@rubytech/create-sitedesk-code 0.1.507 → 0.1.509

package/payload/server/server.js

@@ -1824,10 +1824,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync47, existsSync as existsSync46, watchFile, readdirSync as readdirSync28, statSync as statSync20 } from "fs";
+import { readFileSync as readFileSync48, existsSync as existsSync47, watchFile, readdirSync as readdirSync29, statSync as statSync22 } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { createHash as createHash7 } from "crypto";
-import { resolve as resolve45, join as join47, basename as basename14 } from "path";
+import { createHash as createHash8 } from "crypto";
+import { resolve as resolve45, join as join49, basename as basename14 } from "path";
 import { homedir as homedir4 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -2386,6 +2386,79 @@ async function connectLoop(signal) {
 // server/index.ts
 import { monitorEventLoopDelay } from "perf_hooks";
 
+// server/lib/event-loop-lag.ts
+function readAndResetWindow(hist, windowMs) {
+  const toMs = (ns) => Math.round(ns / 1e6);
+  const w = {
+    p50Ms: toMs(hist.percentile(50)),
+    p99Ms: toMs(hist.percentile(99)),
+    maxMs: toMs(hist.max),
+    // Read before the reset.
+    count: hist.count,
+    windowMs
+  };
+  hist.reset();
+  return w;
+}
+function formatLagWindow(w) {
+  return `[event-loop] op=lag-window p50=${w.p50Ms} p99=${w.p99Ms} max=${w.maxMs} n=${w.count} windowMs=${w.windowMs}`;
+}
+
+// server/lib/static-cache.ts
+import { statSync as statSync3 } from "fs";
+import { join as join3 } from "path";
+var IMMUTABLE = "public, max-age=31536000, immutable";
+var REVALIDATE = "public, no-cache";
+function statOrNull(path3) {
+  try {
+    return statSync3(path3);
+  } catch {
+    return null;
+  }
+}
+function tryDecodeURI2(str) {
+  try {
+    return decodeURI(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decodeURI(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+}
+function resolveStaticFile(root, reqPath) {
+  const filename = tryDecodeURI2(reqPath);
+  if (/(?:^|[/\\])\.\.(?:$|[/\\])/.test(filename)) return null;
+  let path3 = join3(root, filename);
+  let stats = statOrNull(path3);
+  if (stats?.isDirectory()) {
+    path3 = join3(path3, "index.html");
+    stats = statOrNull(path3);
+  }
+  if (!stats?.isFile()) return null;
+  return { path: path3, stats, filename };
+}
+function staticCacheHeaders(root) {
+  return async (c, next) => {
+    if (c.finalized) return next();
+    const hit = resolveStaticFile(root, c.req.path);
+    if (!hit) return next();
+    if (hit.filename.startsWith("/assets/")) {
+      c.header("Cache-Control", IMMUTABLE);
+      return next();
+    }
+    const etag = `"${hit.stats.size}-${hit.stats.mtimeMs}"`;
+    c.header("Cache-Control", REVALIDATE);
+    c.header("Last-Modified", hit.stats.mtime.toUTCString());
+    c.header("ETag", etag);
+    if (c.req.header("If-None-Match") === etag) return c.body(null, 304);
+    return next();
+  };
+}
+
 // app/lib/whatsapp/inbound/media-download-guard.ts
 var TAG2 = "[media-guard]";
 var inFlight2 = 0;
@@ -2452,14 +2525,14 @@ function installMediaDownloadGuard() {
 }
 
 // app/lib/whatsapp/ingest-audit.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
-import { join as join4 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { join as join5 } from "path";
 
 // app/lib/whatsapp/ingest-ledger.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, appendFileSync as appendFileSync2, readFileSync as readFileSync3, writeFileSync, readdirSync as readdirSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var TAG3 = "[wa-ingest-ledger]";
-var LEDGER_ROOT = () => join3(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
+var LEDGER_ROOT = () => join4(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
 var ensuredRoots = /* @__PURE__ */ new Set();
 function ledgerFilePath(account) {
   const root = LEDGER_ROOT();
@@ -2467,7 +2540,7 @@ function ledgerFilePath(account) {
     if (!existsSync3(root)) mkdirSync2(root, { recursive: true });
     ensuredRoots.add(root);
   }
-  return join3(root, `${account}.jsonl`);
+  return join4(root, `${account}.jsonl`);
 }
 function appendStanza(entry) {
   try {
@@ -2573,16 +2646,16 @@ function readAllConversationsCached(accountId) {
   const out = /* @__PURE__ */ new Map();
   let dir;
   try {
-    dir = readdirSync4(join4(STORE_ROOT(), accountId));
+    dir = readdirSync4(join5(STORE_ROOT(), accountId));
   } catch {
     return out;
   }
   for (const file of dir) {
     if (!file.endsWith(".jsonl")) continue;
-    const path3 = join4(STORE_ROOT(), accountId, file);
+    const path3 = join5(STORE_ROOT(), accountId, file);
     let stat11;
     try {
-      stat11 = statSync3(path3);
+      stat11 = statSync4(path3);
     } catch {
       continue;
     }
@@ -2756,12 +2829,12 @@ function pwaCensus(d) {
 }
 
 // server/webchat-descriptor.ts
-import { resolve as resolve3, join as join5 } from "path";
+import { resolve as resolve3, join as join6 } from "path";
 function webchatGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function webchatServerPath() {
-  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join5(__dirname, ".."), "services/webchat-channel/dist/server.js");
+  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join6(__dirname, ".."), "services/webchat-channel/dist/server.js");
 }
 function webchatChannelDescriptor(key) {
   return { key, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() };
@@ -4983,7 +5056,7 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
 }
 
 // app/lib/managed-service.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { readFileSync as readFileSync9 } from "fs";
 function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
   let houseId;
@@ -4994,7 +5067,7 @@ function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
   }
   try {
     const cfg = JSON.parse(
-      readFileSync9(join6(accountsDir, houseId, "account.json"), "utf-8")
+      readFileSync9(join7(accountsDir, houseId, "account.json"), "utf-8")
     );
     return cfg.managedService === true;
   } catch {
@@ -5008,7 +5081,7 @@ function isCustomerTurnSuppressed(role, managedService) {
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID4, createHash } from "crypto";
 import { writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -5023,7 +5096,7 @@ import { resolve as resolve7, extname } from "path";
 
 // app/lib/data-path.ts
 import { realpathSync } from "fs";
-import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join7 } from "path";
+import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join8 } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "../platform");
 var DATA_ROOT = resolve6(PLATFORM_ROOT3, "..", "data");
 var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve6(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
@@ -5091,7 +5164,7 @@ function scratchpadTmpBase() {
 }
 function sessionScratchpadRoot(projectDir, sessionId) {
   const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
-  return join7(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
+  return join8(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
 }
 function resolveScratchpadPath(raw, scratchpadRootAbs) {
   return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
@@ -5634,7 +5707,7 @@ async function downloadInboundMedia(msg, sock, opts) {
   if (!res) return void 0;
   await mkdir2(MEDIA_DIR, { recursive: true });
   const ext = mimeToExt(res.mimetype);
-  const filePath = join8(MEDIA_DIR, `${randomUUID4()}.${ext}`);
+  const filePath = join9(MEDIA_DIR, `${randomUUID4()}.${ext}`);
   await writeFile2(filePath, res.buffer);
   const sizeKB = (res.buffer.length / 1024).toFixed(0);
   console.error(`${TAG14} media downloaded type=${res.mimetype} size=${sizeKB}KB path=${filePath}`);
@@ -7436,7 +7509,7 @@ var health_default = app;
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // app/lib/stt/audio-mime.ts
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
@@ -7490,9 +7563,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join9(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join10(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join9(tempDir, `recording${ext}`);
+    tempPath = join10(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -8068,7 +8141,7 @@ async function sendTelegramText(botToken, chatId, text) {
 }
 
 // server/routes/whatsapp.ts
-import { join as join12, resolve as resolve11 } from "path";
+import { join as join13, resolve as resolve11 } from "path";
 import { readdirSync as readdirSync7, readFileSync as readFileSync14, existsSync as existsSync8 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -8076,7 +8149,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { resolve as resolve9, join as join10, dirname as dirname2, basename as basename2 } from "path";
+import { resolve as resolve9, join as join11, dirname as dirname2, basename as basename2 } from "path";
 var TAG22 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve9(accountDir, "account.json");
@@ -8423,7 +8496,7 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join10(accountDir, "agents", trimmed, "config.json");
+  const agentConfigPath = join11(accountDir, "agents", trimmed, "config.json");
   if (!existsSync7(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
@@ -9060,12 +9133,12 @@ function serializeWhatsAppSchema() {
 
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync6 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var TAG25 = "[whatsapp:reconcile]";
 var HALF_REGISTERED_MIN_AGE_MS = 5 * 6e4;
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync6(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join11(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync6(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join12(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -9080,7 +9153,7 @@ function reconcileCredsOnDisk(opts) {
   const entries2 = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
-    const authDir = join11(credsRoot, accountId);
+    const authDir = join12(credsRoot, accountId);
     const census = credsCensus(authDir);
     if (census.registered && !census.hasAccountSignature) {
       const inFlight3 = activeLoginAccountIds.has(accountId);
@@ -9317,7 +9390,7 @@ app2.get("/status", (c) => {
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
     const activeLoginIds = new Set(listActiveLoginAccountIds());
-    const credsRoot = join12(MAXY_DIR, "credentials", "whatsapp");
+    const credsRoot = join13(MAXY_DIR, "credentials", "whatsapp");
     const accountDir = resolveAccount()?.accountDir ?? null;
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds, activeLoginAccountIds: activeLoginIds });
     const cfg = getWhatsAppConfig();
@@ -9354,7 +9427,7 @@ app2.post("/login/start", async (c) => {
     if (!phone) {
       return c.json({ error: 'Missing required field "phone" (E.164, e.g. +441234567890).' }, 400);
     }
-    const authDir = join12(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join13(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
     console.error(`${TAG26} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
@@ -10001,12 +10074,12 @@ var bodyLimit = (options) => {
 };
 
 // server/routes/storage-broker.ts
-import { join as join13, resolve as resolve12 } from "path";
+import { join as join14, resolve as resolve12 } from "path";
 import { readdirSync as readdirSync8, readFileSync as readFileSync15, existsSync as existsSync9, realpathSync as realpathSync4 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
 var app3 = new Hono();
 function platformRoot() {
-  return process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? join13(__dirname, "..", "..");
+  return process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? join14(__dirname, "..", "..");
 }
 function caller(c) {
   return c.req.header("x-maxy-caller-account")?.trim() || null;
@@ -10541,7 +10614,7 @@ async function runStorageAudit(root) {
       if (!existsSync9(accountsDir)) return [];
       const files = [];
       for (const accountId of readdirSync8(accountsDir)) {
-        const p = join13(accountsDir, accountId, "secrets", "cloudflare.env");
+        const p = join14(accountsDir, accountId, "secrets", "cloudflare.env");
         if (existsSync9(p)) files.push({ accountId, path: p, contents: readFileSync15(p, "utf8") });
       }
       return files;
@@ -10640,7 +10713,7 @@ function discoverPortalAccounts(accountsDir) {
   if (!existsSync9(accountsDir)) return [];
   const found = [];
   for (const accountId of readdirSync8(accountsDir)) {
-    const configPath2 = join13(accountsDir, accountId, "data-portal.json");
+    const configPath2 = join14(accountsDir, accountId, "data-portal.json");
     if (!existsSync9(configPath2)) continue;
     try {
       const cfg = JSON.parse(readFileSync15(configPath2, "utf-8"));
@@ -10723,7 +10796,7 @@ async function runDataPortalAudit(root) {
 // server/portal-uploads-pull.ts
 import { existsSync as existsSync10 } from "fs";
 import { mkdir as mkdir3, readFile as readFile2, rename, stat as stat3, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename4, dirname as dirname4, join as join14, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname4, join as join15, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
 
 // ../plugins/cloudflare/bin/schema-exposed-dirs.mjs
 var ONT_START = "<!-- ontology-buckets:start -->";
@@ -10821,19 +10894,19 @@ function resolveDestination(accountDir, row, exposed) {
     if (!segments.every(safeSegment)) return { ok: false, reason: "bad-target" };
     if (!exposed.includes(segments[0])) return { ok: false, reason: "bad-target" };
     root = resolve13(accountDir);
-    dir = join14(root, ...segments);
+    dir = join15(root, ...segments);
   } else {
     root = resolve13(accountDir, "uploads");
-    dir = join14(root, row.ownerId);
+    dir = join15(root, row.ownerId);
   }
-  const final = join14(dir, row.filename);
+  const final = join15(dir, row.filename);
   if (!final.startsWith(root + sep3)) {
     return { ok: false, reason: row.targetPath ? "bad-target" : "bad-filename" };
   }
   return {
     ok: true,
     dir,
-    tmp: join14(dir, ".uploads-tmp", row.filename),
+    tmp: join15(dir, ".uploads-tmp", row.filename),
     final,
     relative: relative2(resolve13(accountDir), final).split(sep3).join("/")
   };
@@ -10846,7 +10919,7 @@ function nextFreePath(final) {
   const stem = dot > 0 ? base.slice(0, dot) : base;
   const ext = dot > 0 ? base.slice(dot) : "";
   for (let n = 2; ; n++) {
-    const candidate = join14(dir, `${stem} (${n})${ext}`);
+    const candidate = join15(dir, `${stem} (${n})${ext}`);
     if (!existsSync10(candidate)) return candidate;
   }
 }
@@ -10950,7 +11023,7 @@ async function withdrawRow(opts) {
     log2(`${head} removed=false result=bad-path`);
     return false;
   }
-  const absolute = join14(resolve13(accountDir), ...segments);
+  const absolute = join15(resolve13(accountDir), ...segments);
   if (!absolute.startsWith(resolve13(accountDir) + sep3)) {
     log2(`${head} removed=false result=bad-path`);
     return false;
@@ -11015,13 +11088,13 @@ function parsePendingRows(raw) {
 async function readExposedDirs(accountDir) {
   let schemaText = null;
   try {
-    schemaText = await readFile2(join14(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile2(join15(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
   let exposeFolders = [];
   try {
-    const cfg = JSON.parse(await readFile2(join14(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile2(join15(accountDir, "data-portal.json"), "utf8"));
     exposeFolders = Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     exposeFolders = [];
@@ -11046,7 +11119,7 @@ async function runPortalUploadsPull(root) {
         console.error(`${TAG27} op=malformed account=${portal.accountId} rows=${malformed}`);
       }
       if (rows.length === 0) continue;
-      const accountDir = join14(accountsRoot, portal.accountId);
+      const accountDir = join15(accountsRoot, portal.accountId);
       const r = await pullAccount({
         accountDir,
         accountId: portal.accountId,
@@ -11079,7 +11152,7 @@ async function runPortalUploadsPull(root) {
 import { readFile as readFile3, readdir, stat as stat4 } from "fs/promises";
 import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
-import { join as join15, resolve as resolve14 } from "path";
+import { join as join16, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 
 // ../plugins/cloudflare/bin/d1-http.mjs
@@ -11155,7 +11228,7 @@ function readEnvFile(path3) {
 }
 async function readExposeFolders(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile3(join15(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile3(join16(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -11166,12 +11239,12 @@ async function walkExposed(accountDir, exposed) {
   async function walk(rel) {
     let entries2;
     try {
-      entries2 = await readdir(join15(accountDir, rel), { withFileTypes: true });
+      entries2 = await readdir(join16(accountDir, rel), { withFileTypes: true });
     } catch {
       return;
     }
     try {
-      const st = await stat4(join15(accountDir, rel));
+      const st = await stat4(join16(accountDir, rel));
       out.push({ relPath: rel, sizeBytes: 0, modifiedAt: st.mtime.toISOString(), isDir: true });
     } catch {
     }
@@ -11182,7 +11255,7 @@ async function walkExposed(accountDir, exposed) {
         await walk(childRel);
       } else if (e.isFile()) {
         try {
-          const st = await stat4(join15(accountDir, childRel));
+          const st = await stat4(join16(accountDir, childRel));
           out.push({
             relPath: childRel,
             sizeBytes: st.size,
@@ -11201,7 +11274,7 @@ async function pushAccount(opts) {
   const { accountDir, accountId, client, log: log2, nowIso } = opts;
   let schemaText = null;
   try {
-    schemaText = await readFile3(join15(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile3(join16(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -11231,19 +11304,11 @@ async function pushAccount(opts) {
     [accountId]
   );
   const current = Number(state[0]?.currentGeneration ?? 0);
-  const next = current + 1;
-  const orphan = await client.query(
-    "SELECT COUNT(*) AS n FROM directory WHERE accountId = ? AND generation = ?",
-    [accountId, next]
+  const staged = await client.query(
+    "SELECT MAX(generation) AS g FROM directory WHERE accountId = ?",
+    [accountId]
   );
-  const orphanCount = Number(orphan[0]?.n ?? 0);
-  if (orphanCount > 0) {
-    await client.query("DELETE FROM directory WHERE accountId = ? AND generation = ?", [
-      accountId,
-      next
-    ]);
-    log2(`${TAG28} op=stage-clear account=${accountId} generation=${next} cleared=${orphanCount}`);
-  }
+  const next = Math.max(current, Number(staged[0]?.g ?? 0)) + 1;
   for (const row of rows) {
     await client.query(
       "INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt, isDir, generation) VALUES (?, ?, ?, ?, ?, ?, ?)",
@@ -11252,12 +11317,29 @@ async function pushAccount(opts) {
   }
   log2(`${TAG28} op=stage account=${accountId} generation=${next} inserted=${rows.length}`);
   await client.query(
-    "INSERT INTO directory_state (accountId, currentGeneration) VALUES (?, ?) ON CONFLICT (accountId) DO UPDATE SET currentGeneration = excluded.currentGeneration",
+    "INSERT INTO directory_state (accountId, currentGeneration) VALUES (?, ?) ON CONFLICT (accountId) DO UPDATE SET currentGeneration = excluded.currentGeneration WHERE excluded.currentGeneration > directory_state.currentGeneration",
     [accountId, next]
   );
+  const flipped = await client.query(
+    "SELECT currentGeneration FROM directory_state WHERE accountId = ?",
+    [accountId]
+  );
+  const pointer = Number(flipped[0]?.currentGeneration ?? 0);
+  if (pointer !== next) {
+    log2(
+      `${TAG28} op=stage-contended account=${accountId} generation=${next} pointer=${pointer} action=superseded`
+    );
+    return {
+      exposed: r.exposed,
+      rows: rows.length,
+      schemaPresent: true,
+      generation: next,
+      superseded: true
+    };
+  }
   log2(`${TAG28} op=flip account=${accountId} generation=${next}`);
   try {
-    await client.query("DELETE FROM directory WHERE accountId = ? AND generation != ?", [
+    await client.query("DELETE FROM directory WHERE accountId = ? AND generation < ?", [
       accountId,
       next
     ]);
@@ -11309,9 +11391,9 @@ async function portalAccounts(accountsRoot) {
     return out;
   }
   for (const accountId of names) {
-    const accountDir = join15(accountsRoot, accountId);
+    const accountDir = join16(accountsRoot, accountId);
     try {
-      const cfg = JSON.parse(await readFile3(join15(accountDir, "data-portal.json"), "utf8"));
+      const cfg = JSON.parse(await readFile3(join16(accountDir, "data-portal.json"), "utf8"));
       if (typeof cfg?.portalDbName === "string" && cfg.portalDbName) {
         const exposeFolders = Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
         out.push({ accountDir, accountId, dbName: cfg.portalDbName, exposeFolders });
@@ -11324,11 +11406,11 @@ async function portalAccounts(accountsRoot) {
   return out;
 }
 function resolveCloudflareCredentials(platformRoot5) {
-  const houseEnvPath = join15(platformRoot5, "config", "cloudflare-house.env");
+  const houseEnvPath = join16(platformRoot5, "config", "cloudflare-house.env");
   const house = readEnvFile(houseEnvPath);
   if (!house.CLOUDFLARE_API_TOKEN) return { error: "no-house-cloudflare-credential" };
   if (!house.CLOUDFLARE_ACCOUNT_ID) return { error: "no-house-cloudflare-account-id" };
-  const cfTokenSh = join15(platformRoot5, "plugins", "cloudflare", "bin", "cf-token.sh");
+  const cfTokenSh = join16(platformRoot5, "plugins", "cloudflare", "bin", "cf-token.sh");
   if (!existsSync11(cfTokenSh)) return { error: "cf-token-sh-missing" };
   let keyName;
   try {
@@ -11434,17 +11516,17 @@ async function runPortalIndexPush(root) {
 }
 
 // server/google-pending-audit.ts
-import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync4 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
+import { join as join17 } from "path";
 var GOOGLE_PENDING_LIFETIME_SEC = 600;
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync4(path3).mtimeMs) {
+function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync5(path3).mtimeMs) {
   let scanned = 0;
   let stranded = 0;
   if (existsSync12(accountsDir)) {
     for (const accountId of readdirSync9(accountsDir)) {
       if (!UUID_RE2.test(accountId)) continue;
-      const pendingPath2 = join16(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
+      const pendingPath2 = join17(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
       try {
         if (!existsSync12(pendingPath2)) continue;
         const ageSec = Math.max(0, Math.floor((nowMs - readMtimeMs(pendingPath2)) / 1e3));
@@ -11501,19 +11583,19 @@ function runReconcileLivenessAudit(statePath, nowMs, intervalMs, emit) {
 }
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync21, watch as watch2, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
-import { basename as basename6, dirname as dirname7, isAbsolute, join as join21, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
+import { readFileSync as readFileSync21, watch as watch2, statSync as statSync9, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join22, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
-import { dirname as dirname5, join as join19, resolve as resolve15 } from "path";
+import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync7 } from "fs";
+import { dirname as dirname5, join as join20, resolve as resolve15 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
 import { existsSync as existsSync14, readdirSync as readdirSync10 } from "fs";
 import { homedir } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
-  const projectsRoot = join17(claudeConfigDir2, "projects");
+  const projectsRoot = join18(claudeConfigDir2, "projects");
   if (!existsSync14(projectsRoot)) return null;
   let slugs;
   try {
@@ -11523,9 +11605,9 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   }
   const basename15 = `${sessionId}.jsonl`;
   for (const slug of slugs) {
-    const live = join17(projectsRoot, slug, basename15);
+    const live = join18(projectsRoot, slug, basename15);
     if (existsSync14(live)) return live;
-    const archived = join17(projectsRoot, slug, "archive", basename15);
+    const archived = join18(projectsRoot, slug, "archive", basename15);
     if (existsSync14(archived)) return archived;
   }
   return null;
@@ -11533,8 +11615,8 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync5 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync6 } from "fs";
+import { join as join19 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
@@ -11665,7 +11747,7 @@ function enumerateJsonls(projectsRoot) {
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join19(projectsRoot, slug);
+    const slugDir = join20(projectsRoot, slug);
     let entries2;
     try {
       entries2 = readdirSync12(slugDir, { withFileTypes: true });
@@ -11676,9 +11758,9 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join19(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join20(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join19(slugDir, entry.name);
+        const subDir = join20(slugDir, entry.name);
         let subEntries;
         try {
           subEntries = readdirSync12(subDir, { withFileTypes: true });
@@ -11689,11 +11771,11 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join19(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join20(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join19(slugDir, entry.name);
+        const archiveDir = join20(slugDir, entry.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync12(archiveDir, { withFileTypes: true });
@@ -11704,7 +11786,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join19(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join20(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -11737,7 +11819,7 @@ async function fetchLiveSessions() {
 function loadUserTitles(accountDir) {
   const out = /* @__PURE__ */ new Map();
   if (!accountDir) return out;
-  const path3 = join19(accountDir, "session-titles.json");
+  const path3 = join20(accountDir, "session-titles.json");
   let raw;
   try {
     raw = readFileSync19(path3, "utf8");
@@ -11877,7 +11959,7 @@ async function computeSessionList(scopeAccountId) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return { sessions: [], accountId: scopeAccountId };
   }
-  const projectsRoot = join19(configDir2, "projects");
+  const projectsRoot = join20(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
   const accountDir = scopeAccountId ? resolve15(ACCOUNTS_DIR, scopeAccountId) : null;
@@ -11922,7 +12004,7 @@ async function computeSessionList(scopeAccountId) {
     let mtimeMs;
     try {
       body = readFileSync19(path3, "utf8");
-      mtimeMs = statSync6(path3).mtimeMs;
+      mtimeMs = statSync7(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -11930,7 +12012,7 @@ async function computeSessionList(scopeAccountId) {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join19(projectDir, `${sessionId}.meta.json`);
+    const metaPath = join20(projectDir, `${sessionId}.meta.json`);
     const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = readSidecarMeta(metaPath);
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
@@ -12332,8 +12414,8 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync7, realpathSync as realpathSync5 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join20, resolve as resolve16, sep as sep4 } from "path";
+import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync8, realpathSync as realpathSync5 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join21, resolve as resolve16, sep as sep4 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -12346,7 +12428,7 @@ function adminAttachmentIds(text) {
 function adminAttachmentsFromText(text, uploadsBase) {
   const out = [];
   for (const id of adminAttachmentIds(text)) {
-    const meta = readAttachmentMeta(join20(uploadsBase, id));
+    const meta = readAttachmentMeta(join21(uploadsBase, id));
     if (meta) out.push(meta);
   }
   return out;
@@ -12383,7 +12465,7 @@ function claudeUploadAttachmentsFromText(text, sessionId) {
       attachmentId: filename,
       filename,
       mimeType: detectMimeType(filename),
-      sizeBytes: statSync7(real).size,
+      sizeBytes: statSync8(real).size,
       source: "claude-upload"
     });
     accepted.push(m[0]);
@@ -12396,7 +12478,7 @@ function claudeUploadAttachmentsFromText(text, sessionId) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(join20(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync20(join21(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -12425,7 +12507,7 @@ function listSessionAttachmentsInDir(dir) {
   }
   const sidecars = [];
   for (const name of entries2) {
-    const sidecar = readSidecar(join20(dir, name), name);
+    const sidecar = readSidecar(join21(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
   sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
@@ -12585,14 +12667,14 @@ app5.get("/conversations", requireAdminSession, async (c) => {
   }
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join21(cfg, "projects");
+  const projectsRoot = join22(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename6(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname7(path3);
-    const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
       if (meta.accountId === null) sessionRowsExcludedUntagged += 1;
@@ -12723,7 +12805,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   const { value, state } = await getOrCompute("conversations-all", houseId, async () => {
     const cfg = claudeConfigDir();
     if (!cfg) return { conversations: [] };
-    const projectsRoot = join21(cfg, "projects");
+    const projectsRoot = join22(cfg, "projects");
     const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
     const validAccounts = listValidAccounts();
     const validIds = new Set(validAccounts.map((a) => a.accountId));
@@ -12732,7 +12814,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
     for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
       const sessionId = basename6(path3).replace(/\.jsonl$/, "");
       const projectDir = dirname7(path3);
-      const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
       if (!isReaderChannelSession(meta.role, meta.channel)) continue;
       if (meta.accountId === null || !validIds.has(meta.accountId)) continue;
       let body = "";
@@ -12803,7 +12885,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   return c.json(value);
 });
 function readFrom(path3, from) {
-  const end = statSync8(path3).size;
+  const end = statSync9(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync(path3, "r");
   try {
@@ -12897,7 +12979,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync21(join21(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync21(join22(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -12929,7 +13011,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync8(join21(c.subagentsDir, name));
+      const st = statSync9(join22(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -12974,11 +13056,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve17(join21(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve17(join22(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve17(join21(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve17(join22(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep5)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -12997,7 +13079,7 @@ data: ${JSON.stringify(turn)}
     start(controller) {
       const fileEnd0 = (() => {
         try {
-          return statSync8(jsonlPath).size;
+          return statSync9(jsonlPath).size;
         } catch {
           return 0;
         }
@@ -13005,7 +13087,7 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve17(join21(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve17(join22(projectDir, sessionId, "subagents"));
       console.log(
         `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync17(subagentsDir)}`
       );
@@ -13134,7 +13216,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync8(join21(dir, name)).size;
+      len = statSync9(join22(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -13149,7 +13231,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path3 = resolve17(join21(dir, name));
+  const path3 = resolve17(join22(dir, name));
   if (!path3.startsWith(dir + sep5)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -13207,7 +13289,7 @@ app5.get("/store-stream", requireAdminSession, (c) => {
       console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q2}`);
     }
     if (r.attachmentId) {
-      const meta = readAttachmentMeta(join21(uploadsBase, r.attachmentId));
+      const meta = readAttachmentMeta(join22(uploadsBase, r.attachmentId));
       if (meta) return { ...turn, attachments: [meta] };
     }
     return turn;
@@ -13240,7 +13322,7 @@ data: ${JSON.stringify(payload)}
       };
       const fileEnd0 = (() => {
         try {
-          return statSync8(file).size;
+          return statSync9(file).size;
         } catch {
           return 0;
         }
@@ -13458,7 +13540,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
       const absolute = resolved.absolute;
       let size = -1;
       try {
-        const st = statSync8(absolute);
+        const st = statSync9(absolute);
         size = st.isFile() ? st.size : -1;
       } catch {
         size = -1;
@@ -13587,8 +13669,8 @@ app5.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
-import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
-import { basename as basename7, dirname as dirname8, join as join22, resolve as resolve18, sep as sep6 } from "path";
+import { statSync as statSync10, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
+import { basename as basename7, dirname as dirname8, join as join23, resolve as resolve18, sep as sep6 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -13662,10 +13744,10 @@ function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path3 } of enumerateJsonls(join22(cfg, "projects"))) {
+  for (const { path: path3 } of enumerateJsonls(join23(cfg, "projects"))) {
     const sessionId = basename7(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname8(path3);
-    const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -13721,7 +13803,7 @@ function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   }
 }
 function readFrom2(path3, from) {
-  const end = statSync9(path3).size;
+  const end = statSync10(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync2(path3, "r");
   try {
@@ -13741,15 +13823,15 @@ app6.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve18(join22(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve18(join23(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve18(join22(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve18(join23(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep6)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
@@ -13886,16 +13968,16 @@ var public_reader_default = app6;
 
 // server/routes/webchat.ts
 import { basename as basename8, dirname as dirname9 } from "path";
-import { join as join25 } from "path";
-import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
+import { join as join26 } from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync11, writeFileSync as writeFileSync9 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync7, renameSync as renameSync2 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join23(accountDir, FILE);
+  return join24(accountDir, FILE);
 }
 function readRaw(accountDir) {
   try {
@@ -13975,7 +14057,7 @@ function isNewSessionEffortLevel(value) {
 
 // ../services/claude-session-manager/src/sidecar-store.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync16, readFileSync as readFileSync24, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -13983,7 +14065,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join24(sessionsDir, `${id}${suffix}`);
+    return join25(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync4(sessionsDir, { recursive: true });
@@ -14027,7 +14109,7 @@ function createSidecarStore(config) {
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path3 = join24(sessionsDir, name);
+      const path3 = join25(sessionsDir, name);
       let raw;
       try {
         raw = readFileSync24(path3, "utf8");
@@ -14104,13 +14186,13 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const dir = findSessionProjectDir(sessionId);
   if (!dir) return { projectDir: null, channel: null, accountId: null };
-  const meta = readSidecarMeta(join25(dir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join26(dir, `${sessionId}.meta.json`));
   return { projectDir: dir, channel: meta.channel, accountId: meta.accountId };
 }
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join25(cfg, "projects");
+  const projectsRoot = join26(cfg, "projects");
   let slugs;
   try {
     slugs = readdirSync17(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -14118,7 +14200,7 @@ function locateSidecar(sessionId) {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join25(projectsRoot, slug, `${sessionId}.meta.json`);
+    const metaPath = join26(projectsRoot, slug, `${sessionId}.meta.json`);
     if (existsSync19(metaPath)) return readSidecarMeta(metaPath);
   }
   return null;
@@ -14128,7 +14210,7 @@ function readTargetOwner(sessionId) {
   if (sidecar !== null) return { found: true, owner: sidecar.adminUserId };
   const { projectDir } = locateSession(sessionId);
   if (projectDir !== null) {
-    return { found: true, owner: readSidecarMeta(join25(projectDir, `${sessionId}.meta.json`)).adminUserId };
+    return { found: true, owner: readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`)).adminUserId };
   }
   return { found: false, owner: null };
 }
@@ -14136,7 +14218,7 @@ function readSourceRowMeta(sessionId) {
   const sidecar = locateSidecar(sessionId);
   if (sidecar !== null) return sidecar;
   const { projectDir } = locateSession(sessionId);
-  if (projectDir !== null) return readSidecarMeta(join25(projectDir, `${sessionId}.meta.json`));
+  if (projectDir !== null) return readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`));
   return null;
 }
 function ownedByRequester(owner, requesterUserId, primaryUserId) {
@@ -14149,7 +14231,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync10(join25(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync11(join26(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -14285,15 +14367,15 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join25(cfg, "projects"))) {
+  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join26(cfg, "projects"))) {
     if (isSubagent || archived) continue;
     const id = basename8(path3).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join25(dirname9(path3), `${id}.meta.json`));
+    const meta = readSidecarMeta(join26(dirname9(path3), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync10(path3).mtimeMs;
+      mtimeMs = statSync11(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -14601,7 +14683,7 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join25(account.accountDir, "account.json");
+    const accountJsonPath = join26(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync25(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
@@ -14649,7 +14731,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join25(cfg2, "sessions"),
+            join26(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -14681,7 +14763,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path3 } of enumerateJsonls(join25(cfg, "projects"))) {
+      for (const { path: path3 } of enumerateJsonls(join26(cfg, "projects"))) {
         if (basename8(path3) === `${sessionId}.jsonl`) {
           projectDir = dirname9(path3);
           break;
@@ -14689,7 +14771,7 @@ ${note}` : note;
       }
     }
     if (source === "latest" && requesterUserId !== null) {
-      const owner = readSidecarMeta(join25(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
+      const owner = readSidecarMeta(join26(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
       if (owner !== null && owner !== requesterUserId && requesterUserId !== primaryUserId) {
         console.error(`[webchat:inbound] op=session-resolve-foreign key=${sessionId.slice(0, 8)} owner=${owner.slice(0, 8)} requester=${requesterUserId.slice(0, 8)}`);
       }
@@ -14722,7 +14804,7 @@ import { resolve as resolve19 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
 import { existsSync as existsSync20, readFileSync as readFileSync26, readdirSync as readdirSync18 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -14741,7 +14823,7 @@ function readSpecialistRoster(specialistsDir) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync26(join26(specialistsDir, file), "utf-8");
+      raw = readFileSync26(join27(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -14858,7 +14940,7 @@ var webchat_greeting_default = app7;
 
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
-import { resolve as resolve20, join as join27 } from "path";
+import { resolve as resolve20, join as join28 } from "path";
 import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
@@ -14918,7 +15000,7 @@ function routeTelegramUpdate(input) {
 var TAG30 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
-  const brandPath = join27(platformRoot5, "config", "brand.json");
+  const brandPath = join28(platformRoot5, "config", "brand.json");
   if (existsSync21(brandPath)) {
     try {
       return JSON.parse(readFileSync27(brandPath, "utf-8")).configDir ?? ".maxy";
@@ -15007,16 +15089,16 @@ app8.post("/", async (c) => {
 var telegram_default = app8;
 
 // server/routes/quickbooks.ts
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 import { existsSync as existsSync22, readFileSync as readFileSync28, writeFileSync as writeFileSync10, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
 var TAG31 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join28(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join29(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join28(accountDir, "secrets", "quickbooks.json");
+  return join29(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
@@ -15083,7 +15165,7 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync5(join28(accountDir, "secrets"), { recursive: true });
+    mkdirSync5(join29(accountDir, "secrets"), { recursive: true });
     writeFileSync10(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
     const persisted = JSON.parse(readFileSync28(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG31} op=token-exchange realmId=${realmId} persisted=${persisted}`);
@@ -15125,7 +15207,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname11, join as join30 } from "path";
+import { dirname as dirname11, join as join31 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync3 } from "child_process";
@@ -15254,8 +15336,8 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync11, appendFileSync as appendFileSync3 } from "fs";
-import { dirname as dirname10, join as join29 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync12, appendFileSync as appendFileSync3 } from "fs";
+import { dirname as dirname10, join as join30 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -15328,7 +15410,7 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join29(input.accountDir, "account.json");
+    const accountJsonPath = join30(input.accountDir, "account.json");
     if (!existsSync23(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
@@ -15376,13 +15458,13 @@ function computeAdminStoreDivergence(input) {
     }
     for (const entry of entries2) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join29(input.accountsDir, entry);
+      const accountDir = join30(input.accountsDir, entry);
       try {
-        if (!statSync11(accountDir).isDirectory()) continue;
+        if (!statSync12(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join29(accountDir, "account.json");
+      const accountJsonPath = join30(accountDir, "account.json");
       if (!existsSync23(accountJsonPath)) continue;
       let admins = [];
       try {
@@ -15560,7 +15642,7 @@ app10.post("/claude-auth", async (c) => {
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync12(join30(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync12(join31(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -15825,9 +15907,9 @@ ${body.newPin}
 var onboarding_default = app10;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync12 } from "fs";
-import { join as join31 } from "path";
-var CLIENT_ERRORS_LOG = join31(LOG_DIR, "client-errors.log");
+import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync13 } from "fs";
+import { join as join32 } from "path";
+var CLIENT_ERRORS_LOG = join32(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -15885,7 +15967,7 @@ function stackHead(stack) {
 function rotateIfNeeded() {
   try {
     if (!existsSync25(CLIENT_ERRORS_LOG)) return;
-    const stats = statSync12(CLIENT_ERRORS_LOG);
+    const stats = statSync13(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
@@ -15971,7 +16053,7 @@ app11.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -16211,17 +16293,17 @@ app13.get("/", requireAdminSession, async (c) => {
 var accounts_default = app13;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync13 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync14 } from "fs";
 import { resolve as resolve21, basename as basename9 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync26 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join32(dir, filename);
+    const fullPath = join33(dir, filename);
     if (existsSync26(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -16251,7 +16333,7 @@ app14.get("/", async (c) => {
       searched.push(filePath);
       try {
         const buffer = readFileSync31(filePath);
-        const onDiskBytes = statSync13(filePath).size;
+        const onDiskBytes = statSync14(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -16316,7 +16398,7 @@ app14.get("/", async (c) => {
       try {
         const filename = basename9(hit.path);
         const buffer = readFileSync31(hit.path);
-        const onDiskBytes = statSync13(hit.path).size;
+        const onDiskBytes = statSync14(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -16359,7 +16441,7 @@ app14.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync13(resolve21(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync14(resolve21(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
         const content = readFileSync31(resolve21(dir, name));
@@ -16479,7 +16561,7 @@ var attachment_default = app16;
 
 // server/routes/admin/session-upload.ts
 import { readFile as readFile5 } from "fs/promises";
-import { existsSync as existsSync29, statSync as statSync14 } from "fs";
+import { existsSync as existsSync29, statSync as statSync15 } from "fs";
 var app17 = new Hono();
 app17.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -16500,7 +16582,7 @@ app17.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   const resolution = resolveClaudeUploadsPath(`${sessionId}/${file}`);
-  if (!resolution.ok || !existsSync29(resolution.absolute) || !statSync14(resolution.absolute).isFile()) {
+  if (!resolution.ok || !existsSync29(resolution.absolute) || !statSync15(resolution.absolute).isFile()) {
     console.log(`[session-upload] op=miss session=${short2} file=${file} status=404 reason=absent`);
     return c.json({ error: "Not found" }, 404);
   }
@@ -16522,7 +16604,7 @@ var session_upload_default = app17;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve23 } from "path";
-import { readdirSync as readdirSync21, readFileSync as readFileSync32, existsSync as existsSync30, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync22, readFileSync as readFileSync33, existsSync as existsSync31, rmSync as rmSync2, renameSync as renameSync9, mkdirSync as mkdirSync7, writeFileSync as writeFileSync13 } from "fs";
 
 // server/routes/admin/_account-scope.ts
 function accountDirForSession(cacheKey) {
@@ -16549,12 +16631,390 @@ async function authorizeAccountWrite(c, accountId) {
   return { ok: true, via: "session" };
 }
 
+// ../services/claude-session-manager/src/tool-surface.ts
+import { readFileSync as readFileSync32, readdirSync as readdirSync21, statSync as statSync16, existsSync as existsSync30 } from "fs";
+import { createHash as createHash5 } from "crypto";
+import { join as join34 } from "path";
+
+// ../services/claude-session-manager/src/canonical-tool-names.ts
+function canonicalToolName(plugin, tool) {
+  return `mcp__plugin_${plugin}_${plugin}__${tool}`;
+}
+function qualifyShortToolName(plugin, tool) {
+  return `mcp__${plugin}__${tool}`;
+}
+
+// ../services/claude-session-manager/src/tool-surface.ts
+var RISK_CLASSES = ["read", "write_local", "exec", "external"];
+var ToolSurfaceError = class extends Error {
+  constructor(reason, detail) {
+    super(`${reason}: ${detail}`);
+    this.reason = reason;
+    this.detail = detail;
+    this.name = "ToolSurfaceError";
+  }
+};
+var FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---/;
+function extractFrontmatter(raw, pluginDir) {
+  const m = raw.match(FRONTMATTER_RE);
+  if (!m) {
+    throw new ToolSurfaceError("frontmatter-missing", `${pluginDir}/PLUGIN.md has no '---' delimited frontmatter`);
+  }
+  return m[1];
+}
+function parseToolsBlock(frontmatter, pluginDir) {
+  const lines = frontmatter.split(/\r?\n/);
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (/^tools:\s*\[\s*\]\s*$/.test(line)) return [];
+    if (/^tools:\s*$/.test(line)) {
+      i++;
+      break;
+    }
+    i++;
+  }
+  if (i >= lines.length) return [];
+  const out = [];
+  let current = null;
+  const flush = () => {
+    if (!current) return;
+    if (typeof current.name !== "string" || current.name.length === 0) {
+      throw new ToolSurfaceError("tool-name-missing", `${pluginDir}/PLUGIN.md has a tool entry with no name`);
+    }
+    if (typeof current.publicAllowlist !== "boolean") {
+      if (current.publicAllowlist === void 0) {
+        throw new ToolSurfaceError(
+          "public-allowlist-missing",
+          `${pluginDir}/${current.name} \u2014 every tool must declare publicAllowlist: <true|false>`
+        );
+      }
+      throw new ToolSurfaceError(
+        "public-allowlist-not-boolean",
+        `${pluginDir}/${current.name} \u2014 publicAllowlist must be a YAML boolean (true|false), got ${JSON.stringify(current.publicAllowlist)}`
+      );
+    }
+    if (typeof current.adminAllowlist !== "boolean") {
+      if (current.adminAllowlist === void 0) {
+        throw new ToolSurfaceError(
+          "admin-allowlist-missing",
+          `${pluginDir}/${current.name} \u2014 every tool must declare adminAllowlist: <true|false>`
+        );
+      }
+      throw new ToolSurfaceError(
+        "admin-allowlist-not-boolean",
+        `${pluginDir}/${current.name} \u2014 adminAllowlist must be a YAML boolean (true|false), got ${JSON.stringify(current.adminAllowlist)}`
+      );
+    }
+    if (current.riskClass === void 0) {
+      throw new ToolSurfaceError(
+        "risk-class-missing",
+        `${pluginDir}/${current.name} \u2014 every tool must declare riskClass: <${RISK_CLASSES.join("|")}>`
+      );
+    }
+    if (!RISK_CLASSES.includes(current.riskClass)) {
+      throw new ToolSurfaceError(
+        "risk-class-invalid",
+        `${pluginDir}/${current.name} \u2014 riskClass must be one of ${RISK_CLASSES.join("|")}, got ${JSON.stringify(current.riskClass)}`
+      );
+    }
+    out.push(current);
+    current = null;
+  };
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length === 0) continue;
+    if (/^[A-Za-z_]/.test(line)) break;
+    const newEntry = line.match(/^\s+-\s+name:\s*(.+?)\s*$/);
+    if (newEntry) {
+      flush();
+      current = { name: newEntry[1] };
+      continue;
+    }
+    const orphanListItem = line.match(/^\s+-\s+(?!name:)/);
+    if (orphanListItem) {
+      throw new ToolSurfaceError("tool-name-missing", `${pluginDir}/PLUGIN.md tool entry lacks a name field`);
+    }
+    const publicAllow = line.match(/^\s+publicAllowlist:\s*(.+?)\s*$/);
+    if (publicAllow && current) {
+      const v = publicAllow[1].trim();
+      if (v === "true") current.publicAllowlist = true;
+      else if (v === "false") current.publicAllowlist = false;
+      else current.publicAllowlist = v;
+      continue;
+    }
+    const adminAllow = line.match(/^\s+adminAllowlist:\s*(.+?)\s*$/);
+    if (adminAllow && current) {
+      const v = adminAllow[1].trim();
+      if (v === "true") current.adminAllowlist = true;
+      else if (v === "false") current.adminAllowlist = false;
+      else current.adminAllowlist = v;
+      continue;
+    }
+    const risk = line.match(/^\s+riskClass:\s*(.+?)\s*$/);
+    if (risk && current) {
+      current.riskClass = risk[1].trim();
+      continue;
+    }
+  }
+  flush();
+  return out;
+}
+function parseHiddenBlock(frontmatter, pluginDir) {
+  const lines = frontmatter.split(/\r?\n/);
+  let i = 0;
+  while (i < lines.length) {
+    if (/^hidden:\s*$/.test(lines[i])) {
+      i++;
+      break;
+    }
+    i++;
+  }
+  if (i >= lines.length) return [];
+  const out = [];
+  let current = null;
+  const flush = () => {
+    if (!current) return;
+    if (current.riskClass === void 0) {
+      throw new ToolSurfaceError(
+        "risk-class-missing",
+        `${pluginDir}/${current.name} \u2014 every hidden tool must declare riskClass: <${RISK_CLASSES.join("|")}>`
+      );
+    }
+    if (!RISK_CLASSES.includes(current.riskClass)) {
+      throw new ToolSurfaceError(
+        "risk-class-invalid",
+        `${pluginDir}/${current.name} \u2014 hidden riskClass must be one of ${RISK_CLASSES.join("|")}, got ${JSON.stringify(current.riskClass)}`
+      );
+    }
+    out.push(current);
+    current = null;
+  };
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length === 0) continue;
+    if (/^[A-Za-z_]/.test(line)) break;
+    const newEntry = line.match(/^\s+-\s+name:\s*(.+?)\s*$/);
+    if (newEntry) {
+      flush();
+      current = { name: newEntry[1] };
+      continue;
+    }
+    const bareItem = line.match(/^\s+-\s+(.+?)\s*$/);
+    if (bareItem) {
+      throw new ToolSurfaceError(
+        "hidden-tool-name-missing",
+        `${pluginDir}/PLUGIN.md hidden entry "${bareItem[1]}" is a bare name \u2014 declare it as "- name: ${bareItem[1]}" with a riskClass`
+      );
+    }
+    const risk = line.match(/^\s+riskClass:\s*(.+?)\s*$/);
+    if (risk && current) {
+      current.riskClass = risk[1].trim();
+      continue;
+    }
+  }
+  flush();
+  return out;
+}
+function parseMcpBlock(frontmatter, pluginDir) {
+  const lines = frontmatter.split(/\r?\n/);
+  let i = 0;
+  while (i < lines.length) {
+    if (/^mcp:\s*$/.test(lines[i])) {
+      i++;
+      break;
+    }
+    i++;
+  }
+  if (i >= lines.length) return null;
+  let command = null;
+  const args = [];
+  const env = {};
+  let envHasEntry = false;
+  let mode = "top";
+  for (; i < lines.length; i++) {
+    const line = lines[i];
+    if (line.length === 0) continue;
+    if (/^[A-Za-z_]/.test(line)) break;
+    const topCommand = line.match(/^\s\s(command):\s*(.+?)\s*$/);
+    const topArgsHeader = line.match(/^\s\s(args):\s*$/);
+    const topEnvHeader = line.match(/^\s\s(env):\s*$/);
+    if (topCommand) {
+      command = topCommand[2];
+      mode = "top";
+      continue;
+    }
+    if (topArgsHeader) {
+      mode = "args";
+      continue;
+    }
+    if (topEnvHeader) {
+      mode = "env";
+      continue;
+    }
+    if (mode === "args") {
+      const item = line.match(/^\s+-\s+(.+?)\s*$/);
+      if (item) {
+        args.push(item[1]);
+        continue;
+      }
+    }
+    if (mode === "env") {
+      const kv = line.match(/^\s+([A-Za-z_][A-Za-z0-9_]*):\s*(.+?)\s*$/);
+      if (kv) {
+        env[kv[1]] = kv[2];
+        envHasEntry = true;
+        continue;
+      }
+    }
+  }
+  if (command === null) {
+    throw new ToolSurfaceError("mcp-command-missing", `${pluginDir}/PLUGIN.md mcp: block has no command`);
+  }
+  const desc = { command, args };
+  if (envHasEntry) desc.env = env;
+  return desc;
+}
+function loadToolSurface(pluginsRoots) {
+  const roots = Array.isArray(pluginsRoots) ? pluginsRoots : [pluginsRoots];
+  for (const r of roots) {
+    if (!existsSync30(r)) throw new ToolSurfaceError("plugins-root-missing", r);
+  }
+  const admin = /* @__PURE__ */ new Set();
+  const pub = /* @__PURE__ */ new Set();
+  const all = /* @__PURE__ */ new Set();
+  const mcpServers = /* @__PURE__ */ new Map();
+  const riskByTool = /* @__PURE__ */ new Map();
+  const manifestPaths = /* @__PURE__ */ new Map();
+  const loadOne = (pluginsRoot, plugin) => {
+    const pluginDir = join34(pluginsRoot, plugin);
+    try {
+      if (!statSync16(pluginDir).isDirectory()) return;
+    } catch {
+      return;
+    }
+    const manifestPath = join34(pluginDir, "PLUGIN.md");
+    if (!existsSync30(manifestPath)) return;
+    const raw = readFileSync32(manifestPath, "utf-8");
+    const frontmatter = extractFrontmatter(raw, plugin);
+    const tools = parseToolsBlock(frontmatter, plugin);
+    if (tools.length === 0) return;
+    const mcp = parseMcpBlock(frontmatter, plugin);
+    if (!mcp) {
+      throw new ToolSurfaceError(
+        "mcp-block-missing",
+        `${plugin}/PLUGIN.md declares tools but no mcp: block; spawns would --allowed-tools mcp__${plugin}__* with no registered server`
+      );
+    }
+    if (mcpServers.has(plugin)) {
+      const priorPath = manifestPaths.get(plugin);
+      if (!priorPath) {
+        throw new ToolSurfaceError(
+          "mcp-plugin-duplicate-no-prior-path",
+          `${plugin}: mcpServers has entry but manifestPaths is missing \u2014 invariant violated, both maps must be written together`
+        );
+      }
+      const priorSha = createHash5("sha256").update(readFileSync32(priorPath)).digest("hex").slice(0, 8);
+      const newSha = createHash5("sha256").update(raw).digest("hex").slice(0, 8);
+      throw new ToolSurfaceError(
+        "mcp-plugin-duplicate",
+        `${plugin} declared by more than one plugins root: ${priorPath} (sha=${priorSha}) vs ${manifestPath} (sha=${newSha})`
+      );
+    }
+    mcpServers.set(plugin, mcp);
+    manifestPaths.set(plugin, manifestPath);
+    for (const t of tools) {
+      const canonical = canonicalToolName(plugin, t.name);
+      all.add(canonical);
+      riskByTool.set(canonical, t.riskClass);
+      if (t.adminAllowlist) admin.add(canonical);
+      if (t.publicAllowlist) pub.add(qualifyShortToolName(plugin, t.name));
+    }
+    for (const h of parseHiddenBlock(frontmatter, plugin)) {
+      const canonical = canonicalToolName(plugin, h.name);
+      all.add(canonical);
+      riskByTool.set(canonical, h.riskClass);
+    }
+  };
+  for (const root of roots) {
+    const entries2 = readdirSync21(root).sort();
+    for (const plugin of entries2) {
+      const pluginDir = join34(root, plugin);
+      loadOne(root, plugin);
+      const subRoot = join34(pluginDir, "plugins");
+      let subEntries;
+      try {
+        if (!statSync16(subRoot).isDirectory()) continue;
+        subEntries = readdirSync21(subRoot).sort();
+      } catch {
+        continue;
+      }
+      for (const sub of subEntries) {
+        loadOne(subRoot, sub);
+      }
+    }
+  }
+  return { admin, public: pub, all, mcpServers, riskByTool };
+}
+
+// server/lib/agent-risk.ts
+var BUILTIN_TOOL_RISK = {
+  Bash: "exec",
+  Task: "exec",
+  Skill: "exec",
+  Edit: "write_local",
+  MultiEdit: "write_local",
+  Write: "write_local",
+  Read: "read",
+  Glob: "read",
+  Grep: "read",
+  WebFetch: "external",
+  WebSearch: "external"
+};
+var SEVERITY = {
+  read: 0,
+  write_local: 1,
+  exec: 2,
+  external: 2
+};
+var AGENT_CLASS = {
+  read: "green",
+  write_local: "amber",
+  exec: "red",
+  external: "red"
+};
+function agentRiskClass(tools, riskByTool) {
+  const byTool = [];
+  const unresolved = [];
+  let worst = null;
+  let riskiestTool = null;
+  for (const tool of tools) {
+    const cls = BUILTIN_TOOL_RISK[tool] ?? riskByTool.get(tool) ?? null;
+    byTool.push({ tool, risk: cls });
+    if (cls === null) {
+      unresolved.push(tool);
+      continue;
+    }
+    if (worst === null || SEVERITY[cls] > SEVERITY[worst]) {
+      worst = cls;
+      riskiestTool = tool;
+    }
+  }
+  if (unresolved.length > 0) {
+    return { risk: "red", riskiestTool: unresolved[0], unresolved, byTool };
+  }
+  if (worst === null) {
+    return { risk: "red", riskiestTool: null, unresolved, byTool };
+  }
+  return { risk: AGENT_CLASS[worst], riskiestTool, unresolved, byTool };
+}
+
 // server/routes/admin/agents.ts
 var SLUG_UNSAFE = (s) => s.includes("/") || s.includes("..") || s.includes("\\");
 function subdirs(dir) {
-  if (!existsSync30(dir)) return [];
+  if (!existsSync31(dir)) return [];
   try {
-    return readdirSync21(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return readdirSync22(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
@@ -16569,34 +17029,148 @@ function splitFrontmatter(text) {
   }
   return { fm, body: text.slice(m[0].length) };
 }
-function listSpecialists(accountDir) {
+var SPECIALISTS_DIR = ["specialists", "agents"];
+var QUARANTINE_DIR = ["specialists", "agents-disabled"];
+var DISABLED_STORE = "agents-disabled.json";
+function loadRiskSurface() {
+  const roots = [resolve23(PLATFORM_ROOT, "plugins"), resolve23(PLATFORM_ROOT, "..", "premium-plugins")].filter((r) => existsSync31(r));
+  try {
+    return { riskByTool: loadToolSurface(roots).riskByTool, failed: null };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[admin/agents] op=risk-surface status=load-failed reason="${msg}"`);
+    return { riskByTool: /* @__PURE__ */ new Map(), failed: msg };
+  }
+}
+function readDisabledStoreStrict(accountDir) {
+  const p = resolve23(accountDir, DISABLED_STORE);
+  if (!existsSync31(p)) return /* @__PURE__ */ new Set();
+  const parsed = JSON.parse(readFileSync33(p, "utf-8"));
+  if (!Array.isArray(parsed.disabled)) throw new Error("disabled is not an array");
+  return new Set(parsed.disabled.filter((x) => typeof x === "string"));
+}
+function readDisabledStore(accountDir) {
+  try {
+    return readDisabledStoreStrict(accountDir);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[admin/agents] op=disabled-store status=parse-failed reason="${msg}"`);
+    return /* @__PURE__ */ new Set();
+  }
+}
+function shippedSourceDirs(accountDir) {
+  return [
+    resolve23(accountDir, ...SPECIALISTS_DIR),
+    resolve23(accountDir, ...QUARANTINE_DIR),
+    resolve23(PLATFORM_ROOT, "templates", "specialists", "agents")
+  ];
+}
+function writeDisabledStore(accountDir, disabled) {
+  writeFileSync13(
+    resolve23(accountDir, DISABLED_STORE),
+    `${JSON.stringify({ disabled: [...disabled].sort() }, null, 2)}
+`,
+    { mode: 384 }
+  );
+}
+function listShipped(accountDir, riskByTool, disabled, riskSurfaceFailed) {
+  const dirs = shippedSourceDirs(accountDir);
+  const names = /* @__PURE__ */ new Set();
+  for (const dir of dirs) {
+    if (!existsSync31(dir)) continue;
+    try {
+      for (const entry of readdirSync22(dir)) if (entry.endsWith(".md")) names.add(entry);
+    } catch (err) {
+      console.error(`[admin/agents] op=list-shipped read-failed dir=${dir} error="${err}"`);
+    }
+  }
+  const shipped = [];
+  let shippedSkipped = 0;
+  for (const filename of [...names].sort()) {
+    const source = dirs.find((d) => existsSync31(resolve23(d, filename)));
+    if (!source) continue;
+    try {
+      const { fm } = splitFrontmatter(readFileSync33(resolve23(source, filename), "utf-8"));
+      if (!fm.name) {
+        shippedSkipped++;
+        console.error(`[admin/agents] op=list-shipped-skip file=${filename} reason=no-name`);
+        continue;
+      }
+      const tools = parseToolsLine(fm.tools);
+      const r = classify(tools, riskByTool, riskSurfaceFailed);
+      shipped.push({
+        slug: filename.replace(/\.md$/, ""),
+        displayName: fm.name,
+        kind: "specialist",
+        origin: "shipped",
+        plugin: "",
+        description: fm.description ?? "",
+        risk: r.risk,
+        riskiestTool: r.riskiestTool,
+        unresolved: r.unresolved,
+        toolCount: tools.length,
+        // The DIRECTORY is the ground truth, not the store. `spawn-context.ts`
+        // reads the live dir, so a file found in quarantine is not dispatchable
+        // whatever the JSON says, and a file found live IS dispatchable even if
+        // the store claims otherwise. The store only answers for a bundled-only
+        // agent, which has no account copy in either directory to look at.
+        disabled: source === dirs[1] || source === dirs[2] && disabled.has(filename)
+      });
+    } catch (err) {
+      shippedSkipped++;
+      console.error(`[admin/agents] op=list-shipped-skip file=${filename} error="${err}"`);
+    }
+  }
+  return { shipped, shippedSkipped };
+}
+function parseToolsLine(raw) {
+  return raw ? raw.split(",").map((t) => t.trim()).filter(Boolean) : [];
+}
+function classify(tools, riskByTool, riskSurfaceFailed) {
+  if (riskSurfaceFailed) {
+    return { risk: "red", riskiestTool: null, unresolved: [], byTool: tools.map((t) => ({ tool: t, risk: null })) };
+  }
+  return agentRiskClass(tools, riskByTool);
+}
+function listSpecialists(accountDir, riskByTool, riskSurfaceFailed) {
   const pluginsDir = resolve23(accountDir, "plugins");
   const specialists = [];
   let specialistsSkipped = 0;
   for (const plugin of subdirs(pluginsDir).sort()) {
     const agentsDirP = resolve23(pluginsDir, plugin, "agents");
-    if (!existsSync30(agentsDirP)) continue;
+    if (!existsSync31(agentsDirP)) continue;
     let entries2;
     try {
-      entries2 = readdirSync21(agentsDirP, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      entries2 = readdirSync22(agentsDirP, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
     } catch {
       continue;
     }
     for (const entry of entries2) {
       if (!entry.isFile() || !entry.name.endsWith(".md")) continue;
       try {
-        const { fm } = splitFrontmatter(readFileSync32(resolve23(agentsDirP, entry.name), "utf-8"));
+        const { fm } = splitFrontmatter(readFileSync33(resolve23(agentsDirP, entry.name), "utf-8"));
         if (!fm.name) {
           specialistsSkipped++;
           console.error(`[admin/agents] op=list-specialist-skip plugin=${plugin} file=${entry.name}`);
           continue;
         }
+        const specialistTools = parseToolsLine(fm.tools);
+        const r = classify(specialistTools, riskByTool, riskSurfaceFailed);
         specialists.push({
           slug: entry.name.replace(/\.md$/, ""),
           displayName: fm.name,
           kind: "specialist",
+          origin: "specialist",
           plugin,
-          description: fm.description ?? ""
+          description: fm.description ?? "",
+          risk: r.risk,
+          riskiestTool: r.riskiestTool,
+          unresolved: r.unresolved,
+          toolCount: specialistTools.length,
+          // A user-created specialist lives under the account plugins tree,
+          // which provisioning never rewrites, so the quarantine mechanism
+          // does not apply to it.
+          disabled: false
         });
       } catch {
         specialistsSkipped++;
@@ -16619,24 +17193,31 @@ app18.get("/", requireAdminSession, (c) => {
     console.error("[admin/agents] op=list auth-rejected reason=no-account-for-session");
     return c.json({ error: "Account not found for session" }, 401);
   }
+  const { riskByTool, failed: riskSurfaceFailed } = loadRiskSurface();
+  const disabled = readDisabledStore(account.accountDir);
   const agents = [];
   let skipped = 0;
   const agentsDir = resolve23(account.accountDir, "agents");
-  if (existsSync30(agentsDir)) {
+  if (existsSync31(agentsDir)) {
     try {
-      const entries2 = readdirSync21(agentsDir, { withFileTypes: true });
+      const entries2 = readdirSync22(agentsDir, { withFileTypes: true });
       for (const entry of entries2.sort((a, b) => a.name.localeCompare(b.name))) {
         if (!entry.isDirectory()) continue;
         if (entry.name === "admin") continue;
         const configPath2 = resolve23(agentsDir, entry.name, "config.json");
-        if (!existsSync30(configPath2)) continue;
+        if (!existsSync31(configPath2)) continue;
         try {
-          const config = JSON.parse(readFileSync32(configPath2, "utf-8"));
+          const config = JSON.parse(readFileSync33(configPath2, "utf-8"));
           agents.push({
             slug: entry.name,
             displayName: config.displayName ?? entry.name,
             status: config.status ?? "unknown",
-            kind: "public"
+            kind: "public",
+            origin: "public",
+            risk: null,
+            riskiestTool: null,
+            unresolved: [],
+            disabled: false
           });
         } catch {
           skipped++;
@@ -16647,9 +17228,25 @@ app18.get("/", requireAdminSession, (c) => {
       console.error(`[admin/agents] failed to scan agents directory: ${err}`);
     }
   }
-  const { specialists, specialistsSkipped } = listSpecialists(account.accountDir);
-  console.log(`[admin/agents] op=list accountId=${account.accountId.slice(0, 8)} agents=${agents.length} specialists=${specialists.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped}`);
-  return c.json({ agents: [...agents, ...specialists], accountId: account.accountId, skipped, specialistsSkipped });
+  const { specialists, specialistsSkipped } = listSpecialists(account.accountDir, riskByTool, riskSurfaceFailed !== null);
+  const { shipped, shippedSkipped } = listShipped(account.accountDir, riskByTool, disabled, riskSurfaceFailed !== null);
+  const rows = [...agents, ...specialists, ...shipped];
+  const acct = account.accountId.slice(0, 8);
+  for (const row of rows) {
+    if (row.risk === null) continue;
+    console.log(
+      `[admin/agents] op=classify account=${acct} agent=${row.slug} origin=${row.origin} risk=${row.risk} riskiestTool=${row.riskiestTool ?? "none"} tools=${row.toolCount} unresolved=${row.unresolved.length > 0 ? row.unresolved.join(",") : "none"} disabled=${row.disabled}`
+    );
+  }
+  console.log(`[admin/agents] op=list accountId=${acct} agents=${agents.length} specialists=${specialists.length} shipped=${shipped.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped} shippedSkipped=${shippedSkipped}`);
+  return c.json({
+    agents: rows,
+    accountId: account.accountId,
+    skipped,
+    specialistsSkipped,
+    shippedSkipped,
+    riskSurfaceFailed: riskSurfaceFailed !== null
+  });
 });
 app18.get("/:slug", requireAdminSession, (c) => {
   const slug = c.req.param("slug");
@@ -16659,34 +17256,72 @@ app18.get("/:slug", requireAdminSession, (c) => {
     return c.json({ error: "Account not found for session" }, 401);
   }
   if (SLUG_UNSAFE(slug)) return c.json({ error: "Invalid agent slug" }, 400);
+  if (c.req.query("origin") === "shipped") {
+    const dirs = shippedSourceDirs(account.accountDir);
+    const source = dirs.find((d) => existsSync31(resolve23(d, `${slug}.md`)));
+    if (!source) return c.json({ error: "Agent not found" }, 404);
+    const { fm, body } = splitFrontmatter(readFileSync33(resolve23(source, `${slug}.md`), "utf-8"));
+    const { riskByTool, failed } = loadRiskSurface();
+    const tools = parseToolsLine(fm.tools);
+    const r = classify(tools, riskByTool, failed !== null);
+    console.log(`[admin/agents] op=detail accountId=${account.accountId.slice(0, 8)} slug=${slug} kind=specialist origin=shipped risk=${r.risk}`);
+    return c.json({
+      agent: {
+        kind: "specialist",
+        origin: "shipped",
+        slug,
+        displayName: fm.name ?? slug,
+        description: fm.description ?? "",
+        summary: fm.summary ?? "",
+        model: fm.model ?? null,
+        tools,
+        systemPrompt: body.trim(),
+        skills: [],
+        risk: r.risk,
+        riskiestTool: r.riskiestTool,
+        unresolved: r.unresolved,
+        byTool: r.byTool,
+        disabled: readDisabledStore(account.accountDir).has(`${slug}.md`)
+      }
+    });
+  }
   const pluginParam = c.req.query("plugin");
   if (pluginParam) {
     if (SLUG_UNSAFE(pluginParam)) return c.json({ error: "Invalid plugin" }, 400);
     const file = resolve23(account.accountDir, "plugins", pluginParam, "agents", `${slug}.md`);
-    if (!existsSync30(file)) return c.json({ error: "Agent not found" }, 404);
-    const { fm, body } = splitFrontmatter(readFileSync32(file, "utf-8"));
+    if (!existsSync31(file)) return c.json({ error: "Agent not found" }, 404);
+    const { fm, body } = splitFrontmatter(readFileSync33(file, "utf-8"));
     const skills = subdirs(resolve23(account.accountDir, "plugins", pluginParam, "skills"));
-    console.log(`[admin/agents] op=detail accountId=${account.accountId.slice(0, 8)} slug=${slug} kind=specialist plugin=${pluginParam}`);
+    const { riskByTool, failed } = loadRiskSurface();
+    const tools = parseToolsLine(fm.tools);
+    const r = classify(tools, riskByTool, failed !== null);
+    console.log(`[admin/agents] op=detail accountId=${account.accountId.slice(0, 8)} slug=${slug} kind=specialist plugin=${pluginParam} risk=${r.risk}`);
     return c.json({
       agent: {
         kind: "specialist",
+        origin: "specialist",
         slug,
         displayName: fm.name ?? slug,
         description: fm.description ?? "",
         summary: fm.summary ?? "",
         model: fm.model ?? null,
-        tools: fm.tools ? fm.tools.split(",").map((t) => t.trim()).filter(Boolean) : [],
+        tools,
         systemPrompt: body.trim(),
-        skills
+        skills,
+        risk: r.risk,
+        riskiestTool: r.riskiestTool,
+        unresolved: r.unresolved,
+        byTool: r.byTool,
+        disabled: false
       }
     });
   }
   const agentDir = resolve23(account.accountDir, "agents", slug);
   const configPath2 = resolve23(agentDir, "config.json");
-  if (!existsSync30(configPath2)) return c.json({ error: "Agent not found" }, 404);
+  if (!existsSync31(configPath2)) return c.json({ error: "Agent not found" }, 404);
   let config;
   try {
-    config = JSON.parse(readFileSync32(configPath2, "utf-8"));
+    config = JSON.parse(readFileSync33(configPath2, "utf-8"));
   } catch {
     console.error(`[admin/agents] op=detail slug=${slug} error="config.json parse failed"`);
     return c.json({ error: "Agent config unreadable" }, 500);
@@ -16696,8 +17331,8 @@ app18.get("/:slug", requireAdminSession, (c) => {
   for (const { file, key } of OWNED_DOCS) {
     const p = resolve23(agentDir, file);
     try {
-      if (existsSync30(p)) {
-        docs[key] = readFileSync32(p, "utf-8");
+      if (existsSync31(p)) {
+        docs[key] = readFileSync33(p, "utf-8");
         present[key] = true;
       } else {
         docs[key] = "";
@@ -16726,6 +17361,84 @@ app18.get("/:slug", requireAdminSession, (c) => {
     }
   });
 });
+async function resolveWritableAccount(c, op, slug) {
+  const accountIdParam = c.req.query("accountId") ?? "";
+  if (!accountIdParam) {
+    console.error(`[admin/agents] op=${op} rejected reason=missing-accountId slug=${slug}`);
+    return { status: 400, error: "accountId is required" };
+  }
+  const account = validateAccountId2(accountIdParam);
+  if (!account) {
+    console.error(`[admin/agents] op=${op} rejected reason=unknown-accountId accountId=${accountIdParam.slice(0, 8)} slug=${slug}`);
+    return { status: 400, error: "Unknown accountId" };
+  }
+  const authz = await authorizeAccountWrite(c, account.accountId);
+  if (!authz.ok) {
+    console.error(`[admin/agents] op=${op} rejected reason=${authz.reason} accountId=${account.accountId.slice(0, 8)} slug=${slug}`);
+    return { status: 403, error: "Not authorized for this account" };
+  }
+  return account;
+}
+app18.post("/:slug/disable", async (c) => {
+  const slug = c.req.param("slug");
+  if (SLUG_UNSAFE(slug)) return c.json({ error: "Invalid agent slug" }, 400);
+  const resolved = await resolveWritableAccount(c, "disable", slug);
+  if ("status" in resolved) return c.json({ error: resolved.error }, resolved.status);
+  const filename = `${slug}.md`;
+  const live = resolve23(resolved.accountDir, ...SPECIALISTS_DIR, filename);
+  const quarantined = resolve23(resolved.accountDir, ...QUARANTINE_DIR, filename);
+  if (!shippedSourceDirs(resolved.accountDir).some((d) => existsSync31(resolve23(d, filename)))) {
+    console.error(`[admin/agents] op=disable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} outcome=failed reason=not-a-shipped-agent`);
+    return c.json({ error: "Only a shipped agent can be disabled" }, 404);
+  }
+  let moved = false;
+  try {
+    const disabled = readDisabledStoreStrict(resolved.accountDir);
+    if (existsSync31(live)) {
+      mkdirSync7(resolve23(resolved.accountDir, ...QUARANTINE_DIR), { recursive: true });
+      renameSync9(live, quarantined);
+      moved = true;
+    }
+    disabled.add(filename);
+    writeDisabledStore(resolved.accountDir, disabled);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[admin/agents] op=disable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} outcome=failed reason="${msg}"`);
+    return c.json({ error: `Disable failed, disabled store unreadable or unwritable: ${msg}` }, 500);
+  }
+  console.log(`[admin/agents] op=disable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} outcome=ok moved=${moved}`);
+  return c.json({ ok: true, moved });
+});
+app18.post("/:slug/enable", async (c) => {
+  const slug = c.req.param("slug");
+  if (SLUG_UNSAFE(slug)) return c.json({ error: "Invalid agent slug" }, 400);
+  const resolved = await resolveWritableAccount(c, "enable", slug);
+  if ("status" in resolved) return c.json({ error: resolved.error }, resolved.status);
+  const filename = `${slug}.md`;
+  const live = resolve23(resolved.accountDir, ...SPECIALISTS_DIR, filename);
+  const quarantined = resolve23(resolved.accountDir, ...QUARANTINE_DIR, filename);
+  let restored = false;
+  try {
+    const disabled = readDisabledStoreStrict(resolved.accountDir);
+    if (!existsSync31(quarantined) && !disabled.has(filename)) {
+      console.error(`[admin/agents] op=enable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} outcome=failed reason=not-disabled`);
+      return c.json({ error: "This agent is not disabled" }, 404);
+    }
+    if (existsSync31(quarantined)) {
+      mkdirSync7(resolve23(resolved.accountDir, ...SPECIALISTS_DIR), { recursive: true });
+      renameSync9(quarantined, live);
+      restored = true;
+    }
+    disabled.delete(filename);
+    writeDisabledStore(resolved.accountDir, disabled);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`[admin/agents] op=enable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} outcome=failed reason="${msg}"`);
+    return c.json({ error: `Enable failed: ${msg}` }, 500);
+  }
+  console.log(`[admin/agents] op=enable accountId=${resolved.accountId.slice(0, 8)} slug=${slug} outcome=ok restored=${restored}`);
+  return c.json({ ok: true, restored });
+});
 app18.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   if (slug === "admin") {
@@ -16750,7 +17463,7 @@ app18.delete("/:slug", async (c) => {
     return c.json({ error: "Not authorized for this account" }, 403);
   }
   const agentDir = resolve23(account.accountDir, "agents", slug);
-  if (!existsSync30(agentDir)) {
+  if (!existsSync31(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -16793,7 +17506,7 @@ app18.post("/:slug/project", async (c) => {
     return c.json({ error: "Not authorized for this account" }, 403);
   }
   const agentDir = resolve23(account.accountDir, "agents", slug);
-  if (!existsSync30(agentDir)) {
+  if (!existsSync31(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -16809,7 +17522,7 @@ var agents_default = app18;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync31, mkdirSync as mkdirSync7, createWriteStream } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync8, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -16956,7 +17669,7 @@ var pickComponentBytes = (..._args) => null;
 function openResumeStreamLog(accountId, sessionId) {
   const dir = resolvePath(ACCOUNTS_DIR, accountId, "resume-logs");
   try {
-    mkdirSync7(dir, { recursive: true });
+    mkdirSync8(dir, { recursive: true });
   } catch {
   }
   return createWriteStream(resolvePath(dir, `${sessionId}.log`), { flags: "a" });
@@ -16969,7 +17682,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync31(a.storagePath)) reason = "missing-file";
+    else if (!existsSync32(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -17495,8 +18208,8 @@ app19.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app19;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync32, readFileSync as readFileSync33, readdirSync as readdirSync22, statSync as statSync15 } from "fs";
-import { dirname as dirname12, resolve as resolve24, join as join33 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync34, readdirSync as readdirSync23, statSync as statSync17 } from "fs";
+import { dirname as dirname12, resolve as resolve24, join as join35 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -17537,14 +18250,14 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join33(pluginDir, "mcp/dist/index.js"),
-    join33(pluginDir, "mcp/src/index.ts")
+    join35(pluginDir, "mcp/dist/index.js"),
+    join35(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path3 of candidates) {
-    if (!existsSync32(path3)) continue;
+    if (!existsSync33(path3)) continue;
     try {
-      raw = readFileSync33(path3, "utf-8");
+      raw = readFileSync34(path3, "utf-8");
       break;
     } catch {
     }
@@ -17594,25 +18307,25 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs(accountPluginsDir) {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve24(PLATFORM_ROOT, "plugins");
-  if (existsSync32(platformPlugins)) {
-    for (const name of readdirSync22(platformPlugins)) {
-      const dir = join33(platformPlugins, name);
+  if (existsSync33(platformPlugins)) {
+    for (const name of readdirSync23(platformPlugins)) {
+      const dir = join35(platformPlugins, name);
       try {
-        if (statSync15(dir).isDirectory()) out.set(name, dir);
+        if (statSync17(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
   const premiumRoot = resolve24(dirname12(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync32(premiumRoot)) {
-    for (const bundle of readdirSync22(premiumRoot)) {
-      const bundlePlugins = join33(premiumRoot, bundle, "plugins");
-      if (!existsSync32(bundlePlugins)) continue;
+  if (existsSync33(premiumRoot)) {
+    for (const bundle of readdirSync23(premiumRoot)) {
+      const bundlePlugins = join35(premiumRoot, bundle, "plugins");
+      if (!existsSync33(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync22(bundlePlugins)) {
-          const dir = join33(bundlePlugins, name);
+        for (const name of readdirSync23(bundlePlugins)) {
+          const dir = join35(bundlePlugins, name);
           try {
-            if (statSync15(dir).isDirectory()) out.set(name, dir);
+            if (statSync17(dir).isDirectory()) out.set(name, dir);
           } catch {
           }
         }
@@ -17620,13 +18333,13 @@ function listPluginDirs(accountPluginsDir) {
       }
     }
   }
-  if (accountPluginsDir && existsSync32(accountPluginsDir)) {
+  if (accountPluginsDir && existsSync33(accountPluginsDir)) {
     try {
-      for (const name of readdirSync22(accountPluginsDir)) {
+      for (const name of readdirSync23(accountPluginsDir)) {
         if (out.has(name)) continue;
-        const dir = join33(accountPluginsDir, name);
+        const dir = join35(accountPluginsDir, name);
         try {
-          if (statSync15(dir).isDirectory()) out.set(name, dir);
+          if (statSync17(dir).isDirectory()) out.set(name, dir);
         } catch {
         }
       }
@@ -17639,11 +18352,11 @@ function accountPluginsDirFor(accountId) {
   return resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "plugins");
 }
 function listAccountPluginNames(accountPluginsDir) {
-  if (!existsSync32(accountPluginsDir)) return [];
+  if (!existsSync33(accountPluginsDir)) return [];
   try {
-    return readdirSync22(accountPluginsDir).filter((name) => {
+    return readdirSync23(accountPluginsDir).filter((name) => {
       try {
-        return statSync15(join33(accountPluginsDir, name)).isDirectory();
+        return statSync17(join35(accountPluginsDir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -17654,9 +18367,9 @@ function listAccountPluginNames(accountPluginsDir) {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync32(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync33(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync33(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync34(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -17665,10 +18378,10 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path3) {
-  if (!existsSync32(path3)) return null;
+  if (!existsSync33(path3)) return null;
   let raw;
   try {
-    raw = readFileSync33(path3, "utf-8");
+    raw = readFileSync34(path3, "utf-8");
   } catch {
     return null;
   }
@@ -17686,7 +18399,7 @@ function computeActivePlugins(accountId) {
   for (const name of emitNames) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join33(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join35(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -17703,7 +18416,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync32(join33(dir, "mcp/dist/index.js")) || existsSync32(join33(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync33(join35(dir, "mcp/dist/index.js")) || existsSync33(join35(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -17713,7 +18426,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join33(dir, relPath);
+      const skillPath = join35(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -17730,10 +18443,10 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync32(specialistsDir)) return [];
+  if (!existsSync33(specialistsDir)) return [];
   let entries2;
   try {
-    entries2 = readdirSync22(specialistsDir);
+    entries2 = readdirSync23(specialistsDir);
   } catch {
     return [];
   }
@@ -17757,7 +18470,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries2.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join33(specialistsDir, file));
+    const fm = readFrontmatter(join35(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -17776,10 +18489,10 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve24(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync32(accountFile)) return [];
+  if (!existsSync33(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync33(accountFile, "utf-8");
+    const raw = readFileSync34(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -17791,10 +18504,10 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve24(PLATFORM_ROOT, "plugins");
-  if (!existsSync32(pluginsDir)) return [];
+  if (!existsSync33(pluginsDir)) return [];
   let entries2;
   try {
-    entries2 = readdirSync22(pluginsDir);
+    entries2 = readdirSync23(pluginsDir);
   } catch {
     return [];
   }
@@ -17802,10 +18515,10 @@ function computeDormantPlugins(accountId) {
   for (const name of entries2) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve24(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync32(manifestPath)) continue;
+    if (!existsSync33(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync33(manifestPath, "utf-8");
+      manifest = readFileSync34(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -17819,13 +18532,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync33, readFileSync as readFileSync34 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync35 } from "fs";
 import { resolve as resolve25 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync33(statePath)) return null;
+  if (!existsSync34(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync34(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync35(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -17839,7 +18552,7 @@ function resolveTunnelUrl() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync34(resolve25(platformRoot5, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync35(resolve25(platformRoot5, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -18152,11 +18865,11 @@ app22.get("/", requireAdminSession, async (c) => {
 var events_default = app22;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync34 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync35 } from "fs";
 import { readdir as readdir4, readFile as readFile7, stat as stat6, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
 import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename11, dirname as dirname13, join as join35, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
+import { basename as basename11, dirname as dirname13, join as join37, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -18474,7 +19187,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve26, relative as relative4, join as join34, basename as basename10, extname as extname2, sep as sep7 } from "path";
+import { resolve as resolve26, relative as relative4, join as join36, basename as basename10, extname as extname2, sep as sep7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -18556,7 +19269,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join34(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join36(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -18618,7 +19331,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join34(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join36(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -18639,7 +19352,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries2) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join34(root, entry.name);
+    const abs = join36(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -19012,7 +19725,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile7(join35(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile7(join37(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -19067,7 +19780,7 @@ async function servableFilesIn(dirAbs, uuid) {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
-    const dirAbs = join35(absolute, entry.name);
+    const dirAbs = join37(absolute, entry.name);
     const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
       const servable = await servableFilesIn(dirAbs, entry.name);
@@ -19076,7 +19789,7 @@ async function enrich(absolute, entry, accountNames) {
         let size = null;
         let modifiedAt = entry.modifiedAt;
         try {
-          const st = await stat6(join35(dirAbs, innerName));
+          const st = await stat6(join37(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
@@ -19269,7 +19982,7 @@ app23.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join35(absolute, name);
+        const entryPath = join37(absolute, name);
         const s = await stat6(entryPath);
         entries2.push({
           name,
@@ -19298,7 +20011,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const displayPath = buildDisplayPath(relPath, accountNames);
     if (groupReq || isAccountRoot(relPath)) {
       const acctId = relPath.split("/")[1] ?? accountId;
-      const schemaMd = await readFile7(join35(absolute, "SCHEMA.md"), "utf8").catch(() => null);
+      const schemaMd = await readFile7(join37(absolute, "SCHEMA.md"), "utf8").catch(() => null);
       const groups = classifyAccountRoot(schemaMd, entries2.map((e) => e.name));
       console.error(
         `[data-schema] op=classify account=${acctId} status=${groups.parsed ? "ok" : "parse-failed"} reason=${groups.reason} entries=${entries2.length} home=${groups.home.join(",") || "none"} system=${groups.system.length} unknown=${groups.unknown.join(",") || "none"}`
@@ -19336,7 +20049,7 @@ app23.get("/", requireAdminSession, async (c) => {
       for (const name of homeDirs) {
         const base = byName.get(name);
         try {
-          const dirents = await readdir4(join35(absolute, name), { withFileTypes: true });
+          const dirents = await readdir4(join37(absolute, name), { withFileTypes: true });
           const visible = dirents.filter((d) => !d.name.startsWith("."));
           visible.sort((a, b) => {
             const ad = a.isDirectory() ? 0 : 1;
@@ -19401,7 +20114,7 @@ app23.get("/download", requireAdminSession, async (c) => {
       console.error(`[data] op=scratchpad-no-session sessionId="${sessionId.slice(0, 8)}\u2026"`);
       return c.json({ error: "Not found" }, 404);
     }
-    const meta = readSidecarMeta(join35(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join37(projectDir, `${sessionId}.meta.json`));
     if (!meta.accountId || meta.accountId !== accountId) {
       console.error(`[data] account-scope-blocked root="scratchpad" sessionId="${sessionId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
@@ -19496,7 +20209,7 @@ async function* walkRegularFiles(dirAbsolute) {
   const dirents = await readdir4(dirAbsolute, { withFileTypes: true });
   for (const d of dirents) {
     if (d.isSymbolicLink()) continue;
-    const child = join35(dirAbsolute, d.name);
+    const child = join37(dirAbsolute, d.name);
     if (d.isDirectory()) {
       yield* walkRegularFiles(child);
       continue;
@@ -19606,7 +20319,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
   const relDir = relpath ? dirname13(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join35(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join37(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 404, error: "Not found" };
@@ -19680,7 +20393,7 @@ app23.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink3(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync34(tmpPath);
+    const tempRemoved = !existsSync35(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -19754,7 +20467,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink3(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync34(state.tmpPath);
+  const tempRemoved = !existsSync35(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -19983,7 +20696,7 @@ app23.delete("/", requireAdminSession, async (c) => {
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
     const containerDir = dirname13(absolute);
-    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join35(containerDir, `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join37(containerDir, `${stem}.meta.json`) : null;
     const isAttachmentContainer = UUID_RE4.test(stem) && basename11(containerDir) === stem;
     await unlink3(absolute);
     if (sidecarPath) {
@@ -19993,7 +20706,7 @@ app23.delete("/", requireAdminSession, async (c) => {
       }
     }
     if (isAttachmentContainer) {
-      await unlink3(join35(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      await unlink3(join37(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
       });
       await rmdir(containerDir).catch(() => {
       });
@@ -20172,7 +20885,7 @@ function applyBacklinkBoost(hits) {
 }
 
 // ../lib/graph-search/src/dedup.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 var DEFAULT_LAYERS = [
   "nodeId",
   "slug",
@@ -20199,7 +20912,7 @@ function readContentHash(props) {
   const content = props["content"];
   const source = typeof compiled === "string" && compiled.length > 0 ? compiled : typeof content === "string" && content.length > 0 ? content : null;
   if (source === null) return null;
-  return createHash5("sha256").update(source).digest("hex").slice(0, 16);
+  return createHash6("sha256").update(source).digest("hex").slice(0, 16);
 }
 function dedup(hits, layers = DEFAULT_LAYERS) {
   const sorted = [...hits].sort((a, b) => b.score - a.score);
@@ -21102,8 +21815,8 @@ function isHiddenByDefault(label) {
 
 // server/lib/top-level-labels.ts
 var import_dist5 = __toESM(require_dist4(), 1);
-import { readdirSync as readdirSync23, readFileSync as readFileSync35 } from "fs";
-import { join as join36, resolve as resolve28 } from "path";
+import { readdirSync as readdirSync24, readFileSync as readFileSync36 } from "fs";
+import { join as join38, resolve as resolve28 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -21207,7 +21920,7 @@ function parseTopLevelLabels(content) {
 }
 function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
-    return join36(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+    return join38(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
   return resolve28(import.meta.dirname, "../../../plugins/memory/references");
 }
@@ -21215,9 +21928,9 @@ function parseTableTopLevelLabels(referencesDir) {
   const labels = /* @__PURE__ */ new Set();
   const contributingFiles = [];
   try {
-    const fileNames = readdirSync23(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
+    const fileNames = readdirSync24(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
     for (const fileName of fileNames) {
-      const content = readFileSync35(join36(referencesDir, fileName), "utf-8");
+      const content = readFileSync36(join38(referencesDir, fileName), "utf-8");
       const parsed = parseTopLevelLabels(content);
       if (parsed.length > 0) contributingFiles.push(fileName);
       for (const label of parsed) labels.add(label);
@@ -22375,7 +23088,7 @@ var graph_default_view_default = app29;
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir5, stat as stat7 } from "fs/promises";
 import { resolve as resolve29, relative as relative6, isAbsolute as isAbsolute2, sep as sep9, basename as basename12 } from "path";
-import { existsSync as existsSync35 } from "fs";
+import { existsSync as existsSync36 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -22487,7 +23200,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync35(dir)) continue;
+    if (!existsSync36(dir)) continue;
     try {
       const entries2 = await readdir5(dir);
       for (const entry of entries2) {
@@ -22502,7 +23215,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync35(inp.overridePath)) {
+  if (existsSync36(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -22513,7 +23226,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync35(inp.bundledPath)) {
+  } else if (existsSync36(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -22555,19 +23268,19 @@ function isWithin(target, root) {
 var sidebar_artefacts_default = app30;
 
 // server/channel-session-override.ts
-import { readFileSync as readFileSync36, writeFileSync as writeFileSync13, renameSync as renameSync9 } from "fs";
-import { join as join37 } from "path";
+import { readFileSync as readFileSync37, writeFileSync as writeFileSync14, renameSync as renameSync10 } from "fs";
+import { join as join39 } from "path";
 var FILE2 = "channel-session-override.json";
 var UUID3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function channelOverridePath(accountDir) {
-  return join37(accountDir, FILE2);
+  return join39(accountDir, FILE2);
 }
 function senderKey(channel, senderId) {
   return `${channel}:${senderId}`;
 }
 function readRaw2(accountDir) {
   try {
-    return JSON.parse(readFileSync36(channelOverridePath(accountDir), "utf8"));
+    return JSON.parse(readFileSync37(channelOverridePath(accountDir), "utf8"));
   } catch {
     return null;
   }
@@ -22589,8 +23302,8 @@ function writeChannelOverrideId(accountDir, channel, senderId, sessionId) {
   bySender[senderKey(channel, senderId)] = sessionId;
   const path3 = channelOverridePath(accountDir);
   const tmp = `${path3}.${process.pid}.tmp`;
-  writeFileSync13(tmp, JSON.stringify({ bySender }, null, 2), "utf8");
-  renameSync9(tmp, path3);
+  writeFileSync14(tmp, JSON.stringify({ bySender }, null, 2), "utf8");
+  renameSync10(tmp, path3);
 }
 function clearChannelOverrideForSession(accountDir, sessionId) {
   const raw = readRaw2(accountDir);
@@ -22605,8 +23318,8 @@ function clearChannelOverrideForSession(accountDir, sessionId) {
   if (cleared.length === 0) return [];
   const path3 = channelOverridePath(accountDir);
   const tmp = `${path3}.${process.pid}.tmp`;
-  writeFileSync13(tmp, JSON.stringify({ bySender: kept }, null, 2), "utf8");
-  renameSync9(tmp, path3);
+  writeFileSync14(tmp, JSON.stringify({ bySender: kept }, null, 2), "utf8");
+  renameSync10(tmp, path3);
   return cleared;
 }
 
@@ -22956,24 +23669,24 @@ var session_rc_spawn_default = app36;
 import { randomUUID as randomUUID12 } from "crypto";
 
 // server/wa-descriptor.ts
-import { resolve as resolve30, join as join38 } from "path";
+import { resolve as resolve30, join as join40 } from "path";
 function waGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function waServerPath() {
-  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
+  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join40(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
 }
 function waChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: waGatewayUrl(), serverPath: waServerPath() };
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve31, join as join39 } from "path";
+import { resolve as resolve31, join as join41 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 function telegramChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: telegramGatewayUrl(), serverPath: telegramServerPath() };
@@ -23257,14 +23970,14 @@ app38.get("/", async (c) => {
 var system_stats_default = app38;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync36, readFileSync as readFileSync37 } from "fs";
-import { resolve as resolve32, join as join40 } from "path";
+import { existsSync as existsSync37, readFileSync as readFileSync38 } from "fs";
+import { resolve as resolve32, join as join42 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve32(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join40(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync36(brandJsonPath)) {
+var brandJsonPath = join42(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync37(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync37(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync38(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -23273,8 +23986,8 @@ var VERSION_FILE = resolve32(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync36(VERSION_FILE)) return "unknown";
-  return readFileSync37(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync37(VERSION_FILE)) return "unknown";
+  return readFileSync38(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -24050,8 +24763,8 @@ app46.post("/launch", requireAdminSession, async (c) => {
 var browser_default = app46;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync37 } from "fs";
-import { join as join42 } from "path";
+import { existsSync as existsSync38 } from "fs";
+import { join as join44 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -24150,8 +24863,8 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync38 } from "fs";
-import { join as join41 } from "path";
+import { readFileSync as readFileSync39 } from "fs";
+import { join as join43 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -24160,10 +24873,10 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join41(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join43(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync38(path3, "utf-8");
+    raw = readFileSync39(path3, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path3} not found`);
   }
@@ -24522,7 +25235,7 @@ app47.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync37(join42(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync38(join44(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -24724,7 +25437,7 @@ app48.delete("/:eventId", requireAdminSession, async (c) => {
 var routines_default = app48;
 
 // server/routes/admin/skills.ts
-import { existsSync as existsSync38, readdirSync as readdirSync24, readFileSync as readFileSync39, rmSync as rmSync3 } from "fs";
+import { existsSync as existsSync39, readdirSync as readdirSync25, readFileSync as readFileSync40, rmSync as rmSync3 } from "fs";
 import { resolve as resolve33 } from "path";
 var app49 = new Hono();
 var NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
@@ -24748,9 +25461,9 @@ function stripQuotes(s) {
   return s;
 }
 function subdirs2(dir) {
-  if (!existsSync38(dir)) return [];
+  if (!existsSync39(dir)) return [];
   try {
-    return readdirSync24(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return readdirSync25(dir, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
@@ -24771,11 +25484,11 @@ app49.get("/", requireAdminSession, async (c) => {
       const skillsDir = resolve33(pluginsDir, plugin, "skills");
       for (const skill of subdirs2(skillsDir)) {
         const skillMd = resolve33(skillsDir, skill, "SKILL.md");
-        if (!existsSync38(skillMd)) continue;
+        if (!existsSync39(skillMd)) continue;
         try {
-          const { frontmatter } = splitSkillMd(readFileSync39(skillMd, "utf-8"));
+          const { frontmatter } = splitSkillMd(readFileSync40(skillMd, "utf-8"));
           const refsDir = resolve33(skillsDir, skill, "references");
-          const refCount = existsSync38(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
+          const refCount = existsSync39(refsDir) ? readdirSync25(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).length : 0;
           skills.push({ plugin, skill, description: frontmatter.description, refCount });
         } catch (err) {
           console.error(`[admin:skills] op=list-skip plugin=${plugin} skill=${skill} reason="${err instanceof Error ? err.message : String(err)}"`);
@@ -24799,13 +25512,13 @@ app49.get("/:plugin/:skill", requireAdminSession, async (c) => {
   }
   const skillDir = resolve33(acct.accountDir, "plugins", plugin, "skills", skill);
   const skillMd = resolve33(skillDir, "SKILL.md");
-  const found = existsSync38(skillMd);
+  const found = existsSync39(skillMd);
   console.log(`[admin:skills] op=get plugin=${plugin} skill=${skill} found=${found}`);
   if (!found) return c.json({ error: "Skill not found" }, 404);
   try {
-    const { frontmatter, body } = splitSkillMd(readFileSync39(skillMd, "utf-8"));
+    const { frontmatter, body } = splitSkillMd(readFileSync40(skillMd, "utf-8"));
     const refsDir = resolve33(skillDir, "references");
-    const references = existsSync38(refsDir) ? readdirSync24(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
+    const references = existsSync39(refsDir) ? readdirSync25(refsDir, { withFileTypes: true }).filter((e) => e.isFile()).map((e) => e.name).sort() : [];
     return c.json({ skill: { plugin, skill, frontmatter, body, references } });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -24825,7 +25538,7 @@ app49.delete("/:plugin/:skill", requireAdminSession, async (c) => {
   const pluginDir = resolve33(acct.accountDir, "plugins", plugin);
   const skillsDir = resolve33(pluginDir, "skills");
   const skillDir = resolve33(skillsDir, skill);
-  if (!existsSync38(resolve33(skillDir, "SKILL.md"))) {
+  if (!existsSync39(resolve33(skillDir, "SKILL.md"))) {
     console.error(`[admin:skills] op=delete outcome=rejected reason=not-found plugin=${plugin} skill=${skill}`);
     return c.json({ error: "Skill not found" }, 404);
   }
@@ -24833,7 +25546,7 @@ app49.delete("/:plugin/:skill", requireAdminSession, async (c) => {
     rmSync3(skillDir, { recursive: true, force: true });
     const pluginDirRemoved = subdirs2(skillsDir).length === 0;
     if (pluginDirRemoved) rmSync3(pluginDir, { recursive: true, force: true });
-    const skillDirGone = !existsSync38(skillDir);
+    const skillDirGone = !existsSync39(skillDir);
     if (!skillDirGone) {
       console.error(`[admin:skills] op=delete plugin=${plugin} skill=${skill} outcome=rejected reason=rm-incomplete skillDirGone=false`);
       return c.json({ error: "Delete did not remove the skill directory" }, 503);
@@ -25243,20 +25956,20 @@ app54.post("/", requireAdminSession, async (c) => {
 var task_time_adjust_default = app54;
 
 // app/lib/admin-roster.ts
-import { existsSync as existsSync39, readdirSync as readdirSync25, readFileSync as readFileSync40 } from "fs";
+import { existsSync as existsSync40, readdirSync as readdirSync26, readFileSync as readFileSync41 } from "fs";
 import { resolve as resolve34 } from "path";
 function readHouseAdminUserIds(accountsDir = ACCOUNTS_DIR) {
   let entries2;
   try {
-    entries2 = readdirSync25(accountsDir);
+    entries2 = readdirSync26(accountsDir);
   } catch {
     return [];
   }
   for (const entry of entries2) {
     const cfgPath = resolve34(accountsDir, entry, "account.json");
-    if (!existsSync39(cfgPath)) continue;
+    if (!existsSync40(cfgPath)) continue;
     try {
-      const cfg = JSON.parse(readFileSync40(cfgPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync41(cfgPath, "utf-8"));
       if (cfg.role !== "house") continue;
       if (!Array.isArray(cfg.admins)) return [];
       return cfg.admins.map(
@@ -25435,7 +26148,7 @@ app56.get("/", requireAdminSession, async (c) => {
 var admin_users_list_default = app56;
 
 // server/routes/admin/activity.ts
-import { readdirSync as readdirSync26 } from "fs";
+import { readdirSync as readdirSync27 } from "fs";
 var app57 = new Hono();
 var TAG47 = "[activity]";
 function resolveHouseAccountId(accounts) {
@@ -25451,7 +26164,7 @@ function requestToken() {
 var short = (id) => id ? id.slice(0, 8) : "unset";
 function countAccountDirsOnDisk() {
   try {
-    return readdirSync26(ACCOUNTS_DIR, { withFileTypes: true }).filter(
+    return readdirSync27(ACCOUNTS_DIR, { withFileTypes: true }).filter(
       (e) => e.isDirectory() && !e.name.startsWith(".")
     ).length;
   } catch {
@@ -25855,7 +26568,7 @@ app61.route("/request-magic-link", request_magic_link_default);
 var access_default = app61;
 
 // server/routes/sites.ts
-import { existsSync as existsSync40, readFileSync as readFileSync41, realpathSync as realpathSync8, statSync as statSync17 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync42, realpathSync as realpathSync8, statSync as statSync19 } from "fs";
 import { resolve as resolve36 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -25921,7 +26634,7 @@ app62.get("/:rel{.*}", (c) => {
   }
   let stat11;
   try {
-    stat11 = existsSync40(filePath) ? statSync17(filePath) : null;
+    stat11 = existsSync41(filePath) ? statSync19(filePath) : null;
   } catch {
     stat11 = null;
   }
@@ -25940,7 +26653,7 @@ app62.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync40(filePath)) {
+  if (!existsSync41(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -25959,7 +26672,7 @@ app62.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync41(realPath);
+    body = readFileSync42(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -25995,7 +26708,7 @@ var sites_default = app62;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync8, readFileSync as readFileSync42, writeFileSync as writeFileSync14 } from "fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync43, writeFileSync as writeFileSync15 } from "fs";
 import { dirname as dirname14 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -26004,7 +26717,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync42(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync43(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -26013,12 +26726,12 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync8(dirname14(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync14(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    mkdirSync9(dirname14(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    writeFileSync15(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync42(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync43(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -26071,8 +26784,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync41, readFileSync as readFileSync43 } from "fs";
-import { join as join43 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync44 } from "fs";
+import { join as join45 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -26080,10 +26793,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join43(platformRoot5, "config", "brand.json");
-  if (!existsSync41(brandPath)) return null;
+  const brandPath = join45(platformRoot5, "config", "brand.json");
+  if (!existsSync42(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync43(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync44(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -26581,13 +27294,13 @@ var visitor_event_default = app65;
 
 // server/routes/session.ts
 import { resolve as resolve37 } from "path";
-import { existsSync as existsSync42, writeFileSync as writeFileSync15, mkdirSync as mkdirSync9 } from "fs";
+import { existsSync as existsSync43, writeFileSync as writeFileSync16, mkdirSync as mkdirSync10 } from "fs";
 var UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve37(MAXY_DIR, "branding-cache", accountId);
-    mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync15(resolve37(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    mkdirSync10(cacheDir, { recursive: true });
+    writeFileSync16(resolve37(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -26665,7 +27378,7 @@ app66.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve37(account.accountDir, "agents", agentSlug);
-    if (!existsSync42(agentDir) || !existsSync42(resolve37(agentDir, "config.json"))) {
+    if (!existsSync43(agentDir) || !existsSync43(resolve37(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -26925,7 +27638,7 @@ var calendar_public_default = app67;
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile9, realpath } from "fs/promises";
-import { join as join44, resolve as resolve38, sep as sep10 } from "path";
+import { join as join46, resolve as resolve38, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
 var app68 = new Hono();
 var TAG50 = "[portal-fetch]";
@@ -26998,7 +27711,7 @@ function isValidAccountId2(value) {
 }
 async function readExposeFolders2(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile9(join44(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile9(join46(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -27007,7 +27720,7 @@ async function readExposeFolders2(accountDir) {
 async function resolveFetchTarget(accountDir, relPath, ownerId) {
   let schemaText = null;
   try {
-    schemaText = await readFile9(join44(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile9(join46(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -27177,8 +27890,8 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync27, readFileSync as readFileSync44, statSync as statSync18 } from "fs";
-import { join as join45 } from "path";
+import { readdirSync as readdirSync28, readFileSync as readFileSync45, statSync as statSync20 } from "fs";
+import { join as join47 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
 var LEDGER_INDEX_NAMES = [
@@ -27226,16 +27939,16 @@ var DAY_MS = 864e5;
 function countWriteRejects24h(logDir, now) {
   let entries2;
   try {
-    entries2 = readdirSync27(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
+    entries2 = readdirSync28(logDir).filter((f) => f.startsWith("mcp-ledger-") && f.endsWith(".log"));
   } catch {
     return 0;
   }
   let total = 0;
   for (const name of entries2) {
-    const path3 = join45(logDir, name);
+    const path3 = join47(logDir, name);
     try {
-      if (now - statSync18(path3).mtimeMs > DAY_MS) continue;
-      for (const line of readFileSync44(path3, "utf8").split("\n")) {
+      if (now - statSync20(path3).mtimeMs > DAY_MS) continue;
+      for (const line of readFileSync45(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
     } catch {
@@ -27730,8 +28443,8 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir7, readFile as readFile10, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
-import { existsSync as existsSync43 } from "fs";
-import { join as join46 } from "path";
+import { existsSync as existsSync44 } from "fs";
+import { join as join48 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -27760,7 +28473,7 @@ async function writeRaw(path3, obj) {
     await rename4(tmp, path3);
   } catch (err) {
     try {
-      if (existsSync43(tmp)) await unlink4(tmp);
+      if (existsSync44(tmp)) await unlink4(tmp);
     } catch {
     }
     throw err;
@@ -27776,7 +28489,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join46(projectsRoot, slug.name);
+    const slugDir = join48(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir7(slugDir, { withFileTypes: true });
@@ -27785,9 +28498,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join46(slugDir, entry.name));
+        out.push(join48(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join46(slugDir, entry.name);
+        const subDir = join48(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -27795,7 +28508,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join46(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join48(subDir, s.name));
         }
       }
     }
@@ -27807,7 +28520,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join46(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join48(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -30510,14 +31223,14 @@ function warnOnChannelAdminBindingDrift() {
 }
 
 // server/lib/booking-site-accounts.ts
-import { existsSync as existsSync44, readFileSync as readFileSync45 } from "fs";
+import { existsSync as existsSync45, readFileSync as readFileSync46 } from "fs";
 import { resolve as resolve43 } from "path";
 function listBookingSiteAccounts(accounts) {
   return accounts.filter((a) => {
     const availPath = resolve43(a.accountDir, "calendar-availability.json");
-    if (!existsSync44(availPath)) return false;
+    if (!existsSync45(availPath)) return false;
     try {
-      const cfg = JSON.parse(readFileSync45(availPath, "utf-8"));
+      const cfg = JSON.parse(readFileSync46(availPath, "utf-8"));
       return typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
     } catch {
       return false;
@@ -30554,8 +31267,8 @@ function broadcastAdminShutdown(reason) {
 }
 
 // ../lib/entitlement/src/index.ts
-import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync45, readFileSync as readFileSync46, statSync as statSync19 } from "fs";
+import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
+import { existsSync as existsSync46, readFileSync as readFileSync47, statSync as statSync21 } from "fs";
 import { resolve as resolve44 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -30604,10 +31317,10 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve44(brand.configDir, "entitlement.json");
-  if (!existsSync45(entitlementPath)) {
+  if (!existsSync46(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat11 = statSync19(entitlementPath);
+  const stat11 = statSync21(entitlementPath);
   const key = memoKey(stat11.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -30619,13 +31332,13 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync46(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync47(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
     });
   }
-  const pubkeyHash = createHash6("sha256").update(pubkeyPem).digest("hex");
+  const pubkeyHash = createHash7("sha256").update(pubkeyPem).digest("hex");
   if (pubkeyHash !== PUBKEY_SHA256) {
     return logResolved(anonymousFallback("pubkey-tamper"), {
       reason: "pubkey-tamper"
@@ -30633,7 +31346,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync46(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync47(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -30795,14 +31508,14 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join47(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join49(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync46(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync47(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync46(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync47(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync47(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync48(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -30834,11 +31547,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join47(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join49(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync46(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync47(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync47(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync48(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -30913,7 +31626,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -30928,13 +31641,13 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, ".."))
+      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
   ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId, ownerSelfPhone, replyContext }) => {
     if (passive) {
-      const phoneHash = createHash7("sha256").update(senderId).digest("hex").slice(0, 12);
+      const phoneHash = createHash8("sha256").update(senderId).digest("hex").slice(0, 12);
       const prompt = (text ?? "").trim();
       if (prompt.length === 0) {
         console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=empty-text`);
@@ -31046,7 +31759,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join47(configDir2, "projects");
+    const projectsRoot = join49(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -31621,14 +32334,14 @@ app69.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync46(filePath)) {
+  if (!existsSync47(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync47(filePath);
+  const body = readFileSync48(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -31651,14 +32364,14 @@ app69.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync46(filePath)) {
+  if (!existsSync47(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync47(filePath);
+  const body = readFileSync48(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -31671,9 +32384,9 @@ app69.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync46(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync47(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync47(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync48(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -31700,11 +32413,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync46(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync47(resolve45(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync47(resolve45(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync48(resolve45(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -31712,9 +32425,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join47(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync46(versionFile)) return "unknown";
-    const content = readFileSync47(versionFile, "utf-8").trim();
+    const versionFile = join49(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync47(versionFile)) return "unknown";
+    const content = readFileSync48(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -31755,7 +32468,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync47(resolve45(process.cwd(), "public", file), "utf-8");
+    html = readFileSync48(resolve45(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -31772,13 +32485,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join47(homedir4(), BRAND.configDir);
+  const configDir2 = join49(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join47(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync46(cachePath)) return null;
-    return JSON.parse(readFileSync47(cachePath, "utf-8"));
+    const cachePath = join49(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync47(cachePath)) return null;
+    return JSON.parse(readFileSync48(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -31873,7 +32586,7 @@ app69.use("/vnc-popout.html", logViewerFetch);
 app69.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync47(resolve45(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync48(resolve45(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -32007,6 +32720,7 @@ if (brandFaviconPath !== "/favicon.ico") {
     return c.redirect(brandFaviconPath, 302);
   });
 }
+app69.use("/*", staticCacheHeaders("./public"));
 app69.use("/*", serveStatic({ root: "./public" }));
 app69.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
@@ -32025,10 +32739,10 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app69.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const reconcileScript = resolve45(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
-    if (!existsSync46(reconcileScript)) return;
+    if (!existsSync47(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -32048,7 +32762,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join47(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join49(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -32066,7 +32780,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const dreamSweepScript = resolve45(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
@@ -32074,7 +32788,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     firstRunDelayMs: 3e4,
     detached: true,
     run: (ctx) => {
-      if (!existsSync46(dreamSweepScript)) return;
+      if (!existsSync47(dreamSweepScript)) return;
       try {
         const child = spawn3(process.execPath, [dreamSweepScript], {
           env: { ...process.env, PLATFORM_ROOT: dreamPlatformRoot },
@@ -32090,11 +32804,11 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const outlookScript = resolve45(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
-    if (!existsSync46(outlookScript)) return;
+    if (!existsSync47(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -32116,20 +32830,20 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const strandedAccountsDir = resolve45(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync46(strandedAccountsDir)) return;
+      if (!existsSync47(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync28(strandedAccountsDir)) {
+      for (const name of readdirSync29(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve45(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync46(pendingPath2)) continue;
-        const ageMs2 = now - statSync20(pendingPath2).mtimeMs;
+        if (!existsSync47(pendingPath2)) continue;
+        const ageMs2 = now - statSync22(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
         }
@@ -32146,7 +32860,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const googleAccountsDir = resolve45(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
@@ -32165,7 +32879,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const googleAuditScript = resolve45(googleRoot, "plugins/google/mcp/dist/scripts/account-audit.js");
   const GOOGLE_ACCOUNT_AUDIT_INTERVAL_MS = 36e5;
   const runGoogleAccountAudit = (ctx) => {
-    if (!existsSync46(googleAuditScript)) return;
+    if (!existsSync47(googleAuditScript)) return;
     try {
       const child = spawn3(process.execPath, [googleAuditScript], {
         env: { ...process.env, PLATFORM_ROOT: googleRoot },
@@ -32190,7 +32904,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -32236,7 +32950,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const publishScript = resolve45(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
@@ -32248,7 +32962,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account, ctx) => {
-    if (!existsSync46(publishScript)) return;
+    if (!existsSync47(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -32270,8 +32984,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     const availPath = resolve45(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync46(availPath)) {
-        const cfg = JSON.parse(readFileSync47(availPath, "utf-8"));
+      if (existsSync47(availPath)) {
+        const cfg = JSON.parse(readFileSync48(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
@@ -32279,9 +32993,9 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     if (!hasBookingSite) return;
     const statePath = resolve45(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync46(statePath)) {
+    if (existsSync47(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync47(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync48(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -32313,12 +33027,12 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const auditScript = resolve45(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = (ctx) => {
-    if (!existsSync46(auditScript)) return;
+    if (!existsSync47(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -32358,19 +33072,17 @@ startAuthHealthHeartbeat();
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
   loopHist.enable();
-  const LOG_THRESHOLD_MS = 1e3;
+  const LOUD_THRESHOLD_MS = 1e3;
   const WINDOW_MS2 = 3e4;
   registerLoop({
     name: "event-loop-lag",
     intervalMs: WINDOW_MS2,
     run: () => {
-      const maxMs = loopHist.max / 1e6;
-      const p99Ms = loopHist.percentile(99) / 1e6;
-      loopHist.reset();
-      if (maxMs >= LOG_THRESHOLD_MS) {
-        console.error(`[event-loop] lag p99=${Math.round(p99Ms)} max=${Math.round(maxMs)} window=${WINDOW_MS2 / 1e3}s`);
-      }
-      return `p99 ${Math.round(p99Ms)}ms, max ${Math.round(maxMs)}ms`;
+      const w = readAndResetWindow(loopHist, WINDOW_MS2);
+      const line = formatLagWindow(w);
+      if (w.maxMs >= LOUD_THRESHOLD_MS) console.error(line);
+      else console.log(line);
+      return `p99 ${w.p99Ms}ms, max ${w.maxMs}ms`;
     }
   });
 }
@@ -32438,11 +33150,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync46(USERS_FILE)) {
+    if (!existsSync47(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync47(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync48(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -32489,8 +33201,8 @@ registerLoop({
 });
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync46(USERS_FILE)) return 0;
-  const raw = readFileSync47(USERS_FILE, "utf-8").trim();
+  if (!existsSync47(USERS_FILE)) return 0;
+  const raw = readFileSync48(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -32623,7 +33335,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join47(__dirname, "..")),
+  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {