsed.description);
+    if (toolLines.length > 0) lines.push(`Tools:
+${toolLines.join("\n")}`);
+    if (skills.length > 0) {
+      const skillNames = skills.map((s) => s.match(/^skills\/([a-z0-9][a-z0-9-]*)\/SKILL\.md$/)?.[1]).filter((s) => s !== void 0 && s.length > 0);
+      if (skillNames.length > 0) lines.push(`Skills (load via mcp__admin__skill-load with skillName="<name>"): ${skillNames.join(", ")}`);
+    }
+    if (references.length > 0) lines.push(`References (load via mcp__admin__plugin-read with pluginName="${dir}" file="<path>"): ${references.join(", ")}`);
+  }
+  lines.push("\n</plugin-manifest>");
+  console.error(`[plugin-manifest] doctrine-line=present`);
+  console.error(`[plugin-manifest] plugins=${activePlugins.length} (specialist=${specialistPlugins.length} admin=${adminPlugins.length}) tools=${totalTools} (mcp=${mcpSourced + specialistMcpCount} fallback=${fallbackSourced} no-server=${noServer})`);
+  const dormantLines = [];
+  for (const dir of dirs.sort()) {
+    const parsed = parsePluginFrontmatter(dir);
+    if (!parsed) continue;
+    if (!parsed.platform.optional) continue;
+    if (enabled.includes(dir)) continue;
+    if (parsed.platform.always) continue;
+    let entry = `${dir} \u2014 ${parsed.description}`;
+    if (parsed.tools.length > 0) entry += `
+  tools: ${parsed.tools.join(", ")}`;
+    dormantLines.push(entry);
+  }
+  if (dormantLines.length > 0) {
+    lines.push("");
+    lines.push("<dormant-plugins>");
+    lines.push("These plugins are available but not activated. When the user describes a task that one of these plugins handles, mention the capability and offer to activate it. Do not prompt unprompted \u2014 only nudge when the user's intent aligns with a dormant plugin's purpose. If you have already suggested this plugin earlier in the conversation, do not suggest it again.");
+    lines.push("");
+    lines.push(dormantLines.join("\n\n"));
+    lines.push("</dormant-plugins>");
+  }
+  return lines.join("\n");
+}
+function validateComponentData(componentName, data) {
+  if (componentName !== "single-select" && componentName !== "multi-select") return null;
+  const options = data?.options;
+  if (!Array.isArray(options)) return `${componentName}: "options" must be an array, got ${typeof options}`;
+  if (options.length === 0) return `${componentName}: "options" array is empty \u2014 at least one option required`;
+  for (let i = 0; i < options.length; i++) {
+    const opt = options[i];
+    if (!opt || typeof opt !== "object") return `${componentName}: options[${i}] is not an object`;
+    if (typeof opt.label !== "string" || opt.label.trim() === "") return `${componentName}: options[${i}] missing non-empty "label"`;
+    if (typeof opt.value !== "string" || opt.value.trim() === "") return `${componentName}: options[${i}] missing non-empty "value"`;
+  }
+  return null;
+}
+
+// app/lib/claude-agent/spawn-env.ts
+function streamLogPathFor(accountId, logKey) {
+  const logDir = resolve6(ACCOUNTS_DIR, accountId, "logs");
+  const streamLogPath = resolve6(logDir, `claude-agent-stream-${logKey}.log`);
+  return { logDir, streamLogPath };
+}
+function buildSpawnEnv(accountId, accountDir, sessionKey) {
+  if (!sessionKey) {
+    throw new Error(`buildSpawnEnv: sessionKey is required (accountId=${accountId.slice(0, 8)})`);
+  }
+  const { logDir, streamLogPath } = streamLogPathFor(accountId, sessionKey);
+  return {
+    ...process.env,
+    PLATFORM_ROOT: PLATFORM_ROOT2,
+    ACCOUNT_DIR: accountDir,
+    ACCOUNT_ID: accountId,
+    LOG_DIR: logDir,
+    STREAM_LOG_PATH: streamLogPath
+  };
+}
+var _claudeBinaryPath;
+function resolveClaudeBinary() {
+  if (_claudeBinaryPath !== void 0) return _claudeBinaryPath || void 0;
+  if (process.env.CLAUDE_CODE_EXECUTABLE) {
+    _claudeBinaryPath = process.env.CLAUDE_CODE_EXECUTABLE;
+    return _claudeBinaryPath;
+  }
+  try {
+    _claudeBinaryPath = execFileSync("which", ["claude"], { encoding: "utf8" }).trim() || "";
+    return _claudeBinaryPath || void 0;
+  } catch {
+    _claudeBinaryPath = "";
+    return void 0;
+  }
+}
+var MCP_SPAWN_TEE_ENTRY = resolve6(PLATFORM_ROOT2, "lib/mcp-spawn-tee/dist/index.js");
+function withSpawnTee(name, entry, env) {
+  return {
+    command: "node",
+    args: [MCP_SPAWN_TEE_ENTRY, entry],
+    env: { ...env, MCP_SPAWN_TEE_NAME: name }
+  };
+}
+async function resolveAdminConversationNodeId(accountId, conversationId) {
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (c:AdminConversation {conversationId: $conversationId, accountId: $accountId})
+       RETURN elementId(c) AS elementId
+       LIMIT 1`,
+      { conversationId, accountId }
+    );
+    if (res.records.length === 0) {
+      console.error(
+        `[spawn-env] CONVERSATION_NODE_ID resolution: no :AdminConversation for conversationId=${conversationId.slice(0, 8)}\u2026 accountId=${accountId.slice(0, 8)}\u2026 \u2014 omitting env`
+      );
+      return void 0;
+    }
+    return res.records[0].get("elementId");
+  } catch (err) {
+    console.error(
+      `[spawn-env] CONVERSATION_NODE_ID resolution failed: ${err instanceof Error ? err.message : String(err)} \u2014 omitting env`
+    );
+    return void 0;
+  } finally {
+    await session.close();
+  }
+}
+async function getMcpServers(accountId, sessionKey, conversationId, userId, enabledPlugins) {
+  if (!sessionKey) {
+    throw new Error(`getMcpServers: sessionKey is required (accountId=${accountId.slice(0, 8)})`);
+  }
+  if (!conversationId) {
+    throw new Error(`getMcpServers: conversationId is required (accountId=${accountId.slice(0, 8)})`);
+  }
+  const { logDir: LOG_DIR2, streamLogPath: STREAM_LOG_PATH } = streamLogPathFor(accountId, sessionKey);
+  const conversationNodeId = await resolveAdminConversationNodeId(accountId, conversationId);
+  const baseEnv = {
+    ACCOUNT_ID: accountId,
+    PLATFORM_ROOT: PLATFORM_ROOT2,
+    LOG_DIR: LOG_DIR2,
+    STREAM_LOG_PATH,
+    NEO4J_URI: await requireNeo4jUri(),
+    // Pass sessionId so MCP servers can stamp `createdBySession` on graph
+    // writes per-handler (not module-load — that captured undefined and
+    // produced the empty-session-uuid bug).
+    SESSION_ID: conversationId
+  };
+  if (conversationNodeId) {
+    baseEnv.CONVERSATION_NODE_ID = conversationNodeId;
+  }
+  const servers = {
+    "memory": withSpawnTee(
+      "memory",
+      resolve6(PLATFORM_ROOT2, "plugins/memory/mcp/dist/index.js"),
+      { ...baseEnv, ...userId ? { USER_ID: userId } : {} }
+    ),
+    "contacts": withSpawnTee(
+      "contacts",
+      resolve6(PLATFORM_ROOT2, "plugins/contacts/mcp/dist/index.js"),
+      { ...baseEnv }
+    ),
+    "whatsapp": withSpawnTee(
+      "whatsapp",
+      resolve6(PLATFORM_ROOT2, "plugins/whatsapp/mcp/dist/index.js"),
+      { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
+    ),
+    "admin": withSpawnTee(
+      "admin",
+      resolve6(PLATFORM_ROOT2, "plugins/admin/mcp/dist/index.js"),
+      { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200", ...userId ? { USER_ID: userId } : {} }
+    ),
+    "scheduling": withSpawnTee(
+      "scheduling",
+      resolve6(PLATFORM_ROOT2, "plugins/scheduling/mcp/dist/index.js"),
+      // Task 793: USER_ID required for (accountId, userId)-keyed UserProfile reads.
+      { ...baseEnv, ...userId ? { USER_ID: userId } : {} }
+    ),
+    "tasks": withSpawnTee(
+      "tasks",
+      resolve6(PLATFORM_ROOT2, "plugins/tasks/mcp/dist/index.js"),
+      { ...baseEnv }
+    ),
+    "email": withSpawnTee(
+      "email",
+      resolve6(PLATFORM_ROOT2, "plugins/email/mcp/dist/index.js"),
+      { ...baseEnv }
+    ),
+    // Workflows MCP — persistent admin-session server for list/get/update/delete/
+    // validate/runs (the "manage" verbs). The same binary also spawns ad-hoc from
+    // the heartbeat cron for `workflow-execute` via plugins/workflows/.mcp.json;
+    // the two paths are independent. Without this entry the permission allowlist
+    // at ADMIN_CORE_TOOLS grants tools the session never registers, and the model
+    // ToolSearches fruitlessly before degrading to a task-create stand-in.
+    "workflows": withSpawnTee(
+      "workflows",
+      resolve6(PLATFORM_ROOT2, "plugins/workflows/mcp/dist/index.js"),
+      { ...baseEnv }
+    ),
+    // Playwright MCP server — browser automation for browser-specialist.
+    // Key matches Claude Code's plugin naming: plugin_{plugin}_{server} so tools
+    // appear as mcp__plugin_playwright_playwright__browser_navigate etc.
+    // Hardcoded here rather than depending on the plugin cache (which can be wiped
+    // by Claude Code updates or installer re-runs). The --cdp-endpoint connects to
+    // the always-on Chromium instance started by vnc.sh on this brand's
+    // VNC display + CDP_PORT (Tasks 553 + 924; per-brand). Port comes from
+    // paths.ts so a freshly-installed brand's MCP shim points at its own
+    // Chromium without re-bundling.
+    // Spawned via `npx` (not `node`), so the spawn-tee wrapper does not apply.
+    "plugin_playwright_playwright": {
+      command: "npx",
+      args: ["-y", "@playwright/mcp@latest", "--cdp-endpoint", `http://127.0.0.1:${CDP_PORT}`, "--caps", "pdf"]
+    },
+    // Graph MCP shim — spawns upstream `uvx mcp-neo4j-cypher` namespaced
+    // `maxy-graph`, wraps stderr with our tee, and emits one `[graph-query]`
+    // line per tool call. Credentials flow from the brand's own NEO4J_URI +
+    // config/.neo4j-password so a per-brand admin session only ever sees
+    // its own Neo4j instance (isolation is enforced upstream by the
+    // installer's process/port boundary per MAXY-PRD.md:627, not in any
+    // application-layer filter).
+    //
+    // Task 796: NEO4J_READ_ONLY no longer hardcoded — the shim's default
+    // (NEO4J_READ_ONLY=false) lets the upstream register
+    // `write_neo4j_cypher` alongside `read_neo4j_cypher`. Per-agent gating
+    // via `tools:` frontmatter + ADMIN_CORE_TOOLS confines the surface;
+    // only `database-operator.md` and the parent admin spawn allow-list
+    // the write tool. Dev sandboxes that need read-only mode can set
+    // `NEO4J_READ_ONLY=true` in the parent process env — the shim respects
+    // the env var when present.
+    "graph": withSpawnTee(
+      "graph",
+      resolve6(PLATFORM_ROOT2, "lib/graph-mcp/dist/index.js"),
+      {
+        ...baseEnv,
+        BRAND: readBrandHostname(),
+        NEO4J_USERNAME: process.env.NEO4J_USERNAME ?? process.env.NEO4J_USER ?? "neo4j",
+        NEO4J_NAMESPACE: "maxy-graph",
+        NEO4J_RESPONSE_TOKEN_LIMIT: "20000"
+      }
+    )
+  };
+  const tgConfig = resolveAccount()?.config?.telegram;
+  const tgBotToken = tgConfig?.publicBotToken ?? tgConfig?.adminBotToken;
+  if (tgBotToken) {
+    servers["telegram"] = withSpawnTee(
+      "telegram",
+      resolve6(PLATFORM_ROOT2, "plugins/telegram/mcp/dist/index.js"),
+      { ...baseEnv, TELEGRAM_BOT_TOKEN: tgBotToken }
+    );
+  } else {
+    console.error("[plugins] telegram MCP: skipped (no bot token in account.json telegram config)");
+  }
+  servers["cloudflare"] = withSpawnTee(
+    "cloudflare",
+    resolve6(PLATFORM_ROOT2, "plugins/cloudflare/mcp/dist/index.js"),
+    { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
+  );
+  if (process.env.OUTLOOK_CLIENT_ID) {
+    servers["outlook"] = withSpawnTee(
+      "outlook",
+      resolve6(PLATFORM_ROOT2, "plugins/outlook/mcp/dist/index.js"),
+      {
+        ...baseEnv,
+        OUTLOOK_CLIENT_ID: process.env.OUTLOOK_CLIENT_ID,
+        OUTLOOK_TENANT_ID: process.env.OUTLOOK_TENANT_ID ?? "common"
+      }
+    );
+  } else {
+    console.error(
+      "[plugins] outlook MCP: skipped (OUTLOOK_CLIENT_ID not set; see plugins/outlook/references/auth.md)"
+    );
+  }
+  if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
+    for (const dir of enabledPlugins) {
+      if (servers[dir]) continue;
+      if (isMissingPluginDir(dir)) {
+        console.error(
+          `[plugins] WARN: '${dir}' in enabledPlugins but plugin directory missing \u2014 agent will have no '${dir}' tools (auto-delivery may have failed; run premium-deliver or restart the service)`
+        );
+        continue;
+      }
+      const parsed = parsePluginFrontmatter(dir);
+      if (!parsed) continue;
+      if (!parsed.platform.optional) continue;
+      if (parsed.requires.length > 0) {
+        const missing = parsed.requires.filter((req) => {
+          if (enabledPlugins.includes(req)) return false;
+          const reqParsed = parsePluginFrontmatter(req);
+          return !reqParsed || !!reqParsed.platform.optional;
+        });
+        if (missing.length > 0) {
+          console.warn(`[plugins] ${dir} MCP: requires [${missing.join(", ")}] not enabled \u2014 skipping`);
+          continue;
+        }
+      }
+      const mcpDir = resolve6(PLATFORM_ROOT2, "plugins", dir, "mcp");
+      if (!existsSync5(mcpDir)) continue;
+      const mcpEntry = resolve6(PLATFORM_ROOT2, "plugins", dir, "mcp/dist/index.js");
+      if (!existsSync5(mcpEntry)) {
+        console.error(
+          `[plugins] WARN: '${dir}' enabled and mcp/ present but dist/index.js missing \u2014 agent will have no '${dir}' tools (rebuild required)`
+        );
+        continue;
+      }
+      servers[dir] = withSpawnTee(dir, mcpEntry, { ...baseEnv });
+      console.log(`[plugins] optional MCP server started: ${dir}`);
+    }
+  }
+  console.error(`[plugins] MCP servers for session: [${Object.keys(servers).join(", ")}] (${Object.keys(servers).length} total)`);
+  console.error(`[boot] bundleMtime=${getBundleMtimeIso()} conversationId=${conversationId.slice(-8)}`);
+  return servers;
+}
+var cachedBundleMtimeIso;
+function getBundleMtimeIso() {
+  if (cachedBundleMtimeIso) return cachedBundleMtimeIso;
+  const entry = process.argv[1];
+  if (!entry) {
+    cachedBundleMtimeIso = "unknown";
+    return cachedBundleMtimeIso;
+  }
+  try {
+    const stat = statSync4(entry);
+    cachedBundleMtimeIso = stat.mtime.toISOString();
+  } catch {
+    cachedBundleMtimeIso = "unknown";
+  }
+  return cachedBundleMtimeIso;
+}
+var ADMIN_CORE_TOOLS = [
+  "Read",
+  "Write",
+  "Edit",
+  "Bash",
+  "Glob",
+  "Grep",
+  "Agent",
+  // Upstream mcp-neo4j-cypher (namespaced maxy-graph).
+  // FastMCP joins NEO4J_NAMESPACE to each upstream tool name with a hyphen,
+  // and allowedTools matching is string-exact under --permission-mode dontAsk —
+  // these names must equal the init-message tool list byte-for-byte.
+  //
+  // Task 796 + Task 968: both read_neo4j_cypher and write_neo4j_cypher are
+  // allow-listed at the parent admin spawn so the database-operator subagent
+  // inherits permission. Neither is named at IDENTITY-level as a routine
+  // admin tool; admin's prompt routes ANY raw cypher — read or write — to
+  // the operator (per IDENTITY.md routing rule and database-operator.md's
+  // first-sentence description, which is what surfaces in admin's
+  // <specialist-domains> routing block via plugin-manifest.ts). Admin's
+  // routine read surface is the wrapped tools (memory-search, memory-rank,
+  // conversation-search, profile-read); routine writes use schema-aware
+  // memory-write / memory-update / memory-find-candidates / memory-delete.
+  // Raw cypher is reserved for the operator because admin's # SCHEMA block
+  // carries labels and edges only — not the property dictionary — so inline
+  // cypher routinely targets non-existent properties (failure mode 676504f1:
+  // RETURN h.hostname instead of h.hostnameValue, with the 01N52 warning
+  // dropped at the envelope).
+  "mcp__graph__maxy-graph-read_neo4j_cypher",
+  "mcp__graph__maxy-graph-write_neo4j_cypher",
+  "mcp__graph__maxy-graph-get_neo4j_schema",
+  "mcp__memory__memory-search",
+  "mcp__memory__memory-rank",
+  "mcp__memory__memory-write",
+  "mcp__memory__memory-archive-write",
+  "mcp__memory__memory-reindex",
+  "mcp__memory__session-compact",
+  "mcp__memory__session-compact-status",
+  "mcp__memory__conversation-search",
+  "mcp__contacts__contact-create",
+  "mcp__contacts__contact-lookup",
+  "mcp__contacts__contact-update",
+  "mcp__contacts__contact-delete",
+  "mcp__contacts__contact-list",
+  "mcp__contacts__contact-export",
+  "mcp__contacts__contact-erase",
+  "mcp__contacts__group-create",
+  "mcp__contacts__group-manage",
+  "mcp__telegram__message",
+  "mcp__telegram__message-history",
+  "mcp__telegram__telegram-webhook-register",
+  "mcp__whatsapp__whatsapp-login-start",
+  "mcp__whatsapp__whatsapp-login-wait",
+  "mcp__whatsapp__whatsapp-status",
+  "mcp__whatsapp__whatsapp-disconnect",
+  "mcp__whatsapp__whatsapp-send",
+  "mcp__whatsapp__whatsapp-send-document",
+  "mcp__whatsapp__whatsapp-config",
+  "mcp__whatsapp__whatsapp-activity",
+  "mcp__whatsapp__whatsapp-conversations",
+  "mcp__whatsapp__whatsapp-messages",
+  "mcp__whatsapp__whatsapp-conversation-graph-state",
+  "mcp__whatsapp__whatsapp-group-info",
+  "mcp__admin__system-status",
+  "mcp__admin__public-hostname",
+  "mcp__admin__remote-auth-status",
+  "mcp__admin__brand-settings",
+  "mcp__admin__account-manage",
+  "mcp__admin__account-update",
+  "mcp__admin__logs-read",
+  "mcp__admin__plugin-read",
+  "mcp__admin__skill-load",
+  "mcp__admin__store-skill",
+  "mcp__admin__render-component",
+  "mcp__admin__session-reset",
+  "mcp__admin__session-resume",
+  "mcp__admin__admin-add",
+  "mcp__admin__admin-remove",
+  "mcp__admin__admin-list",
+  "mcp__admin__admin-update-pin",
+  "mcp__admin__anthropic-setup",
+  "mcp__admin__api-key-store",
+  "mcp__admin__api-key-verify",
+  "mcp__admin__file-attach",
+  "mcp__admin__action-pending",
+  "mcp__admin__action-approve",
+  "mcp__admin__action-reject",
+  "mcp__admin__action-edit",
+  "mcp__tasks__task-create",
+  "mcp__tasks__task-update",
+  "mcp__tasks__task-list",
+  "mcp__tasks__task-get",
+  "mcp__tasks__task-relate",
+  "mcp__tasks__task-complete",
+  "mcp__tasks__task-ready",
+  "mcp__tasks__session-list",
+  "mcp__tasks__session-name",
+  "mcp__tasks__project-create",
+  "mcp__tasks__project-list",
+  "mcp__tasks__project-get",
+  "mcp__tasks__project-update",
+  "mcp__tasks__project-complete",
+  "mcp__scheduling__schedule-event",
+  "mcp__scheduling__schedule-list",
+  "mcp__scheduling__schedule-get",
+  "mcp__scheduling__schedule-update",
+  "mcp__scheduling__schedule-cancel",
+  "mcp__scheduling__schedule-export-ics",
+  "mcp__scheduling__schedule-import-ics",
+  "mcp__scheduling__time-resolve",
+  "mcp__admin__qr-generate",
+  "mcp__admin__wifi",
+  "mcp__email__email-setup",
+  "mcp__email__email-read",
+  "mcp__email__email-send",
+  "mcp__email__email-reply",
+  "mcp__email__email-search",
+  "mcp__email__email-graph-query",
+  "mcp__email__email-otp-extract",
+  "mcp__email__email-status",
+  "mcp__email__email-auto-respond-config",
+  "mcp__outlook__outlook-account-register",
+  "mcp__outlook__outlook-mail-list",
+  "mcp__outlook__outlook-mail-search",
+  "mcp__outlook__outlook-calendar-list",
+  "mcp__outlook__outlook-calendar-event",
+  "mcp__outlook__outlook-contacts-list",
+  "mcp__outlook__outlook-mailbox-info",
+  "mcp__workflows__workflow-create",
+  "mcp__workflows__workflow-list",
+  "mcp__workflows__workflow-get",
+  "mcp__workflows__workflow-update",
+  "mcp__workflows__workflow-delete",
+  "mcp__workflows__workflow-validate",
+  "mcp__workflows__workflow-execute",
+  "mcp__workflows__workflow-runs",
+  "WebSearch",
+  "WebFetch"
+];
+var ADMIN_EAGER_TOOLS = [
+  // Graph (eagerness minted by graph-mcp shim's tools/list interceptor).
+  "mcp__graph__maxy-graph-read_neo4j_cypher",
+  "mcp__graph__maxy-graph-write_neo4j_cypher",
+  "mcp__graph__maxy-graph-get_neo4j_schema",
+  // Memory.
+  "mcp__memory__memory-search",
+  "mcp__memory__memory-rank",
+  "mcp__memory__memory-write",
+  "mcp__memory__memory-archive-write",
+  "mcp__memory__memory-reindex",
+  "mcp__memory__session-compact",
+  "mcp__memory__session-compact-status",
+  "mcp__memory__conversation-search",
+  // Contacts.
+  "mcp__contacts__contact-create",
+  "mcp__contacts__contact-lookup",
+  "mcp__contacts__contact-update",
+  "mcp__contacts__contact-delete",
+  "mcp__contacts__contact-list",
+  "mcp__contacts__contact-export",
+  "mcp__contacts__contact-erase",
+  "mcp__contacts__group-create",
+  "mcp__contacts__group-manage",
+  // Telegram.
+  "mcp__telegram__message",
+  "mcp__telegram__message-history",
+  "mcp__telegram__telegram-webhook-register",
+  // WhatsApp.
+  "mcp__whatsapp__whatsapp-login-start",
+  "mcp__whatsapp__whatsapp-login-wait",
+  "mcp__whatsapp__whatsapp-status",
+  "mcp__whatsapp__whatsapp-disconnect",
+  "mcp__whatsapp__whatsapp-send",
+  "mcp__whatsapp__whatsapp-send-document",
+  "mcp__whatsapp__whatsapp-config",
+  "mcp__whatsapp__whatsapp-activity",
+  "mcp__whatsapp__whatsapp-conversations",
+  "mcp__whatsapp__whatsapp-messages",
+  "mcp__whatsapp__whatsapp-conversation-graph-state",
+  "mcp__whatsapp__whatsapp-group-info",
+  // Admin.
+  "mcp__admin__system-status",
+  "mcp__admin__public-hostname",
+  "mcp__admin__remote-auth-status",
+  "mcp__admin__brand-settings",
+  "mcp__admin__account-manage",
+  "mcp__admin__account-update",
+  "mcp__admin__logs-read",
+  "mcp__admin__plugin-read",
+  "mcp__admin__skill-load",
+  "mcp__admin__store-skill",
+  "mcp__admin__render-component",
+  "mcp__admin__session-reset",
+  "mcp__admin__session-resume",
+  "mcp__admin__admin-add",
+  "mcp__admin__admin-remove",
+  "mcp__admin__admin-list",
+  "mcp__admin__admin-update-pin",
+  "mcp__admin__anthropic-setup",
+  "mcp__admin__api-key-store",
+  "mcp__admin__api-key-verify",
+  "mcp__admin__file-attach",
+  "mcp__admin__action-pending",
+  "mcp__admin__action-approve",
+  "mcp__admin__action-reject",
+  "mcp__admin__action-edit",
+  "mcp__admin__qr-generate",
+  "mcp__admin__wifi",
+  // Tasks.
+  "mcp__tasks__task-create",
+  "mcp__tasks__task-update",
+  "mcp__tasks__task-list",
+  "mcp__tasks__task-get",
+  "mcp__tasks__task-relate",
+  "mcp__tasks__task-complete",
+  "mcp__tasks__task-ready",
+  "mcp__tasks__session-list",
+  "mcp__tasks__session-name",
+  "mcp__tasks__project-create",
+  "mcp__tasks__project-list",
+  "mcp__tasks__project-get",
+  "mcp__tasks__project-update",
+  "mcp__tasks__project-complete",
+  // Scheduling.
+  "mcp__scheduling__schedule-event",
+  "mcp__scheduling__schedule-list",
+  "mcp__scheduling__schedule-get",
+  "mcp__scheduling__schedule-update",
+  "mcp__scheduling__schedule-cancel",
+  "mcp__scheduling__schedule-export-ics",
+  "mcp__scheduling__schedule-import-ics",
+  "mcp__scheduling__time-resolve",
+  // Email.
+  "mcp__email__email-setup",
+  "mcp__email__email-read",
+  "mcp__email__email-send",
+  "mcp__email__email-reply",
+  "mcp__email__email-search",
+  "mcp__email__email-graph-query",
+  "mcp__email__email-otp-extract",
+  "mcp__email__email-status",
+  "mcp__email__email-auto-respond-config",
+  // Outlook.
+  "mcp__outlook__outlook-account-register",
+  "mcp__outlook__outlook-mail-list",
+  "mcp__outlook__outlook-mail-search",
+  "mcp__outlook__outlook-calendar-list",
+  "mcp__outlook__outlook-calendar-event",
+  "mcp__outlook__outlook-contacts-list",
+  "mcp__outlook__outlook-mailbox-info",
+  // Workflows.
+  "mcp__workflows__workflow-create",
+  "mcp__workflows__workflow-list",
+  "mcp__workflows__workflow-get",
+  "mcp__workflows__workflow-update",
+  "mcp__workflows__workflow-delete",
+  "mcp__workflows__workflow-validate",
+  "mcp__workflows__workflow-execute",
+  "mcp__workflows__workflow-runs"
+];
+function logToolSurface(conversationId, allowedTools) {
+  const allowedSet = new Set(allowedTools);
+  const eagerIntent = ADMIN_EAGER_TOOLS.filter((name) => allowedSet.has(name)).length;
+  const eagerMissing = ADMIN_EAGER_TOOLS.filter((name) => !allowedSet.has(name));
+  const convTag = conversationId ? conversationId.slice(0, 8) : "unknown";
+  console.error(
+    `[tool-surface] session=${convTag} permission_allowed=${allowedTools.length} eager_intent=${eagerIntent} eager_set_size=${ADMIN_EAGER_TOOLS.length}${eagerMissing.length > 0 ? ` missing_from_allowlist=[${eagerMissing.slice(0, 5).join(",")}${eagerMissing.length > 5 ? `,+${eagerMissing.length - 5}` : ""}]` : ""}`
+  );
+}
+function getAdminAllowedTools(enabledPlugins) {
+  const tools = [...ADMIN_CORE_TOOLS];
+  if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
+    const pluginsDir = resolve6(PLATFORM_ROOT2, "plugins");
+    let dirs;
+    try {
+      dirs = readdirSync4(pluginsDir);
+    } catch {
+      return tools;
+    }
+    for (const dir of dirs) {
+      if (!enabledPlugins.includes(dir)) continue;
+      const parsed = parsePluginFrontmatter(dir);
+      if (!parsed?.platform.optional) continue;
+      for (const toolName of parsed.tools) {
+        tools.push(`mcp__${dir}__${toolName}`);
+      }
+    }
+  }
+  return tools;
+}
+function assembleAllowedToolsForAdminSpawn(enabledPlugins) {
+  return getAdminAllowedTools(enabledPlugins);
+}
+
+// app/lib/claude-agent/stream-log-writer.ts
+var FILENAME_BYTE_BUDGET = 240;
+var PRE_TOKEN_BUFFER_CAP_BYTES = 64 * 1024;
+var SESSIONKEY_REGEX = /^(sk_[a-f0-9]{16}|[a-zA-Z0-9_-]{1,64})$/;
+var handles = /* @__PURE__ */ new Map();
+function getStreamLogHandle(accountDir, sessionKey) {
+  if (!sessionKey) {
+    throw new Error(`getStreamLogHandle: sessionKey is required (accountDir=${accountDir})`);
+  }
+  const cached = handles.get(sessionKey);
+  if (cached) return cached;
+  if (!SESSIONKEY_REGEX.test(sessionKey)) {
+    console.error(
+      `[stream-log-writer] reject reason=invalid-sessionkey sessionKey=${JSON.stringify(sessionKey.slice(0, 64))}`
+    );
+    return makeNoOpHandle(buildPath(accountDir, sessionKey));
+  }
+  const path = buildPath(accountDir, sessionKey);
+  const filenameBytes = Buffer.byteLength(`claude-agent-stream-${sessionKey}.log`);
+  if (filenameBytes > FILENAME_BYTE_BUDGET) {
+    console.error(
+      `[stream-log-writer] reject reason=key-too-long sessionKey-bytes=${Buffer.byteLength(sessionKey)} filename-bytes=${filenameBytes}`
+    );
+    return makeNoOpHandle(path);
+  }
+  const handle = makeHandle(path, sessionKey);
+  handles.set(sessionKey, handle);
+  return handle;
+}
+function releaseStreamLogHandle(sessionKey) {
+  const h = handles.get(sessionKey);
+  if (!h) return;
+  h.end();
+  handles.delete(sessionKey);
+}
+function buildPath(accountDir, sessionKey) {
+  return resolve7(accountDir, "logs", `claude-agent-stream-${sessionKey}.log`);
+}
+function makeHandle(path, sessionKey) {
+  let stream = null;
+  let firstTokenReceived = false;
+  let buffer = [];
+  let bufferBytes = 0;
+  let bufferBoundHitOnce = false;
+  let pendingErrorListeners = [];
+  function ensureLogDir() {
+    try {
+      mkdirSync3(resolve7(path, ".."), { recursive: true });
+      return true;
+    } catch (err) {
+      console.error(
+        `[stream-log-writer] mkdir-failed sessionKey=${sessionKey.slice(0, 8)} path=${JSON.stringify(path)} reason=${err instanceof Error ? err.message : String(err)}`
+      );
+      return false;
+    }
+  }
+  function openStream(firstTokenBytesLen) {
+    if (stream) return;
+    if (!ensureLogDir()) {
+      stream = createWriteStream2(devNull2, { flags: "a" });
+      stream.once("error", () => {
+      });
+      return;
+    }
+    stream = createWriteStream2(path, { flags: "a" });
+    stream.once("error", (err) => {
+      console.error(
+        `[stream-log-writer] writer-bind-failed sessionKey=${sessionKey.slice(0, 8)} errno=${err.code ?? "unknown"} path=${JSON.stringify(path)}`
+      );
+      handles.delete(sessionKey);
+    });
+    for (const cb of pendingErrorListeners) {
+      stream.on("error", cb);
+    }
+    pendingErrorListeners = [];
+    registerStreamLog(stream, { path, sessionKey, name: "claude-agent-stream" });
+    console.error(
+      `[stream-log-writer] open sessionKey=${sessionKey.slice(0, 8)} path=${JSON.stringify(path)} firstTokenBytes=${firstTokenBytesLen} ts=${(/* @__PURE__ */ new Date()).toISOString()}`
+    );
+  }
+  function flushBuffer() {
+    if (!stream || buffer.length === 0) return { count: 0, bytes: 0 };
+    const count = buffer.length;
+    const bytes = bufferBytes;
+    for (const line of buffer) {
+      stream.write(line);
+    }
+    buffer = [];
+    bufferBytes = 0;
+    return { count, bytes };
+  }
+  return {
+    get path() {
+      return path;
+    },
+    get firstTokenReceived() {
+      return firstTokenReceived;
+    },
+    get destroyed() {
+      return stream?.destroyed ?? false;
+    },
+    get writableEnded() {
+      return stream?.writableEnded ?? false;
+    },
+    write(bytes) {
+      if (firstTokenReceived && stream && !stream.destroyed && !stream.writableEnded) {
+        stream.write(bytes);
+        return;
+      }
+      const len = Buffer.byteLength(bytes);
+      if (bufferBytes + len > PRE_TOKEN_BUFFER_CAP_BYTES) {
+        while (buffer.length > 0 && bufferBytes + len > PRE_TOKEN_BUFFER_CAP_BYTES) {
+          const dropped = buffer.shift();
+          bufferBytes -= Buffer.byteLength(dropped);
+        }
+        if (!bufferBoundHitOnce) {
+          bufferBoundHitOnce = true;
+          console.error(
+            `[stream-log-writer] buffer-bound-hit sessionKey=${sessionKey.slice(0, 8)} cap=${PRE_TOKEN_BUFFER_CAP_BYTES}`
+          );
+        }
+      }
+      buffer.push(bytes);
+      bufferBytes += len;
+      const trimmed = bytes.endsWith("\n") ? bytes.slice(0, -1) : bytes;
+      console.error(`[stream-log-writer:pretoken] sessionKey=${sessionKey.slice(0, 8)} ${trimmed}`);
+    },
+    writeToken(bytes) {
+      if (!firstTokenReceived) {
+        const firstBytesLen = Buffer.byteLength(bytes);
+        openStream(firstBytesLen);
+        firstTokenReceived = true;
+        const flush = flushBuffer();
+        if (flush.count > 0) {
+          console.error(
+            `[stream-log-writer] buffer-flush sessionKey=${sessionKey.slice(0, 8)} bytes=${flush.bytes} count=${flush.count} firstTokenBytes=${firstBytesLen}`
+          );
+        }
+      }
+      if (stream && !stream.destroyed && !stream.writableEnded) {
+        stream.write(bytes);
+      }
+    },
+    end() {
+      if (stream && !stream.writableEnded) {
+        try {
+          stream.end();
+        } catch {
+        }
+      }
+      buffer = [];
+      bufferBytes = 0;
+    },
+    on(event, cb) {
+      if (stream) {
+        stream.on(event, cb);
+      } else {
+        pendingErrorListeners.push(cb);
+      }
+    }
+  };
+}
+function makeNoOpHandle(path) {
+  return {
+    get path() {
+      return path;
+    },
+    get firstTokenReceived() {
+      return false;
+    },
+    get destroyed() {
+      return false;
+    },
+    get writableEnded() {
+      return false;
+    },
+    write(_bytes) {
+    },
+    writeToken(_bytes) {
+    },
+    end() {
+    },
+    on(_event, _cb) {
+    }
+  };
+}
+function appendStreamLogLine(accountId, sessionKey, line) {
+  if (!accountId || !sessionKey) {
+    console.error(`[stream-log-writer] reject reason=missing-identifier accountId=${accountId ? "set" : "empty"} sessionKey=${sessionKey ? "set" : "empty"}`);
+    return;
+  }
+  let streamLogPath;
+  try {
+    streamLogPath = streamLogPathFor(accountId, sessionKey).streamLogPath;
+  } catch (err) {
+    console.error(`[stream-log-writer] reject reason=path-resolve-failed err=${err instanceof Error ? err.message : String(err)} accountId=${accountId.slice(0, 8)} sessionKey=${sessionKey.slice(0, 12)}`);
+    return;
+  }
+  try {
+    mkdirSync3(dirname(streamLogPath), { recursive: true });
+    appendFileSyncForAdminTelemetry(streamLogPath, line.endsWith("\n") ? line : `${line}
+`);
+  } catch (err) {
+    console.error(`[stream-log-writer] append-failed err=${err instanceof Error ? err.message : String(err)} path=${streamLogPath}`);
+  }
+}
+
+// app/lib/claude-agent/session-store.ts
+function findFirstSubstantiveUserMessage(turns) {
+  for (const t of turns) {
+    if (t.role !== "user") continue;
+    if (isMessageUseful(t.content)) return t.content;
+  }
+  return null;
+}
+var sessionStore = /* @__PURE__ */ new Map();
+function getSession2(cacheKey) {
+  return sessionStore.get(cacheKey);
+}
+setSessionStoreRef(sessionStore);
+var TOKEN_PREFIX = "v1.";
+var TOKEN_VERSION = "adm";
+var TOKEN_TTL_MS = 24 * 60 * 60 * 1e3;
+var TOKEN_SECRET_BYTES = 32;
+var TOKEN_NONCE_BYTES = 16;
+var cachedAdminSecret = null;
+function getAdminSessionSecret() {
+  if (cachedAdminSecret) return cachedAdminSecret;
+  try {
+    const hex2 = readFileSync7(ADMIN_SESSION_SECRET_FILE, "utf-8").trim();
+    if (hex2.length === TOKEN_SECRET_BYTES * 2) {
+      cachedAdminSecret = Buffer.from(hex2, "hex");
+      return cachedAdminSecret;
+    }
+  } catch {
+  }
+  const fresh = randomBytes(TOKEN_SECRET_BYTES).toString("hex");
+  try {
+    mkdirSync4(dirname2(ADMIN_SESSION_SECRET_FILE), { recursive: true, mode: 448 });
+    writeFileSync2(ADMIN_SESSION_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+  } catch {
+  }
+  let hex;
+  try {
+    hex = readFileSync7(ADMIN_SESSION_SECRET_FILE, "utf-8").trim();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`admin-session-secret unreadable at ${ADMIN_SESSION_SECRET_FILE}: ${msg}`);
+  }
+  cachedAdminSecret = Buffer.from(hex, "hex");
+  return cachedAdminSecret;
+}
+function base64urlEncode(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64urlDecode(s) {
+  const padded = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - s.length % 4) % 4);
+  return Buffer.from(padded, "base64");
+}
+function signDigest(payloadJson, secret) {
+  return createHmac("sha256", secret).update(payloadJson).digest();
+}
+function fingerprintSessionKey(raw) {
+  if (typeof raw !== "string" || !raw) return raw;
+  if (/^sk_[a-f0-9]{16}$/.test(raw)) return raw;
+  if (!raw.startsWith("v1.")) return raw;
+  return `sk_${createHash("sha256").update(raw).digest("hex").slice(0, 16)}`;
+}
+function mintAdminSessionToken(identity) {
+  const payload = {
+    v: TOKEN_VERSION,
+    a: identity.accountId,
+    u: identity.userId,
+    c: Date.now(),
+    n: randomBytes(TOKEN_NONCE_BYTES).toString("hex")
+  };
+  const payloadJson = JSON.stringify(payload);
+  const payloadB64 = base64urlEncode(Buffer.from(payloadJson, "utf-8"));
+  const sigB64 = base64urlEncode(signDigest(payloadJson, getAdminSessionSecret()));
+  return `${TOKEN_PREFIX}${payloadB64}.${sigB64}`;
+}
+function parseAdminSessionToken(token) {
+  if (!token.startsWith(TOKEN_PREFIX)) return null;
+  const rest = token.slice(TOKEN_PREFIX.length);
+  const dot = rest.indexOf(".");
+  if (dot === -1) return null;
+  const payloadB64 = rest.slice(0, dot);
+  const sigB64 = rest.slice(dot + 1);
+  if (!payloadB64 || !sigB64) return null;
+  let payloadJson;
+  let providedDigest;
+  try {
+    payloadJson = base64urlDecode(payloadB64).toString("utf-8");
+    providedDigest = base64urlDecode(sigB64);
+  } catch {
+    return null;
+  }
+  const expectedDigest = signDigest(payloadJson, getAdminSessionSecret());
+  if (providedDigest.length !== expectedDigest.length || !timingSafeEqual(providedDigest, expectedDigest)) {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(payloadJson);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const p = parsed;
+  if (p.v !== TOKEN_VERSION) return null;
+  if (typeof p.a !== "string" || !p.a) return null;
+  if (typeof p.u !== "string" || !p.u) return null;
+  if (typeof p.c !== "number" || !Number.isFinite(p.c)) return null;
+  if (typeof p.n !== "string" || !p.n) return null;
+  return p;
+}
+function tryRehydrateAdminSession(cacheKey, signedToken) {
+  const payload = parseAdminSessionToken(signedToken);
+  if (!payload) return { kind: "invalid-token" };
+  const ageMs = Date.now() - payload.c;
+  if (ageMs > TOKEN_TTL_MS) return { kind: "expired", ageMs };
+  sessionStore.set(cacheKey, {
+    createdAt: Date.now(),
+    agentType: "admin",
+    accountId: payload.a,
+    userId: payload.u,
+    wantsPriorConversation: true
+  });
+  console.log(`[session-rehydrate-from-token] cacheKey=${cacheKey.slice(0, 12)}\u2026 accountId=${payload.a.slice(0, 8)} userId=${payload.u.slice(0, 8)} ageMs=${ageMs}`);
+  return { kind: "ok", payload, ageMs };
+}
+function setWantsPriorConversation(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (session) session.wantsPriorConversation = true;
+}
+function consumeWantsPriorConversation(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session || !session.wantsPriorConversation) return false;
+  delete session.wantsPriorConversation;
+  return true;
+}
+function registerSession(cacheKey, agentType, accountId, agentName, userId, userName, role) {
+  const existing = sessionStore.get(cacheKey);
+  if (existing) {
+    existing.agentType = agentType;
+    existing.accountId = accountId;
+    existing.agentName = agentName ?? existing.agentName;
+    existing.userId = userId ?? existing.userId;
+    existing.userName = userName ?? existing.userName;
+    existing.role = role ?? existing.role;
+    return;
+  }
+  sessionStore.set(cacheKey, { createdAt: Date.now(), agentType, accountId, agentName, userId, userName, role });
+}
+function registerResumedSession(cacheKey, accountId, agentName, conversationId, messages) {
+  const messageHistory = messages.map((m) => ({
+    role: m.role,
+    content: m.content,
+    timestamp: m.timestamp ?? Date.now()
+  }));
+  sessionStore.set(cacheKey, {
+    createdAt: Date.now(),
+    agentType: "public",
+    accountId,
+    agentName,
+    conversationId,
+    messageHistory
+  });
+}
+function getSessionMessages(cacheKey) {
+  return sessionStore.get(cacheKey)?.messageHistory;
+}
+function clearSessionHistory(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return void 0;
+  const previousConversationId = session.conversationId;
+  session.agentSessionId = void 0;
+  session.pendingCompactionSummary = void 0;
+  session.stalledSubagents = void 0;
+  session.pendingTrimmedMessages = void 0;
+  session.pendingCommitmentOffers = void 0;
+  session.pendingTurns = void 0;
+  session.stallResume = void 0;
+  session.assistantTurnCount = void 0;
+  return previousConversationId;
+}
+function bufferPendingTurn(cacheKey, turn) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) {
+    console.error(`[conversation-gate] bufferPendingTurn: session not found cacheKey=${cacheKey.slice(0, 8)}\u2026`);
+    return;
+  }
+  if (!session.pendingTurns) session.pendingTurns = [];
+  session.pendingTurns.push(turn);
+  console.log(`[conversation-gate] ${(/* @__PURE__ */ new Date()).toISOString()} buffered cacheKey=${cacheKey.slice(0, 8)} role=${turn.role} turnCount=${session.pendingTurns.filter((t) => t.role === "user").length}`);
+}
+function getPendingTurnCount(cacheKey) {
+  const buf = sessionStore.get(cacheKey)?.pendingTurns;
+  if (!buf) return 0;
+  let n = 0;
+  for (const t of buf) if (t.role === "user") n++;
+  return n;
+}
+function drainPendingTurns(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session?.pendingTurns || session.pendingTurns.length === 0) return void 0;
+  const drained = session.pendingTurns;
+  session.pendingTurns = void 0;
+  return drained;
+}
+function isFlushError(o) {
+  return o !== null && "error" in o;
+}
+async function maybeFlushConversationBuffer(cacheKey, agentType, accountId) {
+  const sk8 = cacheKey.slice(0, 8);
+  const session = sessionStore.get(cacheKey);
+  if (!session) {
+    console.log(`[admin/conversation-flush] cacheKey=${sk8} agentType=${agentType} result=missing-session`);
+    return { error: "missing-session" };
+  }
+  if (session.conversationId) {
+    console.log(`[admin/conversation-flush] cacheKey=${sk8} agentType=${agentType} result=already-flushed conversationId=${session.conversationId.slice(0, 8)}`);
+    return { conversationId: session.conversationId, buffered: [] };
+  }
+  const bufferedCount = session.pendingTurns?.length ?? 0;
+  if (bufferedCount === 0) {
+    console.log(`[admin/conversation-flush] cacheKey=${sk8} agentType=${agentType} result=empty-buffer`);
+    return null;
+  }
+  if (session.flushInFlight) return session.flushInFlight;
+  const attempt = (async () => {
+    let conversationId = null;
+    if (agentType === "admin") {
+      const userId = session.userId;
+      if (!userId) {
+        console.error(`[admin/conversation-flush] cacheKey=${sk8} agentType=admin result=missing-userId bufferedCount=${bufferedCount}`);
+        return { error: "missing-userId" };
+      }
+      conversationId = await createNewAdminConversation(userId, accountId, cacheKey, session.userName);
+    } else {
+      conversationId = (await ensureConversation(accountId, "public", cacheKey, void 0, session.agentName, void 0)).conversationId;
+    }
+    if (!conversationId) {
+      console.error(`[admin/conversation-flush] cacheKey=${sk8} agentType=${agentType} result=writer-failed bufferedCount=${bufferedCount}`);
+      return { error: "writer-failed" };
+    }
+    session.conversationId = conversationId;
+    if (agentType === "admin" && session.agentSessionId) {
+      setConversationAgentSessionId(conversationId, session.agentSessionId).catch(() => {
+      });
+    }
+    const buffered = drainPendingTurns(cacheKey) ?? [];
+    for (const turn of buffered) {
+      persistMessage(conversationId, turn.role, turn.content, accountId, turn.tokens, turn.timestamp, turn.sender, turn.components, turn.attachments).catch((err) => {
+        console.error(`[admin/conversation-flush] replay persistMessage failed role=${turn.role}: ${err instanceof Error ? err.message : String(err)}`);
+      });
+    }
+    console.log(`[admin/conversation-flush] cacheKey=${sk8} agentType=${agentType} result=ok conversationId=${conversationId.slice(0, 8)} bufferedMessages=${buffered.length}`);
+    return { conversationId, buffered };
+  })();
+  session.flushInFlight = attempt;
+  try {
+    return await attempt;
+  } finally {
+    if (session.flushInFlight === attempt) session.flushInFlight = void 0;
+  }
+}
+function isDmChannelCacheKey(cacheKey) {
+  return cacheKey.startsWith("whatsapp:") || cacheKey.startsWith("telegram:");
+}
+function getAgentNameForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.agentName;
+}
+function listAdminSessionsInProgress(accountId, userId) {
+  const rows = [];
+  for (const [cacheKey, session] of Array.from(sessionStore.entries())) {
+    if (session.agentType !== "admin") continue;
+    if (session.accountId !== accountId) continue;
+    if (session.userId !== userId) continue;
+    if (session.conversationId) continue;
+    rows.push({ cacheKey, createdAt: session.createdAt });
+  }
+  rows.sort((a, b) => b.createdAt - a.createdAt);
+  return rows;
+}
+function validateSession(cacheKey, agentType, signedSessionToken) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) {
+    if (agentType === "admin" && signedSessionToken) {
+      const outcome = tryRehydrateAdminSession(cacheKey, signedSessionToken);
+      if (outcome.kind === "ok") return { ok: true };
+      if (outcome.kind === "expired") return { ok: false, reason: "session-expired-age" };
+    }
+    return { ok: false, reason: "session-not-registered" };
+  }
+  if (session.agentType !== agentType) return { ok: false, reason: "agent-type-mismatch" };
+  if (Date.now() - session.createdAt > 24 * 60 * 60 * 1e3) {
+    sessionStore.delete(cacheKey);
+    return { ok: false, reason: "session-expired-age" };
+  }
+  if (session.grantExpiresAt && Date.now() > session.grantExpiresAt) {
+    sessionStore.delete(cacheKey);
+    return { ok: false, reason: "grant-expired" };
+  }
+  return { ok: true };
+}
+function storeAgentSessionId(cacheKey, agentSessionId) {
+  const session = sessionStore.get(cacheKey);
+  if (session) {
+    session.agentSessionId = agentSessionId;
+    console.error(`[session-store] storeAgentSessionId cacheKey=${cacheKey.slice(0, 12)}\u2026 sessionId=${agentSessionId.slice(0, 8)}\u2026`);
+    if (session.agentType === "admin" && session.conversationId) {
+      setConversationAgentSessionId(session.conversationId, agentSessionId).catch(() => {
+      });
+    }
+  } else {
+    console.error(`[session-store] storeAgentSessionId SKIPPED \u2014 no session entry cacheKey=${cacheKey.slice(0, 12)}\u2026 sessionId=${agentSessionId.slice(0, 8)}\u2026`);
+  }
+}
+function getAgentSessionId(cacheKey) {
+  return sessionStore.get(cacheKey)?.agentSessionId;
+}
+function setAgentSessionId(cacheKey, agentSessionId) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return false;
+  session.agentSessionId = agentSessionId;
+  return true;
+}
+function storePendingCompactionSummary(cacheKey, summary) {
+  const session = sessionStore.get(cacheKey);
+  if (session) session.pendingCompactionSummary = summary;
+}
+function consumePendingCompactionSummary(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return void 0;
+  const summary = session.pendingCompactionSummary;
+  delete session.pendingCompactionSummary;
+  return summary;
+}
+function getAccountIdForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.accountId;
+}
+function getUserIdForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.userId;
+}
+function getUserNameForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.userName;
+}
+function getRoleForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.role;
+}
+function getConversationIdForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.conversationId;
+}
+function getSessionKeyByConversationId(conversationId) {
+  for (const [cacheKey, session] of sessionStore.entries()) {
+    if (session.conversationId === conversationId) return cacheKey;
+  }
+  return void 0;
+}
+function setConversationIdForSession(cacheKey, conversationId) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return false;
+  session.conversationId = conversationId;
+  return true;
+}
+function unregisterSession(cacheKey) {
+  releaseStreamLogHandle(cacheKey);
+  return sessionStore.delete(cacheKey);
+}
+function getGroupSlugForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.groupSlug;
+}
+function getVisitorIdForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.visitorId;
+}
+function setGroupContextForSession(cacheKey, context) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return false;
+  session.groupSlug = context.groupSlug;
+  session.groupName = context.groupName;
+  session.conversationId = context.conversationId;
+  session.visitorId = context.visitorId;
+  session.senderDisplayName = context.senderDisplayName;
+  return true;
+}
+function registerGrantSession(cacheKey, accountId, agentName, opts) {
+  sessionStore.set(cacheKey, {
+    createdAt: Date.now(),
+    agentType: "public",
+    accountId,
+    agentName,
+    grantId: opts.grantId,
+    grantExpiresAt: opts.grantExpiresAt,
+    grantStatus: opts.grantStatus,
+    grantDisplayName: opts.grantDisplayName,
+    grantContactValue: opts.grantContactValue,
+    setupRequired: opts.setupRequired
+  });
+}
+function getGrantForSession(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session?.grantId) return void 0;
+  return {
+    grantId: session.grantId,
+    grantExpiresAt: session.grantExpiresAt,
+    grantStatus: session.grantStatus,
+    grantDisplayName: session.grantDisplayName,
+    grantContactValue: session.grantContactValue,
+    setupRequired: session.setupRequired
+  };
+}
+function completeGrantSetup(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (session) {
+    session.setupRequired = false;
+    session.grantStatus = "active";
+  }
+}
+function getMessageHistory(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return [];
+  if (!session.messageHistory) session.messageHistory = [];
+  return session.messageHistory;
+}
+function appendMessage(cacheKey, role, content, timestamp) {
+  if (!content) return;
+  const session = sessionStore.get(cacheKey);
+  if (!session) {
+    console.error(`[managed] appendMessage: session not found for key ${cacheKey.slice(0, 8)}\u2026 (store size: ${sessionStore.size})`);
+    return;
+  }
+  if (!session.messageHistory) session.messageHistory = [];
+  session.messageHistory.push({ role, content, timestamp: timestamp ?? Date.now() });
+}
+function storePendingTrimmedMessages(cacheKey, messages) {
+  const session = sessionStore.get(cacheKey);
+  if (session) session.pendingTrimmedMessages = messages;
+}
+function consumePendingTrimmedMessages(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return void 0;
+  const messages = session.pendingTrimmedMessages;
+  delete session.pendingTrimmedMessages;
+  return messages;
+}
+function storeStalledSubagent(cacheKey, info) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) {
+    console.error(`[stall-recovery] storeStalledSubagent: session not found for key ${cacheKey.slice(0, 8)}\u2026 \u2014 stall context lost`);
+    return;
+  }
+  if (!session.stalledSubagents) session.stalledSubagents = [];
+  session.stalledSubagents.push(info);
+}
+function consumeStalledSubagents(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) return void 0;
+  const stalls = session.stalledSubagents;
+  delete session.stalledSubagents;
+  return stalls && stalls.length > 0 ? stalls : void 0;
+}
+function setPendingCommitmentOffers(cacheKey, offers) {
+  const session = sessionStore.get(cacheKey);
+  if (session) session.pendingCommitmentOffers = offers;
+}
+function getAgentTypeForSession(cacheKey) {
+  return sessionStore.get(cacheKey)?.agentType;
+}
+function clearMessageHistory(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (session) session.messageHistory = [];
+}
+var clearAgentSessionIdHandlers = [];
+function onClearAgentSessionId(handler) {
+  clearAgentSessionIdHandlers.push(handler);
+}
+var evictPoolHandlers = [];
+function onEvictPool(handler) {
+  evictPoolHandlers.push(handler);
+}
+function clearAgentSessionId(cacheKey, reason) {
+  const session = sessionStore.get(cacheKey);
+  if (session) {
+    session.agentSessionId = void 0;
+    session.lastClearReason = reason;
+    console.error(`[session-store] clearAgentSessionId cacheKey=${cacheKey.slice(0, 12)}\u2026 reason=${reason}`);
+  } else {
+    console.error(`[session-store] clearAgentSessionId SKIPPED \u2014 no session entry cacheKey=${cacheKey.slice(0, 12)}\u2026 reason=${reason}`);
+  }
+  for (const handler of clearAgentSessionIdHandlers) {
+    try {
+      handler(cacheKey, reason);
+    } catch (err) {
+      console.error(`[session-store] clearAgentSessionId handler threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+function evictPool(cacheKey, reason) {
+  for (const handler of evictPoolHandlers) {
+    try {
+      handler(cacheKey, reason);
+    } catch (err) {
+      console.error(`[session-store] evictPool handler threw: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+function storeRecoveryHandoff(cacheKey, info) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) {
+    console.error(`[recovery-handoff] storeRecoveryHandoff: session not found for key ${cacheKey.slice(0, 8)}\u2026 \u2014 handoff context lost reason=${info.reason}`);
+    return;
+  }
+  session.recoveryHandoff = { reason: info.reason, summary: info.summary, createdAt: Date.now() };
+}
+function consumeRecoveryHandoff(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session?.recoveryHandoff) return void 0;
+  const handoff = session.recoveryHandoff;
+  delete session.recoveryHandoff;
+  delete session.lastClearReason;
+  return handoff;
+}
+function getLastClearReason(cacheKey) {
+  return sessionStore.get(cacheKey)?.lastClearReason;
+}
+function clearLastClearReason(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (session) delete session.lastClearReason;
+}
+function storeStallResume(cacheKey, info) {
+  const session = sessionStore.get(cacheKey);
+  if (!session) {
+    console.error(`[stall-resume] storeStallResume: session not found for key ${cacheKey.slice(0, 8)}\u2026 \u2014 resume context lost kind=${info.kind}`);
+    return;
+  }
+  session.stallResume = { ...info, createdAt: Date.now() };
+}
+function consumeStallResume(cacheKey) {
+  const session = sessionStore.get(cacheKey);
+  if (!session?.stallResume) return void 0;
+  const payload = session.stallResume;
+  delete session.stallResume;
+  return payload;
+}
+
+// app/lib/claude-agent/client-pool.ts
+var AsyncQueue = class {
+  buffer = [];
+  resolvers = [];
+  closed = false;
+  push(item) {
+    if (this.closed) return;
+    const resolver = this.resolvers.shift();
+    if (resolver) resolver({ value: item, done: false });
+    else this.buffer.push(item);
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    while (this.resolvers.length > 0) {
+      const r = this.resolvers.shift();
+      r({ value: void 0, done: true });
+    }
+  }
+  [Symbol.asyncIterator]() {
+    return {
+      next: () => new Promise((resolve8) => {
+        if (this.buffer.length > 0) {
+          resolve8({ value: this.buffer.shift(), done: false });
+        } else if (this.closed) {
+          resolve8({ value: void 0, done: true });
+        } else {
+          this.resolvers.push(resolve8);
+        }
+      }),
+      return: async () => {
+        this.close();
+        return { value: void 0, done: true };
+      }
+    };
+  }
+};
+var clientPool = /* @__PURE__ */ new Map();
+var DEFAULT_IDLE_MS = 30 * 60 * 1e3;
+var idleEvictMs = (() => {
+  const v = Number(process.env.CLAUDE_CLIENT_IDLE_MS);
+  return Number.isFinite(v) && v > 0 ? v : DEFAULT_IDLE_MS;
+})();
+var ABORT_SDK_TIMEOUT_MS = 2e3;
+function acquireClient(cacheKey, opts, streamLog) {
+  const existing = clientPool.get(cacheKey);
+  if (existing) {
+    existing.lastUsedAt = Date.now();
+    existing.turnsServed += 1;
+    safeWrite(
+      streamLog,
+      `[${isoTs()}] [client-warm-reuse] cacheKey=${sk(cacheKey)} ageMs=${Date.now() - existing.createdAt} turnsServed=${existing.turnsServed} cachedTokens=${existing.cachedTokensLastTurn}
+`
+    );
+    return { entry: existing, isCold: false };
+  }
+  const userQueue = new AsyncQueue();
+  const abortController = new AbortController();
+  let q;
+  try {
+    const sdkOptions = opts.buildSdkOptions();
+    q = query({ prompt: userQueue, options: { ...sdkOptions, abortController } });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    safeWrite(
+      streamLog,
+      `[${isoTs()}] [client-spawn-error] cacheKey=${sk(cacheKey)} reason=${JSON.stringify(reason.slice(0, 200))}
+`
+    );
+    throw err;
+  }
+  const entry = {
+    query: q,
+    userQueue,
+    abortController,
+    inflight: null,
+    createdAt: Date.now(),
+    lastUsedAt: Date.now(),
+    turnsServed: 1,
+    resumedFromSessionId: opts.resumedFromSessionId,
+    cachedTokensLastTurn: -1,
+    accountId: opts.accountId,
+    accountDir: opts.accountDir,
+    logKey: opts.logKey
+  };
+  clientPool.set(cacheKey, entry);
+  safeWrite(
+    streamLog,
+    `[${isoTs()}] [client-cold-create] cacheKey=${sk(cacheKey)} resumedFrom=${opts.resumedFromSessionId ?? "none"} createdAtMs=${entry.createdAt}
+`
+  );
+  safeWrite(
+    streamLog,
+    `[${isoTs()}] [client-sdk-argv] cacheKey=${sk(cacheKey)} cwd=${opts.accountDir} resume=${opts.resumedFromSessionId ?? "none"} configDir=${process.env.CLAUDE_CONFIG_DIR ?? "<unset>"}
+`
+  );
+  return { entry, isCold: true };
+}
+function pushUserMessage(entry, content) {
+  const msg = {
+    type: "user",
+    message: { role: "user", content },
+    parent_tool_use_id: null
+  };
+  entry.userQueue.push(msg);
+}
+function pushUserToolResult(entry, toolUseId, content, isError = false) {
+  const msg = {
+    type: "user",
+    message: {
+      role: "user",
+      content: [{ type: "tool_result", tool_use_id: toolUseId, content, is_error: isError }]
+    },
+    parent_tool_use_id: null
+  };
+  entry.userQueue.push(msg);
+}
+function setInflight(entry, promise) {
+  entry.inflight = promise;
+  promise.finally(() => {
+    if (entry.inflight === promise) entry.inflight = null;
+  }).catch(() => {
+  });
+}
+function recordCachedTokens(entry, cachedTokens) {
+  entry.cachedTokensLastTurn = cachedTokens;
+}
+function getActiveClient(cacheKey) {
+  return clientPool.get(cacheKey);
+}
+function appendAbortLine(entry, line) {
+  const handle = getStreamLogHandle(entry.accountDir, entry.logKey);
+  try {
+    handle.write(line);
+  } catch {
+  }
+  console.error(line.trimEnd());
+}
+async function interruptClient(cacheKey, _streamLog) {
+  void _streamLog;
+  const entry = clientPool.get(cacheKey);
+  if (!entry) return;
+  const startedAt = Date.now();
+  let resolved = false;
+  const timeout = new Promise(
+    (resolve8) => setTimeout(() => resolve8("timeout"), ABORT_SDK_TIMEOUT_MS)
+  );
+  const sdkAbort = entry.query.interrupt().then(() => {
+    resolved = true;
+    return "ok";
+  }).catch((err) => {
+    resolved = true;
+    return { error: err instanceof Error ? err.message : String(err) };
+  });
+  const result = await Promise.race([sdkAbort, timeout]);
+  const durationMs = Date.now() - startedAt;
+  if (result === "timeout" && !resolved) {
+    appendAbortLine(
+      entry,
+      `[${isoTs()}] [client-abort] cacheKey=${sk(cacheKey)} method=signal durationMs=${durationMs}
+`
+    );
+    evictClient(cacheKey, "abort-signal-fallback", null);
+    return;
+  }
+  if (typeof result === "object" && "error" in result) {
+    appendAbortLine(
+      entry,
+      `[${isoTs()}] [client-abort] cacheKey=${sk(cacheKey)} method=sdk durationMs=${durationMs} error=${JSON.stringify(result.error.slice(0, 120))}
+`
+    );
+    evictClient(cacheKey, "abort-error", null);
+    return;
+  }
+  appendAbortLine(
+    entry,
+    `[${isoTs()}] [client-abort] cacheKey=${sk(cacheKey)} method=sdk durationMs=${durationMs}
+`
+  );
+}
+function evictClient(cacheKey, reason, streamLog) {
+  const entry = clientPool.get(cacheKey);
+  if (!entry) return false;
+  const ageMs = Date.now() - entry.createdAt;
+  clientPool.delete(cacheKey);
+  try {
+    entry.userQueue.close();
+  } catch {
+  }
+  try {
+    entry.query.close();
+  } catch {
+  }
+  const line = `[${isoTs()}] [client-evict] reason=${reason} cacheKey=${sk(cacheKey)} ageMs=${ageMs} turnsServed=${entry.turnsServed}
+`;
+  if (streamLog) {
+    safeWrite(streamLog, line);
+  } else {
+    appendAbortLine(entry, line);
+  }
+  return true;
+}
+function acquireOneShotClient(cacheKey, opts, streamLog) {
+  const userQueue = new AsyncQueue();
+  const abortController = new AbortController();
+  let q;
+  try {
+    const sdkOptions = opts.buildSdkOptions();
+    q = query({ prompt: userQueue, options: { ...sdkOptions, abortController } });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    safeWrite(
+      streamLog,
+      `[${isoTs()}] [client-spawn-error] cacheKey=${sk(cacheKey)} site=compaction-one-shot reason=${JSON.stringify(reason.slice(0, 200))}
+`
+    );
+    throw err;
+  }
+  const entry = {
+    query: q,
+    userQueue,
+    abortController,
+    inflight: null,
+    createdAt: Date.now(),
+    lastUsedAt: Date.now(),
+    turnsServed: 1,
+    resumedFromSessionId: opts.resumedFromSessionId,
+    cachedTokensLastTurn: -1,
+    accountId: opts.accountId,
+    accountDir: opts.accountDir,
+    logKey: opts.logKey
+  };
+  safeWrite(
+    streamLog,
+    `[${isoTs()}] [client-cold-create] reason=compaction-one-shot cacheKey=${sk(cacheKey)} createdAtMs=${entry.createdAt}
+`
+  );
+  let evicted = false;
+  const evict = (reason) => {
+    if (evicted) return;
+    evicted = true;
+    const ageMs = Date.now() - entry.createdAt;
+    try {
+      entry.userQueue.close();
+    } catch {
+    }
+    try {
+      entry.query.close();
+    } catch {
+    }
+    safeWrite(
+      streamLog,
+      `[${isoTs()}] [client-evict] reason=${reason} cacheKey=${sk(cacheKey)} ageMs=${ageMs}
+`
+    );
+  };
+  return { entry, evict };
+}
+function recordCrash(cacheKey, reason, streamLog) {
+  const entry = clientPool.get(cacheKey);
+  if (!entry) return;
+  const tail = JSON.stringify(reason.slice(-512));
+  clientPool.delete(cacheKey);
+  try {
+    entry.userQueue.close();
+  } catch {
+  }
+  try {
+    entry.query.close();
+  } catch {
+  }
+  safeWrite(
+    streamLog,
+    `[${isoTs()}] [client-crash] cacheKey=${sk(cacheKey)} reason=${JSON.stringify(reason.slice(0, 80))} tail=${tail}
+`
+  );
+}
+var IDLE_TICK_MS = 6e4;
+var idleTickHandle = null;
+function evictIdleTick() {
+  const now = Date.now();
+  for (const [cacheKey, entry] of Array.from(clientPool.entries())) {
+    if (entry.inflight !== null) continue;
+    if (now - entry.lastUsedAt < idleEvictMs) continue;
+    const ageMs = now - entry.createdAt;
+    clientPool.delete(cacheKey);
+    try {
+      entry.userQueue.close();
+    } catch {
+    }
+    try {
+      entry.query.close();
+    } catch {
+    }
+    console.error(
+      `[${isoTs()}] [client-evict] reason=idle cacheKey=${sk(cacheKey)} ageMs=${ageMs} idleMs=${now - entry.lastUsedAt} turnsServed=${entry.turnsServed}`
+    );
+  }
+}
+function startIdleEvictTick() {
+  if (idleTickHandle) return;
+  idleTickHandle = setInterval(evictIdleTick, IDLE_TICK_MS);
+  if (idleTickHandle.unref) idleTickHandle.unref();
+}
+function stopIdleEvictTick() {
+  if (idleTickHandle) {
+    clearInterval(idleTickHandle);
+    idleTickHandle = null;
+  }
+}
+startIdleEvictTick();
+onClearAgentSessionId((cacheKey, reason) => {
+  const entry = clientPool.get(cacheKey);
+  if (!entry) return;
+  const ageMs = Date.now() - entry.createdAt;
+  clientPool.delete(cacheKey);
+  try {
+    entry.userQueue.close();
+  } catch {
+  }
+  try {
+    entry.query.close();
+  } catch {
+  }
+  console.error(
+    `[${isoTs()}] [client-evict] reason=clearAgentSessionId-${reason} cacheKey=${sk(cacheKey)} ageMs=${ageMs} turnsServed=${entry.turnsServed}`
+  );
+});
+onEvictPool((cacheKey, reason) => {
+  const entry = clientPool.get(cacheKey);
+  if (!entry) return;
+  const ageMs = Date.now() - entry.createdAt;
+  clientPool.delete(cacheKey);
+  try {
+    entry.userQueue.close();
+  } catch {
+  }
+  try {
+    entry.query.close();
+  } catch {
+  }
+  console.error(
+    `[${isoTs()}] [client-evict] reason=evictPool-${reason} cacheKey=${sk(cacheKey)} ageMs=${ageMs} turnsServed=${entry.turnsServed}`
+  );
+});
+function sk(cacheKey) {
+  return cacheKey.length > 12 ? cacheKey.slice(0, 12) + "\u2026" : cacheKey;
+}
+function safeWrite(stream, line) {
+  if (!stream || stream.destroyed) return;
+  if (stream.writableEnded) return;
+  try {
+    stream.write(line);
+  } catch {
+  }
+}
+function _poolSnapshotForTest() {
+  const now = Date.now();
+  return Array.from(clientPool.entries()).map(([cacheKey, entry]) => ({
+    cacheKey,
+    ageMs: now - entry.createdAt,
+    idleMs: now - entry.lastUsedAt,
+    turnsServed: entry.turnsServed,
+    inflight: entry.inflight !== null
+  }));
+}
+function _evictAllForTest(reason = "test-tear-down") {
+  for (const cacheKey of Array.from(clientPool.keys())) {
+    const entry = clientPool.get(cacheKey);
+    if (!entry) continue;
+    clientPool.delete(cacheKey);
+    try {
+      entry.userQueue.close();
+    } catch {
+    }
+    try {
+      entry.query.close();
+    } catch {
+    }
+  }
+  void reason;
+}
+
+export {
+  MAXY_DIR,
+  BRAND_NAME,
+  COMMERCIAL_MODE,
+  VNC_DISPLAY,
+  RFB_PORT,
+  WEBSOCKIFY_PORT,
+  CDP_PORT,
+  CHROMIUM_PROFILE_DIR,
+  USERS_FILE,
+  LOG_DIR,
+  BIN_DIR,
+  REMOTE_PASSWORD_FILE,
+  REMOTE_SESSION_SECRET_FILE,
+  TELEGRAM_WEBHOOK_SECRET_FILE,
+  TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE,
+  CLAUDE_CREDENTIALS_FILE,
+  substituteBrandPlaceholders,
+  PLATFORM_ROOT2 as PLATFORM_ROOT,
+  ACCOUNTS_DIR,
+  hasStubAccountDir,
+  resolveAccount,
+  readAgentFile,
+  readIdentity,
+  validateAgentSlug,
+  resolveDefaultAgentSlug,
+  resolveAgentConfig,
+  getDefaultAccountId,
+  resolveUserAccounts,
+  isoTs,
+  isBrowserTool,
+  runFailureDiagnostic,
+  agentLogStream,
+  emitMissingOnResolve,
+  sigtermFlushStreamLogs,
+  findMissingPlugins,
+  walkPremiumBundles,
+  autoDeliverPremiumPlugins,
+  reconcileEnabledPlugins,
+  autoDeliverUserPlugins,
+  migratePluginRenames,
+  autoDeliverBundleAgents,
+  loadEmbeddedPlugins,
+  buildPluginManifest,
+  validateComponentData,
+  streamLogPathFor,
+  buildSpawnEnv,
+  resolveClaudeBinary,
+  getMcpServers,
+  getBundleMtimeIso,
+  logToolSurface,
+  assembleAllowedToolsForAdminSpawn,
+  getStreamLogHandle,
+  appendStreamLogLine,
+  findFirstSubstantiveUserMessage,
+  getSession2 as getSession,
+  fingerprintSessionKey,
+  mintAdminSessionToken,
+  setWantsPriorConversation,
+  consumeWantsPriorConversation,
+  registerSession,
+  registerResumedSession,
+  getSessionMessages,
+  clearSessionHistory,
+  bufferPendingTurn,
+  getPendingTurnCount,
+  drainPendingTurns,
+  isFlushError,
+  maybeFlushConversationBuffer,
+  isDmChannelCacheKey,
+  getAgentNameForSession,
+  listAdminSessionsInProgress,
+  validateSession,
+  storeAgentSessionId,
+  getAgentSessionId,
+  setAgentSessionId,
+  storePendingCompactionSummary,
+  consumePendingCompactionSummary,
+  getAccountIdForSession,
+  getUserIdForSession,
+  getUserNameForSession,
+  getRoleForSession,
+  getConversationIdForSession,
+  getSessionKeyByConversationId,
+  setConversationIdForSession,
+  unregisterSession,
+  getGroupSlugForSession,
+  getVisitorIdForSession,
+  setGroupContextForSession,
+  registerGrantSession,
+  getGrantForSession,
+  completeGrantSetup,
+  getMessageHistory,
+  appendMessage,
+  storePendingTrimmedMessages,
+  consumePendingTrimmedMessages,
+  storeStalledSubagent,
+  consumeStalledSubagents,
+  setPendingCommitmentOffers,
+  getAgentTypeForSession,
+  clearMessageHistory,
+  clearAgentSessionId,
+  evictPool,
+  storeRecoveryHandoff,
+  consumeRecoveryHandoff,
+  getLastClearReason,
+  clearLastClearReason,
+  storeStallResume,
+  consumeStallResume,
+  acquireClient,
+  pushUserMessage,
+  pushUserToolResult,
+  setInflight,
+  recordCachedTokens,
+  getActiveClient,
+  interruptClient,
+  evictClient,
+  acquireOneShotClient,
+  recordCrash,
+  startIdleEvictTick,
+  stopIdleEvictTick,
+  _poolSnapshotForTest,
+  _evictAllForTest
+};