@rubytech/create-realagent 1.0.622 → 1.0.623

package/payload/server/server.js

@@ -2896,8 +2896,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync26, existsSync as existsSync26, watchFile } from "fs";
-import { resolve as resolve27, join as join13, basename as basename6 } from "path";
+import { readFileSync as readFileSync27, existsSync as existsSync27, watchFile } from "fs";
+import { resolve as resolve27, join as join14, basename as basename6 } from "path";
 import { homedir as homedir4 } from "os";
 
 // app/lib/vnc-logger.ts
@@ -3829,7 +3829,7 @@ Content-Length: 0\r
 }
 
 // app/api/health/route.ts
-import { existsSync as existsSync11, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync13 } from "fs";
 import { createConnection as createConnection3 } from "net";
 
 // app/lib/claude-auth.ts
@@ -4164,9 +4164,9 @@ function keyFilePath() {
 import Anthropic2 from "@anthropic-ai/sdk";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { resolve as resolve6, join as join4 } from "path";
+import { resolve as resolve6, join as join5 } from "path";
 import { platform as osPlatform } from "os";
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync6, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync, cpSync, rmSync } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync7, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync, cpSync, rmSync } from "fs";
 import { lookup as dnsLookup } from "dns/promises";
 import { createConnection as netConnect } from "net";
 import { StringDecoder } from "string_decoder";
@@ -6037,6 +6037,73 @@ ${items}
 </commitment-detected>`;
 }
 
+// app/lib/tool-surface-filter.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { join as join4 } from "path";
+var ALLOWED_CLOUDFLARE_DURING_SETUP = /* @__PURE__ */ new Set([
+  "mcp__cloudflare__cloudflare-setup-run",
+  "mcp__cloudflare__cloudflare-setup-status"
+]);
+function shouldRemoveDuringCloudflareSetup(toolName) {
+  if (toolName.startsWith("mcp__plugin_playwright_playwright__")) return true;
+  if (toolName.startsWith("mcp__plugin_chrome-devtools-mcp_chrome-devtools__")) return true;
+  if (toolName.startsWith("mcp__cloudflare__")) {
+    return !ALLOWED_CLOUDFLARE_DURING_SETUP.has(toolName);
+  }
+  if (toolName === "Bash") return true;
+  if (toolName === "Write") return true;
+  if (toolName === "Edit") return true;
+  if (toolName === "NotebookEdit") return true;
+  return false;
+}
+function readCloudflareSetupState() {
+  const path2 = join4(MAXY_DIR, "cloudflared", "setup.state.json");
+  if (!existsSync6(path2)) return null;
+  try {
+    const raw2 = readFileSync7(path2, "utf-8");
+    const parsed = JSON.parse(raw2);
+    if (typeof parsed?.phase !== "string") return null;
+    const phase = parsed.phase;
+    const setupActive = phase !== "idle" && phase !== "healthy" && phase !== "unhealthy";
+    return { phase, domain: parsed.domain ?? null, setupActive };
+  } catch {
+    return null;
+  }
+}
+function applyToolSurfaceFilters(tools) {
+  const cf = readCloudflareSetupState();
+  if (cf && cf.setupActive) {
+    const kept = [];
+    const removed = [];
+    for (const t of tools) {
+      if (shouldRemoveDuringCloudflareSetup(t)) {
+        removed.push(t);
+      } else {
+        kept.push(t);
+      }
+    }
+    return {
+      tools: kept,
+      filtered: "cloudflare-setup",
+      phase: cf.phase,
+      removed: removed.length,
+      removedList: [...removed].sort().join(",")
+    };
+  }
+  return {
+    tools,
+    filtered: "none",
+    phase: cf?.phase ?? "idle",
+    removed: 0,
+    removedList: ""
+  };
+}
+function logToolSurfaceFilter(result) {
+  console.error(
+    `[chat-driver:tool-surface] filtered=${result.filtered} phase=${result.phase} removed=${result.removed} removed-list=${result.removedList}`
+  );
+}
+
 // app/lib/claude-agent.ts
 var LOG_RETENTION_DAYS = 7;
 var BROWSER_TOOL_PREFIXES = [
@@ -6270,7 +6337,7 @@ function sampleProcState(pid) {
       let sockets2 = 0;
       for (const tcpFile of ["/proc/" + pid + "/net/tcp", "/proc/" + pid + "/net/tcp6"]) {
         try {
-          const raw2 = readFileSync7(tcpFile, "utf-8");
+          const raw2 = readFileSync8(tcpFile, "utf-8");
           const lines2 = raw2.split("\n");
           for (let i = 1; i < lines2.length; i++) {
             const line = lines2[i].trim();
@@ -6286,7 +6353,7 @@ function sampleProcState(pid) {
       }
       let rssMb = 0;
       try {
-        const statm = readFileSync7(`/proc/${pid}/statm`, "utf-8").trim().split(/\s+/);
+        const statm = readFileSync8(`/proc/${pid}/statm`, "utf-8").trim().split(/\s+/);
         const rssPages = parseInt(statm[1] ?? "0", 10);
         if (Number.isFinite(rssPages)) rssMb = Math.round(rssPages * 4096 / (1024 * 1024));
       } catch {
@@ -6321,19 +6388,19 @@ function sampleProcState(pid) {
 }
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
 var ACCOUNTS_DIR = resolve6(PLATFORM_ROOT4, "..", "data/accounts");
-if (!existsSync6(PLATFORM_ROOT4)) {
+if (!existsSync7(PLATFORM_ROOT4)) {
   throw new Error(
     `PLATFORM_ROOT does not exist: ${PLATFORM_ROOT4}
 Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the platform directory.`
   );
 }
 function resolveAccount() {
-  if (!existsSync6(ACCOUNTS_DIR)) return null;
+  if (!existsSync7(ACCOUNTS_DIR)) return null;
   const usersFilePath = resolve6(PLATFORM_ROOT4, "config", "users.json");
   let usersJsonUserId = null;
-  if (existsSync6(usersFilePath)) {
+  if (existsSync7(usersFilePath)) {
     try {
-      const raw2 = readFileSync7(usersFilePath, "utf-8").trim();
+      const raw2 = readFileSync8(usersFilePath, "utf-8").trim();
       if (raw2) {
         const users = JSON.parse(raw2);
         if (users.length > 0) {
@@ -6348,8 +6415,8 @@ function resolveAccount() {
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const configPath2 = resolve6(ACCOUNTS_DIR, entry.name, "account.json");
-    if (!existsSync6(configPath2)) continue;
-    const raw2 = readFileSync7(configPath2, "utf-8");
+    if (!existsSync7(configPath2)) continue;
+    const raw2 = readFileSync8(configPath2, "utf-8");
     let config2;
     try {
       config2 = JSON.parse(raw2);
@@ -6383,8 +6450,8 @@ function resolveAccount() {
 }
 function readAgentFile(accountDir, agentName, filename) {
   const filePath = resolve6(accountDir, "agents", agentName, filename);
-  if (!existsSync6(filePath)) return null;
-  return readFileSync7(filePath, "utf-8");
+  if (!existsSync7(filePath)) return null;
+  return readFileSync8(filePath, "utf-8");
 }
 function readIdentity(accountDir, agentName) {
   return readAgentFile(accountDir, agentName, "IDENTITY.md");
@@ -6401,13 +6468,13 @@ function validateAgentSlug(slug) {
 }
 function resolveDefaultAgentSlug(accountDir) {
   const configPath2 = resolve6(accountDir, "account.json");
-  if (!existsSync6(configPath2)) {
+  if (!existsSync7(configPath2)) {
     console.error("[agent-resolve] account.json not found \u2014 cannot resolve defaultAgent");
     return null;
   }
   let config2;
   try {
-    config2 = JSON.parse(readFileSync7(configPath2, "utf-8"));
+    config2 = JSON.parse(readFileSync8(configPath2, "utf-8"));
   } catch (err) {
     console.error("[agent-resolve] failed to read account.json:", err);
     return null;
@@ -6417,7 +6484,7 @@ function resolveDefaultAgentSlug(accountDir) {
     return null;
   }
   const agentConfigPath = resolve6(accountDir, "agents", config2.defaultAgent, "config.json");
-  if (!existsSync6(agentConfigPath)) {
+  if (!existsSync7(agentConfigPath)) {
     console.error(`[agent-resolve] defaultAgent="${config2.defaultAgent}" has no config.json at ${agentConfigPath}`);
     return null;
   }
@@ -6492,20 +6559,20 @@ function resolveAgentConfig(accountDir, agentName) {
   const agentDir = resolve6(accountDir, "agents", agentName);
   const knowledgePath = resolve6(agentDir, "KNOWLEDGE.md");
   const summaryPath = resolve6(agentDir, "KNOWLEDGE-SUMMARY.md");
-  const hasKnowledge = existsSync6(knowledgePath);
-  const hasSummary = existsSync6(summaryPath);
+  const hasKnowledge = existsSync7(knowledgePath);
+  const hasSummary = existsSync7(summaryPath);
   if (hasKnowledge && hasSummary) {
     const knowledgeMtime = statSync3(knowledgePath).mtimeMs;
     const summaryMtime = statSync3(summaryPath).mtimeMs;
     if (summaryMtime >= knowledgeMtime) {
-      knowledge = readFileSync7(summaryPath, "utf-8");
+      knowledge = readFileSync8(summaryPath, "utf-8");
     } else {
       console.warn(`[agent-config] ${agentName}: KNOWLEDGE-SUMMARY.md is stale (KNOWLEDGE.md is newer) \u2014 using full knowledge`);
-      knowledge = readFileSync7(knowledgePath, "utf-8");
+      knowledge = readFileSync8(knowledgePath, "utf-8");
     }
     knowledgeBaked = true;
   } else if (hasKnowledge) {
-    knowledge = readFileSync7(knowledgePath, "utf-8");
+    knowledge = readFileSync8(knowledgePath, "utf-8");
     knowledgeBaked = true;
   }
   let budget = null;
@@ -6528,10 +6595,10 @@ function resolveAgentConfig(accountDir, agentName) {
 }
 function parsePluginFrontmatter(pluginDir) {
   const pluginPath = resolve6(PLATFORM_ROOT4, "plugins", pluginDir, "PLUGIN.md");
-  if (!existsSync6(pluginPath)) return null;
+  if (!existsSync7(pluginPath)) return null;
   let raw2;
   try {
-    raw2 = readFileSync7(pluginPath, "utf-8");
+    raw2 = readFileSync8(pluginPath, "utf-8");
   } catch {
     console.warn(`[plugins] cannot read ${pluginPath}`);
     return null;
@@ -6592,22 +6659,22 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
   const TAG18 = "[premium-auto-deliver]";
   const stagingRoot = resolve6(PLATFORM_ROOT4, "../premium-plugins");
   const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
-  if (!existsSync6(stagingRoot)) {
+  if (!existsSync7(stagingRoot)) {
     console.log(`${TAG18} no staging directory \u2014 skipping`);
     return;
   }
   for (const pluginName of purchasedPlugins) {
     const stagingDir = resolve6(stagingRoot, pluginName);
-    if (!existsSync6(stagingDir)) {
+    if (!existsSync7(stagingDir)) {
       console.log(`${TAG18} ${pluginName}: not in staging \u2014 skipping`);
       continue;
     }
-    const bundlePath = join4(stagingDir, "BUNDLE.md");
-    const isBundle = existsSync6(bundlePath);
+    const bundlePath = join5(stagingDir, "BUNDLE.md");
+    const isBundle = existsSync7(bundlePath);
     if (isBundle) {
       let bundleRaw;
       try {
-        bundleRaw = readFileSync7(bundlePath, "utf-8");
+        bundleRaw = readFileSync8(bundlePath, "utf-8");
       } catch (err) {
         console.log(`${TAG18} ${pluginName}: cannot read BUNDLE.md \u2014 ${err instanceof Error ? err.message : String(err)}`);
         continue;
@@ -6639,12 +6706,12 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
       let skipped = 0;
       for (const sub of subPlugins) {
         const target = resolve6(pluginsDir, sub);
-        if (existsSync6(resolve6(target, "PLUGIN.md"))) {
+        if (existsSync7(resolve6(target, "PLUGIN.md"))) {
           skipped++;
           continue;
         }
         const source = resolve6(stagingDir, "plugins", sub);
-        if (!existsSync6(source)) {
+        if (!existsSync7(source)) {
           console.log(`${TAG18} ${pluginName}/${sub}: source missing in staging \u2014 skipping`);
           continue;
         }
@@ -6658,7 +6725,7 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
       console.log(`${TAG18} ${pluginName} (bundle): ${delivered} delivered, ${skipped} already present`);
     } else {
       const target = resolve6(pluginsDir, pluginName);
-      if (existsSync6(resolve6(target, "PLUGIN.md"))) {
+      if (existsSync7(resolve6(target, "PLUGIN.md"))) {
         console.log(`${TAG18} ${pluginName}: already present \u2014 skipping`);
         continue;
       }
@@ -6700,7 +6767,7 @@ function migratePluginRenames(accountDir, config2) {
   if (!changed) return;
   const configPath2 = resolve6(accountDir, "account.json");
   try {
-    const raw2 = readFileSync7(configPath2, "utf-8");
+    const raw2 = readFileSync8(configPath2, "utf-8");
     const parsed = JSON.parse(raw2);
     parsed.enabledPlugins = migrated;
     writeFileSync5(configPath2, JSON.stringify(parsed, null, 2) + "\n");
@@ -6712,7 +6779,7 @@ function migratePluginRenames(accountDir, config2) {
   const pluginsDir = resolve6(PLATFORM_ROOT4, "plugins");
   for (const oldName of Object.keys(PLUGIN_RENAMES)) {
     const orphan = resolve6(pluginsDir, oldName);
-    if (existsSync6(orphan)) {
+    if (existsSync7(orphan)) {
       try {
         rmSync(orphan, { recursive: true });
         console.log(`${TAG18} removed orphan: ${oldName}`);
@@ -6727,20 +6794,20 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   const TAG18 = "[bundle-agent-deliver]";
   const stagingRoot = resolve6(PLATFORM_ROOT4, "../premium-plugins");
   const specialistsDir = resolve6(accountDir, "specialists", "agents");
-  if (!existsSync6(stagingRoot)) return;
-  if (!existsSync6(specialistsDir)) {
+  if (!existsSync7(stagingRoot)) return;
+  if (!existsSync7(specialistsDir)) {
     mkdirSync4(specialistsDir, { recursive: true });
   }
   const agentsmdPath = resolve6(accountDir, "agents", "admin", "AGENTS.md");
   let agentsmd = "";
   try {
-    agentsmd = existsSync6(agentsmdPath) ? readFileSync7(agentsmdPath, "utf-8") : "";
+    agentsmd = existsSync7(agentsmdPath) ? readFileSync8(agentsmdPath, "utf-8") : "";
   } catch {
   }
   let delivered = 0;
   for (const pluginName of purchasedPlugins) {
     const bundleAgentsDir = resolve6(stagingRoot, pluginName, "agents");
-    if (!existsSync6(bundleAgentsDir)) continue;
+    if (!existsSync7(bundleAgentsDir)) continue;
     let entries;
     try {
       entries = readdirSync2(bundleAgentsDir).filter((f) => f.endsWith(".md"));
@@ -6749,7 +6816,7 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
     }
     for (const filename of entries) {
       const target = resolve6(specialistsDir, filename);
-      if (existsSync6(target)) continue;
+      if (existsSync7(target)) continue;
       const source = resolve6(bundleAgentsDir, filename);
       try {
         cpSync(source, target);
@@ -6758,7 +6825,7 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
         continue;
       }
       try {
-        const content = readFileSync7(target, "utf-8");
+        const content = readFileSync8(target, "utf-8");
         const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
         if (fmMatch) {
           const nameMatch = fmMatch[1].match(/^name:\s*(.+)/m);
@@ -6794,7 +6861,7 @@ function assemblePublicPluginContent(pluginDir) {
   const pluginPath = resolve6(pluginRoot, "PLUGIN.md");
   let raw2;
   try {
-    raw2 = readFileSync7(pluginPath, "utf-8");
+    raw2 = readFileSync8(pluginPath, "utf-8");
   } catch {
     return null;
   }
@@ -6815,7 +6882,7 @@ function assemblePublicPluginContent(pluginDir) {
     const skillMdPath = resolve6(skillDir, "SKILL.md");
     let skillRaw;
     try {
-      skillRaw = readFileSync7(skillMdPath, "utf-8");
+      skillRaw = readFileSync8(skillMdPath, "utf-8");
     } catch {
       continue;
     }
@@ -6866,7 +6933,7 @@ function assemblePublicPluginContent(pluginDir) {
     }
     for (const refFile of refFiles) {
       try {
-        const refContent = readFileSync7(resolve6(refsDir, refFile), "utf-8").trim();
+        const refContent = readFileSync8(resolve6(refsDir, refFile), "utf-8").trim();
         if (refContent) {
           parts.push(`
 <!-- reference: ${refFile} -->`);
@@ -6940,7 +7007,7 @@ function loadEmbeddedPlugins(agentType, selectedPlugins, enabledPlugins) {
       const pluginPath = resolve6(pluginsDir, dir, "PLUGIN.md");
       let raw2;
       try {
-        raw2 = readFileSync7(pluginPath, "utf-8");
+        raw2 = readFileSync8(pluginPath, "utf-8");
       } catch (err) {
         console.warn(`[plugins] ${dir}: failed to read PLUGIN.md for ${agentType} embed: ${String(err)}`);
         continue;
@@ -6965,7 +7032,7 @@ function fetchMcpToolsList(pluginDir) {
   const cached2 = mcpToolsCache.get(pluginDir);
   if (cached2) return Promise.resolve(cached2);
   const serverPath = resolve6(PLATFORM_ROOT4, "plugins", pluginDir, "mcp/dist/index.js");
-  if (!existsSync6(serverPath)) return Promise.resolve([]);
+  if (!existsSync7(serverPath)) return Promise.resolve([]);
   const startMs = Date.now();
   return new Promise((resolvePromise) => {
     const proc = spawn2(process.execPath, [serverPath], {
@@ -7169,7 +7236,7 @@ ${specialist}: ${plugins.join(", ")}`);
     const references = [];
     const scanDir = (base, prefix, target) => {
       const scanPath = resolve6(pluginRoot, base);
-      if (!existsSync6(scanPath)) return;
+      if (!existsSync7(scanPath)) return;
       try {
         const walk = (current, rel) => {
           for (const entry of readdirSync2(current)) {
@@ -7202,7 +7269,7 @@ ${specialist}: ${plugins.join(", ")}`);
       }
     } else if (parsed.tools.length > 0) {
       const serverPath = resolve6(PLATFORM_ROOT4, "plugins", dir, "mcp/dist/index.js");
-      if (existsSync6(serverPath)) {
+      if (existsSync7(serverPath)) {
         fallbackSourced++;
         console.error(`[plugin-manifest] ${dir}: tools/list empty \u2014 fallback to frontmatter (${parsed.tools.length} tools)`);
       }
@@ -7277,16 +7344,16 @@ function getDefaultAccountId() {
   return resolveAccount()?.accountId ?? null;
 }
 function resolveUserAccounts(userId) {
-  if (!existsSync6(ACCOUNTS_DIR)) return [];
+  if (!existsSync7(ACCOUNTS_DIR)) return [];
   const results = [];
   const entries = readdirSync2(ACCOUNTS_DIR, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     const configPath2 = resolve6(ACCOUNTS_DIR, entry.name, "account.json");
-    if (!existsSync6(configPath2)) continue;
+    if (!existsSync7(configPath2)) continue;
     let config2;
     try {
-      config2 = JSON.parse(readFileSync7(configPath2, "utf-8"));
+      config2 = JSON.parse(readFileSync8(configPath2, "utf-8"));
     } catch {
       console.error(`[session] account.json corrupt at ${configPath2} \u2014 skipping`);
       continue;
@@ -7606,7 +7673,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
         }
       }
       const mcpEntry = resolve6(PLATFORM_ROOT4, "plugins", dir, "mcp/dist/index.js");
-      if (!existsSync6(mcpEntry)) continue;
+      if (!existsSync7(mcpEntry)) continue;
       servers[dir] = {
         command: "node",
         args: [mcpEntry],
@@ -7691,6 +7758,8 @@ var ADMIN_CORE_TOOLS = [
   "mcp__cloudflare__tunnel-enable",
   "mcp__cloudflare__tunnel-disable",
   "mcp__cloudflare__tunnel-add-hostname",
+  "mcp__cloudflare__cloudflare-setup-run",
+  "mcp__cloudflare__cloudflare-setup-status",
   "mcp__cloudflare__dns-lookup",
   "mcp__tasks__task-create",
   "mcp__tasks__task-update",
@@ -7757,6 +7826,12 @@ function getAdminAllowedTools(enabledPlugins) {
   }
   return tools;
 }
+function assembleAllowedToolsForAdminSpawn(enabledPlugins) {
+  const base = getAdminAllowedTools(enabledPlugins);
+  const result = applyToolSurfaceFilters(base);
+  logToolSurfaceFilter(result);
+  return result.tools;
+}
 var QUERY_CLASSIFIER_MODEL = HAIKU_MODEL2;
 var QUERY_CLASSIFIER_TIMEOUT_MS = 3e3;
 var QUERY_CLASSIFIER_MSG_CAP = 500;
@@ -7845,7 +7920,7 @@ ${message.slice(0, QUERY_CLASSIFIER_MSG_CAP)}`
 }
 async function fetchMemoryContext(accountId, query, sessionKey, options) {
   const serverPath = resolve6(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js");
-  if (!existsSync6(serverPath)) {
+  if (!existsSync7(serverPath)) {
     console.error(`[fetchMemoryContext] MCP server not found: ${serverPath}`);
     return null;
   }
@@ -7943,7 +8018,7 @@ async function fetchMemoryContext(accountId, query, sessionKey, options) {
 async function compactTrimmedMessages(accountId, trimmedMessages) {
   if (trimmedMessages.length === 0) return true;
   const serverPath = resolve6(PLATFORM_ROOT4, "plugins/memory/mcp/dist/index.js");
-  if (!existsSync6(serverPath)) return false;
+  if (!existsSync7(serverPath)) return false;
   const briefing = trimmedMessages.map((m) => `[${m.role.toUpperCase()}] ${m.content}`).join("\n\n");
   return new Promise((resolvePromise) => {
     const proc = spawn2(process.execPath, [serverPath], {
@@ -8261,7 +8336,7 @@ var COMPACTION_TIMEOUT_MS = 45e3;
 async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSessionId, adminModel, conversationId, enabledPlugins) {
   const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, conversationId, void 0, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir, conversationId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  if (!existsSync7(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir, conversationId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
     "--print",
@@ -8273,7 +8348,7 @@ async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSes
     "--mcp-config",
     mcpConfig,
     "--allowedTools",
-    getAdminAllowedTools(enabledPlugins).join(","),
+    assembleAllowedToolsForAdminSpawn(enabledPlugins).join(","),
     "--permission-mode",
     "dontAsk",
     "--model",
@@ -9150,7 +9225,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
   const ccUserId = sessionKey ? getUserIdForSession(sessionKey) : void 0;
   const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, spawnConvId, ccUserId, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync6(specialistsDir)) agentLogStream("claude-agent-stream", accountDir, spawnConvId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  if (!existsSync7(specialistsDir)) agentLogStream("claude-agent-stream", accountDir, spawnConvId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
     "--print",
@@ -9162,7 +9237,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     "--mcp-config",
     mcpConfig,
     "--allowedTools",
-    getAdminAllowedTools(enabledPlugins).join(","),
+    assembleAllowedToolsForAdminSpawn(enabledPlugins).join(","),
     "--permission-mode",
     "dontAsk",
     "--model",
@@ -9496,7 +9571,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   const managedUserId = getUserIdForSession(sessionKey);
   const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedConvId, managedUserId, enabledPlugins) });
   const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync6(specialistsDir)) streamLog.write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  if (!existsSync7(specialistsDir)) streamLog.write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const fullMessage = attachments.length > 0 ? message + buildAttachmentMetaText(attachments) : message;
   const args = [
@@ -9509,7 +9584,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
     "--mcp-config",
     mcpConfig,
     "--allowedTools",
-    getAdminAllowedTools(enabledPlugins).join(","),
+    assembleAllowedToolsForAdminSpawn(enabledPlugins).join(","),
     "--permission-mode",
     "dontAsk",
     "--model",
@@ -10166,7 +10241,7 @@ ${sessionContext}`;
       const skillPath = resolve6(PLATFORM_ROOT4, "plugins/admin/skills/onboarding/SKILL.md");
       let skillContent = "";
       try {
-        skillContent = readFileSync7(skillPath, "utf-8");
+        skillContent = readFileSync8(skillPath, "utf-8");
       } catch (err) {
         console.error(`[onboarding-inject] accountId=${accountId.slice(0, 8)}\u2026 error=skill-read-failed path=${skillPath} reason=${err instanceof Error ? err.message : String(err)}`);
       }
@@ -10366,7 +10441,7 @@ ${block}`;
 import { basename as basename2 } from "path";
 
 // app/lib/review-detector/rules.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync7, statSync as statSync4, mkdirSync as mkdirSync5, renameSync } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync6, existsSync as existsSync8, statSync as statSync4, mkdirSync as mkdirSync5, renameSync } from "fs";
 import { resolve as resolve7, dirname as dirname2 } from "path";
 var DEFAULT_SCAN_INTERVAL_MS = 5e3;
 var RATE_LIMIT_PATTERN = "rate[- ]?limit(?:ed| reached| hit)|(?:HTTP|status)[^a-z]{0,3}429|too many requests";
@@ -10696,6 +10771,38 @@ function defaultRules() {
       thresholdCount: 0,
       thresholdWindowMinutes: 0,
       suggestedAction: "A device-bound URL click failed to drive Chromium on the device's VNC display. Identify the `intent` and `hostname` from the log line, then check the VNC surface: read `vnc-boot.log` and confirm Chromium on :99 is responding on CDP port 9222. If CDP is unreachable, the operator needs to restart the VNC stack; if CDP is reachable but navigation errored, the URL itself may be malformed upstream \u2014 grep the stream log for the originating `[device-url:render]` line."
+    },
+    {
+      // Task 547: catches agent prose that forks or narrates during an
+      // orchestrated flow. The tool-surface gate filters the raw tunnel-*
+      // tools, Playwright, and Bash/Write/Edit while cloudflare-setup-run
+      // is mid-flow, so the agent cannot *call* a deviating tool — but the
+      // agent could still narrate ("Want me to kick off the login flow
+      // now?", "Or would you prefer to do it manually?"). This rule catches
+      // that narration surface.
+      //
+      // The task file prescribes a `preceded-by` rule type (scopes the
+      // followup pattern to a window after a `cloudflare-setup-run` tool
+      // result). That type is introduced by Task 544, which has not
+      // shipped at the time of writing. The fallback named in Task 547 is
+      // a pure `repeated-error` with the followup pattern only — accepts
+      // the false-positive surface (other contexts where the agent asks
+      // "Want me to X, or Y?") until 544 lands. Any such false-positive is
+      // also caught by the pre-existing `agent-choice-fork` rule, so the
+      // net observability cost is zero; the name and suggestedAction below
+      // point a reader at Task 547 specifically when this rule fires
+      // during a cloudflare setup. When 544 ships, migrate this to
+      // `preceded-by` with triggerPattern="cloudflare-setup-run" and
+      // followupWindow=5 lines.
+      id: "orchestrator-mid-flow-fork",
+      name: "Agent narration or fork during an orchestrated flow",
+      type: "repeated-error",
+      logSource: "any",
+      pattern: "(Want me to|Should I|Do you want me|Or would you|Either way|Meanwhile)[^\\n]+\\?",
+      thresholdCount: 1,
+      thresholdWindowMinutes: 60,
+      scope: "session",
+      suggestedAction: "Review Task 547 \u2014 during an orchestrated flow (e.g. cloudflare-setup-run), the agent's only permitted output is relaying the tool's result verbatim and passing the operator's input through. Any forking or narrative prose is a deviation even though the tool-surface gate has filtered the deviating tools out of the menu. Check whether the offending turn occurred during a cloudflare setup (grep `[cloudflare:setup-run:` near this line); if so, the IDENTITY.md Tool-Surface Gates section may need a sharper reminder."
     }
   ];
 }
@@ -10704,7 +10811,7 @@ function rulesFilePath(configDir2) {
 }
 function ensureRulesFile(configDir2) {
   const path2 = rulesFilePath(configDir2);
-  if (existsSync7(path2)) return { created: false, path: path2 };
+  if (existsSync8(path2)) return { created: false, path: path2 };
   mkdirSync5(dirname2(path2), { recursive: true });
   const body = {
     scanIntervalMs: DEFAULT_SCAN_INTERVAL_MS,
@@ -10715,10 +10822,10 @@ function ensureRulesFile(configDir2) {
 }
 function loadRules(configDir2) {
   const path2 = rulesFilePath(configDir2);
-  if (!existsSync7(path2)) {
+  if (!existsSync8(path2)) {
     throw new Error(`rules file missing at ${path2}`);
   }
-  const raw2 = readFileSync8(path2, "utf-8");
+  const raw2 = readFileSync9(path2, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw2);
@@ -10883,16 +10990,16 @@ function validateRule(input, label, seenIds) {
 }
 
 // app/lib/review-detector/sources.ts
-import { existsSync as existsSync8, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve8, join as join5, basename, dirname as dirname3 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync2, mkdirSync as mkdirSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve8, join as join6, basename, dirname as dirname3 } from "path";
 function tailStatePath(configDir2) {
   return resolve8(configDir2, "review-state.json");
 }
 function loadTailState(configDir2) {
   const path2 = tailStatePath(configDir2);
-  if (!existsSync8(path2)) return {};
+  if (!existsSync9(path2)) return {};
   try {
-    const raw2 = readFileSync9(path2, "utf-8");
+    const raw2 = readFileSync10(path2, "utf-8");
     const parsed = JSON.parse(raw2);
     if (!parsed || typeof parsed !== "object") return {};
     const clean = {};
@@ -10918,18 +11025,18 @@ function saveTailState(configDir2, state) {
 function discoverSourceFiles(configDir2, accountLogDir2, logicalSource) {
   if (logicalSource === "server") {
     const p = resolve8(configDir2, "logs", "server.log");
-    return existsSync8(p) ? [{ logicalSource: "server", filepath: p }] : [];
+    return existsSync9(p) ? [{ logicalSource: "server", filepath: p }] : [];
   }
   if (logicalSource === "vnc") {
     const p = resolve8(configDir2, "logs", "vnc-boot.log");
-    return existsSync8(p) ? [{ logicalSource: "vnc", filepath: p }] : [];
+    return existsSync9(p) ? [{ logicalSource: "vnc", filepath: p }] : [];
   }
   if (logicalSource === "cloudflared") {
     const files2 = [];
     const daemon = resolve8(configDir2, "logs", "cloudflared.log");
-    if (existsSync8(daemon)) files2.push({ logicalSource: "cloudflared", filepath: daemon });
+    if (existsSync9(daemon)) files2.push({ logicalSource: "cloudflared", filepath: daemon });
     const login = resolve8(configDir2, "logs", "cloudflared-login.log");
-    if (existsSync8(login)) files2.push({ logicalSource: "cloudflared", filepath: login });
+    if (existsSync9(login)) files2.push({ logicalSource: "cloudflared", filepath: login });
     return files2;
   }
   const prefix = {
@@ -10939,7 +11046,7 @@ function discoverSourceFiles(configDir2, accountLogDir2, logicalSource) {
     public: "public-agent-stream-",
     mcp: "mcp-"
   }[logicalSource];
-  if (!existsSync8(accountLogDir2)) return [];
+  if (!existsSync9(accountLogDir2)) return [];
   const files = [];
   let scanned = 0;
   let skippedPrefixMismatch = 0;
@@ -10949,7 +11056,7 @@ function discoverSourceFiles(configDir2, accountLogDir2, logicalSource) {
     const matchesPrefix = entry.startsWith(prefix);
     const isLog = entry.endsWith(".log");
     if (matchesPrefix && isLog) {
-      files.push({ logicalSource, filepath: join5(accountLogDir2, entry) });
+      files.push({ logicalSource, filepath: join6(accountLogDir2, entry) });
     } else if (!matchesPrefix) {
       skippedPrefixMismatch += 1;
     } else {
@@ -10981,7 +11088,7 @@ function discoverAllSources(configDir2, accountLogDir2) {
   ];
 }
 function readNewLines(filepath, prev) {
-  if (!existsSync8(filepath)) return null;
+  if (!existsSync9(filepath)) return null;
   const stat4 = statSync5(filepath);
   const size = stat4.size;
   const inode = stat4.ino;
@@ -11034,12 +11141,12 @@ function readNewLines(filepath, prev) {
   }
 }
 function countRecentWrites(dir, sinceMs) {
-  if (!existsSync8(dir)) return 0;
+  if (!existsSync9(dir)) return 0;
   let count = 0;
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
     if (!entry.isFile()) continue;
     try {
-      const st = statSync5(join5(dir, entry.name));
+      const st = statSync5(join6(dir, entry.name));
       if (st.mtimeMs >= sinceMs) count += 1;
     } catch {
     }
@@ -11047,7 +11154,7 @@ function countRecentWrites(dir, sinceMs) {
   return count;
 }
 function fileLastWriteMs(path2) {
-  if (!existsSync8(path2)) return null;
+  if (!existsSync9(path2)) return null;
   try {
     return statSync5(path2).mtimeMs;
   } catch {
@@ -11062,7 +11169,7 @@ function sourceKey(file2) {
 }
 
 // app/lib/review-detector/writer.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync6 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync8, renameSync as renameSync3, statSync as statSync6 } from "fs";
 import { resolve as resolve9, dirname as dirname4 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function reviewLogPath(configDir2) {
@@ -11200,8 +11307,8 @@ function queueAlert(configDir2, accountId, match2) {
 }
 async function drainPendingAlerts(configDir2) {
   const path2 = pendingAlertsPath(configDir2);
-  if (!existsSync9(path2)) return { drained: 0, remaining: 0 };
-  const raw2 = readFileSync10(path2, "utf-8");
+  if (!existsSync10(path2)) return { drained: 0, remaining: 0 };
+  const raw2 = readFileSync11(path2, "utf-8");
   const lines = raw2.split("\n").filter((l) => l.trim().length > 0);
   if (lines.length === 0) return { drained: 0, remaining: 0 };
   const remaining = [];
@@ -25631,16 +25738,16 @@ var WhatsAppConfigSchema = external_exports.object({
 });
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync11, writeFileSync as writeFileSync9, existsSync as existsSync10 } from "fs";
-import { resolve as resolve11, join as join6 } from "path";
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync9, existsSync as existsSync11 } from "fs";
+import { resolve as resolve11, join as join7 } from "path";
 var TAG2 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve11(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
-  if (!existsSync10(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync11(path2, "utf-8"));
+  if (!existsSync11(path2)) throw new Error(`account.json not found at ${path2}`);
+  return JSON.parse(readFileSync12(path2, "utf-8"));
 }
 function writeConfig(accountDir, config2) {
   const path2 = configPath(accountDir);
@@ -25814,8 +25921,8 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join6(accountDir, "agents", trimmed, "config.json");
-  if (!existsSync10(agentConfigPath)) {
+  const agentConfigPath = join7(accountDir, "agents", trimmed, "config.json");
+  if (!existsSync11(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
   try {
@@ -26855,7 +26962,7 @@ async function sendMediaMessage(sock, to, media, opts) {
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID5 } from "crypto";
 import { writeFile, mkdir } from "fs/promises";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -26941,7 +27048,7 @@ async function downloadInboundMedia(msg, sock, opts) {
     await mkdir(MEDIA_DIR, { recursive: true });
     const ext = mimeToExt(mimetype ?? "application/octet-stream");
     const filename = `${randomUUID5()}.${ext}`;
-    const filePath = join7(MEDIA_DIR, filename);
+    const filePath = join8(MEDIA_DIR, filename);
     await writeFile(filePath, buffer);
     const sizeKB = (buffer.length / 1024).toFixed(0);
     console.error(`${TAG8} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
@@ -27903,8 +28010,8 @@ async function GET(req, remoteAddress) {
   const browserTransport = resolveBrowserTransport(req, remoteAddress);
   let pinConfigured = false;
   try {
-    if (existsSync11(USERS_FILE)) {
-      const raw2 = readFileSync12(USERS_FILE, "utf-8").trim();
+    if (existsSync12(USERS_FILE)) {
+      const raw2 = readFileSync13(USERS_FILE, "utf-8").trim();
       if (raw2) {
         const users = JSON.parse(raw2);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -27923,7 +28030,7 @@ async function GET(req, remoteAddress) {
   const vncRunning = await checkPort(6080);
   let apiKeyConfigured = false;
   try {
-    apiKeyConfigured = existsSync11(keyFilePath());
+    apiKeyConfigured = existsSync12(keyFilePath());
   } catch {
   }
   let apiKeyStatus = "missing";
@@ -27991,7 +28098,7 @@ async function GET(req, remoteAddress) {
 
 // app/api/session/route.ts
 import { resolve as resolve12 } from "path";
-import { existsSync as existsSync12, writeFileSync as writeFileSync10, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync13, writeFileSync as writeFileSync10, mkdirSync as mkdirSync8 } from "fs";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function POST(req) {
   let body;
@@ -28042,7 +28149,7 @@ async function POST(req) {
   if (account) {
     const agentDir = resolve12(account.accountDir, "agents", agentSlug);
     const agentConfigPath = resolve12(agentDir, "config.json");
-    if (!existsSync12(agentDir) || !existsSync12(agentConfigPath)) {
+    if (!existsSync13(agentDir) || !existsSync13(agentConfigPath)) {
       return Response.json({ error: "Agent not found" }, { status: 404 });
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -28417,7 +28524,7 @@ async function storeGeneratedFile(accountId, filePath) {
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 var TAG13 = "[voice]";
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
@@ -28455,9 +28562,9 @@ async function transcribeVoiceNote(file2, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join8(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join9(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join8(tempDir, `recording${ext}`);
+    tempPath = join9(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file2.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -29008,7 +29115,7 @@ async function POST2(req) {
 
 // app/lib/access-gate.ts
 import neo4j2 from "neo4j-driver";
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { resolve as resolve14 } from "path";
 import { randomUUID as randomUUID7, randomInt } from "crypto";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
@@ -29017,7 +29124,7 @@ function readPassword2() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
   const passwordFile = resolve14(PLATFORM_ROOT6, "config/.neo4j-password");
   try {
-    return readFileSync13(passwordFile, "utf-8").trim();
+    return readFileSync14(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -29615,7 +29722,7 @@ async function POST6(req) {
 }
 
 // app/lib/brevo-sms.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, existsSync as existsSync13, chmodSync } from "fs";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, existsSync as existsSync14, chmodSync } from "fs";
 import { dirname as dirname5 } from "path";
 import { resolve as resolve15 } from "path";
 var BREVO_API_KEY_FILE = resolve15(MAXY_DIR, ".brevo-api-key");
@@ -29626,8 +29733,8 @@ var platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
 if (platformRoot2) {
   try {
     const brandPath3 = resolve15(platformRoot2, "config", "brand.json");
-    if (existsSync13(brandPath3)) {
-      const brand = JSON.parse(readFileSync14(brandPath3, "utf-8"));
+    if (existsSync14(brandPath3)) {
+      const brand = JSON.parse(readFileSync15(brandPath3, "utf-8"));
       if (brand.productName) BREVO_SENDER = brand.productName;
     }
   } catch {
@@ -29635,7 +29742,7 @@ if (platformRoot2) {
 }
 function readBrevoApiKey() {
   try {
-    const key = readFileSync14(BREVO_API_KEY_FILE, "utf-8").trim();
+    const key = readFileSync15(BREVO_API_KEY_FILE, "utf-8").trim();
     if (!key) {
       throw new Error(`Brevo API key file is empty: ${BREVO_API_KEY_FILE}`);
     }
@@ -29650,7 +29757,7 @@ function readBrevoApiKey() {
   }
 }
 function hasBrevoApiKey() {
-  return existsSync13(BREVO_API_KEY_FILE);
+  return existsSync14(BREVO_API_KEY_FILE);
 }
 async function sendSms(recipient, content, opts) {
   let apiKey;
@@ -29815,15 +29922,15 @@ function checkTelegramAccess(params) {
 }
 
 // app/api/telegram/webhook/route.ts
-import { existsSync as existsSync14, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync16 } from "fs";
 import { timingSafeEqual as timingSafeEqual2 } from "crypto";
 var TAG15 = "[telegram-webhook]";
 var TELEGRAM_API = "https://api.telegram.org";
 function getWebhookSecret(botType) {
   const filePath = botType === "admin" ? TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE : TELEGRAM_WEBHOOK_SECRET_FILE;
   try {
-    if (!existsSync14(filePath)) return null;
-    const secret = readFileSync15(filePath, "utf-8").trim();
+    if (!existsSync15(filePath)) return null;
+    const secret = readFileSync16(filePath, "utf-8").trim();
     return secret || null;
   } catch {
     return null;
@@ -29980,7 +30087,7 @@ async function POST8(req) {
 }
 
 // app/api/whatsapp/login/start/route.ts
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID8 } from "crypto";
@@ -30210,7 +30317,7 @@ async function POST9(req) {
     const body = await req.json().catch(() => ({}));
     const accountId = validateAccountId(body.accountId);
     const force = body.force ?? false;
-    const authDir = join9(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join10(MAXY_DIR, "credentials", "whatsapp", accountId);
     const result = await startLogin({ accountId, authDir, force });
     console.error(`[whatsapp:api] login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return Response.json(result);
@@ -30424,7 +30531,7 @@ function serializeWhatsAppSchema() {
 
 // app/api/whatsapp/config/route.ts
 import { resolve as resolve16 } from "path";
-import { readdirSync as readdirSync4, readFileSync as readFileSync16, existsSync as existsSync15 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync17, existsSync as existsSync16 } from "fs";
 async function POST14(req) {
   try {
     const body = await req.json().catch(() => ({}));
@@ -30474,15 +30581,15 @@ async function POST14(req) {
       case "list-public-agents": {
         const agentsDir = resolve16(account.accountDir, "agents");
         const agents = [];
-        if (existsSync15(agentsDir)) {
+        if (existsSync16(agentsDir)) {
           try {
             const entries = readdirSync4(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
               const configPath2 = resolve16(agentsDir, entry.name, "config.json");
-              if (!existsSync15(configPath2)) continue;
+              if (!existsSync16(configPath2)) continue;
               try {
-                const config2 = JSON.parse(readFileSync16(configPath2, "utf-8"));
+                const config2 = JSON.parse(readFileSync17(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config2.displayName ?? entry.name });
               } catch {
                 console.error(`[whatsapp:api] config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -30898,15 +31005,15 @@ async function POST17(req, remoteAddress) {
 }
 
 // app/api/onboarding/set-pin/route.ts
-import { existsSync as existsSync16, writeFileSync as writeFileSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync17, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync17, writeFileSync as writeFileSync13, mkdirSync as mkdirSync10, readFileSync as readFileSync18, unlinkSync as unlinkSync2 } from "fs";
 import { createHash, randomUUID as randomUUID9 } from "crypto";
 import { dirname as dirname6 } from "path";
 function hashPin(pin) {
   return createHash("sha256").update(pin).digest("hex");
 }
 function readUsersFile() {
-  if (!existsSync16(USERS_FILE)) return null;
-  const raw2 = readFileSync17(USERS_FILE, "utf-8").trim();
+  if (!existsSync17(USERS_FILE)) return null;
+  const raw2 = readFileSync18(USERS_FILE, "utf-8").trim();
   if (!raw2) return [];
   return JSON.parse(raw2);
 }
@@ -30944,7 +31051,7 @@ async function POST18(req) {
   const account = resolveAccount();
   if (account) {
     try {
-      const config2 = JSON.parse(readFileSync17(`${account.accountDir}/account.json`, "utf-8"));
+      const config2 = JSON.parse(readFileSync18(`${account.accountDir}/account.json`, "utf-8"));
       if (!config2.admins) config2.admins = [];
       if (!config2.admins.some((a) => a.userId === userId)) {
         config2.admins.push({ userId, role: "owner" });
@@ -30995,7 +31102,7 @@ async function DELETE(req) {
 }
 
 // app/api/onboarding/skip/route.ts
-import { existsSync as existsSync17, writeFileSync as writeFileSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync18, writeFileSync as writeFileSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync19 } from "fs";
 import { resolve as resolve18, dirname as dirname7 } from "path";
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
 async function POST19() {
@@ -31007,9 +31114,9 @@ async function POST19() {
   const { accountId, accountDir } = account;
   let agentName = "Maxy";
   const brandPath3 = PLATFORM_ROOT8 ? resolve18(PLATFORM_ROOT8, "config", "brand.json") : "";
-  if (brandPath3 && existsSync17(brandPath3)) {
+  if (brandPath3 && existsSync18(brandPath3)) {
     try {
-      const brand = JSON.parse(readFileSync18(brandPath3, "utf-8"));
+      const brand = JSON.parse(readFileSync19(brandPath3, "utf-8"));
       if (brand.productName) agentName = brand.productName;
     } catch (err) {
       console.error(`[onboarding-skip] brand.json read failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -31055,14 +31162,14 @@ async function POST19() {
 }
 
 // app/api/admin/session/route.ts
-import { readFileSync as readFileSync19, existsSync as existsSync18 } from "fs";
+import { readFileSync as readFileSync20, existsSync as existsSync19 } from "fs";
 import { createHash as createHash2 } from "crypto";
 function hashPin2(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync18(USERS_FILE)) return null;
-  const raw2 = readFileSync19(USERS_FILE, "utf-8").trim();
+  if (!existsSync19(USERS_FILE)) return null;
+  const raw2 = readFileSync20(USERS_FILE, "utf-8").trim();
   if (!raw2) return [];
   return JSON.parse(raw2);
 }
@@ -31463,7 +31570,7 @@ async function POST22(req) {
 }
 
 // app/api/admin/logs/route.ts
-import { existsSync as existsSync19, readdirSync as readdirSync5, readFileSync as readFileSync20, statSync as statSync7 } from "fs";
+import { existsSync as existsSync20, readdirSync as readdirSync5, readFileSync as readFileSync21, statSync as statSync7 } from "fs";
 import { resolve as resolve19, basename as basename5 } from "path";
 var TAIL_BYTES = 8192;
 async function GET9(request) {
@@ -31482,7 +31589,7 @@ async function GET9(request) {
       const filePath = resolve19(dir, safe);
       searched.push(filePath);
       try {
-        const content = readFileSync20(filePath, "utf-8");
+        const content = readFileSync21(filePath, "utf-8");
         const headers = { "Content-Type": "text/plain; charset=utf-8" };
         if (download) headers["Content-Disposition"] = `attachment; filename="${safe}"`;
         return new Response(content, { headers });
@@ -31524,7 +31631,7 @@ async function GET9(request) {
       const filePath = resolve19(dir, fileName);
       searched.push(filePath);
       try {
-        const content = readFileSync20(filePath, "utf-8");
+        const content = readFileSync21(filePath, "utf-8");
         const headers = { "Content-Type": "text/plain; charset=utf-8" };
         if (download) headers["Content-Disposition"] = `attachment; filename="${fileName}"`;
         return new Response(content, { headers });
@@ -31539,7 +31646,7 @@ async function GET9(request) {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of [accountLogDir2, LOG_DIR]) {
-    if (!dir || !existsSync19(dir)) continue;
+    if (!dir || !existsSync20(dir)) continue;
     let files;
     try {
       files = readdirSync5(dir).filter((f) => f.endsWith(".log"));
@@ -31551,7 +31658,7 @@ async function GET9(request) {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync20(resolve19(dir, name));
+        const content = readFileSync21(resolve19(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -31588,7 +31695,7 @@ async function GET10() {
 
 // app/api/admin/attachment/[attachmentId]/route.ts
 import { readFile as readFile3, readdir } from "fs/promises";
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import { resolve as resolve20 } from "path";
 async function GET11(req, attachmentId) {
   const sessionKey = new URL(req.url).searchParams.get("session_key") ?? "";
@@ -31603,11 +31710,11 @@ async function GET11(req, attachmentId) {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve20(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync20(dir)) {
+  if (!existsSync21(dir)) {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve20(dir, `${attachmentId}.meta.json`);
-  if (!existsSync20(metaPath)) {
+  if (!existsSync21(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta3;
@@ -31633,7 +31740,7 @@ async function GET11(req, attachmentId) {
 }
 
 // app/api/admin/account/route.ts
-import { readFileSync as readFileSync21, writeFileSync as writeFileSync15 } from "fs";
+import { readFileSync as readFileSync22, writeFileSync as writeFileSync15 } from "fs";
 import { resolve as resolve21 } from "path";
 var VALID_CONTEXT_MODES = ["managed", "claude-code"];
 async function PATCH(req) {
@@ -31659,7 +31766,7 @@ async function PATCH(req) {
   }
   const configPath2 = resolve21(account.accountDir, "account.json");
   try {
-    const raw2 = readFileSync21(configPath2, "utf-8");
+    const raw2 = readFileSync22(configPath2, "utf-8");
     const config2 = JSON.parse(raw2);
     config2.contextMode = contextMode;
     writeFileSync15(configPath2, JSON.stringify(config2, null, 2) + "\n", "utf-8");
@@ -31673,14 +31780,14 @@ async function PATCH(req) {
 
 // app/api/admin/agents/route.ts
 import { resolve as resolve22 } from "path";
-import { readdirSync as readdirSync6, readFileSync as readFileSync22, existsSync as existsSync21 } from "fs";
+import { readdirSync as readdirSync6, readFileSync as readFileSync23, existsSync as existsSync22 } from "fs";
 async function GET12() {
   const account = resolveAccount();
   if (!account) {
     return Response.json({ agents: [] });
   }
   const agentsDir = resolve22(account.accountDir, "agents");
-  if (!existsSync21(agentsDir)) {
+  if (!existsSync22(agentsDir)) {
     return Response.json({ agents: [] });
   }
   const agents = [];
@@ -31690,9 +31797,9 @@ async function GET12() {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve22(agentsDir, entry.name, "config.json");
-      if (!existsSync21(configPath2)) continue;
+      if (!existsSync22(configPath2)) continue;
       try {
-        const config2 = JSON.parse(readFileSync22(configPath2, "utf-8"));
+        const config2 = JSON.parse(readFileSync23(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config2.displayName ?? entry.name,
@@ -31711,7 +31818,7 @@ async function GET12() {
 
 // app/api/admin/agents/[slug]/route.ts
 import { resolve as resolve23 } from "path";
-import { existsSync as existsSync22, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync23, rmSync as rmSync2 } from "fs";
 async function DELETE2(_req, { params }) {
   const { slug } = await params;
   const account = resolveAccount();
@@ -31725,7 +31832,7 @@ async function DELETE2(_req, { params }) {
     return Response.json({ error: "Invalid agent slug" }, { status: 400 });
   }
   const agentDir = resolve23(account.accountDir, "agents", slug);
-  if (!existsSync22(agentDir)) {
+  if (!existsSync23(agentDir)) {
     return Response.json({ error: "Agent not found" }, { status: 404 });
   }
   try {
@@ -31739,15 +31846,15 @@ async function DELETE2(_req, { params }) {
 }
 
 // app/api/admin/version/route.ts
-import { readFileSync as readFileSync23, existsSync as existsSync23 } from "fs";
-import { resolve as resolve24, join as join10 } from "path";
+import { readFileSync as readFileSync24, existsSync as existsSync24 } from "fs";
+import { resolve as resolve24, join as join11 } from "path";
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandNpmPackage = "@rubytech/create-maxy";
-var brandJsonPath = join10(PLATFORM_ROOT9, "config", "brand.json");
-if (existsSync23(brandJsonPath)) {
+var brandJsonPath = join11(PLATFORM_ROOT9, "config", "brand.json");
+if (existsSync24(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync23(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync24(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
     if (brand.npm?.packageName) brandNpmPackage = brand.npm.packageName;
   } catch {
@@ -31758,8 +31865,8 @@ var NPM_PACKAGE = brandNpmPackage;
 var REGISTRY_URL = `https://registry.npmjs.org/${NPM_PACKAGE}/latest`;
 var FETCH_TIMEOUT_MS = 5e3;
 function readInstalled() {
-  if (!existsSync23(VERSION_FILE)) return "unknown";
-  const content = readFileSync23(VERSION_FILE, "utf-8").trim();
+  if (!existsSync24(VERSION_FILE)) return "unknown";
+  const content = readFileSync24(VERSION_FILE, "utf-8").trim();
   return content || "unknown";
 }
 async function fetchLatest() {
@@ -31810,15 +31917,15 @@ async function GET13() {
 
 // app/api/admin/version/upgrade/route.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync24, statSync as statSync8, writeFileSync as writeFileSync16, readFileSync as readFileSync24, openSync as openSync4, closeSync as closeSync4 } from "fs";
-import { resolve as resolve25, join as join11 } from "path";
+import { existsSync as existsSync25, statSync as statSync8, writeFileSync as writeFileSync16, readFileSync as readFileSync25, openSync as openSync4, closeSync as closeSync4 } from "fs";
+import { resolve as resolve25, join as join12 } from "path";
 var PLATFORM_ROOT10 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
 var upgradePkg = "@rubytech/create-maxy";
 var upgradeHostname = "maxy";
-var brandPath = join11(PLATFORM_ROOT10, "config", "brand.json");
-if (existsSync24(brandPath)) {
+var brandPath = join12(PLATFORM_ROOT10, "config", "brand.json");
+if (existsSync25(brandPath)) {
   try {
-    const brand = JSON.parse(readFileSync24(brandPath, "utf-8"));
+    const brand = JSON.parse(readFileSync25(brandPath, "utf-8"));
     if (brand.npm?.packageName) upgradePkg = brand.npm.packageName;
     if (brand.hostname) upgradeHostname = brand.hostname;
   } catch {
@@ -31828,7 +31935,7 @@ var LOCK_FILE = `/tmp/${upgradeHostname}-upgrade.lock`;
 var LOG_FILE = `/tmp/${upgradeHostname}-upgrade.log`;
 var LOCK_MAX_AGE_MS = 20 * 60 * 1e3;
 function isLockFresh() {
-  if (!existsSync24(LOCK_FILE)) return false;
+  if (!existsSync25(LOCK_FILE)) return false;
   try {
     const stat4 = statSync8(LOCK_FILE);
     return Date.now() - stat4.mtimeMs < LOCK_MAX_AGE_MS;
@@ -31888,14 +31995,14 @@ async function POST23(req) {
 }
 
 // app/api/admin/version/upgrade/progress/route.ts
-import { existsSync as existsSync25, readFileSync as readFileSync25 } from "fs";
-import { resolve as resolve26, join as join12 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync26 } from "fs";
+import { resolve as resolve26, join as join13 } from "path";
 var PLATFORM_ROOT11 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var upgradeHostname2 = "maxy";
-var brandPath2 = join12(PLATFORM_ROOT11, "config", "brand.json");
-if (existsSync25(brandPath2)) {
+var brandPath2 = join13(PLATFORM_ROOT11, "config", "brand.json");
+if (existsSync26(brandPath2)) {
   try {
-    const brand = JSON.parse(readFileSync25(brandPath2, "utf-8"));
+    const brand = JSON.parse(readFileSync26(brandPath2, "utf-8"));
     if (brand.hostname) upgradeHostname2 = brand.hostname;
   } catch {
   }
@@ -31903,12 +32010,12 @@ if (existsSync25(brandPath2)) {
 var LOG_FILE2 = `/tmp/${upgradeHostname2}-upgrade.log`;
 var STEP_RE = /\[(\d+)\/(\d+)\]\s+(.+)/;
 async function GET14() {
-  if (!existsSync25(LOG_FILE2)) {
+  if (!existsSync26(LOG_FILE2)) {
     return Response.json({ step: 0, total: 0, label: "", started: false });
   }
   let content;
   try {
-    content = readFileSync25(LOG_FILE2, "utf-8");
+    content = readFileSync26(LOG_FILE2, "utf-8");
   } catch {
     return Response.json({ step: 0, total: 0, label: "", started: false });
   }
@@ -32374,14 +32481,14 @@ async function POST29(req) {
 
 // server/index.ts
 var PLATFORM_ROOT12 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT12 ? join13(PLATFORM_ROOT12, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT12 ? join14(PLATFORM_ROOT12, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync27(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync27(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync27(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -32400,11 +32507,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join13(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join14(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync26(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync26(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync27(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync27(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -32822,14 +32929,14 @@ app.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync26(filePath)) {
+  if (!existsSync27(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync26(filePath);
+  const body = readFileSync27(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -32852,14 +32959,14 @@ app.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync26(filePath)) {
+  if (!existsSync27(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync26(filePath);
+  const body = readFileSync27(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -32868,9 +32975,9 @@ app.get("/generated/:filename", (c) => {
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync26(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync27(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync26(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync27(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -32887,7 +32994,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function cachedHtml(file2) {
   let html = htmlCache.get(file2);
   if (!html) {
-    html = readFileSync26(resolve27(process.cwd(), "public", file2), "utf-8");
+    html = readFileSync27(resolve27(process.cwd(), "public", file2), "utf-8");
     html = html.replace("<title>Maxy</title>", `<title>${escapeHtml2(BRAND.productName)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml2(brandFaviconPath)}"`);
     html = html.replace("</head>", `${brandScript}
@@ -32898,26 +33005,26 @@ function cachedHtml(file2) {
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join13(homedir4(), BRAND.configDir);
+  const configDir2 = join14(homedir4(), BRAND.configDir);
   try {
-    const accountJsonPath = join13(configDir2, "account.json");
-    if (!existsSync26(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));
+    const accountJsonPath = join14(configDir2, "account.json");
+    if (!existsSync27(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync27(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join13(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync26(cachePath)) return null;
-    return JSON.parse(readFileSync26(cachePath, "utf-8"));
+    const cachePath = join14(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync27(cachePath)) return null;
+    return JSON.parse(readFileSync27(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join13(homedir4(), BRAND.configDir);
-    const accountJsonPath = join13(configDir2, "account.json");
-    if (!existsSync26(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));
+    const configDir2 = join14(homedir4(), BRAND.configDir);
+    const accountJsonPath = join14(configDir2, "account.json");
+    if (!existsSync27(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync27(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -32990,7 +33097,7 @@ app.use("/vnc-popout.html", logViewerFetch);
 app.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync26(resolve27(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync27(resolve27(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml2(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -33044,8 +33151,8 @@ console.log(`${BRAND.productName} listening on http://${hostname3}:${port}`);
 (async () => {
   try {
     let userId = "";
-    if (existsSync26(USERS_FILE)) {
-      const users = JSON.parse(readFileSync26(USERS_FILE, "utf-8").trim() || "[]");
+    if (existsSync27(USERS_FILE)) {
+      const users = JSON.parse(readFileSync27(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);
@@ -33071,7 +33178,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join13(__dirname, "..")),
+  platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join14(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     try {