@rubytech/create-realagent 1.0.678 → 1.0.681

package/payload/server/server.js

@@ -13,7 +13,6 @@ import {
   clearRateLimit,
   createRemoteSession,
   hashPassword,
-  invalidateRemoteSession,
   isPasswordValid,
   isRemoteAuthConfigured,
   recordFailedAttempt,
@@ -25,7 +24,7 @@ import {
   verifyPassword,
   verifyRemotePassword,
   vncLog
-} from "./chunk-5YIXIF6C.js";
+} from "./chunk-3RBKKDHC.js";
 
 // ../lib/models/dist/index.js
 var require_dist = __commonJS({
@@ -1204,14 +1203,14 @@ var Hono = class _Hono {
    * app.route("/api", app2) // GET /api/user
    * ```
    */
-  route(path2, app36) {
+  route(path2, app35) {
     const subApp = this.basePath(path2);
-    app36.routes.map((r) => {
+    app35.routes.map((r) => {
       let handler;
-      if (app36.errorHandler === errorHandler) {
+      if (app35.errorHandler === errorHandler) {
         handler = r.handler;
       } else {
-        handler = async (c, next) => (await compose([], app36.errorHandler)(c, () => r.handler(c, next))).res;
+        handler = async (c, next) => (await compose([], app35.errorHandler)(c, () => r.handler(c, next))).res;
         handler[COMPOSED_HANDLER] = r.handler;
       }
       subApp.#addRoute(r.method, r.path, handler);
@@ -2895,7 +2894,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync24, existsSync as existsSync23, watchFile } from "fs";
+import { readFileSync as readFileSync25, existsSync as existsSync23, watchFile } from "fs";
 import { resolve as resolve27, join as join12, basename as basename7 } from "path";
 import { homedir as homedir4 } from "os";
 
@@ -2908,7 +2907,7 @@ import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
 import { resolve as resolve5, join as join3 } from "path";
 import { platform as osPlatform } from "os";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync as unlinkSync3, cpSync, rmSync as rmSync2, appendFileSync, openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync as unlinkSync3, cpSync, rmSync as rmSync2, appendFileSync, openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
 import { lookup as dnsLookup } from "dns/promises";
 import { createConnection as netConnect } from "net";
 import { StringDecoder } from "string_decoder";
@@ -3265,7 +3264,6 @@ function resolveBrowserTransport(req, remoteAddress) {
   return transport;
 }
 var currentCdpDisplay = null;
-var currentTerminalDisplay = null;
 function discoverNativeDisplay() {
   const fallback = { sessionType: "x11", display: ":0", waylandDisplay: "" };
   try {
@@ -3436,137 +3434,6 @@ async function ensureCdp(transport = "vnc") {
 function killChromium() {
   spawnSync("pkill", ["-f", "chromium"], { stdio: "pipe" });
 }
-function terminalAlive() {
-  const result = spawnSync("bash", [VNC_SCRIPT, "status-terminal"], {
-    stdio: "pipe",
-    timeout: 2e3
-  });
-  return result.status === 0;
-}
-function extractFailureLine(stderr, signal) {
-  if (signal === "SIGTERM") {
-    return '[terminal-launch] failed err="vnc.sh timed out after 10s \u2014 X server on :99 may be wedged (check Xtigervnc + websockify in vnc-boot.log)"';
-  }
-  const raw2 = (stderr ?? "").trim();
-  if (!raw2) return "Terminal failed to start (no diagnostic captured)";
-  const lines = raw2.split("\n").filter((l) => l.trim().length > 0);
-  const lastFailed = [...lines].reverse().find((l) => l.includes("[terminal-launch] failed"));
-  return (lastFailed ?? lines[lines.length - 1]).trim();
-}
-async function ensureTerminal(transport = "vnc") {
-  const targetSentinel = transport === "native" ? "native" : ":99";
-  if (terminalAlive()) {
-    if (currentTerminalDisplay !== null && currentTerminalDisplay !== targetSentinel) {
-      console.error(`[ensureTerminal] Display switch: ${currentTerminalDisplay} \u2192 ${targetSentinel}`);
-      vncLog("ensure-terminal", {
-        action: "display-switch",
-        transport,
-        from_display: currentTerminalDisplay,
-        to_display: targetSentinel
-      });
-      killTerminal();
-      await sleep(500);
-    } else {
-      if (currentTerminalDisplay === null) {
-        currentTerminalDisplay = targetSentinel;
-      }
-      const check = spawnSync("bash", [VNC_SCRIPT, transport === "native" ? "start-terminal-native" : "start-terminal"], {
-        stdio: ["ignore", "pipe", "pipe"],
-        timeout: 1e4
-      });
-      if (check.status !== 0) {
-        const errorLine = extractFailureLine(check.stderr?.toString(), check.signal);
-        vncLog("ensure-terminal", { action: "already-running-self-heal-failed", transport, windowPresent: false, err: errorLine });
-        return { ok: false, error: errorLine };
-      }
-      vncLog("ensure-terminal", { action: "already-running", transport, windowPresent: true });
-      return { ok: true };
-    }
-  }
-  const vncCommand = transport === "native" ? "start-terminal-native" : "start-terminal";
-  if (transport === "vnc") {
-    const xAlive = await waitForPort(5900, 1e3);
-    if (!xAlive) {
-      console.error("[ensureTerminal] X server down on :5900 \u2014 escalating to full VNC restart");
-      vncLog("ensure-terminal", { action: "escalate-vnc-restart", reason: "x-down", transport });
-      const vncOk = await ensureVnc();
-      if (!vncOk) {
-        console.error("[ensureTerminal] Full VNC restart failed \u2014 terminal degraded");
-        vncLog("ensure-terminal", { action: "degraded", reason: "vnc-restart-failed", transport });
-        return { ok: false, error: "VNC failed to start after recovery attempt" };
-      }
-    }
-  }
-  if (transport === "native") {
-    const nativeInfo = discoverNativeDisplay();
-    vncLog("ensure-terminal", {
-      action: "native-display-resolved",
-      transport,
-      session_type: nativeInfo.sessionType,
-      display: nativeInfo.display
-    });
-  }
-  console.error(`[ensureTerminal] Launching terminal (${vncCommand}) for transport=${transport}`);
-  vncLog("ensure-terminal", { action: `launch-${vncCommand}`, transport });
-  const result = spawnSync("bash", [VNC_SCRIPT, vncCommand], {
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: 1e4
-  });
-  if (result.status !== 0) {
-    const errorLine = extractFailureLine(result.stderr?.toString(), result.signal);
-    vncLog("ensure-terminal", { action: "launch-failed", transport, windowPresent: false, err: errorLine });
-    return { ok: false, error: errorLine };
-  }
-  currentTerminalDisplay = targetSentinel;
-  vncLog("ensure-terminal", { action: "launch-complete", transport, sentinel: targetSentinel, windowPresent: true });
-  return { ok: true };
-}
-function killTerminal() {
-  spawnSync("bash", [VNC_SCRIPT, "kill-terminal"], { stdio: "pipe", timeout: 5e3 });
-  currentTerminalDisplay = null;
-}
-async function ensureTerminalUpgrade(transport = "vnc") {
-  const targetSentinel = ":99";
-  vncLog("ensure-terminal", {
-    action: "launch-upgrade",
-    transport,
-    cmd: "npx -y @rubytech/create-maxy@latest"
-  });
-  killTerminal();
-  await sleep(500);
-  if (transport === "vnc") {
-    const xAlive = await waitForPort(5900, 1e3);
-    if (!xAlive) {
-      console.error("[ensureTerminalUpgrade] X server down on :5900 \u2014 escalating to full VNC restart");
-      vncLog("ensure-terminal", { action: "escalate-vnc-restart", reason: "x-down", transport, upgrade: true });
-      const vncOk = await ensureVnc();
-      if (!vncOk) {
-        console.error("[ensureTerminalUpgrade] Full VNC restart failed \u2014 upgrade degraded");
-        vncLog("ensure-terminal", { action: "launch-upgrade-failed", transport, windowPresent: false, err: "VNC failed to start after recovery attempt" });
-        return { ok: false, error: "VNC failed to start after recovery attempt" };
-      }
-    }
-  }
-  console.error(`[ensureTerminalUpgrade] Launching upgrade terminal transport=${transport}`);
-  const result = spawnSync("bash", [VNC_SCRIPT, "start-terminal-upgrade"], {
-    stdio: ["ignore", "pipe", "pipe"],
-    timeout: 1e4
-  });
-  if (result.status !== 0) {
-    const errorLine = extractFailureLine(result.stderr?.toString(), result.signal);
-    vncLog("ensure-terminal", { action: "launch-upgrade-failed", transport, windowPresent: false, err: errorLine });
-    return { ok: false, error: errorLine };
-  }
-  currentTerminalDisplay = targetSentinel;
-  vncLog("ensure-terminal", {
-    action: "launch-upgrade-complete",
-    transport,
-    sentinel: targetSentinel,
-    windowPresent: true,
-    cmd: "npx -y @rubytech/create-maxy@latest"
-  });
-  return { ok: true };
-}
 function writeChromiumWrapper() {
   mkdirSync2(BIN_DIR, { recursive: true });
   const wrapperPath = resolve2(BIN_DIR, "chromium");
@@ -5803,6 +5670,101 @@ async function criticAndRecord(opts) {
   }
 }
 
+// app/lib/admin-schema-block.ts
+import { readFileSync as readFileSync6 } from "fs";
+var EDGE_TAXONOMY = [
+  { type: "PART_OF", direction: "(Message)-[:PART_OF]->(Conversation)", note: "Messages belong to exactly one Conversation. Do NOT use :HAS_MESSAGE \u2014 that edge does not exist." },
+  { type: "NEXT", direction: "(Message)-[:NEXT]->(Message)", note: "Chain order within a Conversation. Each Message has at most one NEXT successor." },
+  { type: "BELONGS_TO", direction: "(Conversation|Task|...)-[:BELONGS_TO]->(LocalBusiness)", note: "Account scope. Universal \u2014 almost every tenant-owned node has one." },
+  { type: "ADMIN_OF", direction: "(AdminUser)-[:ADMIN_OF]->(LocalBusiness)", note: "Device-level admin membership (see admin-add / admin-remove)." },
+  { type: "AUTHORED_BY", direction: "(Message)-[:AUTHORED_BY]->(Person)", note: "Message authorship (when the author is an identified Person)." },
+  { type: "HAS_TOOL_CALL", direction: "(Message)-[:HAS_TOOL_CALL]->(ToolCall)", note: "Tool calls attached to an assistant message." },
+  { type: "HAS_RESULT", direction: "(WorkflowStep|ToolCall)-[:HAS_RESULT]->(StepResult)", note: "Workflow step / tool-call outputs." },
+  { type: "HAS_STEP", direction: "(Workflow)-[:HAS_STEP]->(WorkflowStep)", note: "Workflow composition." },
+  { type: "RUN_OF", direction: "(WorkflowRun)-[:RUN_OF]->(Workflow)", note: "Workflow execution instance." },
+  { type: "HAS_SECTION", direction: "(KnowledgeDocument)-[:HAS_SECTION]->(Section)", note: "Document hierarchy." },
+  { type: "HAS_CHUNK", direction: "(Section)-[:HAS_CHUNK]->(Chunk)", note: "Section-to-embeddable-chunk." },
+  { type: "HAS_PREFERENCE", direction: "(Person)-[:HAS_PREFERENCE]->(Preference)", note: "Person-scoped preferences (profile memory)." },
+  { type: "HAS_ACCESS", direction: "(Person)-[:HAS_ACCESS]->(AccessGrant)", note: "Public agent access grants." },
+  { type: "HAS_TASK", direction: "(Person|LocalBusiness)-[:HAS_TASK]->(Task)", note: "Task ownership / assignment." },
+  { type: "HAS_PRICING", direction: "(Service)-[:HAS_PRICING]->(PriceSpecification)", note: "Service pricing." },
+  { type: "HAS_HOURS", direction: "(LocalBusiness)-[:HAS_HOURS]->(OpeningHoursSpecification)", note: "Opening hours." },
+  { type: "HAS_FAQ", direction: "(LocalBusiness)-[:HAS_FAQ]->(Question)", note: "FAQ attached to business." },
+  { type: "HAS_BRAND_ASSET", direction: "(LocalBusiness)-[:HAS_BRAND_ASSET]->(DigitalDocument|ImageObject)", note: "Branding assets." },
+  { type: "OFFERS", direction: "(LocalBusiness)-[:OFFERS]->(Service)", note: "Service catalogue." },
+  { type: "CONTAINS", direction: "(KnowledgeDocument)-[:CONTAINS]->(Chunk)", note: "Flat document-to-chunk (alternative to HAS_SECTION then HAS_CHUNK)." },
+  { type: "REFERENCES", direction: "(Message|KnowledgeDocument)-[:REFERENCES]->(*)", note: "Soft reference link." },
+  { type: "ABOUT", direction: "(Review|Message)-[:ABOUT]->(*)", note: "Subject pointer." },
+  { type: "REPLY_TO", direction: "(Email)-[:REPLY_TO]->(Email)", note: "Email threading." },
+  { type: "RECEIVED_BY", direction: "(Email)-[:RECEIVED_BY]->(Person)", note: "Email recipient." },
+  { type: "RAISED_BY", direction: "(ReviewAlert)-[:RAISED_BY]->(*)", note: "Alert provenance." },
+  { type: "AFFECTS", direction: "(ReviewAlert)-[:AFFECTS]->(*)", note: "Alert impact surface." },
+  { type: "BLOCKS", direction: "(Task)-[:BLOCKS]->(Task)", note: "Task dependency." },
+  { type: "OBSERVED_IN", direction: "(*)-[:OBSERVED_IN]->(Conversation)", note: "Observation provenance." }
+];
+var SUBLABELS = [
+  { base: "Conversation", sub: "AdminConversation", note: "Admin-only conversation (admin chat, not public)." },
+  { base: "Conversation", sub: "PublicConversation", note: "Public agent conversation (visitor-facing)." },
+  { base: "Message", sub: "UserMessage", note: "Message authored by the human user." },
+  { base: "Message", sub: "AssistantMessage", note: "Message authored by the assistant." }
+];
+var LABEL_PATTERN = /FOR\s*\(\s*\w+\s*:\s*(\w+)\s*\)/g;
+function parseLabelsFromSchemaCypher(schemaCypher) {
+  const found = /* @__PURE__ */ new Set();
+  for (const match2 of schemaCypher.matchAll(LABEL_PATTERN)) {
+    found.add(match2[1]);
+  }
+  return [...found].sort();
+}
+function buildSchemaBlock(schemaCypherText) {
+  const baseLabels = parseLabelsFromSchemaCypher(schemaCypherText);
+  const sublabels = SUBLABELS.map((s) => s.sub);
+  const lines = [];
+  lines.push("# SCHEMA (Neo4j graph, canonical reference)");
+  lines.push("");
+  lines.push("The Neo4j instance backing this admin session contains exactly the labels and relationship types below. Never invent names outside this list. If you need cypher against a token not listed here, first invoke `maxy-graph-get_neo4j_schema` to confirm it exists \u2014 do not guess.");
+  lines.push("");
+  lines.push("## Labels (from platform/neo4j/schema.cypher)");
+  lines.push("");
+  for (const label of baseLabels) {
+    lines.push(`- :${label}`);
+  }
+  lines.push("");
+  lines.push("### Sublabels (Task 633 role-cue variants)");
+  lines.push("");
+  for (const s of SUBLABELS) {
+    lines.push(`- :${s.sub} (on :${s.base}) \u2014 ${s.note}`);
+  }
+  lines.push("");
+  lines.push("## Relationship types (from .docs/neo4j.md)");
+  lines.push("");
+  for (const e of EDGE_TAXONOMY) {
+    lines.push(`- :${e.type} \u2014 ${e.direction} \u2014 ${e.note}`);
+  }
+  lines.push("");
+  lines.push("The cypher MCP validator (graph-mcp proxy, Task 654) rejects write cypher that references unknown labels or edges and warns on read cypher. Stick to the taxonomy above; if you believe a token is missing, invoke `maxy-graph-get_neo4j_schema` for the live snapshot.");
+  const text = lines.join("\n");
+  return {
+    text,
+    labelCount: baseLabels.length + sublabels.length,
+    relationshipTypeCount: EDGE_TAXONOMY.length,
+    bytes: Buffer.byteLength(text, "utf-8")
+  };
+}
+function loadAdminSchemaBlock(schemaCypherPath) {
+  let text;
+  try {
+    text = readFileSync6(schemaCypherPath, "utf-8");
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[admin-identity] schema.cypher unreadable path=${schemaCypherPath} error="${msg.replace(/"/g, "'")}" block=omitted`
+    );
+    return null;
+  }
+  return buildSchemaBlock(text);
+}
+
 // app/lib/claude-agent.ts
 var LOG_RETENTION_DAYS = 7;
 var BROWSER_TOOL_PREFIXES = [
@@ -6063,7 +6025,7 @@ function sampleProcState(pid) {
       let sockets2 = 0;
       for (const tcpFile of ["/proc/" + pid + "/net/tcp", "/proc/" + pid + "/net/tcp6"]) {
         try {
-          const raw2 = readFileSync6(tcpFile, "utf-8");
+          const raw2 = readFileSync7(tcpFile, "utf-8");
           const lines2 = raw2.split("\n");
           for (let i = 1; i < lines2.length; i++) {
             const line = lines2[i].trim();
@@ -6079,7 +6041,7 @@ function sampleProcState(pid) {
       }
       let rssMb = 0;
       try {
-        const statm = readFileSync6(`/proc/${pid}/statm`, "utf-8").trim().split(/\s+/);
+        const statm = readFileSync7(`/proc/${pid}/statm`, "utf-8").trim().split(/\s+/);
         const rssPages = parseInt(statm[1] ?? "0", 10);
         if (Number.isFinite(rssPages)) rssMb = Math.round(rssPages * 4096 / (1024 * 1024));
       } catch {
@@ -6126,7 +6088,7 @@ function resolveAccount() {
   let usersJsonUserId = null;
   if (existsSync5(usersFilePath)) {
     try {
-      const raw2 = readFileSync6(usersFilePath, "utf-8").trim();
+      const raw2 = readFileSync7(usersFilePath, "utf-8").trim();
       if (raw2) {
         const users = JSON.parse(raw2);
         if (users.length > 0) {
@@ -6142,7 +6104,7 @@ function resolveAccount() {
     if (!entry.isDirectory()) continue;
     const configPath2 = resolve5(ACCOUNTS_DIR, entry.name, "account.json");
     if (!existsSync5(configPath2)) continue;
-    const raw2 = readFileSync6(configPath2, "utf-8");
+    const raw2 = readFileSync7(configPath2, "utf-8");
     let config;
     try {
       config = JSON.parse(raw2);
@@ -6177,7 +6139,7 @@ function resolveAccount() {
 function readAgentFile(accountDir, agentName, filename) {
   const filePath = resolve5(accountDir, "agents", agentName, filename);
   if (!existsSync5(filePath)) return null;
-  return readFileSync6(filePath, "utf-8");
+  return readFileSync7(filePath, "utf-8");
 }
 function readIdentity(accountDir, agentName) {
   return readAgentFile(accountDir, agentName, "IDENTITY.md");
@@ -6219,7 +6181,7 @@ function resolveDefaultAgentSlug(accountDir) {
   }
   let config;
   try {
-    config = JSON.parse(readFileSync6(configPath2, "utf-8"));
+    config = JSON.parse(readFileSync7(configPath2, "utf-8"));
   } catch (err) {
     console.error("[agent-resolve] failed to read account.json:", err);
     return null;
@@ -6310,14 +6272,14 @@ function resolveAgentConfig(accountDir, agentName) {
     const knowledgeMtime = statSync3(knowledgePath).mtimeMs;
     const summaryMtime = statSync3(summaryPath).mtimeMs;
     if (summaryMtime >= knowledgeMtime) {
-      knowledge = readFileSync6(summaryPath, "utf-8");
+      knowledge = readFileSync7(summaryPath, "utf-8");
     } else {
       console.warn(`[agent-config] ${agentName}: KNOWLEDGE-SUMMARY.md is stale (KNOWLEDGE.md is newer) \u2014 using full knowledge`);
-      knowledge = readFileSync6(knowledgePath, "utf-8");
+      knowledge = readFileSync7(knowledgePath, "utf-8");
     }
     knowledgeBaked = true;
   } else if (hasKnowledge) {
-    knowledge = readFileSync6(knowledgePath, "utf-8");
+    knowledge = readFileSync7(knowledgePath, "utf-8");
     knowledgeBaked = true;
   }
   let budget = null;
@@ -6343,7 +6305,7 @@ function parsePluginFrontmatter(pluginDir) {
   if (!existsSync5(pluginPath)) return null;
   let raw2;
   try {
-    raw2 = readFileSync6(pluginPath, "utf-8");
+    raw2 = readFileSync7(pluginPath, "utf-8");
   } catch {
     console.warn(`[plugins] cannot read ${pluginPath}`);
     return null;
@@ -6419,7 +6381,7 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
     if (isBundle) {
       let bundleRaw;
       try {
-        bundleRaw = readFileSync6(bundlePath, "utf-8");
+        bundleRaw = readFileSync7(bundlePath, "utf-8");
       } catch (err) {
         console.log(`${TAG19} ${pluginName}: cannot read BUNDLE.md \u2014 ${err instanceof Error ? err.message : String(err)}`);
         continue;
@@ -6512,7 +6474,7 @@ function migratePluginRenames(accountDir, config) {
   if (!changed) return;
   const configPath2 = resolve5(accountDir, "account.json");
   try {
-    const raw2 = readFileSync6(configPath2, "utf-8");
+    const raw2 = readFileSync7(configPath2, "utf-8");
     const parsed = JSON.parse(raw2);
     parsed.enabledPlugins = migrated;
     writeFileSync5(configPath2, JSON.stringify(parsed, null, 2) + "\n");
@@ -6546,7 +6508,7 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   const agentsmdPath = resolve5(accountDir, "agents", "admin", "AGENTS.md");
   let agentsmd = "";
   try {
-    agentsmd = existsSync5(agentsmdPath) ? readFileSync6(agentsmdPath, "utf-8") : "";
+    agentsmd = existsSync5(agentsmdPath) ? readFileSync7(agentsmdPath, "utf-8") : "";
   } catch {
   }
   let delivered = 0;
@@ -6570,7 +6532,7 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
         continue;
       }
       try {
-        const content = readFileSync6(target, "utf-8");
+        const content = readFileSync7(target, "utf-8");
         const fmMatch = content.match(/^---\n([\s\S]*?)\n---/);
         if (fmMatch) {
           const nameMatch = fmMatch[1].match(/^name:\s*(.+)/m);
@@ -6606,7 +6568,7 @@ function assemblePublicPluginContent(pluginDir) {
   const pluginPath = resolve5(pluginRoot, "PLUGIN.md");
   let raw2;
   try {
-    raw2 = readFileSync6(pluginPath, "utf-8");
+    raw2 = readFileSync7(pluginPath, "utf-8");
   } catch {
     return null;
   }
@@ -6627,7 +6589,7 @@ function assemblePublicPluginContent(pluginDir) {
     const skillMdPath = resolve5(skillDir, "SKILL.md");
     let skillRaw;
     try {
-      skillRaw = readFileSync6(skillMdPath, "utf-8");
+      skillRaw = readFileSync7(skillMdPath, "utf-8");
     } catch {
       continue;
     }
@@ -6678,7 +6640,7 @@ function assemblePublicPluginContent(pluginDir) {
     }
     for (const refFile of refFiles) {
       try {
-        const refContent = readFileSync6(resolve5(refsDir, refFile), "utf-8").trim();
+        const refContent = readFileSync7(resolve5(refsDir, refFile), "utf-8").trim();
         if (refContent) {
           parts.push(`
 <!-- reference: ${refFile} -->`);
@@ -6752,7 +6714,7 @@ function loadEmbeddedPlugins(agentType, selectedPlugins, enabledPlugins) {
       const pluginPath = resolve5(pluginsDir, dir, "PLUGIN.md");
       let raw2;
       try {
-        raw2 = readFileSync6(pluginPath, "utf-8");
+        raw2 = readFileSync7(pluginPath, "utf-8");
       } catch (err) {
         console.warn(`[plugins] ${dir}: failed to read PLUGIN.md for ${agentType} embed: ${String(err)}`);
         continue;
@@ -7098,7 +7060,7 @@ function resolveUserAccounts(userId) {
     if (!existsSync5(configPath2)) continue;
     let config;
     try {
-      config = JSON.parse(readFileSync6(configPath2, "utf-8"));
+      config = JSON.parse(readFileSync7(configPath2, "utf-8"));
     } catch {
       console.error(`[session] account.json corrupt at ${configPath2} \u2014 skipping`);
       continue;
@@ -7414,7 +7376,7 @@ function readBrandHostname() {
   if (cachedBrandHostname !== null) return cachedBrandHostname;
   try {
     const brandPath = resolve5(PLATFORM_ROOT3, "config", "brand.json");
-    const parsed = JSON.parse(readFileSync6(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync7(brandPath, "utf-8"));
     cachedBrandHostname = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : "maxy";
   } catch {
     cachedBrandHostname = "maxy";
@@ -10219,7 +10181,7 @@ ${sessionContext}`;
       const skillPath = resolve5(PLATFORM_ROOT3, "plugins/admin/skills/onboarding/SKILL.md");
       let skillContent = "";
       try {
-        skillContent = readFileSync6(skillPath, "utf-8");
+        skillContent = readFileSync7(skillPath, "utf-8");
       } catch (err) {
         console.error(`[onboarding-inject] accountId=${accountId.slice(0, 8)}\u2026 error=skill-read-failed path=${skillPath} reason=${err instanceof Error ? err.message : String(err)}`);
       }
@@ -10271,13 +10233,23 @@ ${manifest}`;
     }
     const graphRefPath = resolve5(PLATFORM_ROOT3, "plugins/memory/references/graph-primitives.md");
     try {
-      const graphRef = readFileSync6(graphRefPath, "utf-8");
+      const graphRef = readFileSync7(graphRefPath, "utf-8");
       baseSystemPrompt += `
 
 ${graphRef}`;
     } catch (err) {
       console.error(`[graph-primitives] reference missing at ${graphRefPath} \u2014 admin session will have no Cypher cookbook: ${err instanceof Error ? err.message : String(err)}`);
     }
+    const schemaCypherPath = resolve5(PLATFORM_ROOT3, "neo4j/schema.cypher");
+    const schemaBlock = loadAdminSchemaBlock(schemaCypherPath);
+    if (schemaBlock) {
+      baseSystemPrompt += `
+
+${schemaBlock.text}`;
+      console.log(
+        `[admin-identity] schemaBlockBytes=${schemaBlock.bytes} labels=${schemaBlock.labelCount} relationshipTypes=${schemaBlock.relationshipTypeCount}`
+      );
+    }
   }
   if (agentConfig?.budget) {
     const pluginTokens = embeddedPlugins.reduce((sum, p) => sum + estimateTokens(p.body), 0);
@@ -10486,7 +10458,7 @@ var clientIpMiddleware = async (c, next) => {
 };
 
 // server/routes/health.ts
-import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync12 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -10511,7 +10483,7 @@ function getLanIp() {
 import { basename as basename2 } from "path";
 
 // app/lib/review-detector/rules.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync6, statSync as statSync4, mkdirSync as mkdirSync5, renameSync as renameSync2 } from "fs";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync6, statSync as statSync4, mkdirSync as mkdirSync5, renameSync as renameSync2 } from "fs";
 import { resolve as resolve6, dirname as dirname3 } from "path";
 var DEFAULT_SCAN_INTERVAL_MS = 5e3;
 var RATE_LIMIT_PATTERN = "rate[- ]?limit(?:ed| reached| hit)|(?:HTTP|status)[^a-z]{0,3}429|too many requests";
@@ -10959,7 +10931,7 @@ function loadRules(configDir2) {
   if (!existsSync6(path2)) {
     throw new Error(`rules file missing at ${path2}`);
   }
-  const raw2 = readFileSync7(path2, "utf-8");
+  const raw2 = readFileSync8(path2, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw2);
@@ -11124,7 +11096,7 @@ function validateRule(input, label, seenIds) {
 }
 
 // app/lib/review-detector/sources.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync3, mkdirSync as mkdirSync6, openSync as openSync3, readSync as readSync3, closeSync as closeSync3, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync7, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync3, mkdirSync as mkdirSync6, openSync as openSync3, readSync as readSync3, closeSync as closeSync3, readFileSync as readFileSync9 } from "fs";
 import { resolve as resolve7, join as join4, basename, dirname as dirname4 } from "path";
 function tailStatePath(configDir2) {
   return resolve7(configDir2, "review-state.json");
@@ -11133,7 +11105,7 @@ function loadTailState(configDir2) {
   const path2 = tailStatePath(configDir2);
   if (!existsSync7(path2)) return {};
   try {
-    const raw2 = readFileSync8(path2, "utf-8");
+    const raw2 = readFileSync9(path2, "utf-8");
     const parsed = JSON.parse(raw2);
     if (!parsed || typeof parsed !== "object") return {};
     const clean = {};
@@ -11303,7 +11275,7 @@ function sourceKey(file) {
 }
 
 // app/lib/review-detector/writer.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync8, renameSync as renameSync4, statSync as statSync6 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync8, renameSync as renameSync4, statSync as statSync6 } from "fs";
 import { resolve as resolve8, dirname as dirname5 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function reviewLogPath(configDir2) {
@@ -11442,7 +11414,7 @@ function queueAlert(configDir2, accountId, match2) {
 async function drainPendingAlerts(configDir2) {
   const path2 = pendingAlertsPath(configDir2);
   if (!existsSync8(path2)) return { drained: 0, remaining: 0 };
-  const raw2 = readFileSync9(path2, "utf-8");
+  const raw2 = readFileSync10(path2, "utf-8");
   const lines = raw2.split("\n").filter((l) => l.trim().length > 0);
   if (lines.length === 0) return { drained: 0, remaining: 0 };
   const remaining = [];
@@ -12105,7 +12077,7 @@ var WhatsAppConfigSchema = z.object({
 });
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
 import { resolve as resolve10, join as join5 } from "path";
 var TAG3 = "[whatsapp:config]";
 function configPath(accountDir) {
@@ -12114,7 +12086,7 @@ function configPath(accountDir) {
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
   if (!existsSync9(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync10(path2, "utf-8"));
+  return JSON.parse(readFileSync11(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
   const path2 = configPath(accountDir);
@@ -14406,7 +14378,7 @@ app.get("/", async (c) => {
   let pinConfigured = false;
   try {
     if (existsSync10(USERS_FILE)) {
-      const raw2 = readFileSync11(USERS_FILE, "utf-8").trim();
+      const raw2 = readFileSync12(USERS_FILE, "utf-8").trim();
       if (raw2) {
         const users = JSON.parse(raw2);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -15523,7 +15495,7 @@ var group_default = app4;
 
 // app/lib/access-gate.ts
 import neo4j2 from "neo4j-driver";
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 import { resolve as resolve13 } from "path";
 import { randomUUID as randomUUID7, randomInt } from "crypto";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "..");
@@ -15532,7 +15504,7 @@ function readPassword2() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
   const passwordFile = resolve13(PLATFORM_ROOT5, "config/.neo4j-password");
   try {
-    return readFileSync12(passwordFile, "utf-8").trim();
+    return readFileSync13(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -15843,7 +15815,7 @@ async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
 }
 
 // app/lib/brevo-sms.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, existsSync as existsSync12, chmodSync } from "fs";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, existsSync as existsSync12, chmodSync } from "fs";
 import { dirname as dirname6 } from "path";
 import { resolve as resolve14 } from "path";
 var BREVO_API_KEY_FILE = resolve14(MAXY_DIR, ".brevo-api-key");
@@ -15855,7 +15827,7 @@ if (platformRoot) {
   try {
     const brandPath = resolve14(platformRoot, "config", "brand.json");
     if (existsSync12(brandPath)) {
-      const brand = JSON.parse(readFileSync13(brandPath, "utf-8"));
+      const brand = JSON.parse(readFileSync14(brandPath, "utf-8"));
       if (brand.productName) BREVO_SENDER = brand.productName;
     }
   } catch {
@@ -15863,7 +15835,7 @@ if (platformRoot) {
 }
 function readBrevoApiKey() {
   try {
-    const key = readFileSync13(BREVO_API_KEY_FILE, "utf-8").trim();
+    const key = readFileSync14(BREVO_API_KEY_FILE, "utf-8").trim();
     if (!key) {
       throw new Error(`Brevo API key file is empty: ${BREVO_API_KEY_FILE}`);
     }
@@ -16294,7 +16266,7 @@ app5.post("/send-otp", async (c) => {
 var access_default = app5;
 
 // server/routes/telegram.ts
-import { existsSync as existsSync13, readFileSync as readFileSync14 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync15 } from "fs";
 import { timingSafeEqual } from "crypto";
 
 // app/lib/telegram/access-control.ts
@@ -16332,7 +16304,7 @@ function getWebhookSecret(botType) {
   const filePath = botType === "admin" ? TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE : TELEGRAM_WEBHOOK_SECRET_FILE;
   try {
     if (!existsSync13(filePath)) return null;
-    const secret = readFileSync14(filePath, "utf-8").trim();
+    const secret = readFileSync15(filePath, "utf-8").trim();
     return secret || null;
   } catch {
     return null;
@@ -16492,7 +16464,7 @@ var telegram_default = app6;
 // server/routes/whatsapp.ts
 import { join as join8, resolve as resolve15, basename as basename4 } from "path";
 import { readFile as readFile2, stat as stat3 } from "fs/promises";
-import { realpathSync as realpathSync2, readdirSync as readdirSync4, readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
+import { realpathSync as realpathSync2, readdirSync as readdirSync4, readFileSync as readFileSync16, existsSync as existsSync14 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID8 } from "crypto";
@@ -16980,7 +16952,7 @@ app7.post("/config", async (c) => {
               const configPath2 = resolve15(agentsDir, entry.name, "config.json");
               if (!existsSync14(configPath2)) continue;
               try {
-                const config = JSON.parse(readFileSync15(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync16(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
                 console.error(`${TAG18} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -17192,7 +17164,7 @@ var whatsapp_default = app7;
 
 // server/routes/onboarding.ts
 import { spawn as spawn3, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync4, closeSync as closeSync4, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync16, unlinkSync as unlinkSync4 } from "fs";
+import { openSync as openSync4, closeSync as closeSync4, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync17, unlinkSync as unlinkSync4 } from "fs";
 import { resolve as resolve16, dirname as dirname7 } from "path";
 import { createHash, randomUUID as randomUUID9 } from "crypto";
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
@@ -17201,7 +17173,7 @@ function hashPin(pin) {
 }
 function readUsersFile() {
   if (!existsSync15(USERS_FILE)) return null;
-  const raw2 = readFileSync16(USERS_FILE, "utf-8").trim();
+  const raw2 = readFileSync17(USERS_FILE, "utf-8").trim();
   if (!raw2) return [];
   return JSON.parse(raw2);
 }
@@ -17312,7 +17284,7 @@ app8.post("/set-pin", async (c) => {
   const account = resolveAccount();
   if (account) {
     try {
-      const config = JSON.parse(readFileSync16(`${account.accountDir}/account.json`, "utf-8"));
+      const config = JSON.parse(readFileSync17(`${account.accountDir}/account.json`, "utf-8"));
       if (!config.admins) config.admins = [];
       if (!config.admins.some((a) => a.userId === userId)) {
         config.admins.push({ userId, role: "owner" });
@@ -17370,7 +17342,7 @@ app8.post("/skip", async (c) => {
   const brandPath = PLATFORM_ROOT7 ? resolve16(PLATFORM_ROOT7, "config", "brand.json") : "";
   if (brandPath && existsSync15(brandPath)) {
     try {
-      const brand = JSON.parse(readFileSync16(brandPath, "utf-8"));
+      const brand = JSON.parse(readFileSync17(brandPath, "utf-8"));
       if (brand.productName) agentName = brand.productName;
     } catch (err) {
       console.error(`[onboarding-skip] brand.json read failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -17564,14 +17536,14 @@ app9.post("/", async (c) => {
 var client_error_default = app9;
 
 // server/routes/admin/session.ts
-import { readFileSync as readFileSync17, existsSync as existsSync17 } from "fs";
+import { readFileSync as readFileSync18, existsSync as existsSync17 } from "fs";
 import { createHash as createHash2 } from "crypto";
 function hashPin2(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
   if (!existsSync17(USERS_FILE)) return null;
-  const raw2 = readFileSync17(USERS_FILE, "utf-8").trim();
+  const raw2 = readFileSync18(USERS_FILE, "utf-8").trim();
   if (!raw2) return [];
   return JSON.parse(raw2);
 }
@@ -18267,7 +18239,7 @@ app12.post("/", requireAdminSession, async (c) => {
 var compact_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync18, readdirSync as readdirSync5, readFileSync as readFileSync18, statSync as statSync9 } from "fs";
+import { existsSync as existsSync18, readdirSync as readdirSync5, readFileSync as readFileSync19, statSync as statSync9 } from "fs";
 import { resolve as resolve18, basename as basename5 } from "path";
 var TAIL_BYTES = 8192;
 var app13 = new Hono2();
@@ -18286,7 +18258,7 @@ app13.get("/", async (c) => {
       const filePath = resolve18(dir, safe);
       searched.push(filePath);
       try {
-        const content = readFileSync18(filePath, "utf-8");
+        const content = readFileSync19(filePath, "utf-8");
         const headers = { "Content-Type": "text/plain; charset=utf-8" };
         if (download) headers["Content-Disposition"] = `attachment; filename="${safe}"`;
         return new Response(content, { headers });
@@ -18328,7 +18300,7 @@ app13.get("/", async (c) => {
       const filePath = resolve18(dir, fileName);
       searched.push(filePath);
       try {
-        const content = readFileSync18(filePath, "utf-8");
+        const content = readFileSync19(filePath, "utf-8");
         const headers = { "Content-Type": "text/plain; charset=utf-8" };
         if (download) headers["Content-Disposition"] = `attachment; filename="${fileName}"`;
         return new Response(content, { headers });
@@ -18355,7 +18327,7 @@ app13.get("/", async (c) => {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve18(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync18(resolve18(dir, name));
+        const content = readFileSync19(resolve18(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -18440,7 +18412,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app15;
 
 // server/routes/admin/account.ts
-import { readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "fs";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync13 } from "fs";
 import { resolve as resolve20 } from "path";
 var VALID_CONTEXT_MODES = ["managed", "claude-code"];
 var app16 = new Hono2();
@@ -18459,7 +18431,7 @@ app16.patch("/", requireAdminSession, async (c) => {
   if (!account) return c.json({ error: "No account configured" }, 500);
   const configPath2 = resolve20(account.accountDir, "account.json");
   try {
-    const raw2 = readFileSync19(configPath2, "utf-8");
+    const raw2 = readFileSync20(configPath2, "utf-8");
     const config = JSON.parse(raw2);
     config.contextMode = contextMode;
     writeFileSync13(configPath2, JSON.stringify(config, null, 2) + "\n", "utf-8");
@@ -18474,7 +18446,7 @@ var account_default = app16;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve21 } from "path";
-import { readdirSync as readdirSync6, readFileSync as readFileSync20, existsSync as existsSync20, rmSync as rmSync3 } from "fs";
+import { readdirSync as readdirSync6, readFileSync as readFileSync21, existsSync as existsSync20, rmSync as rmSync3 } from "fs";
 var app17 = new Hono2();
 app17.get("/", (c) => {
   const account = resolveAccount();
@@ -18490,7 +18462,7 @@ app17.get("/", (c) => {
       const configPath2 = resolve21(agentsDir, entry.name, "config.json");
       if (!existsSync20(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync20(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync21(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -18532,7 +18504,7 @@ app17.delete("/:slug", (c) => {
 var agents_default = app17;
 
 // server/routes/admin/version.ts
-import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
 import { resolve as resolve22, join as join10 } from "path";
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
 var brandHostname = "maxy";
@@ -18540,7 +18512,7 @@ var brandNpmPackage = "@rubytech/create-maxy";
 var brandJsonPath = join10(PLATFORM_ROOT8, "config", "brand.json");
 if (existsSync21(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync21(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync22(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
     if (brand.npm?.packageName) brandNpmPackage = brand.npm.packageName;
   } catch {
@@ -18552,7 +18524,7 @@ var REGISTRY_URL = `https://registry.npmjs.org/${NPM_PACKAGE}/latest`;
 var FETCH_TIMEOUT_MS = 5e3;
 function readInstalled() {
   if (!existsSync21(VERSION_FILE)) return "unknown";
-  const content = readFileSync21(VERSION_FILE, "utf-8").trim();
+  const content = readFileSync22(VERSION_FILE, "utf-8").trim();
   return content || "unknown";
 }
 async function fetchLatest() {
@@ -18806,66 +18778,6 @@ app20.post("/launch", async (c) => {
 });
 var browser_default = app20;
 
-// server/routes/admin/terminal.ts
-var app21 = new Hono2();
-app21.post("/launch", async (c) => {
-  try {
-    const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
-    if (transport === "vnc") {
-      const vncOk = await ensureVnc();
-      if (!vncOk) {
-        return c.json({ ok: false, error: "VNC failed to start" }, 502);
-      }
-    }
-    const terminalResult = await ensureTerminal(transport);
-    if (!terminalResult.ok) {
-      return c.json({ ok: false, error: terminalResult.error ?? "Terminal failed to start" }, 502);
-    }
-    return c.json({ ok: true, transport });
-  } catch (err) {
-    console.error("[admin/terminal/launch] Failed to start terminal:", err);
-    return c.json(
-      { ok: false, error: err instanceof Error ? err.message : "Unknown error" },
-      500
-    );
-  }
-});
-app21.post("/launch-upgrade", async (c) => {
-  try {
-    const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
-    if (transport === "vnc") {
-      const vncOk = await ensureVnc();
-      if (!vncOk) {
-        return c.json({ ok: false, error: "VNC failed to start" }, 502);
-      }
-    }
-    const result = await ensureTerminalUpgrade(transport);
-    if (!result.ok) {
-      return c.json({ ok: false, error: result.error ?? "Upgrade terminal failed to start" }, 502);
-    }
-    return c.json({ ok: true, transport });
-  } catch (err) {
-    console.error("[admin/terminal/launch-upgrade] Failed to start upgrade terminal:", err);
-    return c.json(
-      { ok: false, error: err instanceof Error ? err.message : "Unknown error" },
-      500
-    );
-  }
-});
-app21.post("/close", (c) => {
-  try {
-    killTerminal();
-    return c.json({ ok: true });
-  } catch (err) {
-    console.error("[admin/terminal/close] kill failed:", err);
-    return c.json(
-      { ok: false, error: err instanceof Error ? err.message : "Unknown error" },
-      500
-    );
-  }
-});
-var terminal_default = app21;
-
 // app/lib/cdp-client.ts
 var CDP_HOST = "127.0.0.1";
 var CDP_PORT = 9222;
@@ -18907,8 +18819,8 @@ async function cdpNavigateNewTab(url, opts = {}) {
 }
 
 // server/routes/admin/device-browser.ts
-var app22 = new Hono2();
-app22.post("/navigate", async (c) => {
+var app21 = new Hono2();
+app21.post("/navigate", async (c) => {
   const TAG19 = "[device-url:click]";
   let body;
   try {
@@ -18995,7 +18907,7 @@ app22.post("/navigate", async (c) => {
     targetId: outcome.targetId
   });
 });
-var device_browser_default = app22;
+var device_browser_default = app21;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -19004,8 +18916,8 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app23 = new Hono2();
-app23.post("/", async (c) => {
+var app22 = new Hono2();
+app22.post("/", async (c) => {
   const TAG19 = "[admin:events]";
   let body;
   try {
@@ -19036,12 +18948,12 @@ app23.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app23;
+var events_default = app22;
 
 // server/routes/admin/cloudflare.ts
 import { homedir as homedir3 } from "os";
 import { resolve as resolve24 } from "path";
-import { readFileSync as readFileSync23 } from "fs";
+import { readFileSync as readFileSync24 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -19057,14 +18969,14 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync12, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync12, readFileSync as readFileSync23, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname9 } from "path";
 import { resolve as resolve23 } from "path";
 var ALIAS_DOMAINS_PATH = resolve23(MAXY_DIR, "alias-domains.json");
 function readExisting() {
   if (!existsSync22(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync22(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync23(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -19086,7 +18998,7 @@ function loadBrandInfo() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
   const brandPath = resolve24(platformRoot2, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync23(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync24(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -19129,7 +19041,7 @@ function validateBody(body) {
   }
   return null;
 }
-var app24 = new Hono2();
+var app23 = new Hono2();
 function fieldFromReason(reason) {
   switch (reason) {
     case "not-signed-in":
@@ -19146,7 +19058,7 @@ function fieldFromReason(reason) {
       return "script";
   }
 }
-app24.get("/domains", requireAdminSession, async (c) => {
+app23.get("/domains", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
   let correlationId;
@@ -19239,7 +19151,7 @@ ${result.stderr}` : ""}`;
   );
   return c.json(success, 200);
 });
-app24.post("/setup", requireAdminSession, async (c) => {
+app23.post("/setup", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
   let correlationId;
@@ -19377,7 +19289,7 @@ ${result.stderr}` : ""}`;
   log2(`phase=response-sent`);
   return resp;
 });
-var cloudflare_default = app24;
+var cloudflare_default = app23;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream3 } from "fs";
@@ -19489,25 +19401,72 @@ async function trashNode(params) {
   const setNullClauses = Object.keys(originalKeys).map((k) => `n.\`${k}\` = null`).join(", ");
   const setNullSuffix = setNullClauses ? `, ${setNullClauses}` : "";
   const trashedAt = (/* @__PURE__ */ new Date()).toISOString();
-  await session.run(
-    `MATCH (n) WHERE elementId(n) = $eid
-     SET n:Trashed,
-         n.trashedAt = datetime($trashedAt),
-         n.trashedBy = $by,
-         n.trashReason = $reason,
-         n._trashedKeys = $trashedKeysJson${setNullSuffix}`,
-    {
-      eid: elementId,
-      trashedAt,
-      by,
-      reason: reason ?? null,
-      trashedKeysJson: JSON.stringify(originalKeys)
+  const isConversation = baseLabels.includes("Conversation");
+  const messageUniqueKeys = UNIQUE_KEYS_BY_LABEL["Message"] ?? [];
+  let cascadedMessageCount = 0;
+  await session.executeWrite(async (tx) => {
+    await tx.run(
+      `MATCH (n) WHERE elementId(n) = $eid
+       SET n:Trashed,
+           n.trashedAt = datetime($trashedAt),
+           n.trashedBy = $by,
+           n.trashReason = $reason,
+           n._trashedKeys = $trashedKeysJson${setNullSuffix}`,
+      {
+        eid: elementId,
+        trashedAt,
+        by,
+        reason: reason ?? null,
+        trashedKeysJson: JSON.stringify(originalKeys)
+      }
+    );
+    if (isConversation) {
+      const collectKeys = messageUniqueKeys.length > 0 ? messageUniqueKeys.map((k) => `\`${k}\`: m.\`${k}\``).join(", ") : "";
+      const collectMsgProps = collectKeys ? `, {${collectKeys}}` : ", {}";
+      const collected = await tx.run(
+        `MATCH (c) WHERE elementId(c) = $eid
+         MATCH (m:Message)-[:PART_OF]->(c)
+         WHERE NOT m:Trashed
+         RETURN elementId(m) AS meid${collectMsgProps} AS keys`,
+        { eid: elementId }
+      );
+      for (const rec of collected.records) {
+        const meid = rec.get("meid");
+        const keys = rec.get("keys");
+        const liveKeys = {};
+        for (const k of messageUniqueKeys) {
+          if (keys[k] !== void 0 && keys[k] !== null) liveKeys[k] = keys[k];
+        }
+        const msgSetNulls = Object.keys(liveKeys).length > 0 ? ", " + Object.keys(liveKeys).map((k) => `m.\`${k}\` = null`).join(", ") : "";
+        await tx.run(
+          `MATCH (m) WHERE elementId(m) = $meid
+           SET m:Trashed,
+               m.trashedAt = datetime($trashedAt),
+               m.trashedBy = $by,
+               m.trashReason = $reason,
+               m._trashedKeys = $trashedKeysJson${msgSetNulls}`,
+          {
+            meid,
+            trashedAt,
+            by: `${by}:cascade-from-conversation`,
+            reason: reason ?? `cascade from Conversation ${elementId}`,
+            trashedKeysJson: JSON.stringify(liveKeys)
+          }
+        );
+      }
+      cascadedMessageCount = collected.records.length;
     }
-  );
+  });
   process.stderr.write(
     `[trash:marked] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")} by=${by} reason=${reason ?? "null"}
 `
   );
+  if (isConversation) {
+    process.stderr.write(
+      `[trash:cascaded] accountId=${accountId} conversationElementId=${elementId} messageCount=${cascadedMessageCount} by=${by}
+`
+    );
+  }
   return {
     trashed: true,
     alreadyTrashed: false,
@@ -19558,16 +19517,50 @@ async function restoreNode(params) {
   const setSuffix = setClauses ? `, ${setClauses}` : "";
   const setParams = { eid: elementId };
   for (const [k, v] of Object.entries(originalKeys)) setParams[`val_${k}`] = v;
-  await session.run(
-    `MATCH (n:Trashed) WHERE elementId(n) = $eid
-     REMOVE n:Trashed, n.trashedAt, n.trashedBy, n.trashReason, n._trashedKeys
-     SET n.restoredAt = datetime()${setSuffix}`,
-    setParams
-  );
+  const isConversation = baseLabels.includes("Conversation");
+  let cascadedMessageCount = 0;
+  await session.executeWrite(async (tx) => {
+    await tx.run(
+      `MATCH (n:Trashed) WHERE elementId(n) = $eid
+       REMOVE n:Trashed, n.trashedAt, n.trashedBy, n.trashReason, n._trashedKeys
+       SET n.restoredAt = datetime()${setSuffix}`,
+      setParams
+    );
+    if (isConversation) {
+      const collected = await tx.run(
+        `MATCH (c) WHERE elementId(c) = $eid
+         MATCH (m:Trashed:Message)-[:PART_OF]->(c)
+         WHERE m.trashedBy ENDS WITH ':cascade-from-conversation'
+         RETURN elementId(m) AS meid, m._trashedKeys AS keysJson`,
+        { eid: elementId }
+      );
+      for (const rec of collected.records) {
+        const meid = rec.get("meid");
+        const keysJson2 = rec.get("keysJson");
+        const keys = keysJson2 ? JSON.parse(keysJson2) : {};
+        const setClause = Object.keys(keys).length > 0 ? ", " + Object.keys(keys).map((k) => `m.\`${k}\` = $val_${k}`).join(", ") : "";
+        const msgParams = { meid };
+        for (const [k, v] of Object.entries(keys)) msgParams[`val_${k}`] = v;
+        await tx.run(
+          `MATCH (m) WHERE elementId(m) = $meid
+           REMOVE m:Trashed, m.trashedAt, m.trashedBy, m.trashReason, m._trashedKeys
+           SET m.restoredAt = datetime()${setClause}`,
+          msgParams
+        );
+      }
+      cascadedMessageCount = collected.records.length;
+    }
+  });
   process.stderr.write(
     `[trash:restored] accountId=${accountId} elementId=${elementId} labels=${baseLabels.join(",")}
 `
   );
+  if (isConversation) {
+    process.stderr.write(
+      `[trash:cascade-restored] accountId=${accountId} conversationElementId=${elementId} messageCount=${cascadedMessageCount}
+`
+    );
+  }
   return {
     restored: true,
     nodeId: elementId,
@@ -19729,8 +19722,8 @@ function buildDisplayPath(relPath, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-var app25 = new Hono2();
-app25.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono2();
+app24.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   if (!getAccountIdForSession(sessionKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
@@ -19791,7 +19784,7 @@ app25.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app25.get("/download", requireAdminSession, async (c) => {
+app24.get("/download", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   if (!getAccountIdForSession(sessionKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
@@ -19839,7 +19832,7 @@ app25.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app25.post("/upload", requireAdminSession, async (c) => {
+app24.post("/upload", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -19897,7 +19890,7 @@ app25.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app25.delete("/", requireAdminSession, async (c) => {
+app24.delete("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -19964,13 +19957,13 @@ app25.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app25;
+var files_default = app24;
 
 // server/routes/admin/graph-search.ts
 var DEFAULT_LIMIT = 20;
 var MAX_LIMIT = 100;
-var app26 = new Hono2();
-app26.get("/", requireAdminSession, async (c) => {
+var app25 = new Hono2();
+app25.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -19995,7 +19988,7 @@ app26.get("/", requireAdminSession, async (c) => {
     return c.json({ error: `Graph search unavailable: ${message}` }, 503);
   }
 });
-var graph_search_default = app26;
+var graph_search_default = app25;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j3 from "neo4j-driver";
@@ -20124,8 +20117,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "sessionKey"
 ]);
-var app27 = new Hono2();
-app27.get("/", requireAdminSession, async (c) => {
+var app26 = new Hono2();
+app26.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -20401,12 +20394,12 @@ function pruneNode(node, warnedClasses) {
   const labels = (node.labels ?? []).filter((l) => l !== "Trashed");
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app27;
+var graph_subgraph_default = app26;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash"];
-var app28 = new Hono2();
-app28.post("/", requireAdminSession, async (c) => {
+var app27 = new Hono2();
+app27.post("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -20477,11 +20470,11 @@ app28.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app28;
+var graph_delete_default = app27;
 
 // server/routes/admin/graph-restore.ts
-var app29 = new Hono2();
-app29.post("/", requireAdminSession, async (c) => {
+var app28 = new Hono2();
+app28.post("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -20545,11 +20538,11 @@ app29.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app29;
+var graph_restore_default = app28;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app30 = new Hono2();
-app30.get("/", requireAdminSession, async (c) => {
+var app29 = new Hono2();
+app29.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -20610,11 +20603,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app30;
+var graph_labels_in_graph_default = app29;
 
 // server/routes/admin/graph-default-view.ts
-var app31 = new Hono2();
-app31.get("/", requireAdminSession, async (c) => {
+var app30 = new Hono2();
+app30.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   const userId = getUserIdForSession(sessionKey);
@@ -20652,7 +20645,7 @@ app31.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app31.put("/", requireAdminSession, async (c) => {
+app30.put("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   const userId = getUserIdForSession(sessionKey);
@@ -20734,11 +20727,11 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app31;
+var graph_default_view_default = app30;
 
 // server/routes/admin/file-attach.ts
-var app32 = new Hono2();
-app32.post("/", async (c) => {
+var app31 = new Hono2();
+app31.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -20761,11 +20754,11 @@ app32.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app32;
+var file_attach_default = app31;
 
 // server/routes/admin/adherence.ts
-var app33 = new Hono2();
-app33.get("/", requireAdminSession, async (c) => {
+var app32 = new Hono2();
+app32.get("/", requireAdminSession, async (c) => {
   const agent = c.req.query("agent") ?? "admin";
   const includeBlock = c.req.query("block") === "1";
   const account = resolveAccount();
@@ -20786,35 +20779,34 @@ app33.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to read adherence ledger", agent }, 500);
   }
 });
-var adherence_default = app33;
+var adherence_default = app32;
 
 // server/routes/admin/index.ts
-var app34 = new Hono2();
-app34.route("/session", session_default2);
-app34.route("/chat", chat_default2);
-app34.route("/compact", compact_default);
-app34.route("/logs", logs_default);
-app34.route("/claude-info", claude_info_default);
-app34.route("/attachment", attachment_default);
-app34.route("/account", account_default);
-app34.route("/agents", agents_default);
-app34.route("/version", version_default);
-app34.route("/sessions", sessions_default);
-app34.route("/browser", browser_default);
-app34.route("/terminal", terminal_default);
-app34.route("/device-browser", device_browser_default);
-app34.route("/events", events_default);
-app34.route("/cloudflare", cloudflare_default);
-app34.route("/files", files_default);
-app34.route("/graph-search", graph_search_default);
-app34.route("/graph-subgraph", graph_subgraph_default);
-app34.route("/graph-delete", graph_delete_default);
-app34.route("/graph-restore", graph_restore_default);
-app34.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app34.route("/graph-default-view", graph_default_view_default);
-app34.route("/file-attach", file_attach_default);
-app34.route("/adherence", adherence_default);
-var admin_default = app34;
+var app33 = new Hono2();
+app33.route("/session", session_default2);
+app33.route("/chat", chat_default2);
+app33.route("/compact", compact_default);
+app33.route("/logs", logs_default);
+app33.route("/claude-info", claude_info_default);
+app33.route("/attachment", attachment_default);
+app33.route("/account", account_default);
+app33.route("/agents", agents_default);
+app33.route("/version", version_default);
+app33.route("/sessions", sessions_default);
+app33.route("/browser", browser_default);
+app33.route("/device-browser", device_browser_default);
+app33.route("/events", events_default);
+app33.route("/cloudflare", cloudflare_default);
+app33.route("/files", files_default);
+app33.route("/graph-search", graph_search_default);
+app33.route("/graph-subgraph", graph_subgraph_default);
+app33.route("/graph-delete", graph_delete_default);
+app33.route("/graph-restore", graph_restore_default);
+app33.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app33.route("/graph-default-view", graph_default_view_default);
+app33.route("/file-attach", file_attach_default);
+app33.route("/adherence", adherence_default);
+var admin_default = app33;
 
 // server/index.ts
 var PLATFORM_ROOT10 = process.env.MAXY_PLATFORM_ROOT || "";
@@ -20825,7 +20817,7 @@ if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
 }
 if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync24(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -20848,7 +20840,7 @@ var ALIAS_DOMAINS_PATH2 = join12(homedir4(), BRAND.configDir, "alias-domains.jso
 function loadAliasDomains() {
   try {
     if (!existsSync23(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync24(ALIAS_DOMAINS_PATH2, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -20872,9 +20864,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app35 = new Hono2();
-app35.use("*", clientIpMiddleware);
-app35.use("*", async (c, next) => {
+var app34 = new Hono2();
+app34.use("*", clientIpMiddleware);
+app34.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -20897,7 +20889,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/g/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app35.use("*", async (c, next) => {
+app34.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -20937,7 +20929,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app35.post("/__remote-auth/login", async (c) => {
+app34.post("/__remote-auth/login", async (c) => {
   const clientIp = c.var.clientIp || "unknown";
   const rateLimited = checkRateLimit(clientIp);
   if (rateLimited) {
@@ -20973,10 +20965,7 @@ app35.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app35.get("/__remote-auth/logout", (c) => {
-  const cookieHeader = c.req.header("cookie");
-  const token = parseCookie(cookieHeader, "__remote_session");
-  if (token) invalidateRemoteSession(token);
+app34.get("/__remote-auth/logout", () => {
   return new Response(null, {
     status: 302,
     headers: {
@@ -20986,7 +20975,7 @@ app35.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app35.post("/__remote-auth/change-password", async (c) => {
+app34.post("/__remote-auth/change-password", async (c) => {
   const clientIp = c.var.clientIp || "unknown";
   const rateLimited = checkRateLimit(clientIp);
   if (rateLimited) {
@@ -21035,13 +21024,13 @@ app35.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app35.get("/__remote-auth/setup", (c) => {
+app34.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app35.post("/__remote-auth/set-initial-password", async (c) => {
+app34.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -21077,10 +21066,10 @@ app35.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app35.get("/api/remote-auth/status", (c) => {
+app34.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app35.post("/api/remote-auth/set-password", async (c) => {
+app34.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21110,9 +21099,9 @@ app35.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app35.route("/api/_client-error", client_error_default);
+app34.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app35.use("*", async (c, next) => {
+app34.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -21142,25 +21131,15 @@ app35.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-function parseCookie(cookieHeader, name) {
-  if (!cookieHeader) return null;
-  const match2 = cookieHeader.match(new RegExp(`(?:^|;\\s*)${name}=([^;]*)`));
-  if (!match2) return null;
-  try {
-    return decodeURIComponent(match2[1]);
-  } catch {
-    return null;
-  }
-}
-app35.route("/api/health", health_default);
-app35.route("/api/session", session_default);
-app35.route("/api/chat", chat_default);
-app35.route("/api/group", group_default);
-app35.route("/api/access", access_default);
-app35.route("/api/telegram", telegram_default);
-app35.route("/api/whatsapp", whatsapp_default);
-app35.route("/api/onboarding", onboarding_default);
-app35.route("/api/admin", admin_default);
+app34.route("/api/health", health_default);
+app34.route("/api/session", session_default);
+app34.route("/api/chat", chat_default);
+app34.route("/api/group", group_default);
+app34.route("/api/access", access_default);
+app34.route("/api/telegram", telegram_default);
+app34.route("/api/whatsapp", whatsapp_default);
+app34.route("/api/onboarding", onboarding_default);
+app34.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -21172,7 +21151,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app35.get("/agent-assets/:slug/:filename", (c) => {
+app34.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -21201,13 +21180,13 @@ app35.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync24(filePath);
+  const body = readFileSync25(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app35.get("/generated/:filename", (c) => {
+app34.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -21231,7 +21210,7 @@ app35.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync24(filePath);
+  const body = readFileSync25(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -21242,7 +21221,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync24(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync25(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -21261,7 +21240,7 @@ function readInstalledVersion() {
     if (!PLATFORM_ROOT10) return "unknown";
     const versionFile = join12(PLATFORM_ROOT10, "config", `.${BRAND.hostname}-version`);
     if (!existsSync23(versionFile)) return "unknown";
-    const content = readFileSync24(versionFile, "utf-8").trim();
+    const content = readFileSync25(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -21302,7 +21281,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync24(resolve27(process.cwd(), "public", file), "utf-8");
+    html = readFileSync25(resolve27(process.cwd(), "public", file), "utf-8");
     html = html.replace("<title>Maxy</title>", `<title>${escapeHtml(BRAND.productName)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
     const headInjection = file === "index.html" ? `${brandScript}
@@ -21321,12 +21300,12 @@ function loadBrandingCache(agentSlug) {
   try {
     const accountJsonPath = join12(configDir2, "account.json");
     if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync24(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync25(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join12(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync23(cachePath)) return null;
-    return JSON.parse(readFileSync24(cachePath, "utf-8"));
+    return JSON.parse(readFileSync25(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -21336,7 +21315,7 @@ function resolveDefaultSlug() {
     const configDir2 = join12(homedir4(), BRAND.configDir);
     const accountJsonPath = join12(configDir2, "account.json");
     if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync24(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync25(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -21372,7 +21351,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app35.get("/", (c) => {
+app34.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -21380,12 +21359,12 @@ app35.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app35.get("/public", (c) => {
+app34.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app35.get("/chat", (c) => {
+app34.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -21404,12 +21383,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app35.use("/vnc-viewer.html", logViewerFetch);
-app35.use("/vnc-popout.html", logViewerFetch);
-app35.get("/vnc-popout.html", (c) => {
+app34.use("/vnc-viewer.html", logViewerFetch);
+app34.use("/vnc-popout.html", logViewerFetch);
+app34.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync24(resolve27(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync25(resolve27(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -21419,7 +21398,7 @@ app35.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app35.post("/api/vnc/client-event", async (c) => {
+app34.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21440,20 +21419,20 @@ app35.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app35.get("/g/:slug", (c) => {
+app34.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app35.get("/graph", (c) => {
+app34.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app35.get("/data", (c) => {
+app34.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app35.get("/:slug", async (c, next) => {
+app34.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -21462,10 +21441,10 @@ app35.get("/:slug", async (c, next) => {
   }
   await next();
 });
-app35.use("/*", serveStatic({ root: "./public" }));
+app34.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.PORT ?? "19199", 10);
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app35.fetch, port, hostname });
+var httpServer = serve({ fetch: app34.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 var SUBAPP_MANIFEST = [
   { prefix: "/api/health", file: "server/routes/health.ts", subapp: health_default },
@@ -21485,7 +21464,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app35.routes ?? []) {
+  for (const r of app34.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -21500,7 +21479,7 @@ try {
   try {
     let userId = "";
     if (existsSync23(USERS_FILE)) {
-      const users = JSON.parse(readFileSync24(USERS_FILE, "utf-8").trim() || "[]");
+      const users = JSON.parse(readFileSync25(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);