@rubytech/create-realagent 1.0.642 → 1.0.644

package/payload/server/server.js

@@ -1,8 +1,28 @@
-import {
-  __commonJS,
-  __toESM,
-  readProgressLog
-} from "./chunk-B54KBAK4.js";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 
 // ../lib/models/dist/index.js
 var require_dist = __commonJS({
@@ -2636,8 +2656,8 @@ var createAdaptorServer = (options) => {
     overrideGlobalObjects: options.overrideGlobalObjects,
     autoCleanupIncoming: options.autoCleanupIncoming
   });
-  const createServer2 = options.createServer || createServerHTTP;
-  const server = createServer2(options.serverOptions || {}, requestListener);
+  const createServer = options.createServer || createServerHTTP;
+  const server = createServer(options.serverOptions || {}, requestListener);
   return server;
 };
 var serve = (options, listeningListener) => {
@@ -2872,7 +2892,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync28, existsSync as existsSync28, watchFile } from "fs";
+import { readFileSync as readFileSync29, existsSync as existsSync29, watchFile } from "fs";
 import { resolve as resolve32, join as join15, basename as basename8 } from "path";
 import { homedir as homedir5 } from "os";
 
@@ -3820,23 +3840,32 @@ var HOP_BY_HOP2 = /* @__PURE__ */ new Set([
   "transfer-encoding",
   "upgrade"
 ]);
+var cachedUpstreamPort = null;
 function resolveUpstreamPort() {
-  const uri = process.env.NEO4J_URI ?? "bolt://localhost:7687";
+  if (cachedUpstreamPort !== null) return cachedUpstreamPort;
+  const uri = process.env.NEO4J_URI;
+  if (!uri) {
+    throw new Error(
+      "[ui/graph-proxy] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687 (Task 580)"
+    );
+  }
   const m = uri.match(/:(\d+)$/);
   const boltPort = m ? parseInt(m[1], 10) : 7687;
-  return boltPort - 213;
+  cachedUpstreamPort = boltPort - 213;
+  console.error(`[ui/graph-proxy] resolved neo4j_uri=${uri} http_port=${cachedUpstreamPort}`);
+  return cachedUpstreamPort;
 }
 var UPSTREAM_HOST = "127.0.0.1";
-var UPSTREAM_PORT = resolveUpstreamPort();
 function attachGraphHttpRoutes(app2) {
   const handler = async (c) => {
     const raw2 = c.req.raw;
     const url = new URL(raw2.url);
+    const upstreamPort = resolveUpstreamPort();
     const pathAfterPrefix = url.pathname.slice(GRAPH_PREFIX.length) || "/";
-    const upstreamUrl = `http://${UPSTREAM_HOST}:${UPSTREAM_PORT}${pathAfterPrefix}${url.search}`;
+    const upstreamUrl = `http://${UPSTREAM_HOST}:${upstreamPort}${pathAfterPrefix}${url.search}`;
     const upstreamHeaders = new Headers(raw2.headers);
     for (const h of HOP_BY_HOP2) upstreamHeaders.delete(h);
-    upstreamHeaders.set("host", `${UPSTREAM_HOST}:${UPSTREAM_PORT}`);
+    upstreamHeaders.set("host", `${UPSTREAM_HOST}:${upstreamPort}`);
     try {
       const upstream = await fetch(upstreamUrl, {
         method: raw2.method,
@@ -3849,6 +3878,11 @@ function attachGraphHttpRoutes(app2) {
       });
       const resHeaders = new Headers(upstream.headers);
       for (const h of HOP_BY_HOP2) resHeaders.delete(h);
+      const loc = resHeaders.get("location");
+      if (loc) {
+        const rewritten = rewriteLocation(loc);
+        if (rewritten !== loc) resHeaders.set("location", rewritten);
+      }
       return new Response(upstream.body, {
         status: upstream.status,
         statusText: upstream.statusText,
@@ -3900,13 +3934,14 @@ function attachGraphWsProxy(server, opts) {
       }
       const rewrittenPath = pathname === GRAPH_PREFIX ? "/" : pathname.slice(GRAPH_PREFIX.length);
       const rewrittenUrl = qsIndex === -1 ? rewrittenPath : rewrittenPath + url.slice(qsIndex);
-      const upstream = createConnection2({ host: UPSTREAM_HOST, port: UPSTREAM_PORT });
+      const upstreamPort = resolveUpstreamPort();
+      const upstream = createConnection2({ host: UPSTREAM_HOST, port: upstreamPort });
       upstream.setTimeout(UPSTREAM_TIMEOUT_MS2);
       upstream.once("connect", () => {
         upstream.setTimeout(0);
         const lines = [];
         lines.push(`${req.method ?? "GET"} ${rewrittenUrl} HTTP/${req.httpVersion}`);
-        lines.push(`host: ${UPSTREAM_HOST}:${UPSTREAM_PORT}`);
+        lines.push(`host: ${UPSTREAM_HOST}:${upstreamPort}`);
         for (const [name, value] of Object.entries(req.headers)) {
           if (name === "host") continue;
           if (HOP_BY_HOP2.has(name)) continue;
@@ -3978,6 +4013,21 @@ function headerString2(value) {
   if (value == null) return void 0;
   return Array.isArray(value) ? value[0] : value;
 }
+function rewriteLocation(location) {
+  try {
+    const parsed = new URL(location);
+    if (parsed.hostname === UPSTREAM_HOST && parsed.port === String(resolveUpstreamPort())) {
+      const pathWithQuery = parsed.pathname + parsed.search + parsed.hash;
+      return pathWithQuery.startsWith(GRAPH_PREFIX) ? pathWithQuery : `${GRAPH_PREFIX}${pathWithQuery}`;
+    }
+    return location;
+  } catch {
+    if (location.startsWith("/") && !location.startsWith(`${GRAPH_PREFIX}/`) && location !== GRAPH_PREFIX) {
+      return `${GRAPH_PREFIX}${location}`;
+    }
+    return location;
+  }
+}
 function parseOriginHost2(origin) {
   if (!origin) return null;
   try {
@@ -4659,9 +4709,15 @@ function readPassword() {
 }
 function getDriver() {
   if (!driver) {
-    const uri = process.env.NEO4J_URI ?? "bolt://localhost:7687";
+    const uri = process.env.NEO4J_URI;
+    if (!uri) {
+      throw new Error(
+        "[ui/neo4j-store] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687 (Task 580)"
+      );
+    }
     const user = process.env.NEO4J_USER ?? "neo4j";
     const password = readPassword();
+    console.error(`[ui/neo4j-store] resolved neo4j_uri=${uri}`);
     driver = neo4j.driver(uri, neo4j.auth.basic(user, password), {
       maxConnectionPoolSize: 5
     });
@@ -7842,12 +7898,33 @@ function readBrandHostname() {
   }
   return cachedBrandHostname;
 }
+function requireNeo4jUri() {
+  const uri = process.env.NEO4J_URI;
+  if (!uri) {
+    throw new Error(
+      "NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687. Set NEO4J_URI in the gateway's env (systemd EnvironmentFile or shell .env). (Task 580)"
+    );
+  }
+  const brand = readBrandHostname();
+  if (brand === "realagent" && /:7687([/?]|$)/.test(uri)) {
+    throw new Error(
+      `NEO4J_URI=${uri} points at :7687 on a realagent install \u2014 realagent owns :7688. This would silently write into Maxy's DB (Task 577 vector). (Task 580)`
+    );
+  }
+  return uri;
+}
 function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
   if (!conversationId) {
     throw new Error(`getMcpServers: conversationId is required (accountId=${accountId.slice(0, 8)})`);
   }
   const { logDir: LOG_DIR2, streamLogPath: STREAM_LOG_PATH } = streamLogPathFor(accountId, conversationId);
-  const baseEnv = { ACCOUNT_ID: accountId, PLATFORM_ROOT: PLATFORM_ROOT4, LOG_DIR: LOG_DIR2, STREAM_LOG_PATH };
+  const baseEnv = {
+    ACCOUNT_ID: accountId,
+    PLATFORM_ROOT: PLATFORM_ROOT4,
+    LOG_DIR: LOG_DIR2,
+    STREAM_LOG_PATH,
+    NEO4J_URI: requireNeo4jUri()
+  };
   const servers = {
     "memory": {
       command: "node",
@@ -7918,7 +7995,6 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
       env: {
         ...baseEnv,
         BRAND: readBrandHostname(),
-        NEO4J_URI: process.env.NEO4J_URI ?? "bolt://localhost:7687",
         NEO4J_USERNAME: process.env.NEO4J_USERNAME ?? process.env.NEO4J_USER ?? "neo4j",
         NEO4J_NAMESPACE: "maxy-graph",
         NEO4J_READ_ONLY: "true",
@@ -15746,9 +15822,15 @@ function readPassword2() {
 }
 function getDriver2() {
   if (!driver2) {
-    const uri = process.env.NEO4J_URI ?? "bolt://localhost:7687";
+    const uri = process.env.NEO4J_URI;
+    if (!uri) {
+      throw new Error(
+        "[ui/access-gate] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687 (Task 580)"
+      );
+    }
     const user = process.env.NEO4J_USER ?? "neo4j";
     const password = readPassword2();
+    console.error(`[ui/access-gate] resolved neo4j_uri=${uri}`);
     driver2 = neo4j2.driver(uri, neo4j2.auth.basic(user, password), {
       maxConnectionPoolSize: 5
     });
@@ -18893,9 +18975,7 @@ async function GET13() {
 // app/api/admin/version/upgrade/route.ts
 import { spawn as spawn4 } from "child_process";
 import { existsSync as existsSync25, statSync as statSync10, writeFileSync as writeFileSync16, readFileSync as readFileSync24, openSync as openSync5, closeSync as closeSync5 } from "fs";
-import { createServer } from "net";
-import { resolve as resolve26, join as join12, dirname as dirname8 } from "path";
-import { fileURLToPath } from "url";
+import { resolve as resolve26, join as join12 } from "path";
 var PLATFORM_ROOT10 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var upgradePkg = "@rubytech/create-maxy";
 var upgradeHostname = "maxy";
@@ -18928,27 +19008,6 @@ function isLockFresh() {
     return false;
   }
 }
-function probePortFree(port2) {
-  return new Promise((resolve33) => {
-    const probe = createServer();
-    probe.once("error", (err2) => {
-      resolve33({ error: `${err2.code ?? "EADDRINUSE"} on port ${port2}` });
-    });
-    probe.once("listening", () => {
-      probe.close(() => resolve33(true));
-    });
-    probe.listen(port2, "0.0.0.0");
-  });
-}
-function resolveSidecarPath() {
-  try {
-    const here = dirname8(fileURLToPath(import.meta.url));
-    const candidate = join12(here, "upgrade-progress-server.js");
-    return existsSync25(candidate) ? candidate : null;
-  } catch {
-    return null;
-  }
-}
 async function POST25(req) {
   let body;
   try {
@@ -18966,31 +19025,12 @@ async function POST25(req) {
   if (isLockFresh()) {
     return Response.json({ ok: false, error: "upgrade already in progress" }, { status: 409 });
   }
-  const mainPort = parseInt(process.env.PORT ?? "19200", 10);
-  const sidecarPort = mainPort + 99;
-  const portProbe = await probePortFree(sidecarPort);
-  if (portProbe !== true) {
-    console.error(`[admin/version/upgrade] sidecar port probe failed: ${portProbe.error}`);
-    return Response.json(
-      { ok: false, error: `upgrade progress port ${sidecarPort} is already in use (${portProbe.error})` },
-      { status: 500 }
-    );
-  }
-  const sidecarPath = resolveSidecarPath();
   const installerScope = `upgrade-${upgradeHostname}`;
-  const sidecarScope = `upgrade-progress-${upgradeHostname}`;
   try {
     writeFileSync16(LOCK_FILE, String(Date.now()));
   } catch (err2) {
     console.error("[admin/version/upgrade] failed to write lock file:", err2);
   }
-  if (!sidecarPath) {
-    console.error("[admin/version/upgrade] progress sidecar binary not found in dist/");
-    return Response.json(
-      { ok: false, error: "progress sidecar binary missing \u2014 rebuild required" },
-      { status: 500 }
-    );
-  }
   try {
     writeFileSync16(LOG_FILE, "");
   } catch (err2) {
@@ -19000,34 +19040,6 @@ async function POST25(req) {
       { status: 500 }
     );
   }
-  let sidecarPid;
-  try {
-    const sidecarLogFd = openSync5(LOG_FILE, "a");
-    const sidecar = spawn4("systemd-run", [
-      "--user",
-      "--scope",
-      `--unit=${sidecarScope}`,
-      "--",
-      "node",
-      sidecarPath,
-      `--port=${sidecarPort}`,
-      `--log=${LOG_FILE}`,
-      `--scope=${installerScope}`
-    ], {
-      detached: true,
-      stdio: ["ignore", sidecarLogFd, sidecarLogFd]
-    });
-    sidecar.unref();
-    closeSync5(sidecarLogFd);
-    sidecarPid = sidecar.pid;
-    console.log(`[admin/version/upgrade] spawned progress sidecar (pid ${sidecarPid} port ${sidecarPort})`);
-  } catch (err2) {
-    console.error("[admin/version/upgrade] failed to spawn progress sidecar:", err2);
-    return Response.json(
-      { ok: false, error: err2 instanceof Error ? err2.message : "failed to spawn progress sidecar" },
-      { status: 500 }
-    );
-  }
   try {
     const logFd = openSync5(LOG_FILE, "a");
     const child = spawn4("systemd-run", [
@@ -19046,10 +19058,8 @@ async function POST25(req) {
     });
     child.unref();
     closeSync5(logFd);
-    console.log(`[admin/version/upgrade] spawned upgrade process (pid ${child.pid})`);
-    const host = new URL(req.url).hostname;
-    const progressUrl = `http://${host}:${sidecarPort}/progress`;
-    return Response.json({ ok: true, started: true, progressUrl });
+    console.log(`[admin/version/upgrade] spawned upgrade process (pid ${child.pid} scope ${installerScope})`);
+    return Response.json({ ok: true, started: true });
   } catch (err2) {
     console.error("[admin/version/upgrade] failed to spawn upgrade process:", err2);
     return Response.json(
@@ -19060,14 +19070,57 @@ async function POST25(req) {
 }
 
 // app/api/admin/version/upgrade/progress/route.ts
-import { existsSync as existsSync26, readFileSync as readFileSync25 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync26 } from "fs";
 import { resolve as resolve27, join as join13 } from "path";
+
+// app/lib/upgrade-progress-parser.ts
+import { existsSync as existsSync26, readFileSync as readFileSync25 } from "fs";
+var STEP_RE = /\[(\d+)\/(\d+)\]\s+(.+)/;
+var ANSI_RE = /\x1b\[[0-9;?]*[a-zA-Z]/g;
+var stripAnsi = (s) => s.replace(ANSI_RE, "").replace(/\r/g, "").trimEnd();
+var MAX_SUBSTEPS = 20;
+function parseUpgradeProgress(content) {
+  const rawLines = content.split("\n");
+  let step = 0;
+  let total = 0;
+  let label = "";
+  let markerIdx = -1;
+  for (let i = rawLines.length - 1; i >= 0; i--) {
+    const match2 = rawLines[i].match(STEP_RE);
+    if (match2) {
+      step = parseInt(match2[1], 10);
+      total = parseInt(match2[2], 10);
+      label = match2[3].replace(/\.{3}$/, "").trim();
+      markerIdx = i;
+      break;
+    }
+  }
+  const subSteps = markerIdx >= 0 ? rawLines.slice(markerIdx + 1).map(stripAnsi).filter((l) => l.length > 0).slice(-MAX_SUBSTEPS) : [];
+  const tail = rawLines.slice(-20).join("\n");
+  const finished = tail.includes("Open in your browser:");
+  const failed = tail.includes("Setup failed:");
+  return { step, total, label, started: true, finished, failed, subSteps };
+}
+function readProgressLog(path2) {
+  if (!existsSync26(path2)) {
+    return { step: 0, total: 0, label: "", started: false, subSteps: [] };
+  }
+  let content;
+  try {
+    content = readFileSync25(path2, "utf-8");
+  } catch {
+    return { step: 0, total: 0, label: "", started: false, subSteps: [] };
+  }
+  return parseUpgradeProgress(content);
+}
+
+// app/api/admin/version/upgrade/progress/route.ts
 var PLATFORM_ROOT11 = process.env.MAXY_PLATFORM_ROOT ?? resolve27(process.cwd(), "..");
 var upgradeHostname2 = "maxy";
 var brandPath2 = join13(PLATFORM_ROOT11, "config", "brand.json");
-if (existsSync26(brandPath2)) {
+if (existsSync27(brandPath2)) {
   try {
-    const brand = JSON.parse(readFileSync25(brandPath2, "utf-8"));
+    const brand = JSON.parse(readFileSync26(brandPath2, "utf-8"));
     if (brand.hostname) upgradeHostname2 = brand.hostname;
   } catch {
   }
@@ -19522,7 +19575,7 @@ async function POST31(req) {
 import * as childProcess from "child_process";
 import { homedir as homedir4 } from "os";
 import { resolve as resolve29 } from "path";
-import { readFileSync as readFileSync27 } from "fs";
+import { readFileSync as readFileSync28 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -19538,14 +19591,14 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync12, readFileSync as readFileSync26, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname9 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync12, readFileSync as readFileSync27, writeFileSync as writeFileSync17 } from "fs";
+import { dirname as dirname8 } from "path";
 import { resolve as resolve28 } from "path";
 var ALIAS_DOMAINS_PATH = resolve28(MAXY_DIR, "alias-domains.json");
 function readExisting() {
-  if (!existsSync27(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+  if (!existsSync28(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync26(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync27(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -19556,7 +19609,7 @@ function addAliasDomain(hostname2) {
   const existing = readExisting();
   if (existing.has(hostname2)) return;
   existing.add(hostname2);
-  mkdirSync12(dirname9(ALIAS_DOMAINS_PATH), { recursive: true });
+  mkdirSync12(dirname8(ALIAS_DOMAINS_PATH), { recursive: true });
   writeFileSync17(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
@@ -19580,7 +19633,7 @@ function loadBrandInfo() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve29(process.cwd(), "..");
   const brandPath3 = resolve29(platformRoot3, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync27(brandPath3, "utf-8"));
+    const parsed = JSON.parse(readFileSync28(brandPath3, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -19759,7 +19812,7 @@ async function POST33(req) {
 }
 
 // app/api/admin/files/route.ts
-import { readdir as readdir2, stat as stat4 } from "fs/promises";
+import { readdir as readdir2, readFile as readFile4, stat as stat4 } from "fs/promises";
 import { join as join14 } from "path";
 
 // app/lib/data-path.ts
@@ -19805,6 +19858,39 @@ function resolveDataPath(raw2) {
 }
 
 // app/api/admin/files/route.ts
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function readMeta(absDir, baseName) {
+  try {
+    const raw2 = await readFile4(join14(absDir, `${baseName}.meta.json`), "utf8");
+    const parsed = JSON.parse(raw2);
+    if (typeof parsed?.filename === "string") {
+      return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
+    }
+  } catch {
+  }
+  return null;
+}
+async function enrich(absolute, entry) {
+  if (entry.kind === "directory" && UUID_RE2.test(entry.name)) {
+    const meta = await readMeta(join14(absolute, entry.name), entry.name);
+    if (meta?.filename) {
+      entry.displayName = meta.filename;
+      entry.mimeType = meta.mimeType;
+    }
+    return;
+  }
+  if (entry.kind === "file") {
+    const dot = entry.name.lastIndexOf(".");
+    const base = dot === -1 ? entry.name : entry.name.slice(0, dot);
+    if (UUID_RE2.test(base)) {
+      const meta = await readMeta(absolute, base);
+      if (meta?.filename) {
+        entry.displayName = meta.filename;
+        entry.mimeType = meta.mimeType;
+      }
+    }
+  }
+}
 async function GET17(req) {
   const url = new URL(req.url);
   const sessionKey = url.searchParams.get("session_key");
@@ -19837,6 +19923,9 @@ async function GET17(req) {
     const names = await readdir2(absolute);
     const entries = [];
     for (const name of names) {
+      if (UUID_RE2.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
+        continue;
+      }
       try {
         const entryPath = join14(absolute, name);
         const s = await stat4(entryPath);
@@ -19850,9 +19939,12 @@ async function GET17(req) {
         entries.push({ name, kind: "other", sizeBytes: null, modifiedAt: (/* @__PURE__ */ new Date(0)).toISOString() });
       }
     }
+    await Promise.all(entries.map((e) => enrich(absolute, e)));
     entries.sort((a, b) => {
       if (a.kind !== b.kind) return a.kind === "directory" ? -1 : 1;
-      return a.name.localeCompare(b.name);
+      const aKey = a.displayName ?? a.name;
+      const bKey = b.displayName ?? b.name;
+      return aKey.localeCompare(bKey);
     });
     console.error(`[data] file-list path="${relPath}" entries=${entries.length}`);
     return Response.json({ path: relPath, entries });
@@ -20044,16 +20136,19 @@ async function GET19(req) {
   }
 }
 
+// app/lib/agent-slug-pattern.ts
+var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
+
 // server/index.ts
 var PLATFORM_ROOT13 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT13 ? join15(PLATFORM_ROOT13, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync28(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync29(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync28(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync29(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync28(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync29(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err2) {
     console.error(`[brand] Failed to parse brand.json: ${err2.message}`);
@@ -20075,8 +20170,8 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH2 = join15(homedir5(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync28(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync28(ALIAS_DOMAINS_PATH2, "utf-8"));
+    if (!existsSync29(ALIAS_DOMAINS_PATH2)) return null;
+    const parsed = JSON.parse(readFileSync29(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -20124,7 +20219,6 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/g/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
 app.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
@@ -20509,14 +20603,14 @@ app.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync28(filePath)) {
+  if (!existsSync29(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync28(filePath);
+  const body = readFileSync29(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -20539,14 +20633,14 @@ app.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync28(filePath)) {
+  if (!existsSync29(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync28(filePath);
+  const body = readFileSync29(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -20555,9 +20649,9 @@ app.get("/generated/:filename", (c) => {
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync28(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync29(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync28(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync29(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -20575,8 +20669,8 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT13) return "unknown";
     const versionFile = join15(PLATFORM_ROOT13, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync28(versionFile)) return "unknown";
-    const content = readFileSync28(versionFile, "utf-8").trim();
+    if (!existsSync29(versionFile)) return "unknown";
+    const content = readFileSync29(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -20617,7 +20711,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync28(resolve32(process.cwd(), "public", file), "utf-8");
+    html = readFileSync29(resolve32(process.cwd(), "public", file), "utf-8");
     html = html.replace("<title>Maxy</title>", `<title>${escapeHtml2(BRAND.productName)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml2(brandFaviconPath)}"`);
     const headInjection = file === "index.html" ? `${brandScript}
@@ -20635,13 +20729,13 @@ function loadBrandingCache(agentSlug) {
   const configDir2 = join15(homedir5(), BRAND.configDir);
   try {
     const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync28(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync28(accountJsonPath, "utf-8"));
+    if (!existsSync29(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync29(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync28(cachePath)) return null;
-    return JSON.parse(readFileSync28(cachePath, "utf-8"));
+    if (!existsSync29(cachePath)) return null;
+    return JSON.parse(readFileSync29(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -20650,8 +20744,8 @@ function resolveDefaultSlug() {
   try {
     const configDir2 = join15(homedir5(), BRAND.configDir);
     const accountJsonPath = join15(configDir2, "account.json");
-    if (!existsSync28(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync28(accountJsonPath, "utf-8"));
+    if (!existsSync29(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync29(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -20724,7 +20818,7 @@ app.use("/vnc-popout.html", logViewerFetch);
 app.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync28(resolve32(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync29(resolve32(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml2(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -20758,16 +20852,23 @@ app.post("/api/vnc/client-event", async (c) => {
 app.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
+app.use("/graph/*", graphAuthMiddleware({ isPublicHost, canAccessAdmin }));
+app.use("/graph", graphAuthMiddleware({ isPublicHost, canAccessAdmin }));
+attachGraphHttpRoutes(app);
+app.get("/data", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("data.html"));
+});
 app.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
+    const branding = loadBrandingCache(slug);
+    console.error(`[public-catchall] served path=/${slug} slug=${slug} branding=${branding ? "hit" : "miss"}`);
     return c.html(brandedPublicHtml(slug));
   }
   await next();
 });
-app.use("/graph/*", graphAuthMiddleware({ isPublicHost, canAccessAdmin }));
-app.use("/graph", graphAuthMiddleware({ isPublicHost, canAccessAdmin }));
-attachGraphHttpRoutes(app);
 app.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.PORT ?? "19200", 10);
 var hostname = process.env.HOSTNAME ?? "0.0.0.0";
@@ -20779,11 +20880,24 @@ attachVncWsProxy(httpServer, {
 });
 attachGraphWsProxy(httpServer, { isPublicHost, canAccessAdmin });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
+try {
+  const registered = [];
+  for (const r of app.routes ?? []) {
+    if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
+    if (AGENT_SLUG_PATTERN.test(r.path)) {
+      registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
+    }
+  }
+  const summary = registered.map((r) => `${r.method} ${r.path}`).join(", ") || "(none)";
+  console.log(`[route-shadow] static-paths-matching-slug-pattern count=${registered.length} routes=${summary}`);
+} catch (err2) {
+  console.error(`[route-shadow] introspection unavailable: ${err2 instanceof Error ? err2.message : String(err2)}`);
+}
 (async () => {
   try {
     let userId = "";
-    if (existsSync28(USERS_FILE)) {
-      const users = JSON.parse(readFileSync28(USERS_FILE, "utf-8").trim() || "[]");
+    if (existsSync29(USERS_FILE)) {
+      const users = JSON.parse(readFileSync29(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);