@rubytech/create-maxy 1.0.894 → 1.0.895

package/payload/server/server.js

@@ -7962,17 +7962,75 @@ app12.post("/", requireAdminSession, async (c) => {
 });
 var chat_failure_default = app12;
 
+// server/routes/admin/new-session-failure.ts
+var REASON_VALUES = /* @__PURE__ */ new Set(["server-status", "network-error"]);
+var ISO_RE2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
+var app13 = new Hono();
+app13.post("/", requireAdminSession, async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    console.error(`[admin-chat] new-conversation outcome=fail reason=schema:body-not-json`);
+    return c.json({ ok: false, reason: "body-not-json" }, 400);
+  }
+  if (typeof body.reason !== "string" || !REASON_VALUES.has(body.reason)) {
+    console.error(`[admin-chat] new-conversation outcome=fail reason=schema:reason`);
+    return c.json({ ok: false, reason: "schema:reason" }, 400);
+  }
+  if (typeof body.at !== "string" || !ISO_RE2.test(body.at)) {
+    console.error(`[admin-chat] new-conversation outcome=fail reason=schema:at`);
+    return c.json({ ok: false, reason: "schema:at" }, 400);
+  }
+  let statusToken;
+  if (body.reason === "server-status") {
+    if (typeof body.status !== "number" || !Number.isInteger(body.status) || body.status < 100 || body.status > 599) {
+      console.error(`[admin-chat] new-conversation outcome=fail reason=schema:status`);
+      return c.json({ ok: false, reason: "schema:status" }, 400);
+    }
+    statusToken = String(body.status);
+  } else {
+    statusToken = "net";
+  }
+  const cacheKey = c.var.cacheKey;
+  const cacheKeyTag = cacheKey.slice(0, 8);
+  console.log(`[admin-chat] new-conversation outcome=fail cacheKey=${cacheKeyTag} status=${statusToken} reason=${body.reason} at=${body.at}`);
+  return c.body(null, 204);
+});
+var new_session_failure_default = app13;
+
+// server/routes/admin/new-session-submit.ts
+var ISO_RE3 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
+var app14 = new Hono();
+app14.post("/", requireAdminSession, async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    console.error(`[admin-chat] new-conversation outcome=submit reason=schema:body-not-json`);
+    return c.json({ ok: false, reason: "body-not-json" }, 400);
+  }
+  if (typeof body.at !== "string" || !ISO_RE3.test(body.at)) {
+    console.error(`[admin-chat] new-conversation outcome=submit reason=schema:at`);
+    return c.json({ ok: false, reason: "schema:at" }, 400);
+  }
+  const cacheKey = c.var.cacheKey;
+  console.log(`[admin-chat] new-conversation outcome=submit cacheKey=${cacheKey.slice(0, 8)} at=${body.at}`);
+  return c.body(null, 204);
+});
+var new_session_submit_default = app14;
+
 // server/routes/admin/failure-report.ts
 var SESSION_KEY_RE = /^sk_[0-9a-f]{16}$/i;
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var ISO_RE2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
+var ISO_RE4 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var SAFE_TOKEN_RE = /^[\w.:-]{1,64}$/;
 function validate2(body) {
   const missing = [];
   if (typeof body.sessionKey !== "string" || !SESSION_KEY_RE.test(body.sessionKey)) missing.push("sessionKey");
   if (typeof body.conversationId !== "string" || !UUID_RE4.test(body.conversationId)) missing.push("conversationId");
   if (typeof body.lastUserMessageId !== "string" || !SAFE_TOKEN_RE.test(body.lastUserMessageId)) missing.push("lastUserMessageId");
-  if (typeof body.clickTs !== "string" || !ISO_RE2.test(body.clickTs)) missing.push("clickTs");
+  if (typeof body.clickTs !== "string" || !ISO_RE4.test(body.clickTs)) missing.push("clickTs");
   const snap = body.clientSnapshot;
   if (!snap || typeof snap !== "object") missing.push("clientSnapshot");
   if (missing.length > 0) return { ok: false, missing };
@@ -7995,8 +8053,8 @@ function validate2(body) {
     }
   };
 }
-var app13 = new Hono();
-app13.post("/", requireAdminSession, async (c) => {
+var app15 = new Hono();
+app15.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -8025,12 +8083,12 @@ app13.post("/", requireAdminSession, async (c) => {
   appendStreamLogLine(accountId, v.value.sessionKey, line);
   return c.json({ ok: true });
 });
-var failure_report_default = app13;
+var failure_report_default = app15;
 
 // server/routes/admin/sse-telemetry.ts
 var SESSION_KEY_RE2 = /^sk_[0-9a-f]{16}$/i;
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var ISO_RE3 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
+var ISO_RE5 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var PHASE_VALUES = /* @__PURE__ */ new Set(["connected", "event_received", "render_complete", "error", "close"]);
 var SAFE_TOKEN_RE2 = /^[\w.:-]{1,64}$/;
 function validate3(body) {
@@ -8038,7 +8096,7 @@ function validate3(body) {
   if (typeof body.sessionKey !== "string" || !SESSION_KEY_RE2.test(body.sessionKey)) missing.push("sessionKey");
   if (typeof body.conversationId !== "string" || !UUID_RE5.test(body.conversationId)) missing.push("conversationId");
   if (typeof body.phase !== "string" || !PHASE_VALUES.has(body.phase)) missing.push("phase");
-  if (typeof body.ts !== "string" || !ISO_RE3.test(body.ts)) missing.push("ts");
+  if (typeof body.ts !== "string" || !ISO_RE5.test(body.ts)) missing.push("ts");
   if (missing.length > 0) return { ok: false, missing };
   const eventType = typeof body.eventType === "string" && SAFE_TOKEN_RE2.test(body.eventType) ? body.eventType : "-";
   const messageId = typeof body.messageId === "string" && SAFE_TOKEN_RE2.test(body.messageId) ? body.messageId : "-";
@@ -8054,8 +8112,8 @@ function validate3(body) {
     }
   };
 }
-var app14 = new Hono();
-app14.post("/", requireAdminSession, async (c) => {
+var app16 = new Hono();
+app16.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -8078,11 +8136,11 @@ app14.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true });
 });
-var sse_telemetry_default = app14;
+var sse_telemetry_default = app16;
 
 // server/routes/admin/compact.ts
-var app15 = new Hono();
-app15.post("/", requireAdminSession, async (c) => {
+var app17 = new Hono();
+app17.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const encoder = new TextEncoder();
   const stream = new ReadableStream({
@@ -8109,7 +8167,7 @@ app15.post("/", requireAdminSession, async (c) => {
     }
   });
 });
-var compact_default = app15;
+var compact_default = app17;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync13, readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
@@ -8132,8 +8190,8 @@ function resolveSessionLogPaths(filename, logDirs) {
 
 // server/routes/admin/logs.ts
 var TAIL_BYTES = 8192;
-var app16 = new Hono();
-app16.get("/", async (c) => {
+var app18 = new Hono();
+app18.get("/", async (c) => {
   const fileParam = c.req.query("file");
   const typeParam = c.req.query("type");
   const conversationIdParam = c.req.query("conversationId");
@@ -8275,12 +8333,12 @@ app16.get("/", async (c) => {
   }
   return c.json({ logs });
 });
-var logs_default = app16;
+var logs_default = app18;
 
 // server/routes/admin/claude-info.ts
 import { execFileSync as execFileSync2 } from "child_process";
-var app17 = new Hono();
-app17.get("/", (c) => {
+var app19 = new Hono();
+app19.get("/", (c) => {
   let version = "unknown";
   try {
     const raw = execFileSync2("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
@@ -8298,14 +8356,14 @@ app17.get("/", (c) => {
   const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
   return c.json({ version, account, model, thinkingView });
 });
-var claude_info_default = app17;
+var claude_info_default = app19;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync14 } from "fs";
 import { resolve as resolve9 } from "path";
-var app18 = new Hono();
-app18.get("/:attachmentId", requireAdminSession, async (c) => {
+var app20 = new Hono();
+app20.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -8344,13 +8402,13 @@ app18.get("/:attachmentId", requireAdminSession, async (c) => {
     }
   });
 });
-var attachment_default = app18;
+var attachment_default = app20;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve10 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync12, existsSync as existsSync15, rmSync } from "fs";
-var app19 = new Hono();
-app19.get("/", (c) => {
+var app21 = new Hono();
+app21.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve10(account.accountDir, "agents");
@@ -8380,7 +8438,7 @@ app19.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app19.delete("/:slug", async (c) => {
+app21.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -8410,7 +8468,7 @@ app19.delete("/:slug", async (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-app19.post("/:slug/project", async (c) => {
+app21.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -8432,7 +8490,7 @@ app19.post("/:slug/project", async (c) => {
     return c.json({ error: `Projection failed: ${msg}` }, 500);
   }
 });
-var agents_default = app19;
+var agents_default = app21;
 
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
@@ -8723,8 +8781,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app20 = new Hono();
-app20.get("/", requireAdminSession, async (c) => {
+var app22 = new Hono();
+app22.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -8764,11 +8822,13 @@ app20.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app20.post("/new", requireAdminSession, async (c) => {
+app22.post("/new", requireAdminSession, async (c) => {
   const oldCacheKey = c.var.cacheKey;
+  console.log(`[admin-chat] new-conversation outcome=ingress cacheKey=${oldCacheKey.slice(0, 8)}`);
   const accountId = getAccountIdForSession(oldCacheKey);
   const userId = getUserIdForSession(oldCacheKey);
   if (!accountId || !userId) {
+    console.error(`[admin-chat] new-conversation outcome=fail reason=missing-account-or-user cacheKey=${oldCacheKey.slice(0, 8)}`);
     return c.json({ error: "Session missing account or user context" }, 400);
   }
   const newSignedSessionToken = crypto2.randomUUID();
@@ -8777,10 +8837,10 @@ app20.post("/new", requireAdminSession, async (c) => {
   registerSession(newCacheKey, "admin", accountId, void 0, userId, userName);
   const previousConversationId = clearSessionHistory(oldCacheKey);
   unregisterSession(oldCacheKey);
-  console.log(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} session reset for new conversation: oldCacheKey=${oldCacheKey.slice(0, 8)}\u2026 newCacheKey=${newCacheKey.slice(0, 8)}\u2026 previousConversationId=${previousConversationId?.slice(0, 8) ?? "none"}\u2026 newConversationId=deferred`);
+  console.log(`[admin-chat] new-conversation outcome=ok oldKey=${oldCacheKey.slice(0, 8)} newKey=${newCacheKey.slice(0, 8)} previousConversationId=${previousConversationId?.slice(0, 8) ?? "none"}`);
   return c.json({ session_key: newSignedSessionToken, conversationId: null });
 });
-app20.post("/switch", requireAdminSession, async (c) => {
+app22.post("/switch", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -8808,7 +8868,7 @@ app20.post("/switch", requireAdminSession, async (c) => {
   console.log(`[session-switch] from=${cacheKey.slice(0, 8)} to=${targetCacheKey.slice(0, 8)} targetConvId=${targetConversationId?.slice(0, 8) ?? "none"} accountId=${accountId.slice(0, 8)}`);
   return c.json({ session_key: targetSignedSessionToken, conversationId: targetConversationId });
 });
-app20.delete("/:id", requireAdminSession, async (c) => {
+app22.delete("/:id", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -8823,7 +8883,7 @@ app20.delete("/:id", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to delete session" }, 500);
   }
 });
-app20.post("/:id/resume", async (c) => {
+app22.post("/:id/resume", async (c) => {
   const conversationId = c.req.param("id");
   const t0 = Date.now();
   const signedSessionToken = c.req.query("session_key") ?? "";
@@ -9101,7 +9161,7 @@ app20.post("/:id/resume", async (c) => {
     }
   });
 });
-app20.post("/:id/label", requireAdminSession, async (c) => {
+app22.post("/:id/label", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -9128,7 +9188,7 @@ app20.post("/:id/label", requireAdminSession, async (c) => {
     return c.json({ label: null });
   }
 });
-app20.put("/:id/label", requireAdminSession, async (c) => {
+app22.put("/:id/label", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   let body;
@@ -9154,11 +9214,11 @@ app20.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app20;
+var sessions_default = app22;
 
 // server/routes/admin/browser.ts
-var app21 = new Hono();
-app21.post("/launch", async (c) => {
+var app23 = new Hono();
+app23.post("/launch", async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     if (transport === "vnc") {
@@ -9180,7 +9240,7 @@ app21.post("/launch", async (c) => {
     );
   }
 });
-var browser_default = app21;
+var browser_default = app23;
 
 // server/routes/admin/browser-iframe.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -9197,8 +9257,8 @@ function asString(v, max = 500) {
 function asNumber(v) {
   return typeof v === "number" && Number.isFinite(v) ? v : void 0;
 }
-var app22 = new Hono();
-app22.post("/event", async (c) => {
+var app24 = new Hono();
+app24.post("/event", async (c) => {
   let body = {};
   try {
     body = await c.req.json();
@@ -9219,7 +9279,7 @@ app22.post("/event", async (c) => {
   });
   return c.body(null, 204);
 });
-var browser_iframe_default = app22;
+var browser_iframe_default = app24;
 
 // app/lib/cdp-client.ts
 var CDP_HOST = "127.0.0.1";
@@ -9262,8 +9322,8 @@ async function cdpNavigateNewTab(url, opts = {}) {
 }
 
 // server/routes/admin/device-browser.ts
-var app23 = new Hono();
-app23.post("/navigate", async (c) => {
+var app25 = new Hono();
+app25.post("/navigate", async (c) => {
   const TAG19 = "[device-url:click]";
   let body;
   try {
@@ -9350,7 +9410,7 @@ app23.post("/navigate", async (c) => {
     targetId: outcome.targetId
   });
 });
-var device_browser_default = app23;
+var device_browser_default = app25;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
@@ -9359,8 +9419,8 @@ var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app24 = new Hono();
-app24.post("/", async (c) => {
+var app26 = new Hono();
+app26.post("/", async (c) => {
   const TAG19 = "[admin:events]";
   let body;
   try {
@@ -9391,7 +9451,7 @@ app24.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app24;
+var events_default = app26;
 
 // server/routes/admin/cloudflare.ts
 import { homedir as homedir2 } from "os";
@@ -9534,7 +9594,7 @@ function validateBody(body) {
   }
   return null;
 }
-var app25 = new Hono();
+var app27 = new Hono();
 function fieldFromReason(reason) {
   switch (reason) {
     case "not-signed-in":
@@ -9555,7 +9615,7 @@ function fieldFromReason(reason) {
       return "script";
   }
 }
-app25.get("/domains", requireAdminSession, async (c) => {
+app27.get("/domains", requireAdminSession, async (c) => {
   const started = Date.now();
   const cacheKey = c.var.cacheKey;
   let correlationId;
@@ -9651,7 +9711,7 @@ ${result.stderr}` : ""}`;
   return c.json(success, 200);
 });
 var TUNNELS_TIMEOUT_MS = 30 * 1e3;
-app25.get("/tunnels", requireAdminSession, async (c) => {
+app27.get("/tunnels", requireAdminSession, async (c) => {
   const started = Date.now();
   const cacheKey = c.var.cacheKey;
   let correlationId;
@@ -9748,7 +9808,7 @@ ${result.stderr}` : ""}`;
   const success = { ok: true, tunnels, defaultName, correlationId, streamLogPath };
   return c.json(success, 200);
 });
-app25.post("/setup", requireAdminSession, async (c) => {
+app27.post("/setup", requireAdminSession, async (c) => {
   const started = Date.now();
   const cacheKey = c.var.cacheKey;
   let correlationId;
@@ -10010,7 +10070,7 @@ actionId: ${actionId}`,
   };
   return ok(success);
 });
-var cloudflare_default = app25;
+var cloudflare_default = app27;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream3 } from "fs";
@@ -10443,8 +10503,8 @@ function buildDisplayPath(relPath2, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-var app26 = new Hono();
-app26.get("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
@@ -10505,7 +10565,7 @@ app26.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app26.get("/download", requireAdminSession, async (c) => {
+app28.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   if (!getAccountIdForSession(cacheKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
@@ -10553,7 +10613,7 @@ app26.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app26.post("/upload", requireAdminSession, async (c) => {
+app28.post("/upload", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10611,7 +10671,7 @@ app26.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app26.delete("/", requireAdminSession, async (c) => {
+app28.delete("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10678,7 +10738,7 @@ app26.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app26;
+var files_default = app28;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -11058,8 +11118,8 @@ var MAX_LIMIT = 2e3;
 var DEFAULT_VECTOR_THRESHOLD = 0.82;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage", "WhatsAppMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app27 = new Hono();
-app27.get("/", requireAdminSession, async (c) => {
+var app29 = new Hono();
+app29.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -11190,7 +11250,7 @@ app27.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app27;
+var graph_search_default = app29;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j2 from "neo4j-driver";
@@ -11348,8 +11408,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-var app28 = new Hono();
-app28.get("/", requireAdminSession, async (c) => {
+var app30 = new Hono();
+app30.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -11932,12 +11992,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app28;
+var graph_subgraph_default = app30;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash"];
-var app29 = new Hono();
-app29.post("/", requireAdminSession, async (c) => {
+var app31 = new Hono();
+app31.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12008,11 +12068,11 @@ app29.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app29;
+var graph_delete_default = app31;
 
 // server/routes/admin/graph-restore.ts
-var app30 = new Hono();
-app30.post("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12076,11 +12136,11 @@ app30.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app30;
+var graph_restore_default = app32;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app31 = new Hono();
-app31.get("/", requireAdminSession, async (c) => {
+var app33 = new Hono();
+app33.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12146,11 +12206,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app31;
+var graph_labels_in_graph_default = app33;
 
 // server/routes/admin/graph-default-view.ts
-var app32 = new Hono();
-app32.get("/", requireAdminSession, async (c) => {
+var app34 = new Hono();
+app34.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12188,7 +12248,7 @@ app32.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app32.put("/", requireAdminSession, async (c) => {
+app34.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12277,11 +12337,11 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app32;
+var graph_default_view_default = app34;
 
 // server/routes/admin/file-attach.ts
-var app33 = new Hono();
-app33.post("/", async (c) => {
+var app35 = new Hono();
+app35.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -12304,7 +12364,7 @@ app33.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app33;
+var file_attach_default = app35;
 
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j3 from "neo4j-driver";
@@ -12314,8 +12374,8 @@ import { existsSync as existsSync19 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-var app34 = new Hono();
-app34.get("/", requireAdminSession, async (c) => {
+var app36 = new Hono();
+app36.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12521,7 +12581,7 @@ function isWithin(target, root) {
   const rel = relative2(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app34;
+var sidebar_artefacts_default = app36;
 
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir3, readdir as readdir4, stat as stat5, writeFile as writeFile4 } from "fs/promises";
@@ -12529,8 +12589,8 @@ import { resolve as resolve16 } from "path";
 import { existsSync as existsSync20 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE8 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app35 = new Hono();
-app35.post("/", requireAdminSession, async (c) => {
+var app37 = new Hono();
+app37.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -12642,15 +12702,15 @@ async function resolveSavePath(id, accountId, accountDir) {
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
-var sidebar_artefact_save_default = app35;
+var sidebar_artefact_save_default = app37;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile5, readdir as readdir5 } from "fs/promises";
 import { existsSync as existsSync21 } from "fs";
 import { resolve as resolve17 } from "path";
 var UUID_RE9 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app36 = new Hono();
-app36.get("/", requireAdminSession, async (c) => {
+var app38 = new Hono();
+app38.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
@@ -12691,7 +12751,7 @@ app36.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var sidebar_artefact_content_default = app36;
+var sidebar_artefact_content_default = app38;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync22, readFileSync as readFileSync16 } from "fs";
@@ -12736,8 +12796,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app37 = new Hono();
-app37.get("/", async (c) => {
+var app39 = new Hono();
+app39.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12759,39 +12819,41 @@ app37.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app37;
+var health_default2 = app39;
 
 // server/routes/admin/index.ts
-var app38 = new Hono();
-app38.route("/session", session_default2);
-app38.route("/chat", chat_default2);
-app38.route("/chat-failure", chat_failure_default);
-app38.route("/failure-report", failure_report_default);
-app38.route("/sse-telemetry", sse_telemetry_default);
-app38.route("/compact", compact_default);
-app38.route("/logs", logs_default);
-app38.route("/claude-info", claude_info_default);
-app38.route("/attachment", attachment_default);
-app38.route("/agents", agents_default);
-app38.route("/sessions", sessions_default);
-app38.route("/browser", browser_default);
-app38.route("/browser-iframe", browser_iframe_default);
-app38.route("/device-browser", device_browser_default);
-app38.route("/events", events_default);
-app38.route("/cloudflare", cloudflare_default);
-app38.route("/files", files_default);
-app38.route("/graph-search", graph_search_default);
-app38.route("/graph-subgraph", graph_subgraph_default);
-app38.route("/graph-delete", graph_delete_default);
-app38.route("/graph-restore", graph_restore_default);
-app38.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app38.route("/graph-default-view", graph_default_view_default);
-app38.route("/file-attach", file_attach_default);
-app38.route("/sidebar-artefacts", sidebar_artefacts_default);
-app38.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app38.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app38.route("/health-brand", health_default2);
-var admin_default = app38;
+var app40 = new Hono();
+app40.route("/session", session_default2);
+app40.route("/chat", chat_default2);
+app40.route("/chat-failure", chat_failure_default);
+app40.route("/new-session-failure", new_session_failure_default);
+app40.route("/new-session-submit", new_session_submit_default);
+app40.route("/failure-report", failure_report_default);
+app40.route("/sse-telemetry", sse_telemetry_default);
+app40.route("/compact", compact_default);
+app40.route("/logs", logs_default);
+app40.route("/claude-info", claude_info_default);
+app40.route("/attachment", attachment_default);
+app40.route("/agents", agents_default);
+app40.route("/sessions", sessions_default);
+app40.route("/browser", browser_default);
+app40.route("/browser-iframe", browser_iframe_default);
+app40.route("/device-browser", device_browser_default);
+app40.route("/events", events_default);
+app40.route("/cloudflare", cloudflare_default);
+app40.route("/files", files_default);
+app40.route("/graph-search", graph_search_default);
+app40.route("/graph-subgraph", graph_subgraph_default);
+app40.route("/graph-delete", graph_delete_default);
+app40.route("/graph-restore", graph_restore_default);
+app40.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app40.route("/graph-default-view", graph_default_view_default);
+app40.route("/file-attach", file_attach_default);
+app40.route("/sidebar-artefacts", sidebar_artefacts_default);
+app40.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app40.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app40.route("/health-brand", health_default2);
+var admin_default = app40;
 
 // server/routes/sites.ts
 import { existsSync as existsSync23, readFileSync as readFileSync17, realpathSync as realpathSync4, statSync as statSync7 } from "fs";
@@ -12826,8 +12888,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app39 = new Hono();
-app39.get("/:rel{.*}", (c) => {
+var app41 = new Hono();
+app41.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -12930,7 +12992,7 @@ app39.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app39;
+var sites_default = app41;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -13340,9 +13402,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app40 = new Hono();
-app40.use("*", clientIpMiddleware);
-app40.use("*", async (c, next) => {
+var app42 = new Hono();
+app42.use("*", clientIpMiddleware);
+app42.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13352,7 +13414,7 @@ app40.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app40.use("*", async (c, next) => {
+app42.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13385,7 +13447,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app40.use("*", async (c, next) => {
+app42.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13425,7 +13487,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app40.post("/__remote-auth/login", async (c) => {
+app42.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13470,7 +13532,7 @@ app40.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app40.get("/__remote-auth/logout", (c) => {
+app42.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13483,7 +13545,7 @@ app40.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app40.post("/__remote-auth/change-password", async (c) => {
+app42.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13534,13 +13596,13 @@ app40.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app40.get("/__remote-auth/setup", (c) => {
+app42.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app40.post("/__remote-auth/set-initial-password", async (c) => {
+app42.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13578,10 +13640,10 @@ app40.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app40.get("/api/remote-auth/status", (c) => {
+app42.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app40.post("/api/remote-auth/set-password", async (c) => {
+app42.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13612,9 +13674,9 @@ app40.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app40.route("/api/_client-error", client_error_default);
+app42.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app40.use("*", async (c, next) => {
+app42.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -13654,15 +13716,15 @@ app40.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app40.route("/api/health", health_default);
-app40.route("/api/session", session_default);
-app40.route("/api/chat", chat_default);
-app40.route("/api/group", group_default);
-app40.route("/api/access", access_default);
-app40.route("/api/telegram", telegram_default);
-app40.route("/api/whatsapp", whatsapp_default);
-app40.route("/api/onboarding", onboarding_default);
-app40.route("/api/admin", admin_default);
+app42.route("/api/health", health_default);
+app42.route("/api/session", session_default);
+app42.route("/api/chat", chat_default);
+app42.route("/api/group", group_default);
+app42.route("/api/access", access_default);
+app42.route("/api/telegram", telegram_default);
+app42.route("/api/whatsapp", whatsapp_default);
+app42.route("/api/onboarding", onboarding_default);
+app42.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -13674,7 +13736,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app40.get("/agent-assets/:slug/:filename", (c) => {
+app42.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -13709,7 +13771,7 @@ app40.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app40.get("/generated/:filename", (c) => {
+app42.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -13739,7 +13801,7 @@ app40.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app40.route("/sites", sites_default);
+app42.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -13876,7 +13938,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app40.get("/", (c) => {
+app42.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13884,12 +13946,12 @@ app40.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app40.get("/public", (c) => {
+app42.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app40.get("/chat", (c) => {
+app42.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13908,9 +13970,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app40.use("/vnc-viewer.html", logViewerFetch);
-app40.use("/vnc-popout.html", logViewerFetch);
-app40.get("/vnc-popout.html", (c) => {
+app42.use("/vnc-viewer.html", logViewerFetch);
+app42.use("/vnc-popout.html", logViewerFetch);
+app42.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync19(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -13923,7 +13985,7 @@ app40.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app40.post("/api/vnc/client-event", async (c) => {
+app42.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13944,20 +14006,20 @@ app40.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app40.get("/g/:slug", (c) => {
+app42.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app40.get("/graph", (c) => {
+app42.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app40.get("/data", (c) => {
+app42.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app40.get("/:slug", async (c, next) => {
+app42.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13967,15 +14029,15 @@ app40.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app40.get("/favicon.ico", (c) => {
+  app42.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app40.use("/*", serveStatic({ root: "./public" }));
+app42.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.MAXY_UI_INTERNAL_PORT ?? process.env.PORT ?? "19199", 10);
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app40.fetch, port, hostname });
+var httpServer = serve({ fetch: app42.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 console.log("[boot] auth-mode summary: oauth=8 api-key=1 (api-key consumer: invokePublicAgent only)");
 var SUBAPP_MANIFEST = [
@@ -13996,7 +14058,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app40.routes ?? []) {
+  for (const r of app42.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });