@rubytech/create-realagent 1.0.807 → 1.0.808

package/payload/server/server.js

@@ -6,6 +6,7 @@ import {
   TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE,
   TELEGRAM_WEBHOOK_SECRET_FILE,
   USERS_FILE,
+  actionLogPath,
   autoDeliverPremiumPlugins,
   buildX11Env,
   callOauthLlm,
@@ -29,6 +30,7 @@ import {
   launchAction,
   load,
   logPath,
+  reconcileCloudflareSetupFromLog,
   recordFailedAttempt,
   render,
   renderLoginPage,
@@ -50,7 +52,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-LSUMH6OF.js";
+} from "./chunk-V3VLAL7N.js";
 import {
   ACCOUNTS_DIR,
   GREETING_DIRECTIVE,
@@ -114,7 +116,7 @@ import {
   verifyAndGetConversationUpdatedAt,
   verifyConversationOwnership,
   writeAdminUserAndPerson
-} from "./chunk-YULDSPAC.js";
+} from "./chunk-CRWLE6BZ.js";
 import {
   __commonJS,
   __toESM
@@ -617,8 +619,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync17, existsSync as existsSync24, watchFile } from "fs";
-import { resolve as resolve24, join as join10, basename as basename7 } from "path";
+import { readFileSync as readFileSync18, existsSync as existsSync25, watchFile } from "fs";
+import { resolve as resolve24, join as join11, basename as basename7 } from "path";
 import { homedir as homedir2 } from "os";
 
 // app/lib/agent-slug-pattern.ts
@@ -804,6 +806,28 @@ function defaultRules() {
       scope: "session",
       suggestedAction: "The WebFetch SPA preflight has fired more than once in this conversation. Either the agent is ignoring the loud-failure directive (retrying WebFetch after seeing WEBFETCH_CANNOT_READ_JS_SPA), or multiple SPA URLs are being asked about. Read the conversation's stream log for the [tool-use] / [tool-result] sequence around each occurrence \u2014 if the agent dispatched WebFetch on the same URL or substituted Playwright silently, revisit the IDENTITY.md `Tool Failure Discipline` paragraph that names structured-error handling."
     },
+    {
+      // Task 867 — fires when setup-tunnel.sh emits step=done but no
+      // `[persist] role=user … Cloudflare setup completed (actionId: <id>)`
+      // line appears within 60s. Covers the three failure modes of the
+      // action-relay-queue plumbing: queue-write failed, boot-drain consumer
+      // skipped the record, or the agent's hoisted persist threw. The
+      // followup pattern is intentionally narrow to the cloudflare-setup
+      // relay shape (not a general "any user persist") so a benign user
+      // typing in chat does not satisfy the followup. logSource=any so
+      // the rule sees both the script tee (in stream logs / server.log)
+      // and the [persist] line (server.log).
+      id: "cloudflare-setup-relay-not-acknowledged",
+      name: "Cloudflare-setup completed but the chat relay never acknowledged",
+      type: "absent-followup",
+      logSource: "any",
+      pattern: "\\[script:setup-tunnel\\] step=done",
+      followupPattern: "\\[persist\\] .*role=user.* Cloudflare setup completed \\(actionId:",
+      followupWindowMs: 6e4,
+      thresholdCount: 0,
+      thresholdWindowMinutes: 0,
+      suggestedAction: "[Task 867] cloudflare-setup completed but the post-action relay never reached the chat history. Check `[action-relay-queue] phase=enqueued` (queue write), `[action-completion-relay] phase=consumed` (boot-drain ran), and `[persist] role=user \u2026 Cloudflare setup completed` (graph write). One of those is missing; the matching grep recipe is in the Task 867 brief Observability section."
+    },
     {
       // Task 538: fires when a [spawn] line appears in a conversation's stream
       // log but no subprocess-lifecycle marker follows within 10s. The three
@@ -8070,7 +8094,8 @@ app9.post("/", async (c) => {
     "unknown",
     "graph-labels-in-graph",
     "graph-default-view",
-    "graph-nav"
+    "graph-nav",
+    "event"
   ]);
   const kind = allowedKinds.has(kindRaw) ? kindRaw : "unknown";
   const msg = truncate(body.msg, MAX_MSG_LEN);
@@ -8084,29 +8109,42 @@ app9.post("/", async (c) => {
   const stackTrunc = truncate(body.stack, MAX_STACK_LEN);
   const head = stackHead(body.stack);
   const ts = (/* @__PURE__ */ new Date()).toISOString();
-  console.error(
-    `[client-error] ts=${ts} ip=${ip} kind=${kind} url=${JSON.stringify(url)} version=${version || "unknown"} ua=${JSON.stringify(ua)} msg=${JSON.stringify(msg)} stack-head=${JSON.stringify(head)} file-line-col=${JSON.stringify(fileLineCol)}`
-  );
-  rotateIfNeeded();
-  try {
-    const payload = {
-      ts,
-      ip,
-      kind,
-      url,
-      version,
-      ua,
-      msg,
-      stack: stackTrunc,
-      filename: file,
-      lineno: line,
-      colno: col,
-      tag: typeof body.tag === "string" ? truncate(body.tag, 32) : void 0,
-      status: typeof body.status === "number" ? body.status : void 0
-    };
-    appendFileSync2(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
-  } catch (err) {
-    console.error(`[client-error] append failed: ${err instanceof Error ? err.message : String(err)}`);
+  if (kind === "event") {
+    const source = typeof body.source === "string" ? truncate(body.source, 64) : "unknown";
+    const extra = Object.entries(body).filter(([k]) => !["kind", "source", "msg", "url", "ua", "version", "stack", "filename", "lineno", "colno", "tag", "status"].includes(k)).map(([k, v]) => {
+      const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
+      return `${k}=${safe}`;
+    }).join(" ");
+    console.log(
+      `[client-event] ts=${ts} ip=${ip} source=${source} version=${version || "unknown"}${extra ? " " + extra : ""}`
+    );
+  } else {
+    console.error(
+      `[client-error] ts=${ts} ip=${ip} kind=${kind} url=${JSON.stringify(url)} version=${version || "unknown"} ua=${JSON.stringify(ua)} msg=${JSON.stringify(msg)} stack-head=${JSON.stringify(head)} file-line-col=${JSON.stringify(fileLineCol)}`
+    );
+  }
+  if (kind !== "event") {
+    rotateIfNeeded();
+    try {
+      const payload = {
+        ts,
+        ip,
+        kind,
+        url,
+        version,
+        ua,
+        msg,
+        stack: stackTrunc,
+        filename: file,
+        lineno: line,
+        colno: col,
+        tag: typeof body.tag === "string" ? truncate(body.tag, 32) : void 0,
+        status: typeof body.status === "number" ? body.status : void 0
+      };
+      appendFileSync2(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
+    } catch (err) {
+      console.error(`[client-error] append failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
   }
   return c.json({ ok: true });
 });
@@ -8586,7 +8624,7 @@ var app11 = new Hono();
 app11.post("/cancel", requireAdminSession, async (c) => {
   const session_key = c.var.sessionKey;
   try {
-    const { interruptClient: interruptClient2 } = await import("./client-pool-LXE7RIRT.js");
+    const { interruptClient: interruptClient2 } = await import("./client-pool-N2Y57223.js");
     await interruptClient2(session_key);
     return c.json({ ok: true });
   } catch (err) {
@@ -9749,13 +9787,13 @@ async function cdpNavigateNewTab(url, opts = {}) {
 // server/routes/admin/device-browser.ts
 var app19 = new Hono();
 app19.post("/navigate", async (c) => {
-  const TAG19 = "[device-url:click]";
+  const TAG20 = "[device-url:click]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG19} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
+    console.error(`${TAG20} reject reason=body-not-json detail=${detail} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "Request body was not valid JSON" },
       400
@@ -9765,7 +9803,7 @@ app19.post("/navigate", async (c) => {
   const intent = typeof body.intent === "string" ? body.intent : "";
   const hostname2 = typeof body.hostname === "string" ? body.hostname : "";
   if (!url) {
-    console.error(`${TAG19} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
+    console.error(`${TAG20} reject reason=missing-url intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url field is required" },
       400
@@ -9775,7 +9813,7 @@ app19.post("/navigate", async (c) => {
   try {
     parsed = new URL(url);
   } catch {
-    console.error(`${TAG19} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
+    console.error(`${TAG20} reject reason=url-malformed intent=${JSON.stringify(intent)} url=${url} browser=fallback navigateResult=error`);
     return c.json(
       { ok: false, navigateResult: "error", browser: "fallback", detail: "url is not a valid URL" },
       400
@@ -9783,7 +9821,7 @@ app19.post("/navigate", async (c) => {
   }
   if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
     console.error(
-      `${TAG19} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
+      `${TAG20} reject reason=scheme-not-allowed scheme=${parsed.protocol} intent=${JSON.stringify(intent)} browser=fallback navigateResult=error`
     );
     return c.json(
       {
@@ -9799,7 +9837,7 @@ app19.post("/navigate", async (c) => {
   const cdpOk = await ensureCdp(transport);
   if (!cdpOk) {
     console.error(
-      `${TAG19} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
+      `${TAG20} intent=${JSON.stringify(intent)} browser=fallback navigateResult=cdp-unreachable hostname=${JSON.stringify(hostname2)}`
     );
     return c.json(
       {
@@ -9815,7 +9853,7 @@ app19.post("/navigate", async (c) => {
   const browser = outcome.result === "ok" ? "vnc" : "fallback";
   const detailStr = outcome.detail ? ` detail=${JSON.stringify(outcome.detail.length > 230 ? outcome.detail.slice(0, 227) + "..." : outcome.detail)}` : "";
   console.error(
-    `${TAG19} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
+    `${TAG20} intent=${JSON.stringify(intent)} browser=${browser} navigateResult=${outcome.result} hostname=${JSON.stringify(hostname2)} targetId=${outcome.targetId ?? "none"}${detailStr}`
   );
   if (outcome.result !== "ok") {
     return c.json(
@@ -9846,18 +9884,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app20 = new Hono();
 app20.post("/", async (c) => {
-  const TAG19 = "[admin:events]";
+  const TAG20 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG19} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG20} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG19} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG20} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -9881,7 +9919,7 @@ var events_default = app20;
 // server/routes/admin/cloudflare.ts
 import { homedir } from "os";
 import { resolve as resolve17 } from "path";
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -9919,14 +9957,131 @@ function addAliasDomain(hostname2) {
   writeFileSync9(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
+// app/lib/action-relay-queue.ts
+import {
+  existsSync as existsSync20,
+  mkdirSync as mkdirSync9,
+  readdirSync as readdirSync5,
+  readFileSync as readFileSync15,
+  unlinkSync as unlinkSync2,
+  writeFileSync as writeFileSync10
+} from "fs";
+import { join as join9 } from "path";
+var TAG19 = "[action-relay-queue]";
+var FILE_PREFIX = "action-completion-relay-";
+var FILE_SUFFIX = ".json";
+function queueDir(accountDir) {
+  return join9(accountDir, "queue");
+}
+function relayFilePath(accountDir, actionId) {
+  return join9(queueDir(accountDir), `${FILE_PREFIX}${actionId}${FILE_SUFFIX}`);
+}
+function enqueueActionCompletionRelay(opts) {
+  const dir = queueDir(opts.accountDir);
+  mkdirSync9(dir, { recursive: true });
+  const filePath = relayFilePath(opts.accountDir, opts.actionId);
+  const record = {
+    actionId: opts.actionId,
+    conversationId: opts.conversationId,
+    message: opts.message,
+    queuedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const body = JSON.stringify(record);
+  try {
+    writeFileSync10(filePath, body, { flag: "wx", encoding: "utf-8" });
+    console.log(
+      `${TAG19} phase=enqueued actionId=${opts.actionId} conversationId=${opts.conversationId} path=${filePath} bytes=${Buffer.byteLength(body, "utf-8")}`
+    );
+    return { enqueued: true, path: filePath };
+  } catch (e) {
+    if (e.code === "EEXIST") {
+      console.log(
+        `${TAG19} phase=enqueue-skipped actionId=${opts.actionId} reason=already-queued`
+      );
+      return { enqueued: false, reason: "already-queued", path: filePath };
+    }
+    throw e;
+  }
+}
+function consumeActionCompletionRelays(accountDir) {
+  const dir = queueDir(accountDir);
+  if (!existsSync20(dir)) return [];
+  let entries;
+  try {
+    entries = readdirSync5(dir);
+  } catch (e) {
+    console.error(
+      `${TAG19} phase=readdir-failed dir=${dir} error=${e instanceof Error ? e.message : String(e)}`
+    );
+    return [];
+  }
+  const records = [];
+  for (const name of entries) {
+    if (!name.startsWith(FILE_PREFIX) || !name.endsWith(FILE_SUFFIX)) continue;
+    const filePath = join9(dir, name);
+    let raw;
+    try {
+      raw = readFileSync15(filePath, "utf-8");
+    } catch (e) {
+      console.error(
+        `${TAG19} phase=read-failed file=${name} error=${e instanceof Error ? e.message : String(e)}`
+      );
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch (e) {
+      console.error(
+        `${TAG19} phase=parse-failed file=${name} error=${e instanceof Error ? e.message : String(e)}`
+      );
+      continue;
+    }
+    if (!isActionCompletionRelay(parsed)) {
+      console.error(
+        `${TAG19} phase=shape-invalid file=${name} keys=${parsed && typeof parsed === "object" ? Object.keys(parsed).join(",") : "non-object"}`
+      );
+      continue;
+    }
+    records.push({ rec: parsed, filePath });
+  }
+  records.sort((a, b) => a.rec.queuedAt.localeCompare(b.rec.queuedAt));
+  const out = [];
+  const now = Date.now();
+  for (const { rec, filePath } of records) {
+    const queuedAtMs = Date.parse(rec.queuedAt);
+    const ageMs = Number.isFinite(queuedAtMs) ? now - queuedAtMs : 0;
+    out.push({ ...rec, ageMs, filePath });
+  }
+  return out;
+}
+function deleteConsumedRelay(filePath) {
+  try {
+    unlinkSync2(filePath);
+  } catch (e) {
+    const code = e.code;
+    if (code !== "ENOENT") {
+      console.error(
+        `${TAG19} phase=unlink-failed file=${filePath} error=${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+  }
+}
+function isActionCompletionRelay(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.actionId === "string" && typeof v.conversationId === "string" && typeof v.message === "string" && typeof v.queuedAt === "string";
+}
+
 // server/routes/admin/cloudflare.ts
+import { existsSync as existsSyncFs, readFileSync as readFileSyncFs } from "fs";
 var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
 var DOMAINS_TIMEOUT_MS = 40 * 1e3;
 function loadBrandInfo() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
   const brandPath = resolve17(platformRoot2, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync15(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -10222,13 +10377,79 @@ actionId: ${actionId}`,
   };
   return ok(success);
 });
+var RELAY_MAX_BODY = 8 * 1024;
+var RELAY_MAX_MESSAGE = 2048;
+var ACTION_ID_RE = /^[a-z0-9-]+$/;
+app21.post("/relay-completion", requireAdminSession, async (c) => {
+  const sessionKey = c.var.sessionKey;
+  let raw;
+  try {
+    raw = await c.req.text();
+  } catch {
+    return c.json({ ok: false, reason: "invalid-body" }, 400);
+  }
+  if (Buffer.byteLength(raw, "utf-8") > RELAY_MAX_BODY) {
+    return c.json({ ok: false, reason: "body-too-large" }, 413);
+  }
+  let body;
+  try {
+    body = JSON.parse(raw);
+  } catch {
+    return c.json({ ok: false, reason: "invalid-json" }, 400);
+  }
+  if (!body || typeof body !== "object") {
+    return c.json({ ok: false, reason: "invalid-body" }, 400);
+  }
+  const { actionId, message } = body;
+  if (typeof actionId !== "string" || !ACTION_ID_RE.test(actionId) || actionId.length > 200) {
+    console.error(`[cloudflare-relay-completion] phase=enqueue-skipped reason=invalid-actionid sessionKey=${sessionKey.slice(-8)}`);
+    return c.json({ ok: false, reason: "invalid-actionid" }, 400);
+  }
+  if (typeof message !== "string" || message.length === 0 || message.length > RELAY_MAX_MESSAGE) {
+    return c.json({ ok: false, reason: "invalid-message" }, 400);
+  }
+  const conversationId = getConversationIdForSession(sessionKey);
+  if (!conversationId) {
+    console.error(`[cloudflare-relay-completion] phase=enqueue-skipped reason=missing-conversation-id sessionKey=${sessionKey.slice(-8)}`);
+    return c.json({ ok: false, reason: "missing-conversation-id" }, 400);
+  }
+  const account = resolveAccount();
+  if (!account) {
+    console.error(`[cloudflare-relay-completion] phase=enqueue-skipped reason=missing-account-dir actionId=${actionId}`);
+    return c.json({ ok: false, reason: "missing-account-dir" }, 500);
+  }
+  const logPath2 = actionLogPath(actionId);
+  let auditOutcome = "log-absent";
+  if (existsSyncFs(logPath2)) {
+    try {
+      const lines = readFileSyncFs(logPath2, "utf-8").split("\n");
+      const reconciled = reconcileCloudflareSetupFromLog(lines);
+      auditOutcome = reconciled ? reconciled.kind : "log-incomplete";
+    } catch (e) {
+      auditOutcome = `read-failed:${e instanceof Error ? e.message : String(e)}`;
+    }
+  }
+  console.log(`[cloudflare-relay-completion] phase=enqueue-attempt actionId=${actionId} auditOutcome=${auditOutcome} conversationId=${conversationId}`);
+  try {
+    enqueueActionCompletionRelay({
+      accountDir: account.accountDir,
+      actionId,
+      conversationId,
+      message
+    });
+  } catch (e) {
+    console.error(`[cloudflare-relay-completion] phase=enqueue-failed actionId=${actionId} error=${e instanceof Error ? e.message : String(e)}`);
+    return c.json({ ok: false, reason: "enqueue-failed" }, 500);
+  }
+  return c.body(null, 204);
+});
 var cloudflare_default = app21;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename6, dirname as dirname8, join as join9, resolve as resolve19, sep as sep2 } from "path";
+import { basename as basename6, dirname as dirname8, join as join10, resolve as resolve19, sep as sep2 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
@@ -10586,7 +10807,7 @@ async function cascadeDeleteDocument(params) {
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join9(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join10(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -10624,7 +10845,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join9(absolute, entry.name), entry.name);
+    const meta = await readMeta(join10(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -10683,7 +10904,7 @@ app22.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join9(absolute, name);
+        const entryPath = join10(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -10856,7 +11077,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join9(dirname8(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join10(dirname8(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -12314,7 +12535,7 @@ var adherence_default = app30;
 import neo4j3 from "neo4j-driver";
 import { readFile as readFile5, readdir as readdir3, stat as stat5 } from "fs/promises";
 import { resolve as resolve20, relative as relative2, isAbsolute } from "path";
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -12462,7 +12683,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync20(dir)) continue;
+    if (!existsSync21(dir)) continue;
     try {
       const entries = await readdir3(dir);
       for (const entry of entries) {
@@ -12477,7 +12698,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync20(inp.overridePath)) {
+  if (existsSync21(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -12488,7 +12709,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync20(inp.bundledPath)) {
+  } else if (existsSync21(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -12530,7 +12751,7 @@ var sidebar_artefacts_default = app31;
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
 import { resolve as resolve21 } from "path";
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app32 = new Hono();
@@ -12594,7 +12815,7 @@ async function resolveSavePath(id, accountId, accountDir) {
   }
   if (UUID_RE4.test(id)) {
     const dir = resolve21(ATTACHMENTS_ROOT, accountId, id);
-    if (!existsSync21(dir)) {
+    if (!existsSync22(dir)) {
       return { kind: "reject", status: 400, reason: "not-found" };
     }
     try {
@@ -12618,7 +12839,7 @@ var sidebar_artefact_save_default = app32;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import { resolve as resolve22 } from "path";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app33 = new Hono();
@@ -12632,7 +12853,7 @@ app33.get("/", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve22(ATTACHMENTS_ROOT, accountId, id);
-  if (!existsSync22(dir)) {
+  if (!existsSync23(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
@@ -12694,7 +12915,7 @@ app34.route("/sidebar-artefact-content", sidebar_artefact_content_default);
 var admin_default = app34;
 
 // server/routes/sites.ts
-import { existsSync as existsSync23, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
 import { resolve as resolve23 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -12761,7 +12982,7 @@ app35.get("/:rel{.*}", (c) => {
   }
   let stat7;
   try {
-    stat7 = existsSync23(filePath) ? statSync8(filePath) : null;
+    stat7 = existsSync24(filePath) ? statSync8(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -12774,7 +12995,7 @@ app35.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -12793,7 +13014,7 @@ app35.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync16(realPath);
+    body = readFileSync17(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -12925,14 +13146,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join10(PLATFORM_ROOT7, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join11(PLATFORM_ROOT7, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync25(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync25(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync18(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -12951,11 +13172,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH2 = join10(homedir2(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH2 = join11(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync24(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync17(ALIAS_DOMAINS_PATH2, "utf-8"));
+    if (!existsSync25(ALIAS_DOMAINS_PATH2)) return null;
+    const parsed = JSON.parse(readFileSync18(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -13301,14 +13522,14 @@ app36.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync24(filePath)) {
+  if (!existsSync25(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync17(filePath);
+  const body = readFileSync18(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -13331,14 +13552,14 @@ app36.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync24(filePath)) {
+  if (!existsSync25(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync17(filePath);
+  const body = readFileSync18(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -13348,9 +13569,9 @@ app36.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync25(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync18(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -13367,9 +13588,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT7) return "unknown";
-    const versionFile = join10(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync24(versionFile)) return "unknown";
-    const content = readFileSync17(versionFile, "utf-8").trim();
+    const versionFile = join11(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync25(versionFile)) return "unknown";
+    const content = readFileSync18(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -13410,7 +13631,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync17(resolve24(process.cwd(), "public", file), "utf-8");
+    html = readFileSync18(resolve24(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -13426,26 +13647,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join10(homedir2(), BRAND.configDir);
+  const configDir2 = join11(homedir2(), BRAND.configDir);
   try {
-    const accountJsonPath = join10(configDir2, "account.json");
-    if (!existsSync24(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
+    const accountJsonPath = join11(configDir2, "account.json");
+    if (!existsSync25(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join10(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync24(cachePath)) return null;
-    return JSON.parse(readFileSync17(cachePath, "utf-8"));
+    const cachePath = join11(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync25(cachePath)) return null;
+    return JSON.parse(readFileSync18(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join10(homedir2(), BRAND.configDir);
-    const accountJsonPath = join10(configDir2, "account.json");
-    if (!existsSync24(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
+    const configDir2 = join11(homedir2(), BRAND.configDir);
+    const accountJsonPath = join11(configDir2, "account.json");
+    if (!existsSync25(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -13518,7 +13739,7 @@ app36.use("/vnc-popout.html", logViewerFetch);
 app36.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync17(resolve24(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync18(resolve24(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -13608,8 +13829,8 @@ try {
 (async () => {
   try {
     let userId = "";
-    if (existsSync24(USERS_FILE)) {
-      const users = JSON.parse(readFileSync17(USERS_FILE, "utf-8").trim() || "[]");
+    if (existsSync25(USERS_FILE)) {
+      const users = JSON.parse(readFileSync18(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);
@@ -13669,6 +13890,48 @@ for (const dir of bootEnabled) {
   bootDelivered.push(dir);
 }
 console.error(`[plugins] readiness enabled=${bootEnabled.length} delivered=${bootDelivered.length} dist-missing=[${bootDistMissing.join(",")}] missing=[${bootMissing.join(",")}]`);
+(async () => {
+  if (!bootAccount) {
+    console.log("[action-completion-relay] phase=consumed-skip reason=no-account");
+    return;
+  }
+  let records;
+  try {
+    records = consumeActionCompletionRelays(bootAccount.accountDir);
+  } catch (err) {
+    console.error(`[action-completion-relay] phase=consume-failed error=${err instanceof Error ? err.message : String(err)}`);
+    return;
+  }
+  if (records.length === 0) {
+    console.log(`[action-completion-relay] phase=consumed-empty accountId=${bootAccount.accountId.slice(0, 8)}\u2026`);
+    return;
+  }
+  console.log(`[action-completion-relay] phase=consume-batch count=${records.length} accountId=${bootAccount.accountId.slice(0, 8)}\u2026`);
+  for (const rec of records) {
+    const sessionKey = `cloudflare-relay-boot:${rec.actionId}`;
+    let outcome = "injected";
+    let dispatchError;
+    try {
+      registerSession(sessionKey, "admin", bootAccount.accountId);
+      setConversationIdForSession(sessionKey, rec.conversationId);
+      for await (const _ev of invokeAgent({ type: "admin" }, rec.message, sessionKey)) {
+      }
+    } catch (err) {
+      outcome = "dispatch-failed";
+      dispatchError = err instanceof Error ? err.message : String(err);
+    } finally {
+      unregisterSession(sessionKey);
+    }
+    if (outcome === "injected") {
+      deleteConsumedRelay(rec.filePath);
+      console.log(`[action-completion-relay] phase=consumed actionId=${rec.actionId} conversationId=${rec.conversationId} ageMs=${rec.ageMs} outcome=injected`);
+    } else {
+      console.error(`[action-completion-relay] phase=consumed actionId=${rec.actionId} conversationId=${rec.conversationId} ageMs=${rec.ageMs} outcome=${outcome} reason=${JSON.stringify(dispatchError ?? "")} fileRetained=${JSON.stringify(rec.filePath)}`);
+    }
+  }
+})().catch((err) => {
+  console.error(`[action-completion-relay] boot-drain rejected: ${err instanceof Error ? err.message : String(err)}`);
+});
 if (bootAccountConfig?.whatsapp) {
   console.error(`[whatsapp:boot] loading whatsapp config from account.json publicAgent=${bootPublicAgent ?? "none"}`);
 } else {
@@ -13676,7 +13939,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve24(process.env.MAXY_PLATFORM_ROOT ?? join10(__dirname, "..")),
+  platformRoot: resolve24(process.env.MAXY_PLATFORM_ROOT ?? join11(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     try {