@rubytech/create-sitedesk-code 0.1.508 → 0.1.509

package/payload/server/server.js

@@ -1824,10 +1824,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync48, existsSync as existsSync47, watchFile, readdirSync as readdirSync29, statSync as statSync21 } from "fs";
+import { readFileSync as readFileSync48, existsSync as existsSync47, watchFile, readdirSync as readdirSync29, statSync as statSync22 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { resolve as resolve45, join as join48, basename as basename14 } from "path";
+import { resolve as resolve45, join as join49, basename as basename14 } from "path";
 import { homedir as homedir4 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -2386,6 +2386,79 @@ async function connectLoop(signal) {
 // server/index.ts
 import { monitorEventLoopDelay } from "perf_hooks";
 
+// server/lib/event-loop-lag.ts
+function readAndResetWindow(hist, windowMs) {
+  const toMs = (ns) => Math.round(ns / 1e6);
+  const w = {
+    p50Ms: toMs(hist.percentile(50)),
+    p99Ms: toMs(hist.percentile(99)),
+    maxMs: toMs(hist.max),
+    // Read before the reset.
+    count: hist.count,
+    windowMs
+  };
+  hist.reset();
+  return w;
+}
+function formatLagWindow(w) {
+  return `[event-loop] op=lag-window p50=${w.p50Ms} p99=${w.p99Ms} max=${w.maxMs} n=${w.count} windowMs=${w.windowMs}`;
+}
+
+// server/lib/static-cache.ts
+import { statSync as statSync3 } from "fs";
+import { join as join3 } from "path";
+var IMMUTABLE = "public, max-age=31536000, immutable";
+var REVALIDATE = "public, no-cache";
+function statOrNull(path3) {
+  try {
+    return statSync3(path3);
+  } catch {
+    return null;
+  }
+}
+function tryDecodeURI2(str) {
+  try {
+    return decodeURI(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decodeURI(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+}
+function resolveStaticFile(root, reqPath) {
+  const filename = tryDecodeURI2(reqPath);
+  if (/(?:^|[/\\])\.\.(?:$|[/\\])/.test(filename)) return null;
+  let path3 = join3(root, filename);
+  let stats = statOrNull(path3);
+  if (stats?.isDirectory()) {
+    path3 = join3(path3, "index.html");
+    stats = statOrNull(path3);
+  }
+  if (!stats?.isFile()) return null;
+  return { path: path3, stats, filename };
+}
+function staticCacheHeaders(root) {
+  return async (c, next) => {
+    if (c.finalized) return next();
+    const hit = resolveStaticFile(root, c.req.path);
+    if (!hit) return next();
+    if (hit.filename.startsWith("/assets/")) {
+      c.header("Cache-Control", IMMUTABLE);
+      return next();
+    }
+    const etag = `"${hit.stats.size}-${hit.stats.mtimeMs}"`;
+    c.header("Cache-Control", REVALIDATE);
+    c.header("Last-Modified", hit.stats.mtime.toUTCString());
+    c.header("ETag", etag);
+    if (c.req.header("If-None-Match") === etag) return c.body(null, 304);
+    return next();
+  };
+}
+
 // app/lib/whatsapp/inbound/media-download-guard.ts
 var TAG2 = "[media-guard]";
 var inFlight2 = 0;
@@ -2452,14 +2525,14 @@ function installMediaDownloadGuard() {
 }
 
 // app/lib/whatsapp/ingest-audit.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
-import { join as join4 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { join as join5 } from "path";
 
 // app/lib/whatsapp/ingest-ledger.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, appendFileSync as appendFileSync2, readFileSync as readFileSync3, writeFileSync, readdirSync as readdirSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var TAG3 = "[wa-ingest-ledger]";
-var LEDGER_ROOT = () => join3(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
+var LEDGER_ROOT = () => join4(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
 var ensuredRoots = /* @__PURE__ */ new Set();
 function ledgerFilePath(account) {
   const root = LEDGER_ROOT();
@@ -2467,7 +2540,7 @@ function ledgerFilePath(account) {
     if (!existsSync3(root)) mkdirSync2(root, { recursive: true });
     ensuredRoots.add(root);
   }
-  return join3(root, `${account}.jsonl`);
+  return join4(root, `${account}.jsonl`);
 }
 function appendStanza(entry) {
   try {
@@ -2573,16 +2646,16 @@ function readAllConversationsCached(accountId) {
   const out = /* @__PURE__ */ new Map();
   let dir;
   try {
-    dir = readdirSync4(join4(STORE_ROOT(), accountId));
+    dir = readdirSync4(join5(STORE_ROOT(), accountId));
   } catch {
     return out;
   }
   for (const file of dir) {
     if (!file.endsWith(".jsonl")) continue;
-    const path3 = join4(STORE_ROOT(), accountId, file);
+    const path3 = join5(STORE_ROOT(), accountId, file);
     let stat11;
     try {
-      stat11 = statSync3(path3);
+      stat11 = statSync4(path3);
     } catch {
       continue;
     }
@@ -2756,12 +2829,12 @@ function pwaCensus(d) {
 }
 
 // server/webchat-descriptor.ts
-import { resolve as resolve3, join as join5 } from "path";
+import { resolve as resolve3, join as join6 } from "path";
 function webchatGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function webchatServerPath() {
-  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join5(__dirname, ".."), "services/webchat-channel/dist/server.js");
+  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join6(__dirname, ".."), "services/webchat-channel/dist/server.js");
 }
 function webchatChannelDescriptor(key) {
   return { key, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() };
@@ -4983,7 +5056,7 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
 }
 
 // app/lib/managed-service.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { readFileSync as readFileSync9 } from "fs";
 function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
   let houseId;
@@ -4994,7 +5067,7 @@ function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
   }
   try {
     const cfg = JSON.parse(
-      readFileSync9(join6(accountsDir, houseId, "account.json"), "utf-8")
+      readFileSync9(join7(accountsDir, houseId, "account.json"), "utf-8")
     );
     return cfg.managedService === true;
   } catch {
@@ -5008,7 +5081,7 @@ function isCustomerTurnSuppressed(role, managedService) {
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID4, createHash } from "crypto";
 import { writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -5023,7 +5096,7 @@ import { resolve as resolve7, extname } from "path";
 
 // app/lib/data-path.ts
 import { realpathSync } from "fs";
-import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join7 } from "path";
+import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join8 } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "../platform");
 var DATA_ROOT = resolve6(PLATFORM_ROOT3, "..", "data");
 var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve6(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
@@ -5091,7 +5164,7 @@ function scratchpadTmpBase() {
 }
 function sessionScratchpadRoot(projectDir, sessionId) {
   const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
-  return join7(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
+  return join8(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
 }
 function resolveScratchpadPath(raw, scratchpadRootAbs) {
   return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
@@ -5634,7 +5707,7 @@ async function downloadInboundMedia(msg, sock, opts) {
   if (!res) return void 0;
   await mkdir2(MEDIA_DIR, { recursive: true });
   const ext = mimeToExt(res.mimetype);
-  const filePath = join8(MEDIA_DIR, `${randomUUID4()}.${ext}`);
+  const filePath = join9(MEDIA_DIR, `${randomUUID4()}.${ext}`);
   await writeFile2(filePath, res.buffer);
   const sizeKB = (res.buffer.length / 1024).toFixed(0);
   console.error(`${TAG14} media downloaded type=${res.mimetype} size=${sizeKB}KB path=${filePath}`);
@@ -7436,7 +7509,7 @@ var health_default = app;
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // app/lib/stt/audio-mime.ts
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
@@ -7490,9 +7563,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join9(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join10(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join9(tempDir, `recording${ext}`);
+    tempPath = join10(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -8068,7 +8141,7 @@ async function sendTelegramText(botToken, chatId, text) {
 }
 
 // server/routes/whatsapp.ts
-import { join as join12, resolve as resolve11 } from "path";
+import { join as join13, resolve as resolve11 } from "path";
 import { readdirSync as readdirSync7, readFileSync as readFileSync14, existsSync as existsSync8 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -8076,7 +8149,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { resolve as resolve9, join as join10, dirname as dirname2, basename as basename2 } from "path";
+import { resolve as resolve9, join as join11, dirname as dirname2, basename as basename2 } from "path";
 var TAG22 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve9(accountDir, "account.json");
@@ -8423,7 +8496,7 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join10(accountDir, "agents", trimmed, "config.json");
+  const agentConfigPath = join11(accountDir, "agents", trimmed, "config.json");
   if (!existsSync7(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
@@ -9060,12 +9133,12 @@ function serializeWhatsAppSchema() {
 
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync6 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var TAG25 = "[whatsapp:reconcile]";
 var HALF_REGISTERED_MIN_AGE_MS = 5 * 6e4;
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync6(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join11(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync6(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join12(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -9080,7 +9153,7 @@ function reconcileCredsOnDisk(opts) {
   const entries2 = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
-    const authDir = join11(credsRoot, accountId);
+    const authDir = join12(credsRoot, accountId);
     const census = credsCensus(authDir);
     if (census.registered && !census.hasAccountSignature) {
       const inFlight3 = activeLoginAccountIds.has(accountId);
@@ -9317,7 +9390,7 @@ app2.get("/status", (c) => {
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
     const activeLoginIds = new Set(listActiveLoginAccountIds());
-    const credsRoot = join12(MAXY_DIR, "credentials", "whatsapp");
+    const credsRoot = join13(MAXY_DIR, "credentials", "whatsapp");
     const accountDir = resolveAccount()?.accountDir ?? null;
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds, activeLoginAccountIds: activeLoginIds });
     const cfg = getWhatsAppConfig();
@@ -9354,7 +9427,7 @@ app2.post("/login/start", async (c) => {
     if (!phone) {
       return c.json({ error: 'Missing required field "phone" (E.164, e.g. +441234567890).' }, 400);
     }
-    const authDir = join12(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join13(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
     console.error(`${TAG26} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
@@ -10001,12 +10074,12 @@ var bodyLimit = (options) => {
 };
 
 // server/routes/storage-broker.ts
-import { join as join13, resolve as resolve12 } from "path";
+import { join as join14, resolve as resolve12 } from "path";
 import { readdirSync as readdirSync8, readFileSync as readFileSync15, existsSync as existsSync9, realpathSync as realpathSync4 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
 var app3 = new Hono();
 function platformRoot() {
-  return process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? join13(__dirname, "..", "..");
+  return process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? join14(__dirname, "..", "..");
 }
 function caller(c) {
   return c.req.header("x-maxy-caller-account")?.trim() || null;
@@ -10541,7 +10614,7 @@ async function runStorageAudit(root) {
       if (!existsSync9(accountsDir)) return [];
       const files = [];
       for (const accountId of readdirSync8(accountsDir)) {
-        const p = join13(accountsDir, accountId, "secrets", "cloudflare.env");
+        const p = join14(accountsDir, accountId, "secrets", "cloudflare.env");
         if (existsSync9(p)) files.push({ accountId, path: p, contents: readFileSync15(p, "utf8") });
       }
       return files;
@@ -10640,7 +10713,7 @@ function discoverPortalAccounts(accountsDir) {
   if (!existsSync9(accountsDir)) return [];
   const found = [];
   for (const accountId of readdirSync8(accountsDir)) {
-    const configPath2 = join13(accountsDir, accountId, "data-portal.json");
+    const configPath2 = join14(accountsDir, accountId, "data-portal.json");
     if (!existsSync9(configPath2)) continue;
     try {
       const cfg = JSON.parse(readFileSync15(configPath2, "utf-8"));
@@ -10723,7 +10796,7 @@ async function runDataPortalAudit(root) {
 // server/portal-uploads-pull.ts
 import { existsSync as existsSync10 } from "fs";
 import { mkdir as mkdir3, readFile as readFile2, rename, stat as stat3, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename4, dirname as dirname4, join as join14, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname4, join as join15, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
 
 // ../plugins/cloudflare/bin/schema-exposed-dirs.mjs
 var ONT_START = "<!-- ontology-buckets:start -->";
@@ -10821,19 +10894,19 @@ function resolveDestination(accountDir, row, exposed) {
     if (!segments.every(safeSegment)) return { ok: false, reason: "bad-target" };
     if (!exposed.includes(segments[0])) return { ok: false, reason: "bad-target" };
     root = resolve13(accountDir);
-    dir = join14(root, ...segments);
+    dir = join15(root, ...segments);
   } else {
     root = resolve13(accountDir, "uploads");
-    dir = join14(root, row.ownerId);
+    dir = join15(root, row.ownerId);
   }
-  const final = join14(dir, row.filename);
+  const final = join15(dir, row.filename);
   if (!final.startsWith(root + sep3)) {
     return { ok: false, reason: row.targetPath ? "bad-target" : "bad-filename" };
   }
   return {
     ok: true,
     dir,
-    tmp: join14(dir, ".uploads-tmp", row.filename),
+    tmp: join15(dir, ".uploads-tmp", row.filename),
     final,
     relative: relative2(resolve13(accountDir), final).split(sep3).join("/")
   };
@@ -10846,7 +10919,7 @@ function nextFreePath(final) {
   const stem = dot > 0 ? base.slice(0, dot) : base;
   const ext = dot > 0 ? base.slice(dot) : "";
   for (let n = 2; ; n++) {
-    const candidate = join14(dir, `${stem} (${n})${ext}`);
+    const candidate = join15(dir, `${stem} (${n})${ext}`);
     if (!existsSync10(candidate)) return candidate;
   }
 }
@@ -10950,7 +11023,7 @@ async function withdrawRow(opts) {
     log2(`${head} removed=false result=bad-path`);
     return false;
   }
-  const absolute = join14(resolve13(accountDir), ...segments);
+  const absolute = join15(resolve13(accountDir), ...segments);
   if (!absolute.startsWith(resolve13(accountDir) + sep3)) {
     log2(`${head} removed=false result=bad-path`);
     return false;
@@ -11015,13 +11088,13 @@ function parsePendingRows(raw) {
 async function readExposedDirs(accountDir) {
   let schemaText = null;
   try {
-    schemaText = await readFile2(join14(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile2(join15(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
   let exposeFolders = [];
   try {
-    const cfg = JSON.parse(await readFile2(join14(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile2(join15(accountDir, "data-portal.json"), "utf8"));
     exposeFolders = Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     exposeFolders = [];
@@ -11046,7 +11119,7 @@ async function runPortalUploadsPull(root) {
         console.error(`${TAG27} op=malformed account=${portal.accountId} rows=${malformed}`);
       }
       if (rows.length === 0) continue;
-      const accountDir = join14(accountsRoot, portal.accountId);
+      const accountDir = join15(accountsRoot, portal.accountId);
       const r = await pullAccount({
         accountDir,
         accountId: portal.accountId,
@@ -11079,7 +11152,7 @@ async function runPortalUploadsPull(root) {
 import { readFile as readFile3, readdir, stat as stat4 } from "fs/promises";
 import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
-import { join as join15, resolve as resolve14 } from "path";
+import { join as join16, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 
 // ../plugins/cloudflare/bin/d1-http.mjs
@@ -11155,7 +11228,7 @@ function readEnvFile(path3) {
 }
 async function readExposeFolders(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile3(join15(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile3(join16(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -11166,12 +11239,12 @@ async function walkExposed(accountDir, exposed) {
   async function walk(rel) {
     let entries2;
     try {
-      entries2 = await readdir(join15(accountDir, rel), { withFileTypes: true });
+      entries2 = await readdir(join16(accountDir, rel), { withFileTypes: true });
     } catch {
       return;
     }
     try {
-      const st = await stat4(join15(accountDir, rel));
+      const st = await stat4(join16(accountDir, rel));
       out.push({ relPath: rel, sizeBytes: 0, modifiedAt: st.mtime.toISOString(), isDir: true });
     } catch {
     }
@@ -11182,7 +11255,7 @@ async function walkExposed(accountDir, exposed) {
         await walk(childRel);
       } else if (e.isFile()) {
         try {
-          const st = await stat4(join15(accountDir, childRel));
+          const st = await stat4(join16(accountDir, childRel));
           out.push({
             relPath: childRel,
             sizeBytes: st.size,
@@ -11201,7 +11274,7 @@ async function pushAccount(opts) {
   const { accountDir, accountId, client, log: log2, nowIso } = opts;
   let schemaText = null;
   try {
-    schemaText = await readFile3(join15(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile3(join16(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -11231,19 +11304,11 @@ async function pushAccount(opts) {
     [accountId]
   );
   const current = Number(state[0]?.currentGeneration ?? 0);
-  const next = current + 1;
-  const orphan = await client.query(
-    "SELECT COUNT(*) AS n FROM directory WHERE accountId = ? AND generation = ?",
-    [accountId, next]
+  const staged = await client.query(
+    "SELECT MAX(generation) AS g FROM directory WHERE accountId = ?",
+    [accountId]
   );
-  const orphanCount = Number(orphan[0]?.n ?? 0);
-  if (orphanCount > 0) {
-    await client.query("DELETE FROM directory WHERE accountId = ? AND generation = ?", [
-      accountId,
-      next
-    ]);
-    log2(`${TAG28} op=stage-clear account=${accountId} generation=${next} cleared=${orphanCount}`);
-  }
+  const next = Math.max(current, Number(staged[0]?.g ?? 0)) + 1;
   for (const row of rows) {
     await client.query(
       "INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt, isDir, generation) VALUES (?, ?, ?, ?, ?, ?, ?)",
@@ -11252,12 +11317,29 @@ async function pushAccount(opts) {
   }
   log2(`${TAG28} op=stage account=${accountId} generation=${next} inserted=${rows.length}`);
   await client.query(
-    "INSERT INTO directory_state (accountId, currentGeneration) VALUES (?, ?) ON CONFLICT (accountId) DO UPDATE SET currentGeneration = excluded.currentGeneration",
+    "INSERT INTO directory_state (accountId, currentGeneration) VALUES (?, ?) ON CONFLICT (accountId) DO UPDATE SET currentGeneration = excluded.currentGeneration WHERE excluded.currentGeneration > directory_state.currentGeneration",
     [accountId, next]
   );
+  const flipped = await client.query(
+    "SELECT currentGeneration FROM directory_state WHERE accountId = ?",
+    [accountId]
+  );
+  const pointer = Number(flipped[0]?.currentGeneration ?? 0);
+  if (pointer !== next) {
+    log2(
+      `${TAG28} op=stage-contended account=${accountId} generation=${next} pointer=${pointer} action=superseded`
+    );
+    return {
+      exposed: r.exposed,
+      rows: rows.length,
+      schemaPresent: true,
+      generation: next,
+      superseded: true
+    };
+  }
   log2(`${TAG28} op=flip account=${accountId} generation=${next}`);
   try {
-    await client.query("DELETE FROM directory WHERE accountId = ? AND generation != ?", [
+    await client.query("DELETE FROM directory WHERE accountId = ? AND generation < ?", [
       accountId,
       next
     ]);
@@ -11309,9 +11391,9 @@ async function portalAccounts(accountsRoot) {
     return out;
   }
   for (const accountId of names) {
-    const accountDir = join15(accountsRoot, accountId);
+    const accountDir = join16(accountsRoot, accountId);
     try {
-      const cfg = JSON.parse(await readFile3(join15(accountDir, "data-portal.json"), "utf8"));
+      const cfg = JSON.parse(await readFile3(join16(accountDir, "data-portal.json"), "utf8"));
       if (typeof cfg?.portalDbName === "string" && cfg.portalDbName) {
         const exposeFolders = Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
         out.push({ accountDir, accountId, dbName: cfg.portalDbName, exposeFolders });
@@ -11324,11 +11406,11 @@ async function portalAccounts(accountsRoot) {
   return out;
 }
 function resolveCloudflareCredentials(platformRoot5) {
-  const houseEnvPath = join15(platformRoot5, "config", "cloudflare-house.env");
+  const houseEnvPath = join16(platformRoot5, "config", "cloudflare-house.env");
   const house = readEnvFile(houseEnvPath);
   if (!house.CLOUDFLARE_API_TOKEN) return { error: "no-house-cloudflare-credential" };
   if (!house.CLOUDFLARE_ACCOUNT_ID) return { error: "no-house-cloudflare-account-id" };
-  const cfTokenSh = join15(platformRoot5, "plugins", "cloudflare", "bin", "cf-token.sh");
+  const cfTokenSh = join16(platformRoot5, "plugins", "cloudflare", "bin", "cf-token.sh");
   if (!existsSync11(cfTokenSh)) return { error: "cf-token-sh-missing" };
   let keyName;
   try {
@@ -11434,17 +11516,17 @@ async function runPortalIndexPush(root) {
 }
 
 // server/google-pending-audit.ts
-import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync4 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
+import { join as join17 } from "path";
 var GOOGLE_PENDING_LIFETIME_SEC = 600;
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync4(path3).mtimeMs) {
+function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync5(path3).mtimeMs) {
   let scanned = 0;
   let stranded = 0;
   if (existsSync12(accountsDir)) {
     for (const accountId of readdirSync9(accountsDir)) {
       if (!UUID_RE2.test(accountId)) continue;
-      const pendingPath2 = join16(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
+      const pendingPath2 = join17(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
       try {
         if (!existsSync12(pendingPath2)) continue;
         const ageSec = Math.max(0, Math.floor((nowMs - readMtimeMs(pendingPath2)) / 1e3));
@@ -11501,19 +11583,19 @@ function runReconcileLivenessAudit(statePath, nowMs, intervalMs, emit) {
 }
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync21, watch as watch2, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
-import { basename as basename6, dirname as dirname7, isAbsolute, join as join21, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
+import { readFileSync as readFileSync21, watch as watch2, statSync as statSync9, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join22, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
-import { dirname as dirname5, join as join19, resolve as resolve15 } from "path";
+import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync7 } from "fs";
+import { dirname as dirname5, join as join20, resolve as resolve15 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
 import { existsSync as existsSync14, readdirSync as readdirSync10 } from "fs";
 import { homedir } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
-  const projectsRoot = join17(claudeConfigDir2, "projects");
+  const projectsRoot = join18(claudeConfigDir2, "projects");
   if (!existsSync14(projectsRoot)) return null;
   let slugs;
   try {
@@ -11523,9 +11605,9 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   }
   const basename15 = `${sessionId}.jsonl`;
   for (const slug of slugs) {
-    const live = join17(projectsRoot, slug, basename15);
+    const live = join18(projectsRoot, slug, basename15);
     if (existsSync14(live)) return live;
-    const archived = join17(projectsRoot, slug, "archive", basename15);
+    const archived = join18(projectsRoot, slug, "archive", basename15);
     if (existsSync14(archived)) return archived;
   }
   return null;
@@ -11533,8 +11615,8 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync5 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync6 } from "fs";
+import { join as join19 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
@@ -11665,7 +11747,7 @@ function enumerateJsonls(projectsRoot) {
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join19(projectsRoot, slug);
+    const slugDir = join20(projectsRoot, slug);
     let entries2;
     try {
       entries2 = readdirSync12(slugDir, { withFileTypes: true });
@@ -11676,9 +11758,9 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join19(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join20(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join19(slugDir, entry.name);
+        const subDir = join20(slugDir, entry.name);
         let subEntries;
         try {
           subEntries = readdirSync12(subDir, { withFileTypes: true });
@@ -11689,11 +11771,11 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join19(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join20(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join19(slugDir, entry.name);
+        const archiveDir = join20(slugDir, entry.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync12(archiveDir, { withFileTypes: true });
@@ -11704,7 +11786,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join19(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join20(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -11737,7 +11819,7 @@ async function fetchLiveSessions() {
 function loadUserTitles(accountDir) {
   const out = /* @__PURE__ */ new Map();
   if (!accountDir) return out;
-  const path3 = join19(accountDir, "session-titles.json");
+  const path3 = join20(accountDir, "session-titles.json");
   let raw;
   try {
     raw = readFileSync19(path3, "utf8");
@@ -11877,7 +11959,7 @@ async function computeSessionList(scopeAccountId) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return { sessions: [], accountId: scopeAccountId };
   }
-  const projectsRoot = join19(configDir2, "projects");
+  const projectsRoot = join20(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
   const accountDir = scopeAccountId ? resolve15(ACCOUNTS_DIR, scopeAccountId) : null;
@@ -11922,7 +12004,7 @@ async function computeSessionList(scopeAccountId) {
     let mtimeMs;
     try {
       body = readFileSync19(path3, "utf8");
-      mtimeMs = statSync6(path3).mtimeMs;
+      mtimeMs = statSync7(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -11930,7 +12012,7 @@ async function computeSessionList(scopeAccountId) {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join19(projectDir, `${sessionId}.meta.json`);
+    const metaPath = join20(projectDir, `${sessionId}.meta.json`);
     const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = readSidecarMeta(metaPath);
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
@@ -12332,8 +12414,8 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync7, realpathSync as realpathSync5 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join20, resolve as resolve16, sep as sep4 } from "path";
+import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync8, realpathSync as realpathSync5 } from "fs";
+import { basename as basename5, dirname as dirname6, join as join21, resolve as resolve16, sep as sep4 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -12346,7 +12428,7 @@ function adminAttachmentIds(text) {
 function adminAttachmentsFromText(text, uploadsBase) {
   const out = [];
   for (const id of adminAttachmentIds(text)) {
-    const meta = readAttachmentMeta(join20(uploadsBase, id));
+    const meta = readAttachmentMeta(join21(uploadsBase, id));
     if (meta) out.push(meta);
   }
   return out;
@@ -12383,7 +12465,7 @@ function claudeUploadAttachmentsFromText(text, sessionId) {
       attachmentId: filename,
       filename,
       mimeType: detectMimeType(filename),
-      sizeBytes: statSync7(real).size,
+      sizeBytes: statSync8(real).size,
       source: "claude-upload"
     });
     accepted.push(m[0]);
@@ -12396,7 +12478,7 @@ function claudeUploadAttachmentsFromText(text, sessionId) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(join20(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync20(join21(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -12425,7 +12507,7 @@ function listSessionAttachmentsInDir(dir) {
   }
   const sidecars = [];
   for (const name of entries2) {
-    const sidecar = readSidecar(join20(dir, name), name);
+    const sidecar = readSidecar(join21(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
   sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
@@ -12585,14 +12667,14 @@ app5.get("/conversations", requireAdminSession, async (c) => {
   }
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join21(cfg, "projects");
+  const projectsRoot = join22(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename6(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname7(path3);
-    const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
       if (meta.accountId === null) sessionRowsExcludedUntagged += 1;
@@ -12723,7 +12805,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   const { value, state } = await getOrCompute("conversations-all", houseId, async () => {
     const cfg = claudeConfigDir();
     if (!cfg) return { conversations: [] };
-    const projectsRoot = join21(cfg, "projects");
+    const projectsRoot = join22(cfg, "projects");
     const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
     const validAccounts = listValidAccounts();
     const validIds = new Set(validAccounts.map((a) => a.accountId));
@@ -12732,7 +12814,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
     for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
       const sessionId = basename6(path3).replace(/\.jsonl$/, "");
       const projectDir = dirname7(path3);
-      const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
       if (!isReaderChannelSession(meta.role, meta.channel)) continue;
       if (meta.accountId === null || !validIds.has(meta.accountId)) continue;
       let body = "";
@@ -12803,7 +12885,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   return c.json(value);
 });
 function readFrom(path3, from) {
-  const end = statSync8(path3).size;
+  const end = statSync9(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync(path3, "r");
   try {
@@ -12897,7 +12979,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync21(join21(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync21(join22(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -12929,7 +13011,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync8(join21(c.subagentsDir, name));
+      const st = statSync9(join22(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -12974,11 +13056,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve17(join21(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve17(join22(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve17(join21(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve17(join22(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep5)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -12997,7 +13079,7 @@ data: ${JSON.stringify(turn)}
     start(controller) {
       const fileEnd0 = (() => {
         try {
-          return statSync8(jsonlPath).size;
+          return statSync9(jsonlPath).size;
         } catch {
           return 0;
         }
@@ -13005,7 +13087,7 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve17(join21(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve17(join22(projectDir, sessionId, "subagents"));
       console.log(
         `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync17(subagentsDir)}`
       );
@@ -13134,7 +13216,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync8(join21(dir, name)).size;
+      len = statSync9(join22(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -13149,7 +13231,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path3 = resolve17(join21(dir, name));
+  const path3 = resolve17(join22(dir, name));
   if (!path3.startsWith(dir + sep5)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -13207,7 +13289,7 @@ app5.get("/store-stream", requireAdminSession, (c) => {
       console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q2}`);
     }
     if (r.attachmentId) {
-      const meta = readAttachmentMeta(join21(uploadsBase, r.attachmentId));
+      const meta = readAttachmentMeta(join22(uploadsBase, r.attachmentId));
       if (meta) return { ...turn, attachments: [meta] };
     }
     return turn;
@@ -13240,7 +13322,7 @@ data: ${JSON.stringify(payload)}
       };
       const fileEnd0 = (() => {
         try {
-          return statSync8(file).size;
+          return statSync9(file).size;
         } catch {
           return 0;
         }
@@ -13458,7 +13540,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
       const absolute = resolved.absolute;
       let size = -1;
       try {
-        const st = statSync8(absolute);
+        const st = statSync9(absolute);
         size = st.isFile() ? st.size : -1;
       } catch {
         size = -1;
@@ -13587,8 +13669,8 @@ app5.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
-import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
-import { basename as basename7, dirname as dirname8, join as join22, resolve as resolve18, sep as sep6 } from "path";
+import { statSync as statSync10, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
+import { basename as basename7, dirname as dirname8, join as join23, resolve as resolve18, sep as sep6 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -13662,10 +13744,10 @@ function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path3 } of enumerateJsonls(join22(cfg, "projects"))) {
+  for (const { path: path3 } of enumerateJsonls(join23(cfg, "projects"))) {
     const sessionId = basename7(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname8(path3);
-    const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -13721,7 +13803,7 @@ function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   }
 }
 function readFrom2(path3, from) {
-  const end = statSync9(path3).size;
+  const end = statSync10(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync2(path3, "r");
   try {
@@ -13741,15 +13823,15 @@ app6.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve18(join22(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve18(join23(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve18(join22(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve18(join23(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep6)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
@@ -13886,16 +13968,16 @@ var public_reader_default = app6;
 
 // server/routes/webchat.ts
 import { basename as basename8, dirname as dirname9 } from "path";
-import { join as join25 } from "path";
-import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
+import { join as join26 } from "path";
+import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync11, writeFileSync as writeFileSync9 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync7, renameSync as renameSync2 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join23(accountDir, FILE);
+  return join24(accountDir, FILE);
 }
 function readRaw(accountDir) {
   try {
@@ -13975,7 +14057,7 @@ function isNewSessionEffortLevel(value) {
 
 // ../services/claude-session-manager/src/sidecar-store.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync16, readFileSync as readFileSync24, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -13983,7 +14065,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join24(sessionsDir, `${id}${suffix}`);
+    return join25(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync4(sessionsDir, { recursive: true });
@@ -14027,7 +14109,7 @@ function createSidecarStore(config) {
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path3 = join24(sessionsDir, name);
+      const path3 = join25(sessionsDir, name);
       let raw;
       try {
         raw = readFileSync24(path3, "utf8");
@@ -14104,13 +14186,13 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const dir = findSessionProjectDir(sessionId);
   if (!dir) return { projectDir: null, channel: null, accountId: null };
-  const meta = readSidecarMeta(join25(dir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join26(dir, `${sessionId}.meta.json`));
   return { projectDir: dir, channel: meta.channel, accountId: meta.accountId };
 }
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join25(cfg, "projects");
+  const projectsRoot = join26(cfg, "projects");
   let slugs;
   try {
     slugs = readdirSync17(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -14118,7 +14200,7 @@ function locateSidecar(sessionId) {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join25(projectsRoot, slug, `${sessionId}.meta.json`);
+    const metaPath = join26(projectsRoot, slug, `${sessionId}.meta.json`);
     if (existsSync19(metaPath)) return readSidecarMeta(metaPath);
   }
   return null;
@@ -14128,7 +14210,7 @@ function readTargetOwner(sessionId) {
   if (sidecar !== null) return { found: true, owner: sidecar.adminUserId };
   const { projectDir } = locateSession(sessionId);
   if (projectDir !== null) {
-    return { found: true, owner: readSidecarMeta(join25(projectDir, `${sessionId}.meta.json`)).adminUserId };
+    return { found: true, owner: readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`)).adminUserId };
   }
   return { found: false, owner: null };
 }
@@ -14136,7 +14218,7 @@ function readSourceRowMeta(sessionId) {
   const sidecar = locateSidecar(sessionId);
   if (sidecar !== null) return sidecar;
   const { projectDir } = locateSession(sessionId);
-  if (projectDir !== null) return readSidecarMeta(join25(projectDir, `${sessionId}.meta.json`));
+  if (projectDir !== null) return readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`));
   return null;
 }
 function ownedByRequester(owner, requesterUserId, primaryUserId) {
@@ -14149,7 +14231,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync10(join25(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync11(join26(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -14285,15 +14367,15 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join25(cfg, "projects"))) {
+  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join26(cfg, "projects"))) {
     if (isSubagent || archived) continue;
     const id = basename8(path3).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join25(dirname9(path3), `${id}.meta.json`));
+    const meta = readSidecarMeta(join26(dirname9(path3), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync10(path3).mtimeMs;
+      mtimeMs = statSync11(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -14601,7 +14683,7 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join25(account.accountDir, "account.json");
+    const accountJsonPath = join26(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync25(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
@@ -14649,7 +14731,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join25(cfg2, "sessions"),
+            join26(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -14681,7 +14763,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path3 } of enumerateJsonls(join25(cfg, "projects"))) {
+      for (const { path: path3 } of enumerateJsonls(join26(cfg, "projects"))) {
         if (basename8(path3) === `${sessionId}.jsonl`) {
           projectDir = dirname9(path3);
           break;
@@ -14689,7 +14771,7 @@ ${note}` : note;
       }
     }
     if (source === "latest" && requesterUserId !== null) {
-      const owner = readSidecarMeta(join25(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
+      const owner = readSidecarMeta(join26(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
       if (owner !== null && owner !== requesterUserId && requesterUserId !== primaryUserId) {
         console.error(`[webchat:inbound] op=session-resolve-foreign key=${sessionId.slice(0, 8)} owner=${owner.slice(0, 8)} requester=${requesterUserId.slice(0, 8)}`);
       }
@@ -14722,7 +14804,7 @@ import { resolve as resolve19 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
 import { existsSync as existsSync20, readFileSync as readFileSync26, readdirSync as readdirSync18 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -14741,7 +14823,7 @@ function readSpecialistRoster(specialistsDir) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync26(join26(specialistsDir, file), "utf-8");
+      raw = readFileSync26(join27(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -14858,7 +14940,7 @@ var webchat_greeting_default = app7;
 
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
-import { resolve as resolve20, join as join27 } from "path";
+import { resolve as resolve20, join as join28 } from "path";
 import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
@@ -14918,7 +15000,7 @@ function routeTelegramUpdate(input) {
 var TAG30 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
-  const brandPath = join27(platformRoot5, "config", "brand.json");
+  const brandPath = join28(platformRoot5, "config", "brand.json");
   if (existsSync21(brandPath)) {
     try {
       return JSON.parse(readFileSync27(brandPath, "utf-8")).configDir ?? ".maxy";
@@ -15007,16 +15089,16 @@ app8.post("/", async (c) => {
 var telegram_default = app8;
 
 // server/routes/quickbooks.ts
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 import { existsSync as existsSync22, readFileSync as readFileSync28, writeFileSync as writeFileSync10, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
 var TAG31 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join28(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join29(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join28(accountDir, "secrets", "quickbooks.json");
+  return join29(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
@@ -15083,7 +15165,7 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync5(join28(accountDir, "secrets"), { recursive: true });
+    mkdirSync5(join29(accountDir, "secrets"), { recursive: true });
     writeFileSync10(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
     const persisted = JSON.parse(readFileSync28(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG31} op=token-exchange realmId=${realmId} persisted=${persisted}`);
@@ -15125,7 +15207,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname11, join as join30 } from "path";
+import { dirname as dirname11, join as join31 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync3 } from "child_process";
@@ -15254,8 +15336,8 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync11, appendFileSync as appendFileSync3 } from "fs";
-import { dirname as dirname10, join as join29 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync12, appendFileSync as appendFileSync3 } from "fs";
+import { dirname as dirname10, join as join30 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -15328,7 +15410,7 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join29(input.accountDir, "account.json");
+    const accountJsonPath = join30(input.accountDir, "account.json");
     if (!existsSync23(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
@@ -15376,13 +15458,13 @@ function computeAdminStoreDivergence(input) {
     }
     for (const entry of entries2) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join29(input.accountsDir, entry);
+      const accountDir = join30(input.accountsDir, entry);
       try {
-        if (!statSync11(accountDir).isDirectory()) continue;
+        if (!statSync12(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join29(accountDir, "account.json");
+      const accountJsonPath = join30(accountDir, "account.json");
       if (!existsSync23(accountJsonPath)) continue;
       let admins = [];
       try {
@@ -15560,7 +15642,7 @@ app10.post("/claude-auth", async (c) => {
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync12(join30(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync12(join31(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -15825,9 +15907,9 @@ ${body.newPin}
 var onboarding_default = app10;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync12 } from "fs";
-import { join as join31 } from "path";
-var CLIENT_ERRORS_LOG = join31(LOG_DIR, "client-errors.log");
+import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync13 } from "fs";
+import { join as join32 } from "path";
+var CLIENT_ERRORS_LOG = join32(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -15885,7 +15967,7 @@ function stackHead(stack) {
 function rotateIfNeeded() {
   try {
     if (!existsSync25(CLIENT_ERRORS_LOG)) return;
-    const stats = statSync12(CLIENT_ERRORS_LOG);
+    const stats = statSync13(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
@@ -15971,7 +16053,7 @@ app11.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -16211,17 +16293,17 @@ app13.get("/", requireAdminSession, async (c) => {
 var accounts_default = app13;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync13 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync14 } from "fs";
 import { resolve as resolve21, basename as basename9 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync26 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join32(dir, filename);
+    const fullPath = join33(dir, filename);
     if (existsSync26(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -16251,7 +16333,7 @@ app14.get("/", async (c) => {
       searched.push(filePath);
       try {
         const buffer = readFileSync31(filePath);
-        const onDiskBytes = statSync13(filePath).size;
+        const onDiskBytes = statSync14(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -16316,7 +16398,7 @@ app14.get("/", async (c) => {
       try {
         const filename = basename9(hit.path);
         const buffer = readFileSync31(hit.path);
-        const onDiskBytes = statSync13(hit.path).size;
+        const onDiskBytes = statSync14(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -16359,7 +16441,7 @@ app14.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync13(resolve21(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync14(resolve21(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
         const content = readFileSync31(resolve21(dir, name));
@@ -16479,7 +16561,7 @@ var attachment_default = app16;
 
 // server/routes/admin/session-upload.ts
 import { readFile as readFile5 } from "fs/promises";
-import { existsSync as existsSync29, statSync as statSync14 } from "fs";
+import { existsSync as existsSync29, statSync as statSync15 } from "fs";
 var app17 = new Hono();
 app17.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -16500,7 +16582,7 @@ app17.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   const resolution = resolveClaudeUploadsPath(`${sessionId}/${file}`);
-  if (!resolution.ok || !existsSync29(resolution.absolute) || !statSync14(resolution.absolute).isFile()) {
+  if (!resolution.ok || !existsSync29(resolution.absolute) || !statSync15(resolution.absolute).isFile()) {
     console.log(`[session-upload] op=miss session=${short2} file=${file} status=404 reason=absent`);
     return c.json({ error: "Not found" }, 404);
   }
@@ -16550,9 +16632,9 @@ async function authorizeAccountWrite(c, accountId) {
 }
 
 // ../services/claude-session-manager/src/tool-surface.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync21, statSync as statSync15, existsSync as existsSync30 } from "fs";
+import { readFileSync as readFileSync32, readdirSync as readdirSync21, statSync as statSync16, existsSync as existsSync30 } from "fs";
 import { createHash as createHash5 } from "crypto";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 
 // ../services/claude-session-manager/src/canonical-tool-names.ts
 function canonicalToolName(plugin, tool) {
@@ -16805,13 +16887,13 @@ function loadToolSurface(pluginsRoots) {
   const riskByTool = /* @__PURE__ */ new Map();
   const manifestPaths = /* @__PURE__ */ new Map();
   const loadOne = (pluginsRoot, plugin) => {
-    const pluginDir = join33(pluginsRoot, plugin);
+    const pluginDir = join34(pluginsRoot, plugin);
     try {
-      if (!statSync15(pluginDir).isDirectory()) return;
+      if (!statSync16(pluginDir).isDirectory()) return;
     } catch {
       return;
     }
-    const manifestPath = join33(pluginDir, "PLUGIN.md");
+    const manifestPath = join34(pluginDir, "PLUGIN.md");
     if (!existsSync30(manifestPath)) return;
     const raw = readFileSync32(manifestPath, "utf-8");
     const frontmatter = extractFrontmatter(raw, plugin);
@@ -16857,12 +16939,12 @@ function loadToolSurface(pluginsRoots) {
   for (const root of roots) {
     const entries2 = readdirSync21(root).sort();
     for (const plugin of entries2) {
-      const pluginDir = join33(root, plugin);
+      const pluginDir = join34(root, plugin);
       loadOne(root, plugin);
-      const subRoot = join33(pluginDir, "plugins");
+      const subRoot = join34(pluginDir, "plugins");
       let subEntries;
       try {
-        if (!statSync15(subRoot).isDirectory()) continue;
+        if (!statSync16(subRoot).isDirectory()) continue;
         subEntries = readdirSync21(subRoot).sort();
       } catch {
         continue;
@@ -16905,7 +16987,7 @@ function agentRiskClass(tools, riskByTool) {
   const byTool = [];
   const unresolved = [];
   let worst = null;
-  let worstTool = null;
+  let riskiestTool = null;
   for (const tool of tools) {
     const cls = BUILTIN_TOOL_RISK[tool] ?? riskByTool.get(tool) ?? null;
     byTool.push({ tool, risk: cls });
@@ -16915,16 +16997,16 @@ function agentRiskClass(tools, riskByTool) {
     }
     if (worst === null || SEVERITY[cls] > SEVERITY[worst]) {
       worst = cls;
-      worstTool = tool;
+      riskiestTool = tool;
     }
   }
   if (unresolved.length > 0) {
-    return { risk: "red", worstTool: unresolved[0], unresolved, byTool };
+    return { risk: "red", riskiestTool: unresolved[0], unresolved, byTool };
   }
   if (worst === null) {
-    return { risk: "red", worstTool: null, unresolved, byTool };
+    return { risk: "red", riskiestTool: null, unresolved, byTool };
   }
-  return { risk: AGENT_CLASS[worst], worstTool, unresolved, byTool };
+  return { risk: AGENT_CLASS[worst], riskiestTool, unresolved, byTool };
 }
 
 // server/routes/admin/agents.ts
@@ -17024,7 +17106,7 @@ function listShipped(accountDir, riskByTool, disabled, riskSurfaceFailed) {
         plugin: "",
         description: fm.description ?? "",
         risk: r.risk,
-        worstTool: r.worstTool,
+        riskiestTool: r.riskiestTool,
         unresolved: r.unresolved,
         toolCount: tools.length,
         // The DIRECTORY is the ground truth, not the store. `spawn-context.ts`
@@ -17046,7 +17128,7 @@ function parseToolsLine(raw) {
 }
 function classify(tools, riskByTool, riskSurfaceFailed) {
   if (riskSurfaceFailed) {
-    return { risk: "red", worstTool: null, unresolved: [], byTool: tools.map((t) => ({ tool: t, risk: null })) };
+    return { risk: "red", riskiestTool: null, unresolved: [], byTool: tools.map((t) => ({ tool: t, risk: null })) };
   }
   return agentRiskClass(tools, riskByTool);
 }
@@ -17082,7 +17164,7 @@ function listSpecialists(accountDir, riskByTool, riskSurfaceFailed) {
           plugin,
           description: fm.description ?? "",
           risk: r.risk,
-          worstTool: r.worstTool,
+          riskiestTool: r.riskiestTool,
           unresolved: r.unresolved,
           toolCount: specialistTools.length,
           // A user-created specialist lives under the account plugins tree,
@@ -17133,7 +17215,7 @@ app18.get("/", requireAdminSession, (c) => {
             kind: "public",
             origin: "public",
             risk: null,
-            worstTool: null,
+            riskiestTool: null,
             unresolved: [],
             disabled: false
           });
@@ -17153,7 +17235,7 @@ app18.get("/", requireAdminSession, (c) => {
   for (const row of rows) {
     if (row.risk === null) continue;
     console.log(
-      `[admin/agents] op=classify account=${acct} agent=${row.slug} origin=${row.origin} risk=${row.risk} worstTool=${row.worstTool ?? "none"} tools=${row.toolCount} unresolved=${row.unresolved.length > 0 ? row.unresolved.join(",") : "none"} disabled=${row.disabled}`
+      `[admin/agents] op=classify account=${acct} agent=${row.slug} origin=${row.origin} risk=${row.risk} riskiestTool=${row.riskiestTool ?? "none"} tools=${row.toolCount} unresolved=${row.unresolved.length > 0 ? row.unresolved.join(",") : "none"} disabled=${row.disabled}`
     );
   }
   console.log(`[admin/agents] op=list accountId=${acct} agents=${agents.length} specialists=${specialists.length} shipped=${shipped.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped} shippedSkipped=${shippedSkipped}`);
@@ -17196,7 +17278,7 @@ app18.get("/:slug", requireAdminSession, (c) => {
         systemPrompt: body.trim(),
         skills: [],
         risk: r.risk,
-        worstTool: r.worstTool,
+        riskiestTool: r.riskiestTool,
         unresolved: r.unresolved,
         byTool: r.byTool,
         disabled: readDisabledStore(account.accountDir).has(`${slug}.md`)
@@ -17227,7 +17309,7 @@ app18.get("/:slug", requireAdminSession, (c) => {
         systemPrompt: body.trim(),
         skills,
         risk: r.risk,
-        worstTool: r.worstTool,
+        riskiestTool: r.riskiestTool,
         unresolved: r.unresolved,
         byTool: r.byTool,
         disabled: false
@@ -18126,8 +18208,8 @@ app19.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app19;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync33, readFileSync as readFileSync34, readdirSync as readdirSync23, statSync as statSync16 } from "fs";
-import { dirname as dirname12, resolve as resolve24, join as join34 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync34, readdirSync as readdirSync23, statSync as statSync17 } from "fs";
+import { dirname as dirname12, resolve as resolve24, join as join35 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -18168,8 +18250,8 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join34(pluginDir, "mcp/dist/index.js"),
-    join34(pluginDir, "mcp/src/index.ts")
+    join35(pluginDir, "mcp/dist/index.js"),
+    join35(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path3 of candidates) {
@@ -18227,9 +18309,9 @@ function listPluginDirs(accountPluginsDir) {
   const platformPlugins = resolve24(PLATFORM_ROOT, "plugins");
   if (existsSync33(platformPlugins)) {
     for (const name of readdirSync23(platformPlugins)) {
-      const dir = join34(platformPlugins, name);
+      const dir = join35(platformPlugins, name);
       try {
-        if (statSync16(dir).isDirectory()) out.set(name, dir);
+        if (statSync17(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
@@ -18237,13 +18319,13 @@ function listPluginDirs(accountPluginsDir) {
   const premiumRoot = resolve24(dirname12(PLATFORM_ROOT), "premium-plugins");
   if (existsSync33(premiumRoot)) {
     for (const bundle of readdirSync23(premiumRoot)) {
-      const bundlePlugins = join34(premiumRoot, bundle, "plugins");
+      const bundlePlugins = join35(premiumRoot, bundle, "plugins");
       if (!existsSync33(bundlePlugins)) continue;
       try {
         for (const name of readdirSync23(bundlePlugins)) {
-          const dir = join34(bundlePlugins, name);
+          const dir = join35(bundlePlugins, name);
           try {
-            if (statSync16(dir).isDirectory()) out.set(name, dir);
+            if (statSync17(dir).isDirectory()) out.set(name, dir);
           } catch {
           }
         }
@@ -18255,9 +18337,9 @@ function listPluginDirs(accountPluginsDir) {
     try {
       for (const name of readdirSync23(accountPluginsDir)) {
         if (out.has(name)) continue;
-        const dir = join34(accountPluginsDir, name);
+        const dir = join35(accountPluginsDir, name);
         try {
-          if (statSync16(dir).isDirectory()) out.set(name, dir);
+          if (statSync17(dir).isDirectory()) out.set(name, dir);
         } catch {
         }
       }
@@ -18274,7 +18356,7 @@ function listAccountPluginNames(accountPluginsDir) {
   try {
     return readdirSync23(accountPluginsDir).filter((name) => {
       try {
-        return statSync16(join34(accountPluginsDir, name)).isDirectory();
+        return statSync17(join35(accountPluginsDir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -18317,7 +18399,7 @@ function computeActivePlugins(accountId) {
   for (const name of emitNames) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join34(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join35(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -18334,7 +18416,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync33(join34(dir, "mcp/dist/index.js")) || existsSync33(join34(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync33(join35(dir, "mcp/dist/index.js")) || existsSync33(join35(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -18344,7 +18426,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join34(dir, relPath);
+      const skillPath = join35(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -18388,7 +18470,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries2.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join34(specialistsDir, file));
+    const fm = readFrontmatter(join35(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -18787,7 +18869,7 @@ import { createReadStream as createReadStream2, createWriteStream as createWrite
 import { readdir as readdir4, readFile as readFile7, stat as stat6, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
 import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename11, dirname as dirname13, join as join36, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
+import { basename as basename11, dirname as dirname13, join as join37, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -19105,7 +19187,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve26, relative as relative4, join as join35, basename as basename10, extname as extname2, sep as sep7 } from "path";
+import { resolve as resolve26, relative as relative4, join as join36, basename as basename10, extname as extname2, sep as sep7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -19187,7 +19269,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join35(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join36(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -19249,7 +19331,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join35(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join36(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -19270,7 +19352,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries2) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join35(root, entry.name);
+    const abs = join36(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -19643,7 +19725,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile7(join36(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile7(join37(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -19698,7 +19780,7 @@ async function servableFilesIn(dirAbs, uuid) {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
-    const dirAbs = join36(absolute, entry.name);
+    const dirAbs = join37(absolute, entry.name);
     const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
       const servable = await servableFilesIn(dirAbs, entry.name);
@@ -19707,7 +19789,7 @@ async function enrich(absolute, entry, accountNames) {
         let size = null;
         let modifiedAt = entry.modifiedAt;
         try {
-          const st = await stat6(join36(dirAbs, innerName));
+          const st = await stat6(join37(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
@@ -19900,7 +19982,7 @@ app23.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join36(absolute, name);
+        const entryPath = join37(absolute, name);
         const s = await stat6(entryPath);
         entries2.push({
           name,
@@ -19929,7 +20011,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const displayPath = buildDisplayPath(relPath, accountNames);
     if (groupReq || isAccountRoot(relPath)) {
       const acctId = relPath.split("/")[1] ?? accountId;
-      const schemaMd = await readFile7(join36(absolute, "SCHEMA.md"), "utf8").catch(() => null);
+      const schemaMd = await readFile7(join37(absolute, "SCHEMA.md"), "utf8").catch(() => null);
       const groups = classifyAccountRoot(schemaMd, entries2.map((e) => e.name));
       console.error(
         `[data-schema] op=classify account=${acctId} status=${groups.parsed ? "ok" : "parse-failed"} reason=${groups.reason} entries=${entries2.length} home=${groups.home.join(",") || "none"} system=${groups.system.length} unknown=${groups.unknown.join(",") || "none"}`
@@ -19967,7 +20049,7 @@ app23.get("/", requireAdminSession, async (c) => {
       for (const name of homeDirs) {
         const base = byName.get(name);
         try {
-          const dirents = await readdir4(join36(absolute, name), { withFileTypes: true });
+          const dirents = await readdir4(join37(absolute, name), { withFileTypes: true });
           const visible = dirents.filter((d) => !d.name.startsWith("."));
           visible.sort((a, b) => {
             const ad = a.isDirectory() ? 0 : 1;
@@ -20032,7 +20114,7 @@ app23.get("/download", requireAdminSession, async (c) => {
       console.error(`[data] op=scratchpad-no-session sessionId="${sessionId.slice(0, 8)}\u2026"`);
       return c.json({ error: "Not found" }, 404);
     }
-    const meta = readSidecarMeta(join36(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join37(projectDir, `${sessionId}.meta.json`));
     if (!meta.accountId || meta.accountId !== accountId) {
       console.error(`[data] account-scope-blocked root="scratchpad" sessionId="${sessionId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
@@ -20127,7 +20209,7 @@ async function* walkRegularFiles(dirAbsolute) {
   const dirents = await readdir4(dirAbsolute, { withFileTypes: true });
   for (const d of dirents) {
     if (d.isSymbolicLink()) continue;
-    const child = join36(dirAbsolute, d.name);
+    const child = join37(dirAbsolute, d.name);
     if (d.isDirectory()) {
       yield* walkRegularFiles(child);
       continue;
@@ -20237,7 +20319,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
   const relDir = relpath ? dirname13(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join36(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join37(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 404, error: "Not found" };
@@ -20614,7 +20696,7 @@ app23.delete("/", requireAdminSession, async (c) => {
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
     const containerDir = dirname13(absolute);
-    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join36(containerDir, `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join37(containerDir, `${stem}.meta.json`) : null;
     const isAttachmentContainer = UUID_RE4.test(stem) && basename11(containerDir) === stem;
     await unlink3(absolute);
     if (sidecarPath) {
@@ -20624,7 +20706,7 @@ app23.delete("/", requireAdminSession, async (c) => {
       }
     }
     if (isAttachmentContainer) {
-      await unlink3(join36(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      await unlink3(join37(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
       });
       await rmdir(containerDir).catch(() => {
       });
@@ -21734,7 +21816,7 @@ function isHiddenByDefault(label) {
 // server/lib/top-level-labels.ts
 var import_dist5 = __toESM(require_dist4(), 1);
 import { readdirSync as readdirSync24, readFileSync as readFileSync36 } from "fs";
-import { join as join37, resolve as resolve28 } from "path";
+import { join as join38, resolve as resolve28 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -21838,7 +21920,7 @@ function parseTopLevelLabels(content) {
 }
 function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
-    return join37(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+    return join38(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
   return resolve28(import.meta.dirname, "../../../plugins/memory/references");
 }
@@ -21848,7 +21930,7 @@ function parseTableTopLevelLabels(referencesDir) {
   try {
     const fileNames = readdirSync24(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
     for (const fileName of fileNames) {
-      const content = readFileSync36(join37(referencesDir, fileName), "utf-8");
+      const content = readFileSync36(join38(referencesDir, fileName), "utf-8");
       const parsed = parseTopLevelLabels(content);
       if (parsed.length > 0) contributingFiles.push(fileName);
       for (const label of parsed) labels.add(label);
@@ -23187,11 +23269,11 @@ var sidebar_artefacts_default = app30;
 
 // server/channel-session-override.ts
 import { readFileSync as readFileSync37, writeFileSync as writeFileSync14, renameSync as renameSync10 } from "fs";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 var FILE2 = "channel-session-override.json";
 var UUID3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function channelOverridePath(accountDir) {
-  return join38(accountDir, FILE2);
+  return join39(accountDir, FILE2);
 }
 function senderKey(channel, senderId) {
   return `${channel}:${senderId}`;
@@ -23587,24 +23669,24 @@ var session_rc_spawn_default = app36;
 import { randomUUID as randomUUID12 } from "crypto";
 
 // server/wa-descriptor.ts
-import { resolve as resolve30, join as join39 } from "path";
+import { resolve as resolve30, join as join40 } from "path";
 function waGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function waServerPath() {
-  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
+  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join40(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
 }
 function waChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: waGatewayUrl(), serverPath: waServerPath() };
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve31, join as join40 } from "path";
+import { resolve as resolve31, join as join41 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join40(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 function telegramChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: telegramGatewayUrl(), serverPath: telegramServerPath() };
@@ -23889,10 +23971,10 @@ var system_stats_default = app38;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync37, readFileSync as readFileSync38 } from "fs";
-import { resolve as resolve32, join as join41 } from "path";
+import { resolve as resolve32, join as join42 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve32(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join41(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join42(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync37(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync38(brandJsonPath, "utf-8"));
@@ -24682,7 +24764,7 @@ var browser_default = app46;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync38 } from "fs";
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -24782,7 +24864,7 @@ function countVEvents(ics) {
 
 // server/lib/calendar-availability.ts
 import { readFileSync as readFileSync39 } from "fs";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -24791,7 +24873,7 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join42(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join43(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
     raw = readFileSync39(path3, "utf-8");
@@ -25153,7 +25235,7 @@ app47.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync38(join43(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync38(join44(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -26486,7 +26568,7 @@ app61.route("/request-magic-link", request_magic_link_default);
 var access_default = app61;
 
 // server/routes/sites.ts
-import { existsSync as existsSync41, readFileSync as readFileSync42, realpathSync as realpathSync8, statSync as statSync18 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync42, realpathSync as realpathSync8, statSync as statSync19 } from "fs";
 import { resolve as resolve36 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -26552,7 +26634,7 @@ app62.get("/:rel{.*}", (c) => {
   }
   let stat11;
   try {
-    stat11 = existsSync41(filePath) ? statSync18(filePath) : null;
+    stat11 = existsSync41(filePath) ? statSync19(filePath) : null;
   } catch {
     stat11 = null;
   }
@@ -26703,7 +26785,7 @@ var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
 import { existsSync as existsSync42, readFileSync as readFileSync44 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -26711,7 +26793,7 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join44(platformRoot5, "config", "brand.json");
+  const brandPath = join45(platformRoot5, "config", "brand.json");
   if (!existsSync42(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync44(brandPath, "utf-8"));
@@ -27556,7 +27638,7 @@ var calendar_public_default = app67;
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
 import { stat as stat8, readFile as readFile9, realpath } from "fs/promises";
-import { join as join45, resolve as resolve38, sep as sep10 } from "path";
+import { join as join46, resolve as resolve38, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
 var app68 = new Hono();
 var TAG50 = "[portal-fetch]";
@@ -27629,7 +27711,7 @@ function isValidAccountId2(value) {
 }
 async function readExposeFolders2(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile9(join45(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile9(join46(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -27638,7 +27720,7 @@ async function readExposeFolders2(accountDir) {
 async function resolveFetchTarget(accountDir, relPath, ownerId) {
   let schemaText = null;
   try {
-    schemaText = await readFile9(join45(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile9(join46(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -27808,8 +27890,8 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync28, readFileSync as readFileSync45, statSync as statSync19 } from "fs";
-import { join as join46 } from "path";
+import { readdirSync as readdirSync28, readFileSync as readFileSync45, statSync as statSync20 } from "fs";
+import { join as join47 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
 var LEDGER_INDEX_NAMES = [
@@ -27863,9 +27945,9 @@ function countWriteRejects24h(logDir, now) {
   }
   let total = 0;
   for (const name of entries2) {
-    const path3 = join46(logDir, name);
+    const path3 = join47(logDir, name);
     try {
-      if (now - statSync19(path3).mtimeMs > DAY_MS) continue;
+      if (now - statSync20(path3).mtimeMs > DAY_MS) continue;
       for (const line of readFileSync45(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
@@ -28362,7 +28444,7 @@ async function migrateUploads(opts = {}) {
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir7, readFile as readFile10, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
 import { existsSync as existsSync44 } from "fs";
-import { join as join47 } from "path";
+import { join as join48 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -28407,7 +28489,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join47(projectsRoot, slug.name);
+    const slugDir = join48(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir7(slugDir, { withFileTypes: true });
@@ -28416,9 +28498,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join47(slugDir, entry.name));
+        out.push(join48(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join47(slugDir, entry.name);
+        const subDir = join48(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -28426,7 +28508,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join47(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join48(subDir, s.name));
         }
       }
     }
@@ -28438,7 +28520,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join47(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join48(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -31186,7 +31268,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync46, readFileSync as readFileSync47, statSync as statSync20 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync47, statSync as statSync21 } from "fs";
 import { resolve as resolve44 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -31238,7 +31320,7 @@ function resolveEntitlement(brand, account) {
   if (!existsSync46(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat11 = statSync20(entitlementPath);
+  const stat11 = statSync21(entitlementPath);
   const key = memoKey(stat11.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -31426,7 +31508,7 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join48(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join49(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync47(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
@@ -31465,7 +31547,7 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join48(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join49(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync47(ALIAS_DOMAINS_PATH)) return null;
@@ -31544,7 +31626,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -31559,7 +31641,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, ".."))
+      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -31677,7 +31759,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join48(configDir2, "projects");
+    const projectsRoot = join49(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -32343,7 +32425,7 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join48(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join49(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync47(versionFile)) return "unknown";
     const content = readFileSync48(versionFile, "utf-8").trim();
     return content || "unknown";
@@ -32403,11 +32485,11 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join48(homedir4(), BRAND.configDir);
+  const configDir2 = join49(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join48(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join49(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync47(cachePath)) return null;
     return JSON.parse(readFileSync48(cachePath, "utf-8"));
   } catch {
@@ -32638,6 +32720,7 @@ if (brandFaviconPath !== "/favicon.ico") {
     return c.redirect(brandFaviconPath, 302);
   });
 }
+app69.use("/*", staticCacheHeaders("./public"));
 app69.use("/*", serveStatic({ root: "./public" }));
 app69.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
@@ -32656,7 +32739,7 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app69.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const reconcileScript = resolve45(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
     if (!existsSync47(reconcileScript)) return;
@@ -32679,7 +32762,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join48(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join49(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -32697,7 +32780,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const dreamSweepScript = resolve45(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
@@ -32721,7 +32804,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const outlookScript = resolve45(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
@@ -32747,7 +32830,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const strandedAccountsDir = resolve45(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
@@ -32760,7 +32843,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve45(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync47(pendingPath2)) continue;
-        const ageMs2 = now - statSync21(pendingPath2).mtimeMs;
+        const ageMs2 = now - statSync22(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
         }
@@ -32777,7 +32860,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const googleAccountsDir = resolve45(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
@@ -32821,7 +32904,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -32867,7 +32950,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const publishScript = resolve45(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
@@ -32944,7 +33027,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const auditScript = resolve45(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
@@ -32989,19 +33072,17 @@ startAuthHealthHeartbeat();
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
   loopHist.enable();
-  const LOG_THRESHOLD_MS = 1e3;
+  const LOUD_THRESHOLD_MS = 1e3;
   const WINDOW_MS2 = 3e4;
   registerLoop({
     name: "event-loop-lag",
     intervalMs: WINDOW_MS2,
     run: () => {
-      const maxMs = loopHist.max / 1e6;
-      const p99Ms = loopHist.percentile(99) / 1e6;
-      loopHist.reset();
-      if (maxMs >= LOG_THRESHOLD_MS) {
-        console.error(`[event-loop] lag p99=${Math.round(p99Ms)} max=${Math.round(maxMs)} window=${WINDOW_MS2 / 1e3}s`);
-      }
-      return `p99 ${Math.round(p99Ms)}ms, max ${Math.round(maxMs)}ms`;
+      const w = readAndResetWindow(loopHist, WINDOW_MS2);
+      const line = formatLagWindow(w);
+      if (w.maxMs >= LOUD_THRESHOLD_MS) console.error(line);
+      else console.log(line);
+      return `p99 ${w.p99Ms}ms, max ${w.maxMs}ms`;
     }
   });
 }
@@ -33254,7 +33335,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..")),
+  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {