@rubytech/create-realagent 1.0.721 → 1.0.736

package/payload/server/server.js

@@ -1,35 +1,65 @@
 import {
-  GREETING_DIRECTIVE,
-  HAIKU_MODEL,
   Hono,
   LOG_DIR,
   MAXY_DIR,
   TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE,
   TELEGRAM_WEBHOOK_SECRET_FILE,
   USERS_FILE,
-  __commonJS,
-  __toESM,
-  agentLogStream,
-  backfillNullUserIdConversations,
-  bindVisitorToGroup,
   buildX11Env,
   callOauthLlm,
   canAccessAdmin,
-  checkGroupMembership,
   checkRateLimit,
   clearRateLimit,
-  clearSessionHistory,
   clientIpMiddleware,
   compactSession,
-  completeGrantSetup,
   computeConstraints,
   createRemoteSession,
-  deleteConversation,
-  embed,
   ensureAuth,
   ensureCdp,
   ensureLogDir,
   ensureVnc,
+  hashPassword,
+  invokeAgent,
+  isActionActive,
+  isPasswordValid,
+  isRemoteAuthConfigured,
+  keyFilePath,
+  launchAction,
+  load,
+  logPath,
+  recordFailedAttempt,
+  render,
+  renderLoginPage,
+  requireAdminSession,
+  resolveBrowserTransport,
+  resolveClientIp,
+  safeJson,
+  sanitizeClientCorrId,
+  serve,
+  setRemotePassword,
+  sleep,
+  streamLogPathFor,
+  validateKey,
+  validatePasswordStrength,
+  verifyPassword,
+  verifyRemotePassword,
+  vncLog,
+  waitForExit,
+  writeChromiumWrapper
+} from "./chunk-ULVR2RRY.js";
+import {
+  GREETING_DIRECTIVE,
+  HAIKU_MODEL,
+  __commonJS,
+  __toESM,
+  agentLogStream,
+  backfillNullUserIdConversations,
+  bindVisitorToGroup,
+  checkGroupMembership,
+  clearSessionHistory,
+  completeGrantSetup,
+  deleteConversation,
+  embed,
   fetchBranding,
   findGroupBySlug,
   findRecentConversation,
@@ -49,56 +79,30 @@ import {
   getUserNameForSession,
   getUserTimezone,
   getVisitorIdForSession,
-  hashPassword,
-  invokeAgent,
-  isActionActive,
-  isPasswordValid,
-  isRemoteAuthConfigured,
-  keyFilePath,
-  launchAction,
+  interruptClient,
   listAdminSessions,
   listAdminSessionsInProgress,
-  load,
   loadOnboardingStep,
-  logPath,
   preConversationLogStream,
-  recordFailedAttempt,
+  preflushStreamLogKey,
   registerGrantSession,
   registerResumedSession,
   registerSession,
   renameConversation,
-  render,
-  renderLoginPage,
-  requireAdminSession,
   resolveAccount,
   resolveAgentConfig,
-  resolveBrowserTransport,
-  resolveClientIp,
   resolveDefaultAgentSlug,
   resolveUserAccounts,
-  safeJson,
-  sanitizeClientCorrId,
   seedSessionHistory,
-  serve,
   setConversationIdForSession,
   setGroupContextForSession,
-  setRemotePassword,
   sigtermFlushStreamLogs,
-  sleep,
-  streamLogPathFor,
   unregisterSession,
   validateAgentSlug,
-  validateKey,
-  validatePasswordStrength,
   validateSession,
   verifyAndGetConversationUpdatedAt,
-  verifyConversationOwnership,
-  verifyPassword,
-  verifyRemotePassword,
-  vncLog,
-  waitForExit,
-  writeChromiumWrapper
-} from "./chunk-7ODDM7L4.js";
+  verifyConversationOwnership
+} from "./chunk-3KDVGWPQ.js";
 
 // ../lib/graph-trash/dist/index.js
 var require_dist = __commonJS({
@@ -597,8 +601,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync17, existsSync as existsSync19, watchFile } from "fs";
-import { resolve as resolve21, join as join10, basename as basename7 } from "path";
+import { readFileSync as readFileSync16, existsSync as existsSync19, watchFile } from "fs";
+import { resolve as resolve20, join as join10, basename as basename7 } from "path";
 import { homedir as homedir2 } from "os";
 
 // app/lib/agent-slug-pattern.ts
@@ -2683,7 +2687,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG3} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve22) => setTimeout(() => resolve22("timeout"), timeoutMs)
+    (resolve21) => setTimeout(() => resolve21("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -2811,11 +2815,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve21, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve22();
+        resolve21();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2929,14 +2933,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve22, reject) => {
+  return new Promise((resolve21, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve22(value);
+        resolve21(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -4150,11 +4154,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG11} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve22) => {
-        const timer2 = setTimeout(resolve22, delay);
+      await new Promise((resolve21) => {
+        const timer2 = setTimeout(resolve21, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve22();
+          resolve21();
         }, { once: true });
       });
     }
@@ -4162,16 +4166,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve21) => {
     if (!conn.sock) {
-      resolve22();
+      resolve21();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve22();
+        resolve21();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -4388,8 +4392,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve22) => {
-      resolvePending = resolve22;
+    const sttPending = new Promise((resolve21) => {
+      resolvePending = resolve21;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -4502,20 +4506,20 @@ async function probeApiKey() {
   return result.status;
 }
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve22) => {
+  return new Promise((resolve21) => {
     const socket = createConnection(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve22(true);
+      resolve21(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve22(false);
+      resolve21(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve22(false);
+      resolve21(false);
     });
   });
 }
@@ -6717,8 +6721,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve22, reject) => {
-    resolveQr = resolve22;
+  const qrPromise = new Promise((resolve21, reject) => {
+    resolveQr = resolve21;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -7820,6 +7824,7 @@ var session_default2 = app10;
 
 // server/routes/admin/chat.ts
 import { resolve as resolve12 } from "path";
+import { appendFileSync as appendFileSync4 } from "fs";
 
 // app/lib/script-stream-tailer.ts
 import * as childProcess from "child_process";
@@ -8106,6 +8111,16 @@ function chatReject(status, error, sk) {
   });
 }
 var app11 = new Hono();
+app11.post("/cancel", requireAdminSession, async (c) => {
+  const session_key = c.var.sessionKey;
+  try {
+    const { interruptClient: interruptClient2 } = await import("./client-pool-I5TCP7WI.js");
+    await interruptClient2(session_key);
+    return c.json({ ok: true });
+  } catch (err) {
+    return c.json({ ok: false, error: err instanceof Error ? err.message : String(err) }, 500);
+  }
+});
 app11.post("/", requireAdminSession, async (c) => {
   const session_key = c.var.sessionKey;
   const contentType = c.req.header("content-type") ?? "";
@@ -8254,13 +8269,107 @@ app11.post("/", requireAdminSession, async (c) => {
   }
   const encoder = new TextEncoder();
   const sseConvId = getConversationIdForSession(session_key);
-  const sseLog = sseConvId ? agentLogStream("sse-events", account.accountDir, sseConvId) : preConversationLogStream("sse-events", account.accountDir);
+  const sseLogStream = sseConvId ? agentLogStream("sse-events", account.accountDir, sseConvId) : preConversationLogStream("sse-events", account.accountDir);
   const sk = sseConvId?.slice(0, 8) ?? session_key.slice(0, 8);
+  const teeStreamLogKey = sseConvId ?? preflushStreamLogKey(session_key);
+  const teeStreamLogPath = resolve12(account.accountDir, "logs", `claude-agent-stream-${teeStreamLogKey}.log`);
+  try {
+    appendFileSync4(teeStreamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [chat-route-version=task606-incoming-close] sessionKey=${session_key.slice(0, 12)}\u2026
+`);
+  } catch {
+  }
+  const incoming = c.env?.incoming;
+  if (incoming && typeof incoming.on === "function") {
+    incoming.on("close", () => {
+      const tsClose = (/* @__PURE__ */ new Date()).toISOString();
+      try {
+        appendFileSync4(teeStreamLogPath, `[${tsClose}] [incoming-close] sessionKey=${session_key.slice(0, 12)}\u2026 complete=${incoming.complete}
+`);
+      } catch {
+      }
+      if (incoming.complete === false) {
+        console.error(`[${tsClose}] [incoming-close] DISCONNECT sessionKey=${session_key.slice(0, 12)}\u2026`);
+        interruptClient(session_key).catch((err) => {
+          try {
+            appendFileSync4(teeStreamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [incoming-close] interrupt-failed: ${err instanceof Error ? err.message : String(err)}
+`);
+          } catch {
+          }
+        });
+      }
+    });
+  } else {
+    try {
+      appendFileSync4(teeStreamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [incoming-close] UNAVAILABLE \u2014 c.env.incoming is not an EventEmitter
+`);
+    } catch {
+    }
+  }
+  const sseLog = {
+    write(line) {
+      try {
+        sseLogStream.write(line);
+      } catch {
+      }
+      try {
+        appendFileSync4(teeStreamLogPath, line);
+      } catch {
+      }
+      return true;
+    },
+    end() {
+      try {
+        sseLogStream.end();
+      } catch {
+      }
+    }
+  };
   let tailer = null;
   const readable = new ReadableStream({
+    // Task 606 — fires when the consumer (Hono's response writer / Node
+    // adapter) cancels the stream because the client disconnected. This is
+    // the only signal that arrives WHILE start()'s for-await is blocked
+    // awaiting the SDK's next message — c.req.raw.signal didn't propagate
+    // under @hono/node-server, and controller.enqueue throwing only
+    // surfaces on the next yielded event (which never comes if the model
+    // is mid-response when Cancel is pressed). cancel() is the load-bearing
+    // hook for operator abort.
+    //
+    // Synchronous trace writes go to BOTH the per-conv stream log (where
+    // operators read) AND console.error (server.log backstop). This lets
+    // us prove definitively whether this callback is even being invoked
+    // by @hono/node-server on disconnect.
+    cancel(reason) {
+      const ts = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
+      const reasonStr = typeof reason === "string" ? reason : reason instanceof Error ? reason.message : "consumer-cancelled";
+      sseLog.write(`[${ts}] [${sk}] admin: CANCEL [stream-cancel] reason=${reasonStr}
+`);
+      console.error(`[${(/* @__PURE__ */ new Date()).toISOString()}] [stream-cancel-callback] sessionKey=${session_key.slice(0, 12)}\u2026 reason=${JSON.stringify(reasonStr)}`);
+      interruptClient(session_key).catch((err) => {
+        sseLog.write(`[${ts}] [${sk}] admin: ABORT [interrupt-failed] ${err instanceof Error ? err.message : String(err)}
+`);
+      });
+    },
     async start(controller) {
       let controllerOpen = true;
       const sseEntry = { controller, conversationId: sseConvId ?? null, sessionKey: session_key };
+      try {
+        const reqSignal = c.req.raw?.signal;
+        if (reqSignal) {
+          reqSignal.addEventListener("abort", () => {
+            const abortLogKey = sseConvId ?? preflushStreamLogKey(session_key);
+            const abortStreamLog = agentLogStream("claude-agent-stream", account.accountDir, abortLogKey);
+            const ts = (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
+            sseLog.write(`[${ts}] [${sk}] admin: ABORT [operator-cancel] interrupting pool client
+`);
+            interruptClient(session_key, abortStreamLog).catch((err) => {
+              sseLog.write(`[${ts}] [${sk}] admin: ABORT [interrupt-failed] ${err instanceof Error ? err.message : String(err)}
+`);
+            });
+          }, { once: true });
+        }
+      } catch {
+      }
       try {
         registerAdminSSE(sseEntry);
         if (sseConvId) {
@@ -8308,6 +8417,10 @@ app11.post("/", requireAdminSession, async (c) => {
         if (controllerClosed) {
           sseLog.write(`[${ts}] [${sk}] admin: DISCONNECT [client_disconnect] ${rawMessage}
 `);
+          interruptClient(session_key).catch((interruptErr) => {
+            sseLog.write(`[${ts}] [${sk}] admin: ABORT [interrupt-failed] ${interruptErr instanceof Error ? interruptErr.message : String(interruptErr)}
+`);
+          });
         } else {
           const category = classifyAgentError(err);
           const errEvent = JSON.stringify({ type: "text", content: friendlyAgentError(err) });
@@ -8595,9 +8708,8 @@ app14.get("/", (c) => {
   }
   const resolvedAccount = resolveAccount();
   const model = resolvedAccount?.config.adminModel ?? "unknown";
-  const contextMode = resolvedAccount?.config.contextMode ?? "managed";
   const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
-  return c.json({ version, account, model, contextMode, thinkingView });
+  return c.json({ version, account, model, thinkingView });
 });
 var claude_info_default = app14;
 
@@ -8647,47 +8759,14 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
 });
 var attachment_default = app15;
 
-// server/routes/admin/account.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
+// server/routes/admin/agents.ts
 import { resolve as resolve15 } from "path";
-var VALID_CONTEXT_MODES = ["managed", "claude-code"];
+import { readdirSync as readdirSync4, readFileSync as readFileSync13, existsSync as existsSync17, rmSync } from "fs";
 var app16 = new Hono();
-app16.patch("/", requireAdminSession, async (c) => {
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "Invalid request" }, 400);
-  }
-  const { contextMode } = body;
-  if (!contextMode || !VALID_CONTEXT_MODES.includes(contextMode)) {
-    return c.json({ error: `Invalid contextMode. Valid values: ${VALID_CONTEXT_MODES.join(", ")}` }, 400);
-  }
-  const account = resolveAccount();
-  if (!account) return c.json({ error: "No account configured" }, 500);
-  const configPath2 = resolve15(account.accountDir, "account.json");
-  try {
-    const raw = readFileSync13(configPath2, "utf-8");
-    const config = JSON.parse(raw);
-    config.contextMode = contextMode;
-    writeFileSync8(configPath2, JSON.stringify(config, null, 2) + "\n", "utf-8");
-    console.error(`[account-update] contextMode=${contextMode}`);
-    return c.json({ ok: true, contextMode });
-  } catch (err) {
-    console.error(`[account-update] failed: ${err instanceof Error ? err.message : String(err)}`);
-    return c.json({ error: "Failed to update account" }, 500);
-  }
-});
-var account_default = app16;
-
-// server/routes/admin/agents.ts
-import { resolve as resolve16 } from "path";
-import { readdirSync as readdirSync4, readFileSync as readFileSync14, existsSync as existsSync17, rmSync } from "fs";
-var app17 = new Hono();
-app17.get("/", (c) => {
+app16.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve16(account.accountDir, "agents");
+  const agentsDir = resolve15(account.accountDir, "agents");
   if (!existsSync17(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -8695,10 +8774,10 @@ app17.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve16(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve15(agentsDir, entry.name, "config.json");
       if (!existsSync17(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync14(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync13(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -8714,7 +8793,7 @@ app17.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app17.delete("/:slug", (c) => {
+app16.delete("/:slug", (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -8724,7 +8803,7 @@ app17.delete("/:slug", (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve16(account.accountDir, "agents", slug);
+  const agentDir = resolve15(account.accountDir, "agents", slug);
   if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -8737,7 +8816,7 @@ app17.delete("/:slug", (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-var agents_default = app17;
+var agents_default = app16;
 
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
@@ -8759,8 +8838,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app18 = new Hono();
-app18.get("/", requireAdminSession, async (c) => {
+var app17 = new Hono();
+app17.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -8790,7 +8869,7 @@ app18.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app18.post("/new", requireAdminSession, async (c) => {
+app17.post("/new", requireAdminSession, async (c) => {
   const oldSessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(oldSessionKey);
   const userId = getUserIdForSession(oldSessionKey);
@@ -8805,7 +8884,7 @@ app18.post("/new", requireAdminSession, async (c) => {
   console.log(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} session reset for new conversation: oldSessionKey=${oldSessionKey.slice(0, 8)}\u2026 newSessionKey=${newSessionKey.slice(0, 8)}\u2026 previousConversationId=${previousConversationId?.slice(0, 8) ?? "none"}\u2026 newConversationId=deferred`);
   return c.json({ session_key: newSessionKey, conversationId: null });
 });
-app18.delete("/:id", requireAdminSession, async (c) => {
+app17.delete("/:id", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
@@ -8820,7 +8899,7 @@ app18.delete("/:id", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to delete session" }, 500);
   }
 });
-app18.get("/:id/messages", requireAdminSession, async (c) => {
+app17.get("/:id/messages", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
@@ -8835,7 +8914,7 @@ app18.get("/:id/messages", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch messages" }, 500);
   }
 });
-app18.post("/:id/resume", requireAdminSession, async (c) => {
+app17.post("/:id/resume", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
@@ -8863,7 +8942,7 @@ app18.post("/:id/resume", requireAdminSession, async (c) => {
   console.log(`[session-resume] ${(/* @__PURE__ */ new Date()).toISOString()} conversationId=${conversationId.slice(0, 8)}\u2026 age=${age} loaded=${messages.length} messages (${estimatedTokens} estimated tokens) previousConversationId=${previousConversationId?.slice(0, 8) ?? "none"}\u2026 sessionKey=${sessionKey.slice(0, 8)}\u2026`);
   return c.json({ conversationId, messages });
 });
-app18.post("/:id/label", requireAdminSession, async (c) => {
+app17.post("/:id/label", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
@@ -8890,7 +8969,7 @@ app18.post("/:id/label", requireAdminSession, async (c) => {
     return c.json({ label: null });
   }
 });
-app18.put("/:id/label", requireAdminSession, async (c) => {
+app17.put("/:id/label", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
   const sessionKey = c.var.sessionKey;
   let body;
@@ -8916,11 +8995,11 @@ app18.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app18;
+var sessions_default = app17;
 
 // server/routes/admin/browser.ts
-var app19 = new Hono();
-app19.post("/launch", async (c) => {
+var app18 = new Hono();
+app18.post("/launch", async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     if (transport === "vnc") {
@@ -8942,7 +9021,7 @@ app19.post("/launch", async (c) => {
     );
   }
 });
-var browser_default = app19;
+var browser_default = app18;
 
 // app/lib/cdp-client.ts
 var CDP_HOST = "127.0.0.1";
@@ -8985,8 +9064,8 @@ async function cdpNavigateNewTab(url, opts = {}) {
 }
 
 // server/routes/admin/device-browser.ts
-var app20 = new Hono();
-app20.post("/navigate", async (c) => {
+var app19 = new Hono();
+app19.post("/navigate", async (c) => {
   const TAG17 = "[device-url:click]";
   let body;
   try {
@@ -9073,7 +9152,7 @@ app20.post("/navigate", async (c) => {
     targetId: outcome.targetId
   });
 });
-var device_browser_default = app20;
+var device_browser_default = app19;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -9082,8 +9161,8 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app21 = new Hono();
-app21.post("/", async (c) => {
+var app20 = new Hono();
+app20.post("/", async (c) => {
   const TAG17 = "[admin:events]";
   let body;
   try {
@@ -9114,12 +9193,12 @@ app21.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app21;
+var events_default = app20;
 
 // server/routes/admin/cloudflare.ts
 import { homedir } from "os";
-import { resolve as resolve18 } from "path";
-import { readFileSync as readFileSync16 } from "fs";
+import { resolve as resolve17 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -9135,14 +9214,14 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync8, readFileSync as readFileSync15, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname7 } from "path";
-import { resolve as resolve17 } from "path";
-var ALIAS_DOMAINS_PATH = resolve17(MAXY_DIR, "alias-domains.json");
+import { resolve as resolve16 } from "path";
+var ALIAS_DOMAINS_PATH = resolve16(MAXY_DIR, "alias-domains.json");
 function readExisting() {
   if (!existsSync18(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync15(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync14(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -9154,17 +9233,17 @@ function addAliasDomain(hostname2) {
   if (existing.has(hostname2)) return;
   existing.add(hostname2);
   mkdirSync8(dirname7(ALIAS_DOMAINS_PATH), { recursive: true });
-  writeFileSync9(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
+  writeFileSync8(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
 // server/routes/admin/cloudflare.ts
 var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
 var DOMAINS_TIMEOUT_MS = 40 * 1e3;
 function loadBrandInfo() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
-  const brandPath = resolve18(platformRoot2, "config", "brand.json");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
+  const brandPath = resolve17(platformRoot2, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync16(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync15(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -9207,7 +9286,7 @@ function validateBody(body) {
   }
   return null;
 }
-var app22 = new Hono();
+var app21 = new Hono();
 function fieldFromReason(reason) {
   switch (reason) {
     case "not-signed-in":
@@ -9224,7 +9303,7 @@ function fieldFromReason(reason) {
       return "script";
   }
 }
-app22.get("/domains", requireAdminSession, async (c) => {
+app21.get("/domains", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
   let correlationId;
@@ -9267,7 +9346,7 @@ app22.get("/domains", requireAdminSession, async (c) => {
   streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
   log(`phase=stream-log-resolved path=${streamLogPath}`);
   const brand = loadBrandInfo();
-  const scriptPath = resolve18(homedir(), "list-cf-domains.sh");
+  const scriptPath = resolve17(homedir(), "list-cf-domains.sh");
   const result = await runFormSpawn({
     scriptPath,
     args: [brand.hostname],
@@ -9317,7 +9396,7 @@ ${result.stderr}` : ""}`;
   );
   return c.json(success, 200);
 });
-app22.post("/setup", requireAdminSession, async (c) => {
+app21.post("/setup", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
   let correlationId;
@@ -9452,23 +9531,23 @@ actionId: ${actionId}`,
   };
   return ok(success);
 });
-var cloudflare_default = app22;
+var cloudflare_default = app21;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename6, dirname as dirname8, join as join9, resolve as resolve20, sep as sep2 } from "path";
+import { basename as basename6, dirname as dirname8, join as join9, resolve as resolve19, sep as sep2 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve19, normalize, sep, relative } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "../platform");
-var DATA_ROOT = resolve19(PLATFORM_ROOT5, "..", "data");
+import { resolve as resolve18, normalize, sep, relative } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "../platform");
+var DATA_ROOT = resolve18(PLATFORM_ROOT5, "..", "data");
 function resolveDataPath(raw) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve19(DATA_ROOT, cleaned);
+  const absolute = resolve18(DATA_ROOT, cleaned);
   let dataRootReal;
   try {
     dataRootReal = realpathSync3(DATA_ROOT);
@@ -9827,7 +9906,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve20(DATA_ROOT, "accounts");
+  const accountsDir = resolve19(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir2(accountsDir);
@@ -9836,7 +9915,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve20(accountsDir, name, "account.json");
+    const configPath2 = resolve19(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -9885,8 +9964,8 @@ function buildDisplayPath(relPath, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+var app22 = new Hono();
+app22.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   if (!getAccountIdForSession(sessionKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
@@ -9947,7 +10026,7 @@ app23.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app23.get("/download", requireAdminSession, async (c) => {
+app22.get("/download", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   if (!getAccountIdForSession(sessionKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
@@ -9995,7 +10074,7 @@ app23.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app23.post("/upload", requireAdminSession, async (c) => {
+app22.post("/upload", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -10027,8 +10106,8 @@ app23.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve20(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve20(destDir, finalName);
+  const destDir = resolve19(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve19(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -10053,7 +10132,7 @@ app23.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app23.delete("/", requireAdminSession, async (c) => {
+app22.delete("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -10120,7 +10199,7 @@ app23.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app23;
+var files_default = app22;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -10437,8 +10516,8 @@ function plainProperties(properties) {
 // server/routes/admin/graph-search.ts
 var DEFAULT_LIMIT = 20;
 var MAX_LIMIT = 2e3;
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -10488,7 +10567,7 @@ app24.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app24;
+var graph_search_default = app23;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j2 from "neo4j-driver";
@@ -10643,8 +10722,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "sessionKey"
 ]);
-var app25 = new Hono();
-app25.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11071,12 +11150,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app25;
+var graph_subgraph_default = app24;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash"];
-var app26 = new Hono();
-app26.post("/", requireAdminSession, async (c) => {
+var app25 = new Hono();
+app25.post("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11147,11 +11226,11 @@ app26.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app26;
+var graph_delete_default = app25;
 
 // server/routes/admin/graph-restore.ts
-var app27 = new Hono();
-app27.post("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.post("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11215,11 +11294,11 @@ app27.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app27;
+var graph_restore_default = app26;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app28 = new Hono();
-app28.get("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11285,11 +11364,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app28;
+var graph_labels_in_graph_default = app27;
 
 // server/routes/admin/graph-default-view.ts
-var app29 = new Hono();
-app29.get("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   const userId = getUserIdForSession(sessionKey);
@@ -11327,7 +11406,7 @@ app29.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app29.put("/", requireAdminSession, async (c) => {
+app28.put("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   const userId = getUserIdForSession(sessionKey);
@@ -11416,11 +11495,11 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app29;
+var graph_default_view_default = app28;
 
 // server/routes/admin/file-attach.ts
-var app30 = new Hono();
-app30.post("/", async (c) => {
+var app29 = new Hono();
+app29.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -11443,11 +11522,11 @@ app30.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app30;
+var file_attach_default = app29;
 
 // server/routes/admin/adherence.ts
-var app31 = new Hono();
-app31.get("/", requireAdminSession, async (c) => {
+var app30 = new Hono();
+app30.get("/", requireAdminSession, async (c) => {
   const agent = c.req.query("agent") ?? "admin";
   const includeBlock = c.req.query("block") === "1";
   const account = resolveAccount();
@@ -11468,33 +11547,32 @@ app31.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to read adherence ledger", agent }, 500);
   }
 });
-var adherence_default = app31;
+var adherence_default = app30;
 
 // server/routes/admin/index.ts
-var app32 = new Hono();
-app32.route("/session", session_default2);
-app32.route("/chat", chat_default2);
-app32.route("/compact", compact_default);
-app32.route("/logs", logs_default);
-app32.route("/claude-info", claude_info_default);
-app32.route("/attachment", attachment_default);
-app32.route("/account", account_default);
-app32.route("/agents", agents_default);
-app32.route("/sessions", sessions_default);
-app32.route("/browser", browser_default);
-app32.route("/device-browser", device_browser_default);
-app32.route("/events", events_default);
-app32.route("/cloudflare", cloudflare_default);
-app32.route("/files", files_default);
-app32.route("/graph-search", graph_search_default);
-app32.route("/graph-subgraph", graph_subgraph_default);
-app32.route("/graph-delete", graph_delete_default);
-app32.route("/graph-restore", graph_restore_default);
-app32.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app32.route("/graph-default-view", graph_default_view_default);
-app32.route("/file-attach", file_attach_default);
-app32.route("/adherence", adherence_default);
-var admin_default = app32;
+var app31 = new Hono();
+app31.route("/session", session_default2);
+app31.route("/chat", chat_default2);
+app31.route("/compact", compact_default);
+app31.route("/logs", logs_default);
+app31.route("/claude-info", claude_info_default);
+app31.route("/attachment", attachment_default);
+app31.route("/agents", agents_default);
+app31.route("/sessions", sessions_default);
+app31.route("/browser", browser_default);
+app31.route("/device-browser", device_browser_default);
+app31.route("/events", events_default);
+app31.route("/cloudflare", cloudflare_default);
+app31.route("/files", files_default);
+app31.route("/graph-search", graph_search_default);
+app31.route("/graph-subgraph", graph_subgraph_default);
+app31.route("/graph-delete", graph_delete_default);
+app31.route("/graph-restore", graph_restore_default);
+app31.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app31.route("/graph-default-view", graph_default_view_default);
+app31.route("/file-attach", file_attach_default);
+app31.route("/adherence", adherence_default);
+var admin_default = app31;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -11561,7 +11639,7 @@ if (BRAND_JSON_PATH && !existsSync19(BRAND_JSON_PATH)) {
 }
 if (BRAND_JSON_PATH && existsSync19(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -11584,7 +11662,7 @@ var ALIAS_DOMAINS_PATH2 = join10(homedir2(), BRAND.configDir, "alias-domains.jso
 function loadAliasDomains() {
   try {
     if (!existsSync19(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync17(ALIAS_DOMAINS_PATH2, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -11608,9 +11686,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app33 = new Hono();
-app33.use("*", clientIpMiddleware);
-app33.use("*", async (c, next) => {
+var app32 = new Hono();
+app32.use("*", clientIpMiddleware);
+app32.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -11633,7 +11711,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/g/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app33.use("*", async (c, next) => {
+app32.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -11673,7 +11751,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app33.post("/__remote-auth/login", async (c) => {
+app32.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -11717,7 +11795,7 @@ app33.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app33.get("/__remote-auth/logout", (c) => {
+app32.get("/__remote-auth/logout", (c) => {
   return new Response(null, {
     status: 302,
     headers: {
@@ -11727,7 +11805,7 @@ app33.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app33.post("/__remote-auth/change-password", async (c) => {
+app32.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -11777,13 +11855,13 @@ app33.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app33.get("/__remote-auth/setup", (c) => {
+app32.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app33.post("/__remote-auth/set-initial-password", async (c) => {
+app32.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -11819,10 +11897,10 @@ app33.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app33.get("/api/remote-auth/status", (c) => {
+app32.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app33.post("/api/remote-auth/set-password", async (c) => {
+app32.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -11852,9 +11930,9 @@ app33.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app33.route("/api/_client-error", client_error_default);
+app32.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app33.use("*", async (c, next) => {
+app32.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -11887,15 +11965,15 @@ app33.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app33.route("/api/health", health_default);
-app33.route("/api/session", session_default);
-app33.route("/api/chat", chat_default);
-app33.route("/api/group", group_default);
-app33.route("/api/access", access_default);
-app33.route("/api/telegram", telegram_default);
-app33.route("/api/whatsapp", whatsapp_default);
-app33.route("/api/onboarding", onboarding_default);
-app33.route("/api/admin", admin_default);
+app32.route("/api/health", health_default);
+app32.route("/api/session", session_default);
+app32.route("/api/chat", chat_default);
+app32.route("/api/group", group_default);
+app32.route("/api/access", access_default);
+app32.route("/api/telegram", telegram_default);
+app32.route("/api/whatsapp", whatsapp_default);
+app32.route("/api/onboarding", onboarding_default);
+app32.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -11907,7 +11985,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app33.get("/agent-assets/:slug/:filename", (c) => {
+app32.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -11923,8 +12001,8 @@ app33.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve21(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve21(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve20(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve20(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -11936,13 +12014,13 @@ app33.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync17(filePath);
+  const body = readFileSync16(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app33.get("/generated/:filename", (c) => {
+app32.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -11953,8 +12031,8 @@ app33.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve21(account.accountDir, "generated", filename);
-  const expectedDir = resolve21(account.accountDir, "generated");
+  const filePath = resolve20(account.accountDir, "generated", filename);
+  const expectedDir = resolve20(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -11966,7 +12044,7 @@ app33.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync17(filePath);
+  const body = readFileSync16(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -11977,7 +12055,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync19(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync16(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -11996,7 +12074,7 @@ function readInstalledVersion() {
     if (!PLATFORM_ROOT6) return "unknown";
     const versionFile = join10(PLATFORM_ROOT6, "config", `.${BRAND.hostname}-version`);
     if (!existsSync19(versionFile)) return "unknown";
-    const content = readFileSync17(versionFile, "utf-8").trim();
+    const content = readFileSync16(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -12037,7 +12115,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync17(resolve21(process.cwd(), "public", file), "utf-8");
+    html = readFileSync16(resolve20(process.cwd(), "public", file), "utf-8");
     html = html.replace("<title>Maxy</title>", `<title>${escapeHtml(BRAND.productName)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
     const headInjection = file === "index.html" ? `${brandScript}
@@ -12056,12 +12134,12 @@ function loadBrandingCache(agentSlug) {
   try {
     const accountJsonPath = join10(configDir2, "account.json");
     if (!existsSync19(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync16(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join10(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync19(cachePath)) return null;
-    return JSON.parse(readFileSync17(cachePath, "utf-8"));
+    return JSON.parse(readFileSync16(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -12071,7 +12149,7 @@ function resolveDefaultSlug() {
     const configDir2 = join10(homedir2(), BRAND.configDir);
     const accountJsonPath = join10(configDir2, "account.json");
     if (!existsSync19(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync16(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -12107,7 +12185,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app33.get("/", (c) => {
+app32.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -12115,12 +12193,12 @@ app33.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app33.get("/public", (c) => {
+app32.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app33.get("/chat", (c) => {
+app32.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -12139,12 +12217,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app33.use("/vnc-viewer.html", logViewerFetch);
-app33.use("/vnc-popout.html", logViewerFetch);
-app33.get("/vnc-popout.html", (c) => {
+app32.use("/vnc-viewer.html", logViewerFetch);
+app32.use("/vnc-popout.html", logViewerFetch);
+app32.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync17(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync16(resolve20(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -12154,7 +12232,7 @@ app33.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app33.post("/api/vnc/client-event", async (c) => {
+app32.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12175,20 +12253,20 @@ app33.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app33.get("/g/:slug", (c) => {
+app32.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app33.get("/graph", (c) => {
+app32.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app33.get("/data", (c) => {
+app32.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app33.get("/:slug", async (c, next) => {
+app32.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -12197,10 +12275,10 @@ app33.get("/:slug", async (c, next) => {
   }
   await next();
 });
-app33.use("/*", serveStatic({ root: "./public" }));
+app32.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.MAXY_UI_INTERNAL_PORT ?? process.env.PORT ?? "19199", 10);
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app33.fetch, port, hostname });
+var httpServer = serve({ fetch: app32.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 var SUBAPP_MANIFEST = [
   { prefix: "/api/health", file: "server/routes/health.ts", subapp: health_default },
@@ -12220,7 +12298,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app33.routes ?? []) {
+  for (const r of app32.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -12235,7 +12313,7 @@ try {
   try {
     let userId = "";
     if (existsSync19(USERS_FILE)) {
-      const users = JSON.parse(readFileSync17(USERS_FILE, "utf-8").trim() || "[]");
+      const users = JSON.parse(readFileSync16(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);
@@ -12262,7 +12340,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve21(process.env.MAXY_PLATFORM_ROOT ?? join10(__dirname, "..")),
+  platformRoot: resolve20(process.env.MAXY_PLATFORM_ROOT ?? join10(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     try {