@rubytech/create-realagent 1.0.858 → 1.0.859

package/payload/server/server.js

@@ -6,6 +6,7 @@ import {
   SUPPORTED_MIME_TYPES,
   assertSupportedMime,
   autoDeliverPremiumPlugins,
+  browserViewerLog,
   buildX11Env,
   callOauthLlm,
   canAccessAdmin,
@@ -25,6 +26,7 @@ import {
   ensureVnc,
   findMissingPlugins,
   hashPassword,
+  httpLog,
   invokeAgent,
   isActionActive,
   isPasswordValid,
@@ -62,7 +64,7 @@ import {
   vncLog,
   waitForExit,
   writeChromiumWrapper
-} from "./chunk-CNNPNADU.js";
+} from "./chunk-2Q2S52GB.js";
 import {
   ACCOUNTS_DIR,
   CDP_PORT,
@@ -107,7 +109,7 @@ import {
   unregisterSession,
   validateAgentSlug,
   validateSession
-} from "./chunk-FL3H3AQD.js";
+} from "./chunk-22LK7D5R.js";
 import {
   CLOUDFLARE_TASK_DIAGNOSTICS,
   appendCloudflareSteps,
@@ -7434,7 +7436,7 @@ var app11 = new Hono();
 app11.post("/cancel", requireAdminSession, async (c) => {
   const session_key = c.var.sessionKey;
   try {
-    const { interruptClient: interruptClient2 } = await import("./client-pool-WA5WGN7W.js");
+    const { interruptClient: interruptClient2 } = await import("./client-pool-3BCJTPPA.js");
     await interruptClient2(session_key);
     return c.json({ ok: true });
   } catch (err) {
@@ -8893,6 +8895,45 @@ app18.post("/launch", async (c) => {
 });
 var browser_default = app18;
 
+// server/routes/admin/browser-iframe.ts
+var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
+  "mount",
+  "unmount",
+  "rfb-connected",
+  "rfb-error",
+  "iframe-load"
+]);
+function asString(v, max = 500) {
+  if (typeof v !== "string") return void 0;
+  return v.length > max ? v.slice(0, max) : v;
+}
+function asNumber(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : void 0;
+}
+var app19 = new Hono();
+app19.post("/event", async (c) => {
+  let body = {};
+  try {
+    body = await c.req.json();
+  } catch {
+    browserViewerLog("invalid", { reason: "body-not-json" });
+    return c.body(null, 204);
+  }
+  const eventRaw = asString(body.event, 64);
+  const event = eventRaw && ALLOWED_EVENTS.has(eventRaw) ? eventRaw : "invalid";
+  browserViewerLog(event, {
+    brand: asString(body.brand, 64),
+    conversationId: asString(body.conversationId, 64),
+    session_key: asString(body.session_key, 128),
+    durationMs: asNumber(body.durationMs),
+    errorCode: asString(body.errorCode, 64),
+    message: asString(body.message, 200),
+    surface: asString(body.surface, 32)
+  });
+  return c.body(null, 204);
+});
+var browser_iframe_default = app19;
+
 // app/lib/cdp-client.ts
 var CDP_HOST = "127.0.0.1";
 var CDP_PORT2 = CDP_PORT;
@@ -8934,8 +8975,8 @@ async function cdpNavigateNewTab(url, opts = {}) {
 }
 
 // server/routes/admin/device-browser.ts
-var app19 = new Hono();
-app19.post("/navigate", async (c) => {
+var app20 = new Hono();
+app20.post("/navigate", async (c) => {
   const TAG19 = "[device-url:click]";
   let body;
   try {
@@ -9022,17 +9063,17 @@ app19.post("/navigate", async (c) => {
     targetId: outcome.targetId
   });
 });
-var device_browser_default = app19;
+var device_browser_default = app20;
 
 // server/routes/admin/events.ts
-var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
+var ALLOWED_EVENTS2 = /* @__PURE__ */ new Set([
   "device-url:render",
   "device-url:fallback-shown",
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app20 = new Hono();
-app20.post("/", async (c) => {
+var app21 = new Hono();
+app21.post("/", async (c) => {
   const TAG19 = "[admin:events]";
   let body;
   try {
@@ -9043,7 +9084,7 @@ app20.post("/", async (c) => {
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
-  if (!ALLOWED_EVENTS.has(event)) {
+  if (!ALLOWED_EVENTS2.has(event)) {
     console.error(`${TAG19} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
@@ -9063,7 +9104,7 @@ app20.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app20;
+var events_default = app21;
 
 // server/routes/admin/cloudflare.ts
 import { homedir as homedir2 } from "os";
@@ -9181,7 +9222,7 @@ function validateBody(body) {
   }
   return null;
 }
-var app21 = new Hono();
+var app22 = new Hono();
 function fieldFromReason(reason) {
   switch (reason) {
     case "not-signed-in":
@@ -9202,7 +9243,7 @@ function fieldFromReason(reason) {
       return "script";
   }
 }
-app21.get("/domains", requireAdminSession, async (c) => {
+app22.get("/domains", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
   let correlationId;
@@ -9297,7 +9338,7 @@ ${result.stderr}` : ""}`;
   return c.json(success, 200);
 });
 var TUNNELS_TIMEOUT_MS = 30 * 1e3;
-app21.get("/tunnels", requireAdminSession, async (c) => {
+app22.get("/tunnels", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
   let correlationId;
@@ -9385,7 +9426,7 @@ ${result.stderr}` : ""}`;
   const success = { ok: true, tunnels, defaultName, correlationId, streamLogPath };
   return c.json(success, 200);
 });
-app21.post("/setup", requireAdminSession, async (c) => {
+app22.post("/setup", requireAdminSession, async (c) => {
   const started = Date.now();
   const sessionKey = c.var.sessionKey;
   let correlationId;
@@ -9622,7 +9663,7 @@ actionId: ${actionId}`,
   };
   return ok(success);
 });
-var cloudflare_default = app21;
+var cloudflare_default = app22;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream3 } from "fs";
@@ -10055,8 +10096,8 @@ function buildDisplayPath(relPath2, accountNames) {
     return dn ? { name: seg, displayName: dn } : { name: seg };
   });
 }
-var app22 = new Hono();
-app22.get("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   if (!getAccountIdForSession(sessionKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files" reason="no account for session"`);
@@ -10117,7 +10158,7 @@ app22.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app22.get("/download", requireAdminSession, async (c) => {
+app23.get("/download", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   if (!getAccountIdForSession(sessionKey)) {
     console.error(`[data] auth-rejected endpoint="/api/admin/files/download" reason="no account for session"`);
@@ -10165,7 +10206,7 @@ app22.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app22.post("/upload", requireAdminSession, async (c) => {
+app23.post("/upload", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -10223,7 +10264,7 @@ app22.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app22.delete("/", requireAdminSession, async (c) => {
+app23.delete("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -10290,7 +10331,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app22;
+var files_default = app23;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -10622,8 +10663,8 @@ var DEFAULT_LIMIT = 20;
 var MAX_LIMIT = 2e3;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage", "WhatsAppMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -10733,7 +10774,7 @@ app23.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app23;
+var graph_search_default = app24;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j2 from "neo4j-driver";
@@ -10891,8 +10932,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "sessionKey"
 ]);
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
+var app25 = new Hono();
+app25.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11475,12 +11516,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app24;
+var graph_subgraph_default = app25;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash"];
-var app25 = new Hono();
-app25.post("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.post("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11551,11 +11592,11 @@ app25.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app25;
+var graph_delete_default = app26;
 
 // server/routes/admin/graph-restore.ts
-var app26 = new Hono();
-app26.post("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.post("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11619,11 +11660,11 @@ app26.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app26;
+var graph_restore_default = app27;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app27 = new Hono();
-app27.get("/", requireAdminSession, async (c) => {
+var app28 = new Hono();
+app28.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -11689,11 +11730,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app27;
+var graph_labels_in_graph_default = app28;
 
 // server/routes/admin/graph-default-view.ts
-var app28 = new Hono();
-app28.get("/", requireAdminSession, async (c) => {
+var app29 = new Hono();
+app29.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   const userId = getUserIdForSession(sessionKey);
@@ -11731,7 +11772,7 @@ app28.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app28.put("/", requireAdminSession, async (c) => {
+app29.put("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   const userId = getUserIdForSession(sessionKey);
@@ -11820,11 +11861,11 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app28;
+var graph_default_view_default = app29;
 
 // server/routes/admin/file-attach.ts
-var app29 = new Hono();
-app29.post("/", async (c) => {
+var app30 = new Hono();
+app30.post("/", async (c) => {
   try {
     const body = await c.req.json();
     const { filePath, accountId } = body;
@@ -11847,11 +11888,11 @@ app29.post("/", async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var file_attach_default = app29;
+var file_attach_default = app30;
 
 // server/routes/admin/adherence.ts
-var app30 = new Hono();
-app30.get("/", requireAdminSession, async (c) => {
+var app31 = new Hono();
+app31.get("/", requireAdminSession, async (c) => {
   const agent = c.req.query("agent") ?? "admin";
   const includeBlock = c.req.query("block") === "1";
   const account = resolveAccount();
@@ -11872,7 +11913,7 @@ app30.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to read adherence ledger", agent }, 500);
   }
 });
-var adherence_default = app30;
+var adherence_default = app31;
 
 // server/routes/admin/sidebar-artefacts.ts
 import neo4j3 from "neo4j-driver";
@@ -11882,8 +11923,8 @@ import { existsSync as existsSync19 } from "fs";
 var LIMIT = 50;
 var TEXT_MIME_PREFIXES = ["text/", "application/json", "application/markdown"];
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
-var app31 = new Hono();
-app31.get("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) {
@@ -12089,7 +12130,7 @@ function isWithin(target, root) {
   const rel = relative2(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app31;
+var sidebar_artefacts_default = app32;
 
 // server/routes/admin/sidebar-artefact-save.ts
 import { mkdir as mkdir3, readdir as readdir4, stat as stat5, writeFile as writeFile4 } from "fs/promises";
@@ -12097,8 +12138,8 @@ import { resolve as resolve17 } from "path";
 import { existsSync as existsSync20 } from "fs";
 var ADMIN_AGENT_FILES2 = /* @__PURE__ */ new Set(["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"]);
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app32 = new Hono();
-app32.post("/", requireAdminSession, async (c) => {
+var app33 = new Hono();
+app33.post("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -12178,15 +12219,15 @@ async function resolveSavePath(id, accountId, accountDir) {
 function relPath(absPath, root) {
   return absPath.startsWith(root) ? absPath.slice(root.length + 1) : absPath;
 }
-var sidebar_artefact_save_default = app32;
+var sidebar_artefact_save_default = app33;
 
 // server/routes/admin/sidebar-artefact-content.ts
 import { readFile as readFile5, readdir as readdir5 } from "fs/promises";
 import { existsSync as existsSync21 } from "fs";
 import { resolve as resolve18 } from "path";
 var UUID_RE6 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
-var app33 = new Hono();
-app33.get("/", requireAdminSession, async (c) => {
+var app34 = new Hono();
+app34.get("/", requireAdminSession, async (c) => {
   const sessionKey = c.var.sessionKey;
   const accountId = getAccountIdForSession(sessionKey);
   if (!accountId) return new Response("Unauthorized", { status: 401 });
@@ -12227,7 +12268,7 @@ app33.get("/", requireAdminSession, async (c) => {
     }
   });
 });
-var sidebar_artefact_content_default = app33;
+var sidebar_artefact_content_default = app34;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync22, readFileSync as readFileSync16 } from "fs";
@@ -12272,8 +12313,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app34 = new Hono();
-app34.get("/", async (c) => {
+var app35 = new Hono();
+app35.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -12295,36 +12336,37 @@ app34.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app34;
+var health_default2 = app35;
 
 // server/routes/admin/index.ts
-var app35 = new Hono();
-app35.route("/session", session_default2);
-app35.route("/chat", chat_default2);
-app35.route("/compact", compact_default);
-app35.route("/logs", logs_default);
-app35.route("/claude-info", claude_info_default);
-app35.route("/attachment", attachment_default);
-app35.route("/agents", agents_default);
-app35.route("/sessions", sessions_default);
-app35.route("/browser", browser_default);
-app35.route("/device-browser", device_browser_default);
-app35.route("/events", events_default);
-app35.route("/cloudflare", cloudflare_default);
-app35.route("/files", files_default);
-app35.route("/graph-search", graph_search_default);
-app35.route("/graph-subgraph", graph_subgraph_default);
-app35.route("/graph-delete", graph_delete_default);
-app35.route("/graph-restore", graph_restore_default);
-app35.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app35.route("/graph-default-view", graph_default_view_default);
-app35.route("/file-attach", file_attach_default);
-app35.route("/adherence", adherence_default);
-app35.route("/sidebar-artefacts", sidebar_artefacts_default);
-app35.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app35.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app35.route("/health-brand", health_default2);
-var admin_default = app35;
+var app36 = new Hono();
+app36.route("/session", session_default2);
+app36.route("/chat", chat_default2);
+app36.route("/compact", compact_default);
+app36.route("/logs", logs_default);
+app36.route("/claude-info", claude_info_default);
+app36.route("/attachment", attachment_default);
+app36.route("/agents", agents_default);
+app36.route("/sessions", sessions_default);
+app36.route("/browser", browser_default);
+app36.route("/browser-iframe", browser_iframe_default);
+app36.route("/device-browser", device_browser_default);
+app36.route("/events", events_default);
+app36.route("/cloudflare", cloudflare_default);
+app36.route("/files", files_default);
+app36.route("/graph-search", graph_search_default);
+app36.route("/graph-subgraph", graph_subgraph_default);
+app36.route("/graph-delete", graph_delete_default);
+app36.route("/graph-restore", graph_restore_default);
+app36.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app36.route("/graph-default-view", graph_default_view_default);
+app36.route("/file-attach", file_attach_default);
+app36.route("/adherence", adherence_default);
+app36.route("/sidebar-artefacts", sidebar_artefacts_default);
+app36.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app36.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app36.route("/health-brand", health_default2);
+var admin_default = app36;
 
 // server/routes/sites.ts
 import { existsSync as existsSync23, readFileSync as readFileSync17, realpathSync as realpathSync4, statSync as statSync7 } from "fs";
@@ -12359,8 +12401,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app36 = new Hono();
-app36.get("/:rel{.*}", (c) => {
+var app37 = new Hono();
+app37.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -12463,7 +12505,7 @@ app36.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app36;
+var sites_default = app37;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -12617,9 +12659,9 @@ watchFile(ALIAS_DOMAINS_PATH2, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app37 = new Hono();
-app37.use("*", clientIpMiddleware);
-app37.use("*", async (c, next) => {
+var app38 = new Hono();
+app38.use("*", clientIpMiddleware);
+app38.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -12628,6 +12670,25 @@ app37.use("*", async (c, next) => {
     c.req.path === "/vnc-viewer.html" ? "SAMEORIGIN" : "DENY"
   );
 });
+var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
+app38.use("*", async (c, next) => {
+  if (!HTTP_LOG_PATHS.has(c.req.path)) {
+    await next();
+    return;
+  }
+  const start = Date.now();
+  try {
+    await next();
+  } finally {
+    httpLog({
+      method: c.req.method,
+      path: c.req.path,
+      status: c.res?.status ?? 0,
+      ms: Date.now() - start,
+      brand: BRAND.productName
+    });
+  }
+});
 var PUBLIC_ALLOWED_PREFIXES = [
   "/api/session",
   "/api/chat",
@@ -12643,7 +12704,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -12683,7 +12744,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app37.post("/__remote-auth/login", async (c) => {
+app38.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -12727,7 +12788,7 @@ app37.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app37.get("/__remote-auth/logout", (c) => {
+app38.get("/__remote-auth/logout", (c) => {
   return new Response(null, {
     status: 302,
     headers: {
@@ -12737,7 +12798,7 @@ app37.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app37.post("/__remote-auth/change-password", async (c) => {
+app38.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -12787,13 +12848,13 @@ app37.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app37.get("/__remote-auth/setup", (c) => {
+app38.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app37.post("/__remote-auth/set-initial-password", async (c) => {
+app38.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -12829,10 +12890,10 @@ app37.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app37.get("/api/remote-auth/status", (c) => {
+app38.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app37.post("/api/remote-auth/set-password", async (c) => {
+app38.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -12862,9 +12923,9 @@ app37.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app37.route("/api/_client-error", client_error_default);
+app38.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app37.use("*", async (c, next) => {
+app38.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -12890,6 +12951,13 @@ app37.use("*", async (c, next) => {
     return;
   }
   const disambig = `remoteAddress="${rawRemote ?? ""}" xff="${rawXff ?? ""}" resolvedKind=${decision.client.kind}`;
+  if (path2 === "/api/admin/browser-iframe/event") {
+    browserViewerLog("auth-rejected", {
+      ip: clientIp,
+      reason: decision.reason,
+      brand: BRAND.productName
+    });
+  }
   if (decision.reason === "remote-unconfigured") {
     console.error(`[remote-auth] not configured, redirecting to setup ip=${clientIp} path=${path2} ${disambig}`);
     return c.redirect("/__remote-auth/setup");
@@ -12897,15 +12965,15 @@ app37.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app37.route("/api/health", health_default);
-app37.route("/api/session", session_default);
-app37.route("/api/chat", chat_default);
-app37.route("/api/group", group_default);
-app37.route("/api/access", access_default);
-app37.route("/api/telegram", telegram_default);
-app37.route("/api/whatsapp", whatsapp_default);
-app37.route("/api/onboarding", onboarding_default);
-app37.route("/api/admin", admin_default);
+app38.route("/api/health", health_default);
+app38.route("/api/session", session_default);
+app38.route("/api/chat", chat_default);
+app38.route("/api/group", group_default);
+app38.route("/api/access", access_default);
+app38.route("/api/telegram", telegram_default);
+app38.route("/api/whatsapp", whatsapp_default);
+app38.route("/api/onboarding", onboarding_default);
+app38.route("/api/admin", admin_default);
 var SAFE_SLUG_RE = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -12917,7 +12985,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app37.get("/agent-assets/:slug/:filename", (c) => {
+app38.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE.test(slug)) {
@@ -12952,7 +13020,7 @@ app37.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app37.get("/generated/:filename", (c) => {
+app38.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -12982,7 +13050,7 @@ app37.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app37.route("/sites", sites_default);
+app38.route("/sites", sites_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -13119,7 +13187,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app37.get("/", (c) => {
+app38.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13127,12 +13195,12 @@ app37.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app37.get("/public", (c) => {
+app38.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app37.get("/chat", (c) => {
+app38.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13151,9 +13219,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app37.use("/vnc-viewer.html", logViewerFetch);
-app37.use("/vnc-popout.html", logViewerFetch);
-app37.get("/vnc-popout.html", (c) => {
+app38.use("/vnc-viewer.html", logViewerFetch);
+app38.use("/vnc-popout.html", logViewerFetch);
+app38.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync18(resolve21(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -13166,7 +13234,7 @@ app37.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app37.post("/api/vnc/client-event", async (c) => {
+app38.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13187,20 +13255,20 @@ app37.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app37.get("/g/:slug", (c) => {
+app38.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app37.get("/graph", (c) => {
+app38.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app37.get("/data", (c) => {
+app38.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app37.get("/:slug", async (c, next) => {
+app38.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13210,15 +13278,15 @@ app37.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app37.get("/favicon.ico", (c) => {
+  app38.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app37.use("/*", serveStatic({ root: "./public" }));
+app38.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.MAXY_UI_INTERNAL_PORT ?? process.env.PORT ?? "19199", 10);
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app37.fetch, port, hostname });
+var httpServer = serve({ fetch: app38.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 console.log("[boot] auth-mode summary: oauth=8 api-key=1 (api-key consumer: invokePublicAgent only)");
 var SUBAPP_MANIFEST = [
@@ -13239,7 +13307,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app37.routes ?? []) {
+  for (const r of app38.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });