@rubytech/create-realagent 1.0.853 → 1.0.855

package/payload/server/server.js

@@ -1,5 +1,10 @@
 import {
+  ATTACHMENTS_ROOT,
   Hono,
+  MAX_FILES_PER_MESSAGE,
+  MAX_FILE_SIZE_BYTES,
+  SUPPORTED_MIME_TYPES,
+  assertSupportedMime,
   autoDeliverPremiumPlugins,
   buildX11Env,
   callOauthLlm,
@@ -10,6 +15,10 @@ import {
   compactSession,
   computeConstraints,
   createRemoteSession,
+  deriveComponentAttachmentId,
+  deriveComponentMimeType,
+  deriveComponentTitle,
+  detectMimeType,
   ensureAuth,
   ensureCdp,
   ensureLogDir,
@@ -19,11 +28,13 @@ import {
   invokeAgent,
   isActionActive,
   isPasswordValid,
+  isPersistentComponent,
   isRemoteAuthConfigured,
   keyFilePath,
   launchAction,
   load,
   logPath,
+  pickComponentBytes,
   recordFailedAttempt,
   render,
   renderLoginPage,
@@ -36,9 +47,14 @@ import {
   serve,
   setRemotePassword,
   sleep,
+  storeAttachment,
+  storeComponentArtefact,
+  storeGeneratedFile,
+  storePublicAttachment,
   streamLogPathFor,
   stripAttachmentMetaSuffix,
   tryCookieBridgeForConversation,
+  validateFilePathInAccount,
   validateKey,
   validatePasswordStrength,
   verifyPassword,
@@ -46,7 +62,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-X3LVMXI5.js";
+} from "./chunk-LTB5SSQW.js";
 import {
   ACCOUNTS_DIR,
   CDP_PORT,
@@ -91,7 +107,7 @@ import {
   unregisterSession,
   validateAgentSlug,
   validateSession
-} from "./chunk-DIRNBH7F.js";
+} from "./chunk-DC6DWYZJ.js";
 import {
   CLOUDFLARE_TASK_DIAGNOSTICS,
   appendCloudflareSteps,
@@ -99,7 +115,7 @@ import {
   openCloudflareTask,
   readTunnelState,
   resolveUnitGoneVerdict
-} from "./chunk-DTWW35TK.js";
+} from "./chunk-CFNSKDGA.js";
 import {
   GREETING_DIRECTIVE,
   HAIKU_MODEL,
@@ -123,13 +139,14 @@ import {
   listAdminSessions,
   loadAdminUserName,
   loadOnboardingStep,
+  persistMessage,
   projectAgent,
   renameConversation,
   runAdminUserSelfHeal,
   verifyAndGetConversationUpdatedAt,
   verifyConversationOwnership,
   writeAdminUserAndPerson
-} from "./chunk-CJWFM3WX.js";
+} from "./chunk-MN2LGNUB.js";
 import {
   __commonJS,
   __toESM
@@ -632,9 +649,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync17, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve22, join as join12, basename as basename5 } from "path";
-import { homedir as homedir2 } from "os";
+import { readFileSync as readFileSync18, existsSync as existsSync24, watchFile } from "fs";
+import { resolve as resolve21, join as join12, basename as basename4 } from "path";
+import { homedir as homedir3 } from "os";
 
 // app/lib/agent-slug-pattern.ts
 var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
@@ -1277,7 +1294,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG3} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve23) => setTimeout(() => resolve23("timeout"), timeoutMs)
+    (resolve22) => setTimeout(() => resolve22("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1405,11 +1422,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve22, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve23();
+        resolve22();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -1523,14 +1540,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve23, reject) => {
+  return new Promise((resolve22, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve23(value);
+        resolve22(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2065,8 +2082,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.sessionKey);
   let release;
-  const mine = new Promise((resolve23) => {
-    release = resolve23;
+  const mine = new Promise((resolve22) => {
+    release = resolve22;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.sessionKey, chained);
@@ -3091,11 +3108,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve23) => {
-        const timer2 = setTimeout(resolve23, delay);
+      await new Promise((resolve22) => {
+        const timer2 = setTimeout(resolve22, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve23();
+          resolve22();
         }, { once: true });
       });
     }
@@ -3103,16 +3120,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve22) => {
     if (!conn.sock) {
-      resolve23();
+      resolve22();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve23();
+        resolve22();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3373,8 +3390,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve23) => {
-      resolvePending = resolve23;
+    const sttPending = new Promise((resolve22) => {
+      resolvePending = resolve22;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3495,20 +3512,20 @@ async function probeApiKey() {
   return result.status;
 }
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve23) => {
+  return new Promise((resolve22) => {
     const socket = createConnection(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve23(true);
+      resolve22(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve23(false);
+      resolve22(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve23(false);
+      resolve22(false);
     });
   });
 }
@@ -3921,142 +3938,31 @@ ${raw}`;
   return base;
 }
 
-// app/lib/attachments.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { mkdir as mkdir2, readFile, stat as stat2, writeFile as writeFile2 } from "fs/promises";
-import { realpathSync } from "fs";
-import { resolve as resolve4, extname, basename } from "path";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve4(PLATFORM_ROOT2, "..", "data/uploads");
-var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp",
-  "application/pdf",
-  "text/plain",
-  "text/markdown",
-  "text/csv",
-  "text/html",
-  "text/calendar",
-  "application/zip",
-  "application/x-zip-compressed"
-]);
-var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
-var MAX_FILES_PER_MESSAGE = 5;
-var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
-function assertSupportedMime(mimeType) {
-  if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
-    throw new Error(
-      `Unsupported file type: "${mimeType}". Supported types: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
-    );
-  }
-}
-async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
-  const attachmentId = randomUUID3();
-  const dir = resolve4(ATTACHMENTS_ROOT, scope, attachmentId);
-  await mkdir2(dir, { recursive: true });
-  const ext = extname(filename) || "";
-  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
-  const meta = {
-    attachmentId,
-    scope,
-    filename,
-    mimeType,
-    sizeBytes,
-    storedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await writeFile2(storagePath, buffer);
-  await writeFile2(metaPath, JSON.stringify(meta, null, 2));
-  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes };
-}
-async function storeAttachment(accountId, file) {
-  assertSupportedMime(file.type);
-  if (file.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
-    );
-  }
-  const buffer = Buffer.from(await file.arrayBuffer());
-  return writeAttachment(accountId, file.name, file.type, file.size, buffer);
-}
-async function storePublicAttachment(sessionId, file, buffer) {
-  assertSupportedMime(file.type);
-  if (file.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
-    );
-  }
-  return writeAttachment(`public/${sessionId}`, file.name, file.type, file.size, buffer);
-}
-var MIME_BY_EXT = {
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".xml": "text/xml",
-  ".zip": "application/zip",
-  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  ".ics": "text/calendar"
-};
-function detectMimeType(filePath) {
-  const ext = extname(filePath).toLowerCase();
-  return MIME_BY_EXT[ext] ?? "application/octet-stream";
-}
-function validateFilePathInAccount(filePath, accountDir) {
-  const resolved = realpathSync(filePath);
-  const accountResolved = realpathSync(accountDir);
-  if (!resolved.startsWith(accountResolved + "/")) {
-    throw new Error(`File path is outside the account directory`);
-  }
-  return resolved;
-}
-async function storeGeneratedFile(accountId, filePath) {
-  const fileStat = await stat2(filePath);
-  if (fileStat.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File exceeds the 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB).`
-    );
-  }
-  const filename = basename(filePath);
-  const mimeType = detectMimeType(filePath);
-  const buffer = await readFile(filePath);
-  return writeAttachment(accountId, filename, mimeType, fileStat.size, buffer);
-}
-
 // app/lib/stt/voice-note.ts
-import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
+import { writeFile as writeFile2, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join4 } from "path";
 var TAG14 = "[voice]";
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
+  "audio/opus",
   "audio/webm",
   "audio/mp4",
   "audio/mpeg",
   "audio/wav"
 ]);
+function normalizeMime(mimeType) {
+  return mimeType.split(";")[0].trim().toLowerCase();
+}
 function isAudioMime(mimeType) {
-  return AUDIO_MIME_TYPES.has(mimeType);
+  return AUDIO_MIME_TYPES.has(normalizeMime(mimeType));
 }
 function audioExtension(mimeType) {
-  switch (mimeType) {
+  switch (normalizeMime(mimeType)) {
     case "audio/ogg":
       return ".ogg";
+    case "audio/opus":
+      return ".opus";
     case "audio/webm":
       return ".webm";
     case "audio/mp4":
@@ -4083,7 +3989,7 @@ async function transcribeVoiceNote(file, source) {
     const ext = audioExtension(mimeType);
     tempPath = join4(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
-    await writeFile3(tempPath, buffer);
+    await writeFile2(tempPath, buffer);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(`${TAG14} failed source=${source} error=temp-file-write: ${reason}`);
@@ -4637,13 +4543,13 @@ var group_default = app4;
 // app/lib/access-gate.ts
 import neo4j from "neo4j-driver";
 import { readFileSync as readFileSync4 } from "fs";
-import { resolve as resolve5 } from "path";
-import { randomUUID as randomUUID4, randomInt } from "crypto";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
+import { resolve as resolve4 } from "path";
+import { randomUUID as randomUUID3, randomInt } from "crypto";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve5(PLATFORM_ROOT3, "config/.neo4j-password");
+  const passwordFile = resolve4(PLATFORM_ROOT2, "config/.neo4j-password");
   try {
     return readFileSync4(passwordFile, "utf-8").trim();
   } catch {
@@ -4894,7 +4800,7 @@ async function setGrantPassword(grantId, passwordHash) {
   }
 }
 async function generateNewMagicToken(grantId) {
-  const token = randomUUID4();
+  const token = randomUUID3();
   const session = getSession2();
   try {
     await session.run(
@@ -4958,15 +4864,15 @@ async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
 // app/lib/brevo-sms.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2, existsSync as existsSync5, chmodSync } from "fs";
 import { dirname } from "path";
-import { resolve as resolve6 } from "path";
-var BREVO_API_KEY_FILE = resolve6(MAXY_DIR, ".brevo-api-key");
+import { resolve as resolve5 } from "path";
+var BREVO_API_KEY_FILE = resolve5(MAXY_DIR, ".brevo-api-key");
 var BREVO_API_URL = "https://api.brevo.com/v3/transactionalSMS/sms";
 var BREVO_TIMEOUT_MS = 1e4;
 var BREVO_SENDER = "Maxy";
 var platformRoot = process.env.MAXY_PLATFORM_ROOT;
 if (platformRoot) {
   try {
-    const brandPath = resolve6(platformRoot, "config", "brand.json");
+    const brandPath = resolve5(platformRoot, "config", "brand.json");
     if (existsSync5(brandPath)) {
       const brand = JSON.parse(readFileSync5(brandPath, "utf-8"));
       if (brand.productName) BREVO_SENDER = brand.productName;
@@ -5603,12 +5509,12 @@ app6.post("/webhook", async (c) => {
 var telegram_default = app6;
 
 // server/routes/whatsapp.ts
-import { join as join5, resolve as resolve7, basename as basename2 } from "path";
-import { readFile as readFile2, stat as stat3 } from "fs/promises";
-import { realpathSync as realpathSync2, readdirSync as readdirSync2, readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
+import { join as join5, resolve as resolve6, basename } from "path";
+import { readFile, stat as stat2 } from "fs/promises";
+import { realpathSync, readdirSync as readdirSync2, readFileSync as readFileSync7, existsSync as existsSync7 } from "fs";
 
 // app/lib/whatsapp/login.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var TAG17 = "[whatsapp:login]";
 var ACTIVE_LOGIN_TTL_MS = 3 * 6e4;
 var activeLogins = /* @__PURE__ */ new Map();
@@ -5711,8 +5617,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve23, reject) => {
-    resolveQr = resolve23;
+  const qrPromise = new Promise((resolve22, reject) => {
+    resolveQr = resolve22;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -5747,7 +5653,7 @@ async function startLogin(opts) {
   const login = {
     accountId,
     authDir,
-    id: randomUUID5(),
+    id: randomUUID4(),
     sock,
     startedAt: Date.now(),
     connected: false
@@ -5928,7 +5834,7 @@ function serializeWhatsAppSchema() {
 
 // server/routes/whatsapp.ts
 var TAG18 = "[whatsapp:api]";
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT || "";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT || "";
 var app7 = new Hono();
 app7.get("/status", (c) => {
   try {
@@ -6106,14 +6012,14 @@ app7.post("/config", async (c) => {
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-public-agents": {
-        const agentsDir = resolve7(account.accountDir, "agents");
+        const agentsDir = resolve6(account.accountDir, "agents");
         const agents = [];
         if (existsSync7(agentsDir)) {
           try {
             const entries = readdirSync2(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve7(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve6(agentsDir, entry.name, "config.json");
               if (!existsSync7(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync7(configPath2, "utf-8"));
@@ -6188,14 +6094,14 @@ app7.post("/send-document", async (c) => {
     if (!to || !filePath) {
       return c.json({ error: "Missing required fields: to, filePath" }, 400);
     }
-    if (!maxyAccountId || !PLATFORM_ROOT4) {
+    if (!maxyAccountId || !PLATFORM_ROOT3) {
       return c.json({ error: "Cannot validate file path: missing account or platform context" }, 400);
     }
-    const accountDir = resolve7(PLATFORM_ROOT4, "..", "data/accounts", maxyAccountId);
+    const accountDir = resolve6(PLATFORM_ROOT3, "..", "data/accounts", maxyAccountId);
     let resolvedPath;
     try {
-      resolvedPath = realpathSync2(filePath);
-      const accountResolved = realpathSync2(accountDir);
+      resolvedPath = realpathSync(filePath);
+      const accountResolved = realpathSync(accountDir);
       if (!resolvedPath.startsWith(accountResolved + "/")) {
         const sanitised = filePath.replace(accountDir, "<account>/");
         console.error(`${TAG18} send-document REJECTED path=${sanitised} reason=outside_account_directory`);
@@ -6210,12 +6116,12 @@ app7.post("/send-document", async (c) => {
       console.error(`${TAG18} send-document path error: ${String(err)}`);
       return c.json({ error: String(err) }, 500);
     }
-    const fileStat = await stat3(resolvedPath);
+    const fileStat = await stat2(resolvedPath);
     if (fileStat.size > MAX_FILE_SIZE_BYTES) {
       return c.json({ error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)` }, 400);
     }
-    const buffer = Buffer.from(await readFile2(resolvedPath));
-    const filename = basename2(resolvedPath);
+    const buffer = Buffer.from(await readFile(resolvedPath));
+    const filename = basename(resolvedPath);
     const mimetype = detectMimeType(resolvedPath);
     const sock = getSocket(accountId);
     if (!sock) {
@@ -6416,8 +6322,8 @@ var whatsapp_default = app7;
 // server/routes/onboarding.ts
 import { spawn, execFileSync } from "child_process";
 import { openSync, closeSync, writeFileSync as writeFileSync5, writeSync, existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync9, unlinkSync } from "fs";
-import { resolve as resolve8, dirname as dirname3 } from "path";
-import { createHash, randomUUID as randomUUID6 } from "crypto";
+import { resolve as resolve7, dirname as dirname3 } from "path";
+import { createHash, randomUUID as randomUUID5 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync4, renameSync, mkdirSync as mkdirSync3, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
@@ -6566,7 +6472,7 @@ function checkAdminAuthInvariant(input) {
 }
 
 // server/routes/onboarding.ts
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT || "";
 function hashPin(pin) {
   return createHash("sha256").update(pin).digest("hex");
 }
@@ -6693,7 +6599,7 @@ app8.post("/set-pin", async (c) => {
   const hash = hashPin(body.pin);
   const account = resolveAccount();
   const existingOwnerUserId = account?.config.admins?.find((a) => a.role === "owner")?.userId;
-  const userId = existingOwnerUserId ?? randomUUID6();
+  const userId = existingOwnerUserId ?? randomUUID5();
   if (existingOwnerUserId) {
     console.log(`[set-pin] reusing existing owner userId=${userId.slice(0, 8)}\u2026 (change-PIN preserves identity)`);
   } else {
@@ -6785,7 +6691,7 @@ app8.post("/skip", async (c) => {
   }
   const { accountId, accountDir } = account;
   let agentName = "Maxy";
-  const brandPath = PLATFORM_ROOT5 ? resolve8(PLATFORM_ROOT5, "config", "brand.json") : "";
+  const brandPath = PLATFORM_ROOT4 ? resolve7(PLATFORM_ROOT4, "config", "brand.json") : "";
   if (brandPath && existsSync9(brandPath)) {
     try {
       const brand = JSON.parse(readFileSync9(brandPath, "utf-8"));
@@ -6794,7 +6700,7 @@ app8.post("/skip", async (c) => {
       console.error(`[onboarding-skip] brand.json read failed: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  const soulPath = resolve8(accountDir, "agents", "admin", "SOUL.md");
+  const soulPath = resolve7(accountDir, "agents", "admin", "SOUL.md");
   try {
     mkdirSync4(dirname3(soulPath), { recursive: true });
     writeFileSync5(soulPath, `You are ${agentName}, an AI operations manager.
@@ -7225,7 +7131,7 @@ app10.post("/", async (c) => {
 var session_default2 = app10;
 
 // server/routes/admin/chat.ts
-import { resolve as resolve9 } from "path";
+import { resolve as resolve8 } from "path";
 import { appendFileSync as appendFileSync3 } from "fs";
 
 // app/lib/script-stream-tailer.ts
@@ -7516,7 +7422,7 @@ var app11 = new Hono();
 app11.post("/cancel", requireAdminSession, async (c) => {
   const session_key = c.var.sessionKey;
   try {
-    const { interruptClient: interruptClient2 } = await import("./client-pool-7Z6YRUQT.js");
+    const { interruptClient: interruptClient2 } = await import("./client-pool-AMT2W3II.js");
     await interruptClient2(session_key);
     return c.json({ ok: true });
   } catch (err) {
@@ -7680,7 +7586,7 @@ app11.post("/", requireAdminSession, async (c) => {
   function resolveTeeStreamLogPath() {
     const liveConvId = getConversationIdForSession(session_key);
     const key = liveConvId ?? preflushStreamLogKey(session_key);
-    return resolve9(account.accountDir, "logs", `claude-agent-stream-${key}.log`);
+    return resolve8(account.accountDir, "logs", `claude-agent-stream-${key}.log`);
   }
   try {
     appendFileSync3(resolveTeeStreamLogPath(), `[${(/* @__PURE__ */ new Date()).toISOString()}] [chat-route-version=task606-tee-path-resolve] sessionKey=${session_key.slice(0, 12)}\u2026
@@ -7782,7 +7688,7 @@ app11.post("/", requireAdminSession, async (c) => {
       try {
         registerAdminSSE(sseEntry);
         if (sseConvId) {
-          const streamLogPath = resolve9(account.accountDir, "logs", `claude-agent-stream-${sseConvId}.log`);
+          const streamLogPath = resolve8(account.accountDir, "logs", `claude-agent-stream-${sseConvId}.log`);
           tailer = startScriptStreamTailer({
             path: streamLogPath,
             onEvent: (event) => {
@@ -7912,7 +7818,7 @@ var compact_default = app12;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync13, readdirSync as readdirSync5, readFileSync as readFileSync11, statSync as statSync6 } from "fs";
-import { resolve as resolve10, basename as basename3 } from "path";
+import { resolve as resolve9, basename as basename2 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync12 } from "fs";
@@ -7956,15 +7862,15 @@ app13.get("/", async (c) => {
   const sessionKeyParam = c.req.query("sessionKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve10(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve9(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename3(fileParam);
+    const safe = basename2(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve10(dir, safe);
+      const filePath = resolve9(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync11(filePath);
@@ -8051,7 +7957,7 @@ app13.get("/", async (c) => {
       const hit = hits[0];
       console.info(`[admin/logs] resolved sessionKey=${sessionKeySlice} conversationId=${conversationIdSlice} shape=${hit.shape} stalePreflushCount=${stalePreflushCount}`);
       try {
-        const filename = basename3(hit.path);
+        const filename = basename2(hit.path);
         if (stalePreflushCount > 0 && !download) {
           const content = readFileSync11(hit.path, "utf-8");
           return c.json({
@@ -8104,10 +8010,10 @@ app13.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync6(resolve10(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync6(resolve9(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync11(resolve10(dir, name));
+        const content = readFileSync11(resolve9(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -8145,9 +8051,9 @@ app14.get("/", (c) => {
 var claude_info_default = app14;
 
 // server/routes/admin/attachment.ts
-import { readFile as readFile3, readdir } from "fs/promises";
+import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync14 } from "fs";
-import { resolve as resolve11 } from "path";
+import { resolve as resolve10 } from "path";
 var app15 = new Hono();
 app15.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -8159,17 +8065,17 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve11(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve10(ATTACHMENTS_ROOT, accountId, attachmentId);
   if (!existsSync14(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve11(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve10(dir, `${attachmentId}.meta.json`);
   if (!existsSync14(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile3(metaPath, "utf-8"));
+    meta = JSON.parse(await readFile2(metaPath, "utf-8"));
   } catch {
     return new Response("Not found", { status: 404 });
   }
@@ -8178,8 +8084,8 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve11(dir, dataFile);
-  const buffer = await readFile3(filePath);
+  const filePath = resolve10(dir, dataFile);
+  const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": meta.mimeType,
@@ -8191,13 +8097,13 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app15;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve12 } from "path";
+import { resolve as resolve11 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync12, existsSync as existsSync15, rmSync } from "fs";
 var app16 = new Hono();
 app16.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve12(account.accountDir, "agents");
+  const agentsDir = resolve11(account.accountDir, "agents");
   if (!existsSync15(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -8205,7 +8111,7 @@ app16.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve12(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve11(agentsDir, entry.name, "config.json");
       if (!existsSync15(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
@@ -8234,7 +8140,7 @@ app16.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve12(account.accountDir, "agents", slug);
+  const agentDir = resolve11(account.accountDir, "agents", slug);
   if (!existsSync15(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -8264,7 +8170,7 @@ app16.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve12(account.accountDir, "agents", slug);
+  const agentDir = resolve11(account.accountDir, "agents", slug);
   if (!existsSync15(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -8281,7 +8187,7 @@ var agents_default = app16;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { appendFileSync as appendFileSync4, existsSync as existsSync16 } from "fs";
+import { appendFileSync as appendFileSync4, existsSync as existsSync17 } from "fs";
 
 // app/lib/synthetic-marker.ts
 var CLOUDFLARE_MARKER_PREFIX = "Cloudflare setup completed (actionId: ";
@@ -8292,7 +8198,135 @@ function isSyntheticUserMarker(content) {
   return content.startsWith(COMPONENT_DONE_PREFIX) || content.startsWith(LIFECYCLE_PREFIX) || content.startsWith(CLOUDFLARE_MARKER_PREFIX);
 }
 
+// app/lib/claude-agent/jsonl-replay.ts
+import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
+function replayJsonl(jsonlPath) {
+  if (!existsSync16(jsonlPath)) {
+    return { messages: [], jsonlMissing: true, malformedLines: 0 };
+  }
+  let raw;
+  try {
+    raw = readFileSync13(jsonlPath, "utf8");
+  } catch {
+    return { messages: [], jsonlMissing: true, malformedLines: 0 };
+  }
+  const lines = raw.split("\n");
+  const messages = [];
+  let malformedLines = 0;
+  let pendingText = "";
+  let pendingComponents = [];
+  let pendingMessageId;
+  let pendingCreatedAt;
+  const flushAssistant = () => {
+    if (!pendingMessageId) return;
+    if (pendingText.length === 0 && pendingComponents.length === 0) {
+      pendingMessageId = void 0;
+      pendingCreatedAt = void 0;
+      return;
+    }
+    messages.push({
+      messageId: pendingMessageId,
+      role: "assistant",
+      content: pendingText,
+      createdAt: pendingCreatedAt ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      components: pendingComponents,
+      attachments: []
+    });
+    pendingText = "";
+    pendingComponents = [];
+    pendingMessageId = void 0;
+    pendingCreatedAt = void 0;
+  };
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let entry;
+    try {
+      entry = JSON.parse(line);
+    } catch {
+      malformedLines += 1;
+      continue;
+    }
+    if (entry.type === "user") {
+      const content = entry.message?.content;
+      if (typeof content === "string" && content.length > 0) {
+        flushAssistant();
+        messages.push({
+          messageId: entry.uuid ?? `jsonl-user-${messages.length}`,
+          role: "user",
+          content,
+          createdAt: entry.timestamp ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+          components: [],
+          attachments: []
+        });
+      }
+      continue;
+    }
+    if (entry.type === "assistant" && Array.isArray(entry.message?.content)) {
+      if (!pendingMessageId) {
+        pendingMessageId = entry.uuid ?? `jsonl-asst-${messages.length}`;
+        pendingCreatedAt = entry.timestamp;
+      }
+      for (const block of entry.message.content) {
+        if (block.type === "text" && typeof block.text === "string" && block.text.length > 0) {
+          pendingText = pendingText.length > 0 ? `${pendingText}
+
+${block.text}` : block.text;
+        } else if (block.type === "tool_use" && block.name === "mcp__admin__render-component") {
+          const rawInput = block.input ?? {};
+          const rawName = rawInput.name;
+          const rawData = rawInput.data;
+          const componentName = typeof rawName === "string" && rawName.length > 0 ? rawName : "unknown";
+          let dataObj = {};
+          if (rawData !== null && typeof rawData === "object" && !Array.isArray(rawData)) {
+            dataObj = rawData;
+          } else if (typeof rawData === "string") {
+            try {
+              dataObj = JSON.parse(rawData);
+            } catch {
+            }
+          }
+          let healArtefactAttachmentId;
+          let healArtefactMimeType;
+          let healArtefactTitle;
+          if (isPersistentComponent(componentName) && block.id) {
+            const mimeType = deriveComponentMimeType(dataObj);
+            if (mimeType) {
+              healArtefactAttachmentId = deriveComponentAttachmentId(block.id);
+              healArtefactMimeType = mimeType;
+              healArtefactTitle = deriveComponentTitle(componentName, dataObj);
+            }
+          }
+          pendingComponents.push({
+            componentId: block.id ?? `jsonl-comp-${pendingComponents.length}`,
+            name: componentName,
+            data: JSON.stringify(dataObj),
+            ordinal: pendingComponents.length,
+            textOffset: pendingText.length,
+            // Submitted state is a Neo4j projection — JSONL has no notion of
+            // it. The resume route supplements `submitted: true` from the
+            // matching :Component row when present.
+            submitted: false,
+            ...healArtefactAttachmentId ? {
+              artefactAttachmentId: healArtefactAttachmentId,
+              artefactMimeType: healArtefactMimeType,
+              artefactTitle: healArtefactTitle
+            } : {}
+          });
+        }
+      }
+      continue;
+    }
+  }
+  flushAssistant();
+  return { messages, jsonlMissing: false, malformedLines };
+}
+function resolveJsonlPath(homeDir, accountDir, agentSessionId) {
+  const projectKey = "-" + accountDir.split("/").filter(Boolean).join("-");
+  return `${homeDir}/.claude/projects/${projectKey}/${agentSessionId}.jsonl`;
+}
+
 // server/routes/admin/sessions.ts
+import { homedir } from "os";
 function validateAndShapeAttachments(raws, conversationAccountId, conversationId, messageId, streamLogPath) {
   const chips = [];
   let valid = 0;
@@ -8301,7 +8335,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, conversationId
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync16(a.storagePath)) reason = "missing-file";
+    else if (!existsSync17(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -8550,15 +8584,150 @@ app17.post("/:id/resume", async (c) => {
   if (persistedAgentSessionId) {
     setAgentSessionId(sessionKey, persistedAgentSessionId);
   }
+  const streamLogPath = resolvePath(ACCOUNTS_DIR, accountId, "logs", `claude-agent-stream-${conversationId}.log`);
+  const tag = persistedAgentSessionId ? `agentSessionId=${persistedAgentSessionId.slice(0, 8)}\u2026` : "agentSessionId=missing";
   let messages = [];
+  let neo4jMessages = [];
+  let jsonlReplayMessages = [];
+  let jsonlMissing = false;
+  let jsonlMalformedLines = 0;
+  let jsonlHealMissing = 0;
+  let jsonlHealOk = 0;
+  let jsonlHealFail = 0;
   try {
-    messages = await getRecentMessages(conversationId);
+    neo4jMessages = await getRecentMessages(conversationId);
   } catch (err) {
     console.error(`[admin-resume] ${(/* @__PURE__ */ new Date()).toISOString()} getRecentMessages failed: conversationId=${conversationId.slice(0, 8)}\u2026 error=${err instanceof Error ? err.message : String(err)}`);
     return c.json({ error: "Failed to load conversation messages" }, 500);
   }
-  const streamLogPath = resolvePath(ACCOUNTS_DIR, accountId, "logs", `claude-agent-stream-${conversationId}.log`);
-  const tag = persistedAgentSessionId ? `agentSessionId=${persistedAgentSessionId.slice(0, 8)}\u2026` : "agentSessionId=missing";
+  if (persistedAgentSessionId) {
+    const jsonlPath = resolveJsonlPath(homedir(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
+    const replay = replayJsonl(jsonlPath);
+    jsonlMissing = replay.jsonlMissing;
+    jsonlMalformedLines = replay.malformedLines;
+    jsonlReplayMessages = replay.messages;
+  } else {
+    jsonlMissing = true;
+  }
+  if (jsonlMissing || jsonlReplayMessages.length === 0) {
+    messages = neo4jMessages;
+  } else {
+    const neo4jByKey = /* @__PURE__ */ new Map();
+    for (const n of neo4jMessages) {
+      neo4jByKey.set(`${n.role}${n.content}`, n);
+    }
+    const healQueue = [];
+    messages = jsonlReplayMessages.map((j) => {
+      const match = neo4jByKey.get(`${j.role}${j.content}`);
+      if (match) {
+        const mergedComponents = j.components.map((c2, i) => {
+          const neoComp = match.components?.[i];
+          return {
+            componentId: neoComp?.componentId ?? c2.componentId,
+            name: c2.name,
+            data: c2.data,
+            ordinal: c2.ordinal,
+            textOffset: c2.textOffset,
+            submitted: neoComp?.submitted ?? false
+          };
+        });
+        return {
+          messageId: match.messageId,
+          role: match.role,
+          content: match.content,
+          createdAt: match.createdAt,
+          components: mergedComponents,
+          attachments: match.attachments ?? []
+        };
+      }
+      healQueue.push({ role: j.role, content: j.content, createdAt: j.createdAt, components: j.components });
+      return {
+        messageId: j.messageId,
+        role: j.role,
+        content: j.content,
+        createdAt: j.createdAt,
+        components: j.components.map((c2) => ({
+          componentId: c2.componentId,
+          name: c2.name,
+          data: c2.data,
+          ordinal: c2.ordinal,
+          textOffset: c2.textOffset,
+          submitted: false
+        })),
+        attachments: []
+      };
+    });
+    jsonlHealMissing = healQueue.length;
+    if (healQueue.length > 0) {
+      void (async () => {
+        for (let i = 0; i < healQueue.length; i++) {
+          const q = healQueue[i];
+          try {
+            const healComponents = await Promise.all(q.components.map(async (c2) => {
+              const base = {
+                componentId: c2.componentId,
+                name: c2.name,
+                data: c2.data,
+                ordinal: c2.ordinal,
+                textOffset: c2.textOffset
+              };
+              if (!c2.artefactAttachmentId || !c2.artefactMimeType || !c2.artefactTitle) return base;
+              try {
+                const dataObj = JSON.parse(c2.data);
+                const bytesPick = pickComponentBytes(dataObj);
+                if (!bytesPick) return base;
+                const filename = bytesPick.mimeType === "text/html" ? `${c2.artefactTitle}.html` : `${c2.artefactTitle}.md`;
+                await storeComponentArtefact(accountId, c2.artefactAttachmentId, bytesPick.mimeType, bytesPick.content, filename);
+                appendFileSync4(
+                  streamLogPath,
+                  `[${(/* @__PURE__ */ new Date()).toISOString()}] [render-component-persist] heal componentName=${c2.name} attachmentId=${c2.artefactAttachmentId.slice(0, 8)} mimeType=${bytesPick.mimeType} bytes=${bytesPick.content.length} outcome=ok
+`
+                );
+                return {
+                  ...base,
+                  artefactAttachmentId: c2.artefactAttachmentId,
+                  artefactMimeType: c2.artefactMimeType,
+                  artefactTitle: c2.artefactTitle
+                };
+              } catch (writeErr) {
+                const reason2 = writeErr instanceof Error ? writeErr.message : String(writeErr);
+                appendFileSync4(
+                  streamLogPath,
+                  `[${(/* @__PURE__ */ new Date()).toISOString()}] [render-component-persist] heal componentName=${c2.name} attachmentId=${c2.artefactAttachmentId.slice(0, 8)} outcome=disk-fail reason=${JSON.stringify(reason2.slice(0, 200))}
+`
+                );
+                return base;
+              }
+            }));
+            const messageId = await persistMessage(
+              conversationId,
+              q.role,
+              q.content,
+              accountId,
+              void 0,
+              q.createdAt,
+              void 0,
+              healComponents,
+              void 0
+            );
+            jsonlHealOk += 1;
+            try {
+              appendFileSync4(streamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${conversationId.slice(0, 8)} turnIndex=${i} role=${q.role} outcome=ok messageId=${(messageId ?? "").slice(0, 8)}
+`);
+            } catch {
+            }
+          } catch (err) {
+            jsonlHealFail += 1;
+            try {
+              appendFileSync4(streamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-persist-heal] convId=${conversationId.slice(0, 8)} turnIndex=${i} role=${q.role} outcome=fail reason=${JSON.stringify((err instanceof Error ? err.message : String(err)).slice(0, 200))}
+`);
+            } catch {
+            }
+          }
+        }
+      })();
+    }
+  }
   let totalValid = 0;
   let totalInvalid = 0;
   let totalComponents = 0;
@@ -8600,7 +8769,8 @@ app17.post("/:id/resume", async (c) => {
   const userMessageCount = rehydrated.filter((m) => m.role !== "assistant").length;
   const reason = bridged ? "post-restart" : "page-refresh";
   try {
-    appendFileSync4(streamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-resume] reason=${reason} sessionKey=${sessionKey.slice(0, 8)} conversationId=${conversationId.slice(0, 8)} ${tag} loadedMessages=${messages.length} componentCount=${totalComponents} userAttachmentCount=${totalAttachments} syntheticHidden=${syntheticHidden}
+    const source = jsonlMissing ? persistedAgentSessionId ? "jsonl-missing" : "neo4j-only" : "jsonl";
+    appendFileSync4(streamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-resume] reason=${reason} source=${source} sessionKey=${sessionKey.slice(0, 8)} conversationId=${conversationId.slice(0, 8)} ${tag} loadedMessages=${messages.length} jsonlReplayMessages=${jsonlReplayMessages.length} neo4jMessages=${neo4jMessages.length} jsonlMalformed=${jsonlMalformedLines} componentCount=${totalComponents} userAttachmentCount=${totalAttachments} syntheticHidden=${syntheticHidden}
 `);
     if (totalComponents > 0) {
       appendFileSync4(streamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [component-rehydrate] conversationId=${conversationId.slice(0, 8)} count=${totalComponents} valid=${totalValid} invalid=${totalInvalid} textRuns=${textRuns}
@@ -8608,13 +8778,27 @@ app17.post("/:id/resume", async (c) => {
     }
     if (totalAttachments > 0 || totalAttachmentInvalid > 0) {
       appendFileSync4(streamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [attachment-rehydrate] conversationId=${conversationId.slice(0, 8)} userMessages=${userMessageCount} attachments=${totalAttachments} invalid=${totalAttachmentInvalid}
+`);
+    }
+    if (jsonlHealMissing > 0) {
+      appendFileSync4(streamLogPath, `[${(/* @__PURE__ */ new Date()).toISOString()}] [admin-resume-heal] conversationId=${conversationId.slice(0, 8)} missingTurns=${jsonlHealMissing} healOk=${jsonlHealOk} healFail=${jsonlHealFail} note=async-writes-may-still-be-in-flight
 `);
     }
   } catch {
   }
   const age = formatAge(updatedAt);
-  console.log(`[admin-resume] ${(/* @__PURE__ */ new Date()).toISOString()} reason=${reason} conversationId=${conversationId.slice(0, 8)}\u2026 age=${age} loaded=${messages.length} messages ${tag} components=${totalComponents} attachments=${totalAttachments} syntheticHidden=${syntheticHidden} sessionKey=${sessionKey.slice(0, 8)}\u2026`);
-  return c.json({ conversationId, messages: rehydrated });
+  console.log(`[admin-resume] ${(/* @__PURE__ */ new Date()).toISOString()} reason=${reason} conversationId=${conversationId.slice(0, 8)}\u2026 age=${age} loaded=${messages.length} messages ${tag} components=${totalComponents} attachments=${totalAttachments} syntheticHidden=${syntheticHidden} jsonlMissing=${jsonlMissing} healMissing=${jsonlHealMissing} sessionKey=${sessionKey.slice(0, 8)}\u2026`);
+  return c.json({
+    conversationId,
+    messages: rehydrated,
+    resumeHeal: {
+      missingTurns: jsonlHealMissing,
+      healed: jsonlHealOk,
+      failed: jsonlHealFail,
+      jsonlMissing,
+      jsonlMalformedLines
+    }
+  });
 });
 app17.post("/:id/label", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
@@ -8870,9 +9054,9 @@ app20.post("/", async (c) => {
 var events_default = app20;
 
 // server/routes/admin/cloudflare.ts
-import { homedir } from "os";
-import { resolve as resolve14 } from "path";
-import { readFileSync as readFileSync14 } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve13 } from "path";
+import { readFileSync as readFileSync15 } from "fs";
 
 // app/lib/dns-label.ts
 var VALID_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
@@ -8888,14 +9072,14 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync18, mkdirSync as mkdirSync6, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
 import { dirname as dirname5 } from "path";
-import { resolve as resolve13 } from "path";
-var ALIAS_DOMAINS_PATH = resolve13(MAXY_DIR, "alias-domains.json");
+import { resolve as resolve12 } from "path";
+var ALIAS_DOMAINS_PATH = resolve12(MAXY_DIR, "alias-domains.json");
 function readExisting() {
-  if (!existsSync17(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
+  if (!existsSync18(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync13(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync14(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) return /* @__PURE__ */ new Set();
     return new Set(parsed.filter((h) => typeof h === "string"));
   } catch {
@@ -8919,10 +9103,10 @@ var CLOUDFLARE_SETUP_FORM_SCHEMA = {
 var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
 var DOMAINS_TIMEOUT_MS = 40 * 1e3;
 function loadBrandInfo() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
-  const brandPath = resolve14(platformRoot2, "config", "brand.json");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "..");
+  const brandPath = resolve13(platformRoot2, "config", "brand.json");
   try {
-    const parsed = JSON.parse(readFileSync14(brandPath, "utf-8"));
+    const parsed = JSON.parse(readFileSync15(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
     const configDir2 = typeof parsed.configDir === "string" && parsed.configDir ? parsed.configDir : ".maxy";
     return { hostname: hostname2, configDir: configDir2 };
@@ -8990,6 +9174,10 @@ function fieldFromReason(reason) {
   switch (reason) {
     case "not-signed-in":
       return "dashboard";
+    case "brand-arg-missing":
+    case "brand-config-missing":
+    case "cdp-port-unresolved":
+      return "config";
     case "cdp-unreachable":
     case "target-create-failed":
     case "ws-connect-failed":
@@ -9018,7 +9206,7 @@ app21.get("/domains", requireAdminSession, async (c) => {
   function logErr(line) {
     console.error(`[cloudflare-domains] ${line}${tag()}`);
   }
-  function err(field, message, output) {
+  function err(field, message, output, brand2) {
     logErr(`phase=error field=${field} reason="${message.slice(0, 160).replace(/"/g, "'")}"`);
     if (streamLogPath) {
       writeRouteMilestone(
@@ -9033,7 +9221,8 @@ app21.get("/domains", requireAdminSession, async (c) => {
       message,
       output,
       correlationId,
-      streamLogPath
+      streamLogPath,
+      brand: brand2
     };
     return c.json(body, 200);
   }
@@ -9045,7 +9234,7 @@ app21.get("/domains", requireAdminSession, async (c) => {
   streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
   log(`phase=stream-log-resolved path=${streamLogPath}`);
   const brand = loadBrandInfo();
-  const scriptPath = resolve14(homedir(), "list-cf-domains.sh");
+  const scriptPath = resolve13(homedir2(), "list-cf-domains.sh");
   const result = await runFormSpawn({
     scriptPath,
     args: [brand.hostname],
@@ -9064,7 +9253,7 @@ ${result.stderr}` : ""}`;
     const reason = reasonMatch ? reasonMatch[1] : void 0;
     const field = fieldFromReason(reason);
     const message = reason ? `Domain discovery failed: ${reason}` : result.timedOut ? `Domain discovery timed out after ${DOMAINS_TIMEOUT_MS / 1e3}s` : `Domain discovery exited with code ${result.code ?? "null"}${result.signal ? ` (signal ${result.signal})` : ""}`;
-    return err(field, message, combined);
+    return err(field, message, combined, field === "config" ? brand.hostname : void 0);
   }
   let domains;
   try {
@@ -9135,9 +9324,9 @@ app21.get("/tunnels", requireAdminSession, async (c) => {
   if (!accountId) return err("session", "No account bound to session \u2014 refresh chat.");
   if (!correlationId) return err("session", "No active conversation for session \u2014 refresh chat.");
   streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
-  const certPath = resolve14(homedir(), brand.configDir, "cloudflared", "cert.pem");
-  const { existsSync: existsSync24 } = await import("fs");
-  if (!existsSync24(certPath)) {
+  const certPath = resolve13(homedir2(), brand.configDir, "cloudflared", "cert.pem");
+  const { existsSync: existsSync25 } = await import("fs");
+  if (!existsSync25(certPath)) {
     return err("cert", `Cloudflare origin certificate is not on disk yet (${certPath}). Complete the Cloudflare login first by submitting the form once \u2014 the OAuth flow writes cert.pem.`);
   }
   const result = await runFormSpawn({
@@ -9425,22 +9614,22 @@ var cloudflare_default = app21;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream3 } from "fs";
-import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
-import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname6, join as join10, resolve as resolve16, sep as sep2 } from "path";
+import { readdir as readdir2, readFile as readFile3, stat as stat3, mkdir as mkdir2, writeFile as writeFile3, unlink as unlink2 } from "fs/promises";
+import { realpathSync as realpathSync3 } from "fs";
+import { basename as basename3, dirname as dirname6, join as join10, resolve as resolve15, sep as sep2 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
-import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve15, normalize, sep, relative } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "../platform");
-var DATA_ROOT = resolve15(PLATFORM_ROOT6, "..", "data");
+import { realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve14, normalize, sep, relative } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "../platform");
+var DATA_ROOT = resolve14(PLATFORM_ROOT5, "..", "data");
 function resolveDataPath(raw) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve15(DATA_ROOT, cleaned);
+  const absolute = resolve14(DATA_ROOT, cleaned);
   let dataRootReal;
   try {
-    dataRootReal = realpathSync3(DATA_ROOT);
+    dataRootReal = realpathSync2(DATA_ROOT);
   } catch (err) {
     return {
       ok: false,
@@ -9450,7 +9639,7 @@ function resolveDataPath(raw) {
   }
   let resolvedReal;
   try {
-    resolvedReal = realpathSync3(absolute);
+    resolvedReal = realpathSync2(absolute);
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
@@ -9785,7 +9974,7 @@ async function cascadeDeleteDocument(params) {
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join10(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile3(join10(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -9796,7 +9985,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve16(DATA_ROOT, "accounts");
+  const accountsDir = resolve15(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir2(accountsDir);
@@ -9805,9 +9994,9 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE4.test(name)) continue;
-    const configPath2 = resolve16(accountsDir, name, "account.json");
+    const configPath2 = resolve15(accountsDir, name, "account.json");
     try {
-      const raw = await readFile4(configPath2, "utf8");
+      const raw = await readFile3(configPath2, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed?.name === "string" && parsed.name.length > 0) {
         map.set(name, parsed.name);
@@ -9871,7 +10060,7 @@ app22.get("/", requireAdminSession, async (c) => {
   }
   const { absolute, relative: relPath2 } = resolution;
   try {
-    const info = await stat4(absolute);
+    const info = await stat3(absolute);
     if (!info.isDirectory()) {
       return c.json({ error: "Path is not a directory \u2014 use /api/admin/files/download for files" }, 400);
     }
@@ -9883,7 +10072,7 @@ app22.get("/", requireAdminSession, async (c) => {
       }
       try {
         const entryPath = join10(absolute, name);
-        const s = await stat4(entryPath);
+        const s = await stat3(entryPath);
         entries.push({
           name,
           kind: s.isDirectory() ? "directory" : s.isFile() ? "file" : "other",
@@ -9933,11 +10122,11 @@ app22.get("/download", requireAdminSession, async (c) => {
   }
   const { absolute, relative: relPath2 } = resolution;
   try {
-    const info = await stat4(absolute);
+    const info = await stat3(absolute);
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename4(absolute);
+    const filename = basename3(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream3(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -9994,20 +10183,20 @@ app22.post("/upload", requireAdminSession, async (c) => {
       error: `Unsupported file type: "${file.type}". Supported: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
     }, 422);
   }
-  const safeName = basename4(file.name).replace(/[\0/\\]/g, "_");
+  const safeName = basename3(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve16(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve16(destDir, finalName);
+  const destDir = resolve15(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve15(destDir, finalName);
   try {
-    await mkdir3(destDir, { recursive: true });
-    const dataRootReal = realpathSync4(DATA_ROOT);
-    const destDirReal = realpathSync4(destDir);
+    await mkdir2(destDir, { recursive: true });
+    const dataRootReal = realpathSync3(DATA_ROOT);
+    const destDirReal = realpathSync3(destDir);
     if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep2)) {
       console.error(`[data] path-traversal-blocked requested="uploads/${accountId}" resolved="${destDirReal}"`);
       return c.json({ error: "Upload destination escapes DATA_ROOT" }, 403);
     }
     const buffer = Buffer.from(await file.arrayBuffer());
-    await writeFile4(destPath, buffer);
+    await writeFile3(destPath, buffer);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[data] file-upload error filename="${safeName}" err="${message}"`);
@@ -10039,14 +10228,14 @@ app22.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: resolution.error }, resolution.status);
   }
   const { absolute, relative: relPath2 } = resolution;
-  const base = basename4(absolute);
+  const base = basename3(absolute);
   const segments = relPath2.split("/").filter(Boolean);
   if (base === "account.json" || segments.includes(".git")) {
     console.error(`[data] file-delete blocked path="${relPath2}" reason="protected"`);
     return c.json({ error: "Protected file \u2014 refusing to delete" }, 403);
   }
   try {
-    const info = await stat4(absolute);
+    const info = await stat3(absolute);
     if (info.isDirectory()) {
       return c.json({ error: "Directory deletion not supported" }, 400);
     }
@@ -11675,9 +11864,9 @@ var adherence_default = app30;
 
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j3 from "neo4j-driver";
-import { readFile as readFile5, readdir as readdir3, stat as stat5 } from "fs/promises";
-import { resolve as resolve17, relative as relative2, isAbsolute } from "path";
-import { existsSync as existsSync18 } from "fs";
+import { readFile as readFile4, readdir as readdir3, stat as stat4 } from "fs/promises";
+import { resolve as resolve16, relative as relative2, isAbsolute } from "path";
+import { existsSync as existsSync19 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -11693,7 +11882,7 @@ app31.get("/", requireAdminSession, async (c) => {
   if (docs === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve17(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve16(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...docs, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -11756,8 +11945,8 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
     logSkip(displayName, "non-text-mime", mimeType);
     return { content: "", skipReason: "non-text-mime" };
   }
-  const accountDir = resolve17(ATTACHMENTS_ROOT, accountId);
-  const dir = resolve17(accountDir, attachmentId);
+  const accountDir = resolve16(ATTACHMENTS_ROOT, accountId);
+  const dir = resolve16(accountDir, attachmentId);
   try {
     validateFilePathInAccount(dir, accountDir);
   } catch {
@@ -11771,7 +11960,7 @@ async function readArtefactContent(accountId, attachmentId, mimeType, displayNam
       logSkip(displayName, "missing-on-disk", mimeType);
       return { content: "", skipReason: "missing-on-disk" };
     }
-    return { content: await readFile5(resolve17(dir, dataFile), "utf-8"), skipReason: null };
+    return { content: await readFile4(resolve16(dir, dataFile), "utf-8"), skipReason: null };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(`[admin/sidebar-artefacts] read-failed attachmentId=${attachmentId.slice(0, 8)} error="${message}"`);
@@ -11787,8 +11976,8 @@ function logSkip(name, reason, mimeType) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve17(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve17(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve16(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve16(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -11802,12 +11991,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve17(accountDir, "specialists", "agents");
-  const bundledDir = resolve17(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve16(accountDir, "specialists", "agents");
+  const bundledDir = resolve16(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve17(overrideDir, filename);
-    const bundledPath = resolve17(bundledDir, filename);
+    const overridePath = resolve16(overrideDir, filename);
+    const bundledPath = resolve16(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -11825,7 +12014,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync18(dir)) continue;
+    if (!existsSync19(dir)) continue;
     try {
       const entries = await readdir3(dir);
       for (const entry of entries) {
@@ -11840,7 +12029,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync18(inp.overridePath)) {
+  if (existsSync19(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -11851,7 +12040,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync18(inp.bundledPath)) {
+  } else if (existsSync19(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -11863,8 +12052,8 @@ async function readAgentTemplateRow(inp) {
   if (!chosenPath) return null;
   try {
     const [content, st] = await Promise.all([
-      readFile5(chosenPath, "utf-8"),
-      stat5(chosenPath)
+      readFile4(chosenPath, "utf-8"),
+      stat4(chosenPath)
     ]);
     return {
       id: inp.id,
@@ -11891,9 +12080,9 @@ function isWithin(target, root) {
 var sidebar_artefacts_default = app31;
 
 // server/routes/admin/sidebar-artefact-save.ts
-import { mkdir as mkdir4, readdir as readdir4, stat as stat6, writeFile as writeFile5 } from "fs/promises";
-import { resolve as resolve18 } from "path";
-import { existsSync as existsSync19 } from "fs";
+import { mkdir as mkdir3, readdir as readdir4, stat as stat5, writeFile as writeFile4 } from "fs/promises";
+import { resolve as resolve17 } from "path";
+import { existsSync as existsSync20 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app32 = new Hono();
@@ -11905,7 +12094,7 @@ app32.post("/", requireAdminSession, async (c) => {
   if (!body || typeof body.id !== "string" || typeof body.content !== "string") {
     return c.json({ error: "id and content required" }, 400);
   }
-  const accountDir = resolve18(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve17(ACCOUNTS_DIR, accountId);
   const resolved = await resolveSavePath(body.id, accountId, accountDir);
   if (resolved.kind === "reject") {
     console.error(
@@ -11915,7 +12104,7 @@ app32.post("/", requireAdminSession, async (c) => {
   }
   const start = Date.now();
   try {
-    await writeFile5(resolved.path, body.content, "utf-8");
+    await writeFile4(resolved.path, body.content, "utf-8");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     console.error(
@@ -11925,7 +12114,7 @@ app32.post("/", requireAdminSession, async (c) => {
   }
   let updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    const st = await stat6(resolved.path);
+    const st = await stat5(resolved.path);
     updatedAt = st.mtime.toISOString();
   } catch {
   }
@@ -11946,22 +12135,22 @@ async function resolveSavePath(id, accountId, accountDir) {
     if (role !== "admin" || !ADMIN_AGENT_FILES2.has(filename)) {
       return { kind: "reject", status: 400, reason: "invalid-id" };
     }
-    const parent = resolve18(accountDir, "agents", "admin");
-    await mkdir4(parent, { recursive: true });
+    const parent = resolve17(accountDir, "agents", "admin");
+    await mkdir3(parent, { recursive: true });
     try {
       validateFilePathInAccount(parent, accountDir);
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
-    return { kind: "admin-template", path: resolve18(parent, filename) };
+    return { kind: "admin-template", path: resolve17(parent, filename) };
   }
   if (UUID_RE5.test(id)) {
-    const dir = resolve18(ATTACHMENTS_ROOT, accountId, id);
-    if (!existsSync19(dir)) {
+    const dir = resolve17(ATTACHMENTS_ROOT, accountId, id);
+    if (!existsSync20(dir)) {
       return { kind: "reject", status: 400, reason: "not-found" };
     }
     try {
-      validateFilePathInAccount(dir, resolve18(ATTACHMENTS_ROOT, accountId));
+      validateFilePathInAccount(dir, resolve17(ATTACHMENTS_ROOT, accountId));
     } catch {
       return { kind: "reject", status: 400, reason: "containment-rejected" };
     }
@@ -11970,7 +12159,7 @@ async function resolveSavePath(id, accountId, accountDir) {
     if (!dataFile) {
       return { kind: "reject", status: 400, reason: "not-found" };
     }
-    return { kind: "knowledge-doc", path: resolve18(dir, dataFile) };
+    return { kind: "knowledge-doc", path: resolve17(dir, dataFile) };
   }
   return { kind: "reject", status: 400, reason: "invalid-id" };
 }
@@ -11980,9 +12169,9 @@ function relPath(absPath, root) {
 var sidebar_artefact_save_default = app32;
 
 // server/routes/admin/sidebar-artefact-content.ts
-import { readFile as readFile6, readdir as readdir5 } from "fs/promises";
-import { existsSync as existsSync20 } from "fs";
-import { resolve as resolve19 } from "path";
+import { readFile as readFile5, readdir as readdir5 } from "fs/promises";
+import { existsSync as existsSync21 } from "fs";
+import { resolve as resolve18 } from "path";
 var UUID_RE6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var app33 = new Hono();
 app33.get("/", requireAdminSession, async (c) => {
@@ -11994,14 +12183,14 @@ app33.get("/", requireAdminSession, async (c) => {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve19(ATTACHMENTS_ROOT, accountId, id);
-  if (!existsSync20(dir)) {
+  const dir = resolve18(ATTACHMENTS_ROOT, accountId, id);
+  if (!existsSync21(dir)) {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile6(resolve19(dir, `${id}.meta.json`), "utf-8"));
+    meta = JSON.parse(await readFile5(resolve18(dir, `${id}.meta.json`), "utf-8"));
   } catch {
     console.error(`[admin/sidebar-artefact-content] not-found id=${id.slice(0, 8)}`);
     return new Response("Not found", { status: 404 });
@@ -12013,7 +12202,7 @@ app33.get("/", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const start = Date.now();
-  const buffer = await readFile6(resolve19(dir, dataFile));
+  const buffer = await readFile5(resolve18(dir, dataFile));
   const ms = Date.now() - start;
   console.log(
     `[admin/sidebar-artefact-content] account=${accountId} id=${id.slice(0, 8)} mime=${meta.mimeType} bytes=${buffer.length} ms=${ms}`
@@ -12029,24 +12218,24 @@ app33.get("/", requireAdminSession, async (c) => {
 var sidebar_artefact_content_default = app33;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync21, readFileSync as readFileSync15 } from "fs";
-import { resolve as resolve20, join as join11 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
+import { existsSync as existsSync22, readFileSync as readFileSync16 } from "fs";
+import { resolve as resolve19, join as join11 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join11(PLATFORM_ROOT7, "config", "brand.json");
-if (existsSync21(brandJsonPath)) {
+var brandJsonPath = join11(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync22(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync15(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync16(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve20(PLATFORM_ROOT7, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve19(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync21(VERSION_FILE)) return "unknown";
-  return readFileSync15(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync22(VERSION_FILE)) return "unknown";
+  return readFileSync16(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -12126,8 +12315,8 @@ app35.route("/health-brand", health_default2);
 var admin_default = app35;
 
 // server/routes/sites.ts
-import { existsSync as existsSync22, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
-import { resolve as resolve21 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync17, realpathSync as realpathSync4, statSync as statSync7 } from "fs";
+import { resolve as resolve20 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -12184,19 +12373,19 @@ app36.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve21(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve21(rootDir, ...segments);
+  const rootDir = resolve20(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve20(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat7;
+  let stat6;
   try {
-    stat7 = existsSync22(filePath) ? statSync7(filePath) : null;
+    stat6 = existsSync23(filePath) ? statSync7(filePath) : null;
   } catch {
-    stat7 = null;
+    stat6 = null;
   }
-  if (stat7?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat6?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -12204,22 +12393,22 @@ app36.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat7?.isDirectory()) {
-    filePath = resolve21(filePath, "index.html");
+  if (stat6?.isDirectory()) {
+    filePath = resolve20(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync22(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
   let realPath;
   let realRoot;
   try {
-    realPath = realpathSync5(filePath);
-    realRoot = realpathSync5(rootDir);
+    realPath = realpathSync4(filePath);
+    realRoot = realpathSync4(rootDir);
   } catch {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
@@ -12230,7 +12419,7 @@ app36.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync16(realPath);
+    body = readFileSync17(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -12361,15 +12550,15 @@ function clientFrom(c) {
     c.req.header("x-forwarded-for")
   );
 }
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join12(PLATFORM_ROOT8, "config", "brand.json") : "";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
+var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join12(PLATFORM_ROOT7, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", domain: "getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync18(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -12388,11 +12577,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH2 = join12(homedir2(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH2 = join12(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync23(ALIAS_DOMAINS_PATH2)) return null;
-    const parsed = JSON.parse(readFileSync17(ALIAS_DOMAINS_PATH2, "utf-8"));
+    if (!existsSync24(ALIAS_DOMAINS_PATH2)) return null;
+    const parsed = JSON.parse(readFileSync18(ALIAS_DOMAINS_PATH2, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -12732,20 +12921,20 @@ app37.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve22(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve22(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve21(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve21(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync17(filePath);
+  const body = readFileSync18(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -12762,20 +12951,20 @@ app37.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve22(account.accountDir, "generated", filename);
-  const expectedDir = resolve22(account.accountDir, "generated");
+  const filePath = resolve21(account.accountDir, "generated", filename);
+  const expectedDir = resolve21(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync17(filePath);
+  const body = readFileSync18(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -12785,9 +12974,9 @@ app37.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync17(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync18(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -12803,10 +12992,10 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 })}</script>`;
 function readInstalledVersion() {
   try {
-    if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join12(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync23(versionFile)) return "unknown";
-    const content = readFileSync17(versionFile, "utf-8").trim();
+    if (!PLATFORM_ROOT7) return "unknown";
+    const versionFile = join12(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync24(versionFile)) return "unknown";
+    const content = readFileSync18(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -12847,7 +13036,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync17(resolve22(process.cwd(), "public", file), "utf-8");
+    html = readFileSync18(resolve21(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -12863,26 +13052,26 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join12(homedir2(), BRAND.configDir);
+  const configDir2 = join12(homedir3(), BRAND.configDir);
   try {
     const accountJsonPath = join12(configDir2, "account.json");
-    if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
+    if (!existsSync24(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join12(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync23(cachePath)) return null;
-    return JSON.parse(readFileSync17(cachePath, "utf-8"));
+    if (!existsSync24(cachePath)) return null;
+    return JSON.parse(readFileSync18(cachePath, "utf-8"));
   } catch {
     return null;
   }
 }
 function resolveDefaultSlug() {
   try {
-    const configDir2 = join12(homedir2(), BRAND.configDir);
+    const configDir2 = join12(homedir3(), BRAND.configDir);
     const accountJsonPath = join12(configDir2, "account.json");
-    if (!existsSync23(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync17(accountJsonPath, "utf-8"));
+    if (!existsSync24(accountJsonPath)) return null;
+    const account = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -12955,7 +13144,7 @@ app37.use("/vnc-popout.html", logViewerFetch);
 app37.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync17(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync18(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -13061,8 +13250,8 @@ try {
 (async () => {
   try {
     let userId = "";
-    if (existsSync23(USERS_FILE)) {
-      const users = JSON.parse(readFileSync17(USERS_FILE, "utf-8").trim() || "[]");
+    if (existsSync24(USERS_FILE)) {
+      const users = JSON.parse(readFileSync18(USERS_FILE, "utf-8").trim() || "[]");
       userId = users[0]?.userId ?? "";
     }
     await backfillNullUserIdConversations(userId);
@@ -13072,8 +13261,8 @@ try {
 })();
 (async () => {
   try {
-    if (!existsSync23(USERS_FILE)) return;
-    const usersRaw = readFileSync17(USERS_FILE, "utf-8").trim();
+    if (!existsSync24(USERS_FILE)) return;
+    const usersRaw = readFileSync18(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
     const userId = users[0]?.userId;
@@ -13095,7 +13284,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename5(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename4(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 var bootAccountConfig = bootAccount?.config;
 var bootPublicAgent = bootAccount ? resolvePublicAgent(bootAccount.accountDir, { accountId: bootAccount.accountId })?.slug ?? null : null;
@@ -13112,7 +13301,7 @@ autoDeliverPremiumPlugins(bootEntitlement?.purchasedPlugins ?? void 0);
 (async () => {
   if (!bootAccount) return;
   try {
-    const { recoverRunningCloudflareTasks } = await import("./cloudflare-task-tracker-NQK7A2EQ.js");
+    const { recoverRunningCloudflareTasks } = await import("./cloudflare-task-tracker-LJ4SMK2D.js");
     const result = await recoverRunningCloudflareTasks(
       bootAccount.accountId,
       configDirForWhatsApp,
@@ -13162,7 +13351,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join12(__dirname, "..")),
+  platformRoot: resolve21(process.env.MAXY_PLATFORM_ROOT ?? join12(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     try {