@rubytech/create-realagent 1.0.831 → 1.0.833

package/payload/server/server.js

@@ -1,11 +1,5 @@
 import {
-  COMMERCIAL_MODE,
   Hono,
-  LOG_DIR,
-  MAXY_DIR,
-  TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE,
-  TELEGRAM_WEBHOOK_SECRET_FILE,
-  USERS_FILE,
   autoDeliverPremiumPlugins,
   buildX11Env,
   callOauthLlm,
@@ -51,7 +45,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-CV3HPX46.js";
+} from "./chunk-IVTESKFR.js";
 import {
   agentLogStream,
   clearSessionHistory,
@@ -79,17 +73,24 @@ import {
   sigtermFlushStreamLogs,
   unregisterSession,
   validateSession
-} from "./chunk-J6YWEJBN.js";
+} from "./chunk-KD3XP4IK.js";
 import {
   ACCOUNTS_DIR,
+  COMMERCIAL_MODE,
+  LOG_DIR,
+  MAXY_DIR,
   PLATFORM_ROOT,
+  TELEGRAM_ADMIN_WEBHOOK_SECRET_FILE,
+  TELEGRAM_WEBHOOK_SECRET_FILE,
+  USERS_FILE,
   getDefaultAccountId,
+  hasStubAccountDir,
   resolveAccount,
   resolveAgentConfig,
   resolveDefaultAgentSlug,
   resolveUserAccounts,
   validateAgentSlug
-} from "./chunk-5OG7TUQL.js";
+} from "./chunk-OJZPS4BL.js";
 import {
   CLOUDFLARE_TASK_DIAGNOSTICS,
   appendCloudflareSteps,
@@ -97,7 +98,7 @@ import {
   openCloudflareTask,
   readTunnelState,
   resolveUnitGoneVerdict
-} from "./chunk-OCPJGZ6S.js";
+} from "./chunk-CRAIGEXY.js";
 import {
   GREETING_DIRECTIVE,
   HAIKU_MODEL,
@@ -129,7 +130,7 @@ import {
   verifyAndGetConversationUpdatedAt,
   verifyConversationOwnership,
   writeAdminUserAndPerson
-} from "./chunk-BCFM2UPH.js";
+} from "./chunk-I2NOLBQA.js";
 
 // ../lib/graph-trash/dist/index.js
 var require_dist = __commonJS({
@@ -628,8 +629,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync16, existsSync as existsSync22, watchFile } from "fs";
-import { resolve as resolve22, join as join10, basename as basename5 } from "path";
+import { readFileSync as readFileSync17, existsSync as existsSync23, watchFile } from "fs";
+import { resolve as resolve22, join as join12, basename as basename5 } from "path";
 import { homedir as homedir2 } from "os";
 
 // app/lib/agent-slug-pattern.ts
@@ -6391,16 +6392,164 @@ var whatsapp_default = app7;
 
 // server/routes/onboarding.ts
 import { spawn, execFileSync } from "child_process";
-import { openSync, closeSync, writeFileSync as writeFileSync4, writeSync, existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync8, unlinkSync } from "fs";
-import { resolve as resolve8, dirname as dirname2 } from "path";
+import { openSync, closeSync, writeFileSync as writeFileSync5, writeSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync9, unlinkSync } from "fs";
+import { resolve as resolve8, dirname as dirname3 } from "path";
 import { createHash, randomUUID as randomUUID6 } from "crypto";
+
+// ../lib/admins-write/src/index.ts
+import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync4, renameSync, mkdirSync as mkdirSync3, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
+import { dirname as dirname2, join as join6 } from "path";
+function logLine(input, result) {
+  const userIdShort = input.userId.slice(0, 8);
+  console.error(
+    `[admins-write] caller=${input.caller} userId=${userIdShort} usersJsonResult=${result.usersJsonResult} accountJsonResult=${result.accountJsonResult}` + (result.usersError ? ` usersError=${result.usersError}` : "") + (result.accountError ? ` accountError=${result.accountError}` : "")
+  );
+}
+function writeFileAtomic(filePath, contents, mode) {
+  mkdirSync3(dirname2(filePath), { recursive: true });
+  const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
+  writeFileSync4(tempPath, contents, mode !== void 0 ? { mode } : void 0);
+  renameSync(tempPath, filePath);
+}
+function writeAdminEntry(input) {
+  const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
+  try {
+    let users = [];
+    if (existsSync8(input.usersFile)) {
+      const raw = readFileSync8(input.usersFile, "utf-8").trim();
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed)) {
+          throw new Error("users.json is not an array");
+        }
+        users = parsed;
+      }
+    }
+    const existing = users.findIndex((u) => u.userId === input.userId);
+    if (existing === -1) {
+      users.push({ userId: input.userId, pin: input.pin });
+    } else {
+      const merged = { ...users[existing], pin: input.pin };
+      delete merged.name;
+      users[existing] = merged;
+    }
+    writeFileAtomic(input.usersFile, JSON.stringify(users, null, 2) + "\n", 384);
+    result.usersJsonResult = "ok";
+  } catch (err) {
+    result.usersJsonResult = "fail";
+    result.usersError = err instanceof Error ? err.message : String(err);
+    logLine(input, result);
+    return result;
+  }
+  try {
+    const accountJsonPath = join6(input.accountDir, "account.json");
+    if (!existsSync8(accountJsonPath)) {
+      throw new Error(`account.json not found at ${accountJsonPath}`);
+    }
+    const config = JSON.parse(readFileSync8(accountJsonPath, "utf-8"));
+    const admins = config.admins ?? [];
+    if (admins.some((a) => a.userId === input.userId)) {
+      result.accountJsonResult = "noop";
+    } else {
+      admins.push({ userId: input.userId, role: input.role });
+      config.admins = admins;
+      writeFileAtomic(accountJsonPath, JSON.stringify(config, null, 2) + "\n");
+      result.accountJsonResult = "ok";
+    }
+  } catch (err) {
+    result.accountJsonResult = "fail";
+    result.accountError = err instanceof Error ? err.message : String(err);
+  }
+  logLine(input, result);
+  return result;
+}
+function checkAdminAuthInvariant(input) {
+  const result = {
+    divergences: 0,
+    accountWithoutUsers: [],
+    usersWithoutAccount: []
+  };
+  const usersUserIds = /* @__PURE__ */ new Set();
+  if (existsSync8(input.usersFile)) {
+    try {
+      const raw = readFileSync8(input.usersFile, "utf-8").trim();
+      if (raw) {
+        const users = JSON.parse(raw);
+        for (const u of users) {
+          if (typeof u.userId === "string") usersUserIds.add(u.userId);
+        }
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`[${input.tag}] users.json unreadable usersFile=${input.usersFile} error=${msg}`);
+    }
+  }
+  const accountUserIds = /* @__PURE__ */ new Set();
+  if (existsSync8(input.accountsDir)) {
+    let entries;
+    try {
+      entries = readdirSync3(input.accountsDir);
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`[${input.tag}] accounts-dir unreadable accountsDir=${input.accountsDir} error=${msg}`);
+      console.error(`[${input.tag}] check complete divergences=0 (accounts-dir unreadable)`);
+      return result;
+    }
+    for (const entry of entries) {
+      if (entry.startsWith(".")) continue;
+      const accountDir = join6(input.accountsDir, entry);
+      try {
+        if (!statSync2(accountDir).isDirectory()) continue;
+      } catch {
+        continue;
+      }
+      const accountJsonPath = join6(accountDir, "account.json");
+      if (!existsSync8(accountJsonPath)) continue;
+      let admins = [];
+      try {
+        const config = JSON.parse(readFileSync8(accountJsonPath, "utf-8"));
+        admins = config.admins ?? [];
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`[${input.tag}] account.json unreadable source=${accountJsonPath} error=${msg}`);
+        continue;
+      }
+      for (const a of admins) {
+        if (typeof a.userId !== "string") continue;
+        accountUserIds.add(a.userId);
+        if (!usersUserIds.has(a.userId)) {
+          const userIdShort = a.userId.slice(0, 8);
+          console.error(
+            `[${input.tag}] direction=account-without-users userId=${userIdShort} source=${accountJsonPath}`
+          );
+          result.accountWithoutUsers.push({ userId: a.userId, source: accountJsonPath });
+          result.divergences += 1;
+        }
+      }
+    }
+  }
+  for (const uid of usersUserIds) {
+    if (!accountUserIds.has(uid)) {
+      const userIdShort = uid.slice(0, 8);
+      console.error(
+        `[${input.tag}] direction=users-without-account userId=${userIdShort} source=${input.usersFile}`
+      );
+      result.usersWithoutAccount.push({ userId: uid });
+      result.divergences += 1;
+    }
+  }
+  console.error(`[${input.tag}] check complete divergences=${result.divergences}`);
+  return result;
+}
+
+// server/routes/onboarding.ts
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
 function hashPin(pin) {
   return createHash("sha256").update(pin).digest("hex");
 }
 function readUsersFile() {
-  if (!existsSync8(USERS_FILE)) return null;
-  const raw = readFileSync8(USERS_FILE, "utf-8").trim();
+  if (!existsSync9(USERS_FILE)) return null;
+  const raw = readFileSync9(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -6466,7 +6615,7 @@ app8.post("/claude-auth", async (c) => {
     if (!vncReady) return c.json({ error: "VNC display failed to start" }, 500);
   }
   await ensureCdp(transport);
-  writeFileSync4(logPath("claude-auth"), "");
+  writeFileSync5(logPath("claude-auth"), "");
   const chromiumWrapper = writeChromiumWrapper();
   const x11Env = buildX11Env(chromiumWrapper, transport);
   vncLog("claude-auth", { action: "start", transport });
@@ -6494,6 +6643,17 @@ app8.post("/set-pin", async (c) => {
   if (existingUsers !== null && existingUsers.length > 0) {
     return c.json({ error: "PIN is already configured." }, 409);
   }
+  const stubCheck = hasStubAccountDir();
+  if (stubCheck.stub) {
+    console.error(
+      `[onboarding] set-pin REFUSED reason=stub-account-dirs dirs=${stubCheck.dirs.join(",")}`
+    );
+    return c.json({
+      error: `Onboarding refused: data/accounts/ contains ${stubCheck.dirs.length} directory/ies without account.json (${stubCheck.dirs.join(", ")}). Resolve the stub before setting up.`,
+      code: "STUB_ACCOUNT_DIR",
+      dirs: stubCheck.dirs
+    }, 409);
+  }
   let body;
   try {
     body = await c.req.json();
@@ -6516,36 +6676,41 @@ app8.post("/set-pin", async (c) => {
   } else {
     console.log(`[set-pin] minted new userId=${userId.slice(0, 8)}\u2026 (first-time install)`);
   }
-  mkdirSync3(dirname2(USERS_FILE), { recursive: true });
-  writeFileSync4(USERS_FILE, JSON.stringify([{ userId, pin: hash }]), { mode: 384 });
-  console.log(`[set-pin] wrote users.json: userId=${userId.slice(0, 8)}\u2026 hash=${hash.slice(0, 8)}\u2026`);
-  if (account) {
-    try {
-      const config = JSON.parse(readFileSync8(`${account.accountDir}/account.json`, "utf-8"));
-      if (!config.admins) config.admins = [];
-      if (!config.admins.some((a) => a.userId === userId)) {
-        config.admins.push({ userId, role: "owner" });
-        writeFileSync4(`${account.accountDir}/account.json`, JSON.stringify(config, null, 2) + "\n");
-        console.log(`[set-pin] added userId=${userId.slice(0, 8)}\u2026 to account.json admins`);
-      }
-    } catch (err) {
-      console.error(`[set-pin] failed to update account.json admins: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    try {
-      const result = await writeAdminUserAndPerson({
-        userId,
-        fullName,
-        accountId: account.accountId
-      });
-      console.log(
-        `[admin-identity] adminuser-bound userId=${userId.slice(0, 8)} givenName=${result.givenName} familyName=${result.familyName ?? "null"} personReused=${result.personReused}`
-      );
-    } catch (err) {
-      console.error(
-        `[admin-identity] adminuser-bind-failed userId=${userId.slice(0, 8)} accountId=${account.accountId.slice(0, 8)} error=${err instanceof Error ? err.message : String(err)}`
-      );
-      return c.json({ error: "Failed to write admin identity to graph. Check Neo4j connectivity and retry." }, 500);
-    }
+  if (!account) {
+    console.error(`[set-pin] no account resolvable at set-pin time \u2014 refusing to write users.json without account binding`);
+    return c.json({ error: "No account is configured on this device. Re-run the installer." }, 503);
+  }
+  const result = writeAdminEntry({
+    userId,
+    pin: hash,
+    role: "owner",
+    usersFile: USERS_FILE,
+    accountDir: account.accountDir,
+    caller: "set-pin"
+  });
+  if (result.usersJsonResult !== "ok") {
+    console.error(`[set-pin] users.json write failed: ${result.usersError ?? "unknown"}`);
+    return c.json({ error: "Failed to write user configuration. See server log." }, 500);
+  }
+  if (result.accountJsonResult === "fail") {
+    console.error(`[set-pin] account.json write failed after users.json succeeded: ${result.accountError ?? "unknown"}`);
+    return c.json({ error: "PIN saved but admin role could not be recorded. See server log." }, 500);
+  }
+  console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
+  try {
+    const adminBind = await writeAdminUserAndPerson({
+      userId,
+      fullName,
+      accountId: account.accountId
+    });
+    console.log(
+      `[admin-identity] adminuser-bound userId=${userId.slice(0, 8)} givenName=${adminBind.givenName} familyName=${adminBind.familyName ?? "null"} personReused=${adminBind.personReused}`
+    );
+  } catch (err) {
+    console.error(
+      `[admin-identity] adminuser-bind-failed userId=${userId.slice(0, 8)} accountId=${account.accountId.slice(0, 8)} error=${err instanceof Error ? err.message : String(err)}`
+    );
+    return c.json({ error: "Failed to write admin identity to graph. Check Neo4j connectivity and retry." }, 500);
   }
   return c.json({ ok: true });
 });
@@ -6578,7 +6743,7 @@ app8.delete("/set-pin", async (c) => {
     unlinkSync(USERS_FILE);
     console.log(`[set-pin] cleared users.json (last entry removed): userId=${matchedUser.userId.slice(0, 8)}\u2026`);
   } else {
-    writeFileSync4(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
+    writeFileSync5(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
     console.log(`[set-pin] removed entry from users.json: userId=${matchedUser.userId.slice(0, 8)}\u2026 remaining=${remaining.length}`);
   }
   return c.json({ ok: true });
@@ -6598,9 +6763,9 @@ app8.post("/skip", async (c) => {
   const { accountId, accountDir } = account;
   let agentName = "Maxy";
   const brandPath = PLATFORM_ROOT5 ? resolve8(PLATFORM_ROOT5, "config", "brand.json") : "";
-  if (brandPath && existsSync8(brandPath)) {
+  if (brandPath && existsSync9(brandPath)) {
     try {
-      const brand = JSON.parse(readFileSync8(brandPath, "utf-8"));
+      const brand = JSON.parse(readFileSync9(brandPath, "utf-8"));
       if (brand.productName) agentName = brand.productName;
     } catch (err) {
       console.error(`[onboarding-skip] brand.json read failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -6608,8 +6773,8 @@ app8.post("/skip", async (c) => {
   }
   const soulPath = resolve8(accountDir, "agents", "admin", "SOUL.md");
   try {
-    mkdirSync3(dirname2(soulPath), { recursive: true });
-    writeFileSync4(soulPath, `You are ${agentName}, an AI operations manager.
+    mkdirSync4(dirname3(soulPath), { recursive: true });
+    writeFileSync5(soulPath, `You are ${agentName}, an AI operations manager.
 `);
     console.log(`[onboarding-skip] wrote SOUL.md: ${soulPath}`);
   } catch (err) {
@@ -6653,9 +6818,9 @@ app8.post("/skip", async (c) => {
 var onboarding_default = app8;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync9, renameSync, statSync as statSync2 } from "fs";
-import { join as join6 } from "path";
-var CLIENT_ERRORS_LOG = join6(LOG_DIR, "client-errors.log");
+import { appendFileSync, existsSync as existsSync10, renameSync as renameSync2, statSync as statSync3 } from "fs";
+import { join as join7 } from "path";
+var CLIENT_ERRORS_LOG = join7(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -6698,10 +6863,10 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync9(CLIENT_ERRORS_LOG)) return;
-    const stats = statSync2(CLIENT_ERRORS_LOG);
+    if (!existsSync10(CLIENT_ERRORS_LOG)) return;
+    const stats = statSync3(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
-    renameSync(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
+    renameSync2(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
     console.error(`[client-error] log rotation failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -6812,18 +6977,53 @@ app9.post("/", async (c) => {
 var client_error_default = app9;
 
 // server/routes/admin/session.ts
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync5, existsSync as existsSync10 } from "fs";
+import { readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync4, writeFileSync as writeFileSync6, existsSync as existsSync11 } from "fs";
+import { join as join8 } from "path";
 import { createHash as createHash2 } from "crypto";
 var deprecationLogged = /* @__PURE__ */ new Set();
 function hashPin2(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync10(USERS_FILE)) return null;
-  const raw = readFileSync9(USERS_FILE, "utf-8").trim();
+  if (!existsSync11(USERS_FILE)) return null;
+  const raw = readFileSync10(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
+function scanForOrphanedAccountAdmins(users) {
+  const usersUserIds = new Set(users.map((u) => u.userId));
+  const orphans = [];
+  if (!existsSync11(ACCOUNTS_DIR)) return orphans;
+  let entries;
+  try {
+    entries = readdirSync4(ACCOUNTS_DIR);
+  } catch {
+    return orphans;
+  }
+  for (const entry of entries) {
+    if (entry.startsWith(".")) continue;
+    const accountDir = join8(ACCOUNTS_DIR, entry);
+    try {
+      if (!statSync4(accountDir).isDirectory()) continue;
+    } catch {
+      continue;
+    }
+    const accountJsonPath = join8(accountDir, "account.json");
+    if (!existsSync11(accountJsonPath)) continue;
+    try {
+      const config = JSON.parse(readFileSync10(accountJsonPath, "utf-8"));
+      const admins = config.admins ?? [];
+      for (const a of admins) {
+        if (typeof a.userId === "string" && !usersUserIds.has(a.userId)) {
+          orphans.push(a.userId);
+        }
+      }
+    } catch {
+      continue;
+    }
+  }
+  return orphans;
+}
 function stripLegacyNameField(users) {
   const dirty = users.some((u) => "name" in u && u.name !== void 0);
   if (!dirty) return;
@@ -6837,7 +7037,7 @@ function stripLegacyNameField(users) {
     }
   }
   try {
-    writeFileSync5(USERS_FILE, JSON.stringify(users), { mode: 384 });
+    writeFileSync6(USERS_FILE, JSON.stringify(users), { mode: 384 });
   } catch (err) {
     console.error(`[admin-identity] users-json strip failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -6957,7 +7157,15 @@ app10.post("/", async (c) => {
   }
   const matchedUser = users.find((u) => u.pin === inputHash);
   if (!matchedUser) {
-    console.log(`[session] PIN auth failed: no matching user`);
+    const orphanUserIds = scanForOrphanedAccountAdmins(users);
+    if (orphanUserIds.length > 0) {
+      const prefix = orphanUserIds[0].slice(0, 8);
+      console.log(
+        `[session] PIN auth failed: no matching user; account.json admins[] contains userId=${prefix} with no users.json row \u2014 three-store divergence`
+      );
+    } else {
+      console.log(`[session] PIN auth failed: no matching user`);
+    }
     return c.json({ error: "Invalid PIN" }, 401);
   }
   stripLegacyNameField(users);
@@ -6999,8 +7207,8 @@ import { appendFileSync as appendFileSync3 } from "fs";
 
 // app/lib/script-stream-tailer.ts
 import * as childProcess from "child_process";
-import { appendFileSync as appendFileSync2, createReadStream as createReadStream2, mkdirSync as mkdirSync4, statSync as statSync3 } from "fs";
-import { dirname as dirname3 } from "path";
+import { appendFileSync as appendFileSync2, createReadStream as createReadStream2, mkdirSync as mkdirSync5, statSync as statSync5 } from "fs";
+import { dirname as dirname4 } from "path";
 import { StringDecoder } from "string_decoder";
 var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[script:([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
 function parseLine(line) {
@@ -7018,7 +7226,7 @@ function startScriptStreamTailer(opts) {
   const { path: path2, onEvent, onError } = opts;
   let offset;
   try {
-    offset = statSync3(path2).size;
+    offset = statSync5(path2).size;
   } catch {
     offset = 0;
   }
@@ -7037,7 +7245,7 @@ function startScriptStreamTailer(opts) {
     try {
       let size;
       try {
-        size = statSync3(path2).size;
+        size = statSync5(path2).size;
       } catch {
         return;
       }
@@ -7109,7 +7317,7 @@ function writeRouteMilestone(streamLogPath, scope, line) {
   }
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    mkdirSync4(dirname3(streamLogPath), { recursive: true });
+    mkdirSync5(dirname4(streamLogPath), { recursive: true });
     appendFileSync2(streamLogPath, `[${ts}] [script:${scope}] ${line}
 `);
   } catch (err) {
@@ -7285,7 +7493,7 @@ var app11 = new Hono();
 app11.post("/cancel", requireAdminSession, async (c) => {
   const session_key = c.var.sessionKey;
   try {
-    const { interruptClient: interruptClient2 } = await import("./client-pool-ZNGN66GN.js");
+    const { interruptClient: interruptClient2 } = await import("./client-pool-J5BCVVI2.js");
     await interruptClient2(session_key);
     return c.json({ ok: true });
   } catch (err) {
@@ -7680,22 +7888,22 @@ app12.post("/", requireAdminSession, async (c) => {
 var compact_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync12, readdirSync as readdirSync3, readFileSync as readFileSync10, statSync as statSync4 } from "fs";
+import { existsSync as existsSync13, readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
 import { resolve as resolve10, basename as basename3 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync11 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync12 } from "fs";
+import { join as join9 } from "path";
 function resolveConversationLogPaths(fullFilename, preflushFilename, logDirs) {
   const tried = [fullFilename, preflushFilename];
   const hits = [];
   const stalePreflushPaths = [];
   for (const dir of logDirs) {
-    const fullPath = join7(dir, fullFilename);
-    if (existsSync11(fullPath)) {
+    const fullPath = join9(dir, fullFilename);
+    if (existsSync12(fullPath)) {
       hits.push({ path: fullPath, shape: "full", dir });
-      const preflushSibling = join7(dir, preflushFilename);
-      if (existsSync11(preflushSibling)) {
+      const preflushSibling = join9(dir, preflushFilename);
+      if (existsSync12(preflushSibling)) {
         stalePreflushPaths.push(preflushSibling);
       }
     }
@@ -7704,8 +7912,8 @@ function resolveConversationLogPaths(fullFilename, preflushFilename, logDirs) {
     return { hits, stalePreflushPaths, tried };
   }
   for (const dir of logDirs) {
-    const preflushPath = join7(dir, preflushFilename);
-    if (existsSync11(preflushPath)) {
+    const preflushPath = join9(dir, preflushFilename);
+    if (existsSync12(preflushPath)) {
       hits.push({ path: preflushPath, shape: "preflush", dir });
     }
   }
@@ -7736,8 +7944,8 @@ app13.get("/", async (c) => {
       const filePath = resolve10(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync10(filePath);
-        const onDiskBytes = statSync4(filePath).size;
+        const buffer = readFileSync11(filePath);
+        const onDiskBytes = statSync6(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -7822,7 +8030,7 @@ app13.get("/", async (c) => {
       try {
         const filename = basename3(hit.path);
         if (stalePreflushCount > 0 && !download) {
-          const content = readFileSync10(hit.path, "utf-8");
+          const content = readFileSync11(hit.path, "utf-8");
           return c.json({
             log: content,
             filename,
@@ -7830,8 +8038,8 @@ app13.get("/", async (c) => {
             warnings: stalePreflushPaths.map((path2) => ({ kind: "stale-preflush", path: path2 }))
           });
         }
-        const buffer = readFileSync10(hit.path);
-        const onDiskBytes = statSync4(hit.path).size;
+        const buffer = readFileSync11(hit.path);
+        const onDiskBytes = statSync6(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -7864,19 +8072,19 @@ app13.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync12(dir)) continue;
+    if (!existsSync13(dir)) continue;
     let files;
     try {
-      files = readdirSync3(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync5(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync4(resolve10(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync6(resolve10(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync10(resolve10(dir, name));
+        const content = readFileSync11(resolve10(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -7915,7 +8123,7 @@ var claude_info_default = app14;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile3, readdir } from "fs/promises";
-import { existsSync as existsSync13 } from "fs";
+import { existsSync as existsSync14 } from "fs";
 import { resolve as resolve11 } from "path";
 var app15 = new Hono();
 app15.get("/:attachmentId", requireAdminSession, async (c) => {
@@ -7929,11 +8137,11 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve11(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync13(dir)) {
+  if (!existsSync14(dir)) {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve11(dir, `${attachmentId}.meta.json`);
-  if (!existsSync13(metaPath)) {
+  if (!existsSync14(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -7961,23 +8169,23 @@ var attachment_default = app15;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve12 } from "path";
-import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync14, rmSync } from "fs";
+import { readdirSync as readdirSync6, readFileSync as readFileSync12, existsSync as existsSync15, rmSync } from "fs";
 var app16 = new Hono();
 app16.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve12(account.accountDir, "agents");
-  if (!existsSync14(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync15(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync4(agentsDir, { withFileTypes: true });
+    const entries = readdirSync6(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve12(agentsDir, entry.name, "config.json");
-      if (!existsSync14(configPath2)) continue;
+      if (!existsSync15(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -8004,7 +8212,7 @@ app16.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve12(account.accountDir, "agents", slug);
-  if (!existsSync14(agentDir)) {
+  if (!existsSync15(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -8034,7 +8242,7 @@ app16.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve12(account.accountDir, "agents", slug);
-  if (!existsSync14(agentDir)) {
+  if (!existsSync15(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -8050,7 +8258,7 @@ var agents_default = app16;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { appendFileSync as appendFileSync4, existsSync as existsSync15 } from "fs";
+import { appendFileSync as appendFileSync4, existsSync as existsSync16 } from "fs";
 
 // app/lib/synthetic-marker.ts
 var CLOUDFLARE_MARKER_PREFIX = "Cloudflare setup completed (actionId: ";
@@ -8070,7 +8278,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, conversationId
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync15(a.storagePath)) reason = "missing-file";
+    else if (!existsSync16(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -8641,7 +8849,7 @@ var events_default = app20;
 // server/routes/admin/cloudflare.ts
 import { homedir } from "os";
 import { resolve as resolve14 } from "path";
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -8657,14 +8865,14 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync5, readFileSync as readFileSync12, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname4 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5 } from "path";
 import { resolve as resolve13 } from "path";
 var ALIAS_DOMAINS_PATH = resolve13(MAXY_DIR, "alias-domains.json");
 function readExisting() {
-  if (!existsSync16(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+  if (!existsSync17(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync12(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync13(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -8675,8 +8883,8 @@ function addAliasDomain(hostname2) {
   const existing = readExisting();
   if (existing.has(hostname2)) return;
   existing.add(hostname2);
-  mkdirSync5(dirname4(ALIAS_DOMAINS_PATH), { recursive: true });
-  writeFileSync6(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
+  mkdirSync6(dirname5(ALIAS_DOMAINS_PATH), { recursive: true });
+  writeFileSync7(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
 // app/lib/cloudflare-setup-types.ts
@@ -8691,7 +8899,7 @@ function loadBrandInfo() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
   const brandPath = resolve14(platformRoot2, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync13(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync14(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -8905,8 +9113,8 @@ app21.get("/tunnels", requireAdminSession, async (c) => {
   if (!correlationId) return err("session", "No active conversation for session \u2014 refresh chat.");
   streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
   const certPath = resolve14(homedir(), brand.configDir, "cloudflared", "cert.pem");
-  const { existsSync: existsSync23 } = await import("fs");
-  if (!existsSync23(certPath)) {
+  const { existsSync: existsSync24 } = await import("fs");
+  if (!existsSync24(certPath)) {
     return err("cert", `Cloudflare origin certificate is not on disk yet (${certPath}). Complete the Cloudflare login first by submitting the form once \u2014 the OAuth flow writes cert.pem.`);
   }
   const result = await runFormSpawn({
@@ -9196,7 +9404,7 @@ var cloudflare_default = app21;
 import { createReadStream as createReadStream3 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname5, join as join8, resolve as resolve16, sep as sep2 } from "path";
+import { basename as basename4, dirname as dirname6, join as join10, resolve as resolve16, sep as sep2 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
@@ -9554,7 +9762,7 @@ async function cascadeDeleteDocument(params) {
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join8(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join10(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -9592,7 +9800,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
-    const meta = await readMeta(join8(absolute, entry.name), entry.name);
+    const meta = await readMeta(join10(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -9651,7 +9859,7 @@ app22.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join8(absolute, name);
+        const entryPath = join10(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -9824,7 +10032,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join8(dirname5(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join10(dirname6(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -11446,7 +11654,7 @@ var adherence_default = app30;
 import neo4j3 from "neo4j-driver";
 import { readFile as readFile5, readdir as readdir3, stat as stat5 } from "fs/promises";
 import { resolve as resolve17, relative as relative2, isAbsolute } from "path";
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -11594,7 +11802,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync17(dir)) continue;
+    if (!existsSync18(dir)) continue;
     try {
       const entries = await readdir3(dir);
       for (const entry of entries) {
@@ -11609,7 +11817,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync17(inp.overridePath)) {
+  if (existsSync18(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -11620,7 +11828,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync17(inp.bundledPath)) {
+  } else if (existsSync18(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -11662,7 +11870,7 @@ var sidebar_artefacts_default = app31;
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
 import { resolve as resolve18 } from "path";
-import { existsSync as existsSync18 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app32 = new Hono();
@@ -11726,7 +11934,7 @@ async function resolveSavePath(id, accountId, accountDir) {
   }
   if (UUID_RE5.test(id)) {
     const dir = resolve18(ATTACHMENTS_ROOT, accountId, id);
-    if (!existsSync18(dir)) {
+    if (!existsSync19(dir)) {
       return { kind: "reject", status: 400, reason: "not-found" };
     }
     try {
@@ -11750,7 +11958,7 @@ var sidebar_artefact_save_default = app32;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { resolve as resolve19 } from "path";
 var UUID_RE6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app33 = new Hono();
@@ -11764,7 +11972,7 @@ app33.get("/", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve19(ATTACHMENTS_ROOT, accountId, id);
-  if (!existsSync19(dir)) {
+  if (!existsSync20(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
@@ -11798,14 +12006,14 @@ app33.get("/", requireAdminSession, async (c) => {
 var sidebar_artefact_content_default = app33;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync20, readFileSync as readFileSync14 } from "fs";
-import { resolve as resolve20, join as join9 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync15 } from "fs";
+import { resolve as resolve20, join as join11 } from "path";
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join9(PLATFORM_ROOT7, "config", "brand.json");
-if (existsSync20(brandJsonPath)) {
+var brandJsonPath = join11(PLATFORM_ROOT7, "config", "brand.json");
+if (existsSync21(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync14(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync15(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -11814,8 +12022,8 @@ var VERSION_FILE = resolve20(PLATFORM_ROOT7, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync20(VERSION_FILE)) return "unknown";
-  return readFileSync14(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync21(VERSION_FILE)) return "unknown";
+  return readFileSync15(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -11895,7 +12103,7 @@ app35.route("/health-brand", health_default2);
 var admin_default = app35;
 
 // server/routes/sites.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15, realpathSync as realpathSync5, statSync as statSync5 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
 import { resolve as resolve21 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -11962,7 +12170,7 @@ app36.get("/:rel{.*}", (c) => {
   }
   let stat7;
   try {
-    stat7 = existsSync21(filePath) ? statSync5(filePath) : null;
+    stat7 = existsSync22(filePath) ? statSync7(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -11975,7 +12183,7 @@ app36.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync21(filePath)) {
+  if (!existsSync22(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -11994,7 +12202,7 @@ app36.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync15(realPath);
+    body = readFileSync16(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -12126,14 +12334,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join10(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join12(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync16(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -12152,11 +12360,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH2 = join10(homedir2(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH2 = join12(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync22(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync16(ALIAS_DOMAINS_PATH2, "utf-8"));
+    if (!existsSync23(ALIAS_DOMAINS_PATH2)) return null;
+    const parsed = JSON.parse(readFileSync17(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -12502,14 +12710,14 @@ app37.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync16(filePath);
+  const body = readFileSync17(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -12532,14 +12740,14 @@ app37.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync16(filePath);
+  const body = readFileSync17(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -12549,9 +12757,9 @@ app37.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync22(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync16(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -12568,9 +12776,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join10(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync22(versionFile)) return "unknown";
-    const content = readFileSync16(versionFile, "utf-8").trim();
+    const versionFile = join12(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync23(versionFile)) return "unknown";
+    const content = readFileSync17(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -12611,7 +12819,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync16(resolve22(process.cwd(), "public", file), "utf-8");
+    html = readFileSync17(resolve22(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -12627,26 +12835,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join10(homedir2(), BRAND.configDir);
+  const configDir2 = join12(homedir2(), BRAND.configDir);
   try {
-    const accountJsonPath = join10(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync16(accountJsonPath, "utf-8"));
+    const accountJsonPath = join12(configDir2, "account.json");
+    if (!existsSync23(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
-    const cachePath = join10(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync22(cachePath)) return null;
-    return JSON.parse(readFileSync16(cachePath, "utf-8"));
+    const cachePath = join12(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync23(cachePath)) return null;
+    return JSON.parse(readFileSync17(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join10(homedir2(), BRAND.configDir);
-    const accountJsonPath = join10(configDir2, "account.json");
-    if (!existsSync22(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync16(accountJsonPath, "utf-8"));
+    const configDir2 = join12(homedir2(), BRAND.configDir);
+    const accountJsonPath = join12(configDir2, "account.json");
+    if (!existsSync23(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -12719,7 +12927,7 @@ app37.use("/vnc-popout.html", logViewerFetch);
 app37.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync16(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync17(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -12777,6 +12985,7 @@ var port = parseInt(process.env.MAXY_UI_INTERNAL_PORT ?? process.env.PORT ?? "19
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app37.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
+console.log("[boot] auth-mode summary: oauth=8 api-key=1 (api-key consumer: invokePublicAgent only)");
 var SUBAPP_MANIFEST = [
   { prefix: "/api/health", file: "server/routes/health.ts", subapp: health_default },
   { prefix: "/api/session", file: "server/routes/session.ts", subapp: session_default },
@@ -12806,11 +13015,20 @@ try {
 } catch (err) {
   console.error(`[route-shadow] introspection unavailable: ${err instanceof Error ? err.message : String(err)}`);
 }
+try {
+  checkAdminAuthInvariant({
+    usersFile: USERS_FILE,
+    accountsDir: ACCOUNTS_DIR,
+    tag: "admin-invariant"
+  });
+} catch (err) {
+  console.error(`[admin-invariant] check threw \u2014 proceeding with boot: ${err instanceof Error ? err.message : String(err)}`);
+}
 (async () => {
   try {
     let userId = "";
-    if (existsSync22(USERS_FILE)) {
-      const users = JSON.parse(readFileSync16(USERS_FILE, "utf-8").trim() || "[]");
+    if (existsSync23(USERS_FILE)) {
+      const users = JSON.parse(readFileSync17(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);
@@ -12843,7 +13061,7 @@ autoDeliverPremiumPlugins(bootEntitlement?.purchasedPlugins ?? void 0);
 (async () => {
   if (!bootAccount) return;
   try {
-    const { recoverRunningCloudflareTasks } = await import("./cloudflare-task-tracker-MHALDN54.js");
+    const { recoverRunningCloudflareTasks } = await import("./cloudflare-task-tracker-XCUO4N74.js");
     const result = await recoverRunningCloudflareTasks(
       bootAccount.accountId,
       configDirForWhatsApp,
@@ -12893,7 +13111,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join10(__dirname, "..")),
+  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join12(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     try {