@rubytech/create-sitedesk-code 0.1.509 → 0.1.511

package/payload/server/server.js

@@ -1601,230 +1601,8 @@ var require_dist5 = __commonJS({
   }
 });
 
-// node_modules/hono/dist/utils/mime.js
-var getMimeType = (filename, mimes = baseMimes) => {
-  const regexp = /\.([a-zA-Z0-9]+?)$/;
-  const match = filename.match(regexp);
-  if (!match) {
-    return;
-  }
-  let mimeType = mimes[match[1].toLowerCase()];
-  if (mimeType && mimeType.startsWith("text")) {
-    mimeType += "; charset=utf-8";
-  }
-  return mimeType;
-};
-var _baseMimes = {
-  aac: "audio/aac",
-  avi: "video/x-msvideo",
-  avif: "image/avif",
-  av1: "video/av1",
-  bin: "application/octet-stream",
-  bmp: "image/bmp",
-  css: "text/css",
-  csv: "text/csv",
-  eot: "application/vnd.ms-fontobject",
-  epub: "application/epub+zip",
-  gif: "image/gif",
-  gz: "application/gzip",
-  htm: "text/html",
-  html: "text/html",
-  ico: "image/x-icon",
-  ics: "text/calendar",
-  jpeg: "image/jpeg",
-  jpg: "image/jpeg",
-  js: "text/javascript",
-  json: "application/json",
-  jsonld: "application/ld+json",
-  map: "application/json",
-  mid: "audio/x-midi",
-  midi: "audio/x-midi",
-  mjs: "text/javascript",
-  mp3: "audio/mpeg",
-  mp4: "video/mp4",
-  mpeg: "video/mpeg",
-  oga: "audio/ogg",
-  ogv: "video/ogg",
-  ogx: "application/ogg",
-  opus: "audio/opus",
-  otf: "font/otf",
-  pdf: "application/pdf",
-  png: "image/png",
-  rtf: "application/rtf",
-  svg: "image/svg+xml",
-  tif: "image/tiff",
-  tiff: "image/tiff",
-  ts: "video/mp2t",
-  ttf: "font/ttf",
-  txt: "text/plain",
-  wasm: "application/wasm",
-  webm: "video/webm",
-  weba: "audio/webm",
-  webmanifest: "application/manifest+json",
-  webp: "image/webp",
-  woff: "font/woff",
-  woff2: "font/woff2",
-  xhtml: "application/xhtml+xml",
-  xml: "application/xml",
-  zip: "application/zip",
-  "3gp": "video/3gpp",
-  "3g2": "video/3gpp2",
-  gltf: "model/gltf+json",
-  glb: "model/gltf-binary"
-};
-var baseMimes = _baseMimes;
-
-// node_modules/@hono/node-server/dist/serve-static.mjs
-import { createReadStream, statSync, existsSync } from "fs";
-import { join } from "path";
-import { versions } from "process";
-import { Readable } from "stream";
-var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
-var ENCODINGS = {
-  br: ".br",
-  zstd: ".zst",
-  gzip: ".gz"
-};
-var ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
-var pr54206Applied = () => {
-  const [major, minor] = versions.node.split(".").map((component) => parseInt(component));
-  return major >= 23 || major === 22 && minor >= 7 || major === 20 && minor >= 18;
-};
-var useReadableToWeb = pr54206Applied();
-var createStreamBody = (stream2) => {
-  if (useReadableToWeb) {
-    return Readable.toWeb(stream2);
-  }
-  const body = new ReadableStream({
-    start(controller) {
-      stream2.on("data", (chunk) => {
-        controller.enqueue(chunk);
-      });
-      stream2.on("error", (err) => {
-        controller.error(err);
-      });
-      stream2.on("end", () => {
-        controller.close();
-      });
-    },
-    cancel() {
-      stream2.destroy();
-    }
-  });
-  return body;
-};
-var getStats = (path3) => {
-  let stats;
-  try {
-    stats = statSync(path3);
-  } catch {
-  }
-  return stats;
-};
-var tryDecode = (str, decoder) => {
-  try {
-    return decoder(str);
-  } catch {
-    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
-      try {
-        return decoder(match);
-      } catch {
-        return match;
-      }
-    });
-  }
-};
-var tryDecodeURI = (str) => tryDecode(str, decodeURI);
-var serveStatic = (options = { root: "" }) => {
-  const root = options.root || "";
-  const optionPath = options.path;
-  if (root !== "" && !existsSync(root)) {
-    console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
-  }
-  return async (c, next) => {
-    if (c.finalized) {
-      return next();
-    }
-    let filename;
-    if (optionPath) {
-      filename = optionPath;
-    } else {
-      try {
-        filename = tryDecodeURI(c.req.path);
-        if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
-          throw new Error();
-        }
-      } catch {
-        await options.onNotFound?.(c.req.path, c);
-        return next();
-      }
-    }
-    let path3 = join(
-      root,
-      !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename
-    );
-    let stats = getStats(path3);
-    if (stats && stats.isDirectory()) {
-      const indexFile2 = options.index ?? "index.html";
-      path3 = join(path3, indexFile2);
-      stats = getStats(path3);
-    }
-    if (!stats) {
-      await options.onNotFound?.(path3, c);
-      return next();
-    }
-    const mimeType = getMimeType(path3);
-    c.header("Content-Type", mimeType || "application/octet-stream");
-    if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
-      const acceptEncodingSet = new Set(
-        c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim())
-      );
-      for (const encoding of ENCODINGS_ORDERED_KEYS) {
-        if (!acceptEncodingSet.has(encoding)) {
-          continue;
-        }
-        const precompressedStats = getStats(path3 + ENCODINGS[encoding]);
-        if (precompressedStats) {
-          c.header("Content-Encoding", encoding);
-          c.header("Vary", "Accept-Encoding", { append: true });
-          stats = precompressedStats;
-          path3 = path3 + ENCODINGS[encoding];
-          break;
-        }
-      }
-    }
-    let result;
-    const size = stats.size;
-    const range = c.req.header("range") || "";
-    if (c.req.method == "HEAD" || c.req.method == "OPTIONS") {
-      c.header("Content-Length", size.toString());
-      c.status(200);
-      result = c.body(null);
-    } else if (!range) {
-      c.header("Content-Length", size.toString());
-      result = c.body(createStreamBody(createReadStream(path3)), 200);
-    } else {
-      c.header("Accept-Ranges", "bytes");
-      c.header("Date", stats.birthtime.toUTCString());
-      const parts = range.replace(/bytes=/, "").split("-", 2);
-      const start = parseInt(parts[0], 10) || 0;
-      let end = parseInt(parts[1], 10) || size - 1;
-      if (size < end - start + 1) {
-        end = size - 1;
-      }
-      const chunksize = end - start + 1;
-      const stream2 = createReadStream(path3, { start, end });
-      c.header("Content-Length", chunksize.toString());
-      c.header("Content-Range", `bytes ${start}-${end}/${stats.size}`);
-      result = c.body(createStreamBody(stream2), 206);
-    }
-    await options.onFound?.(path3, c);
-    return result;
-  };
-};
-
 // server/index.ts
-import { readFileSync as readFileSync48, existsSync as existsSync47, watchFile, readdirSync as readdirSync29, statSync as statSync22 } from "fs";
+import { readFileSync as readFileSync48, existsSync as existsSync47, watchFile, readdirSync as readdirSync29, statSync as statSync21 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
 import { resolve as resolve45, join as join49, basename as basename14 } from "path";
@@ -1950,21 +1728,21 @@ function onInvalidate(fn) {
 }
 
 // app/lib/whatsapp/message-store.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync, appendFileSync, readdirSync, statSync as statSync2 } from "fs";
-import { dirname, join as join2 } from "path";
+import { existsSync, mkdirSync, readFileSync, appendFileSync, readdirSync, statSync } from "fs";
+import { dirname, join } from "path";
 function isReactionRecord(r) {
   return r.kind === "reaction";
 }
-var STORE_ROOT = () => join2(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
+var STORE_ROOT = () => join(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
 function conversationFile(platformAccountId, remoteJid) {
-  return join2(STORE_ROOT(), platformAccountId, `${remoteJid}.jsonl`);
+  return join(STORE_ROOT(), platformAccountId, `${remoteJid}.jsonl`);
 }
 function listStoredAccountIds() {
   const root = STORE_ROOT();
-  if (!existsSync2(root)) return [];
+  if (!existsSync(root)) return [];
   return readdirSync(root).filter((name) => {
     try {
-      return statSync2(join2(root, name)).isDirectory();
+      return statSync(join(root, name)).isDirectory();
     } catch {
       return false;
     }
@@ -2000,7 +1778,7 @@ function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
   try {
     const filesToCheck = [file, ...altDedupeRemoteJids.filter((jid) => jid && jid !== record.remoteJid).map((jid) => conversationFile(platformAccountId, jid))];
     for (const candidate of new Set(filesToCheck)) {
-      if (!existsSync2(candidate)) continue;
+      if (!existsSync(candidate)) continue;
       const existing = parseLines(readFileSync(candidate, "utf8"));
       if (existing.some((r) => r.messageId === record.messageId)) {
         return { created: false };
@@ -2023,7 +1801,7 @@ function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
 function readConversation(platformAccountId, remoteJid) {
   const file = conversationFile(platformAccountId, remoteJid);
   try {
-    if (!existsSync2(file)) return [];
+    if (!existsSync(file)) return [];
     return parseLines(readFileSync(file, "utf8")).sort(byDateSentAsc);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
@@ -2048,7 +1826,7 @@ function appendReaction(platformAccountId, record) {
 function readReactions(platformAccountId, remoteJid) {
   const file = conversationFile(platformAccountId, remoteJid);
   try {
-    if (!existsSync2(file)) return [];
+    if (!existsSync(file)) return [];
     const out = [];
     for (const line of readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) continue;
@@ -2094,23 +1872,23 @@ function summariseRecords(records) {
   };
 }
 function readConversationSummaries(platformAccountId) {
-  const dir = join2(STORE_ROOT(), platformAccountId);
+  const dir = join(STORE_ROOT(), platformAccountId);
   const out = /* @__PURE__ */ new Map();
   const seen = /* @__PURE__ */ new Set();
   let fullReads = 0;
   let cacheHits = 0;
   let bytesRead = 0;
   try {
-    if (!existsSync2(dir)) return out;
+    if (!existsSync(dir)) return out;
     for (const entry of readdirSync(dir)) {
       if (!entry.endsWith(".jsonl")) continue;
       const remoteJid = entry.slice(0, -".jsonl".length);
-      const file = join2(dir, entry);
+      const file = join(dir, entry);
       seen.add(file);
       let size;
       let mtimeMs;
       try {
-        const st = statSync2(file);
+        const st = statSync(file);
         size = st.size;
         mtimeMs = st.mtimeMs;
       } catch {
@@ -2150,10 +1928,10 @@ function readConversationSummaries(platformAccountId) {
   return out;
 }
 function readAllConversations(platformAccountId) {
-  const dir = join2(STORE_ROOT(), platformAccountId);
+  const dir = join(STORE_ROOT(), platformAccountId);
   const out = /* @__PURE__ */ new Map();
   try {
-    if (!existsSync2(dir)) return out;
+    if (!existsSync(dir)) return out;
     for (const entry of readdirSync(dir)) {
       if (!entry.endsWith(".jsonl")) continue;
       const remoteJid = entry.slice(0, -".jsonl".length);
@@ -2317,92 +2095,314 @@ function handleManagerFrame(raw) {
     console.error(`${TAG} op=skip reason=no-account sessionId=${sessionId}`);
     return null;
   }
-  const status = String(body.status ?? "unknown");
-  const fullSessionId = String(body.sessionId ?? "");
-  if (fullSessionId && lastStatusBySession.get(fullSessionId) === status) {
-    return null;
+  const status = String(body.status ?? "unknown");
+  const fullSessionId = String(body.sessionId ?? "");
+  if (fullSessionId && lastStatusBySession.get(fullSessionId) === status) {
+    return null;
+  }
+  if (fullSessionId) lastStatusBySession.set(fullSessionId, status);
+  console.log(
+    `${TAG} op=event sessionId=${sessionId} accountId=${accountId.slice(0, 8)} activity=${status}`
+  );
+  notify("webchat-pointer", accountId);
+  return { resource: "webchat-pointer", accountId };
+}
+var connections = 0;
+var started = false;
+var abort = null;
+function startManagerEventsSubscriber() {
+  if (started) return;
+  started = true;
+  abort = new AbortController();
+  void connectLoop(abort.signal);
+}
+async function connectLoop(signal) {
+  let backoffMs = 1e3;
+  for (; ; ) {
+    if (signal.aborted) return;
+    let port2;
+    try {
+      port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "webchat-pointer" });
+    } catch {
+      console.error(`${TAG} op=drop reason=manager-port-unset`);
+      return;
+    }
+    const connectedAt = Date.now();
+    try {
+      const res = await fetch(`http://127.0.0.1:${port2}/events`, { signal });
+      if (!res.ok || !res.body) throw new Error(`status ${res.status}`);
+      connections += 1;
+      console.log(`${TAG} op=subscribe upstream-count=${connections}`);
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = "";
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true });
+        let cut = buffer.indexOf("\n\n");
+        while (cut !== -1) {
+          handleManagerFrame(buffer.slice(0, cut));
+          buffer = buffer.slice(cut + 2);
+          cut = buffer.indexOf("\n\n");
+        }
+      }
+      connections -= 1;
+    } catch (err) {
+      if (connections > 0) connections -= 1;
+      if (signal.aborted) return;
+      console.error(`${TAG} op=drop reason=${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (signal.aborted) return;
+    if (Date.now() - connectedAt >= STABLE_CONNECTION_MS) backoffMs = 1e3;
+    console.log(`${TAG} op=reconnect inMs=${backoffMs} upstream-count=${connections}`);
+    await new Promise((r) => setTimeout(r, backoffMs));
+    backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+  }
+}
+
+// server/index.ts
+import { monitorEventLoopDelay } from "perf_hooks";
+
+// server/lib/event-loop-lag.ts
+function readAndResetWindow(hist, windowMs) {
+  const toMs = (ns) => Math.round(ns / 1e6);
+  const w = {
+    p50Ms: toMs(hist.percentile(50)),
+    p99Ms: toMs(hist.percentile(99)),
+    maxMs: toMs(hist.max),
+    // Read before the reset.
+    count: hist.count,
+    windowMs
+  };
+  hist.reset();
+  return w;
+}
+function formatLagWindow(w) {
+  return `[event-loop] op=lag-window p50=${w.p50Ms} p99=${w.p99Ms} max=${w.maxMs} n=${w.count} windowMs=${w.windowMs}`;
+}
+
+// node_modules/hono/dist/utils/mime.js
+var getMimeType = (filename, mimes = baseMimes) => {
+  const regexp = /\.([a-zA-Z0-9]+?)$/;
+  const match = filename.match(regexp);
+  if (!match) {
+    return;
+  }
+  let mimeType = mimes[match[1].toLowerCase()];
+  if (mimeType && mimeType.startsWith("text")) {
+    mimeType += "; charset=utf-8";
+  }
+  return mimeType;
+};
+var _baseMimes = {
+  aac: "audio/aac",
+  avi: "video/x-msvideo",
+  avif: "image/avif",
+  av1: "video/av1",
+  bin: "application/octet-stream",
+  bmp: "image/bmp",
+  css: "text/css",
+  csv: "text/csv",
+  eot: "application/vnd.ms-fontobject",
+  epub: "application/epub+zip",
+  gif: "image/gif",
+  gz: "application/gzip",
+  htm: "text/html",
+  html: "text/html",
+  ico: "image/x-icon",
+  ics: "text/calendar",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  js: "text/javascript",
+  json: "application/json",
+  jsonld: "application/ld+json",
+  map: "application/json",
+  mid: "audio/x-midi",
+  midi: "audio/x-midi",
+  mjs: "text/javascript",
+  mp3: "audio/mpeg",
+  mp4: "video/mp4",
+  mpeg: "video/mpeg",
+  oga: "audio/ogg",
+  ogv: "video/ogg",
+  ogx: "application/ogg",
+  opus: "audio/opus",
+  otf: "font/otf",
+  pdf: "application/pdf",
+  png: "image/png",
+  rtf: "application/rtf",
+  svg: "image/svg+xml",
+  tif: "image/tiff",
+  tiff: "image/tiff",
+  ts: "video/mp2t",
+  ttf: "font/ttf",
+  txt: "text/plain",
+  wasm: "application/wasm",
+  webm: "video/webm",
+  weba: "audio/webm",
+  webmanifest: "application/manifest+json",
+  webp: "image/webp",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  xhtml: "application/xhtml+xml",
+  xml: "application/xml",
+  zip: "application/zip",
+  "3gp": "video/3gpp",
+  "3g2": "video/3gpp2",
+  gltf: "model/gltf+json",
+  glb: "model/gltf-binary"
+};
+var baseMimes = _baseMimes;
+
+// node_modules/@hono/node-server/dist/serve-static.mjs
+import { createReadStream, statSync as statSync2, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { versions } from "process";
+import { Readable } from "stream";
+var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
+var ENCODINGS = {
+  br: ".br",
+  zstd: ".zst",
+  gzip: ".gz"
+};
+var ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
+var pr54206Applied = () => {
+  const [major, minor] = versions.node.split(".").map((component) => parseInt(component));
+  return major >= 23 || major === 22 && minor >= 7 || major === 20 && minor >= 18;
+};
+var useReadableToWeb = pr54206Applied();
+var createStreamBody = (stream2) => {
+  if (useReadableToWeb) {
+    return Readable.toWeb(stream2);
+  }
+  const body = new ReadableStream({
+    start(controller) {
+      stream2.on("data", (chunk) => {
+        controller.enqueue(chunk);
+      });
+      stream2.on("error", (err) => {
+        controller.error(err);
+      });
+      stream2.on("end", () => {
+        controller.close();
+      });
+    },
+    cancel() {
+      stream2.destroy();
+    }
+  });
+  return body;
+};
+var getStats = (path3) => {
+  let stats;
+  try {
+    stats = statSync2(path3);
+  } catch {
+  }
+  return stats;
+};
+var tryDecode = (str, decoder) => {
+  try {
+    return decoder(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decoder(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+};
+var tryDecodeURI = (str) => tryDecode(str, decodeURI);
+var serveStatic = (options = { root: "" }) => {
+  const root = options.root || "";
+  const optionPath = options.path;
+  if (root !== "" && !existsSync2(root)) {
+    console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
   }
-  if (fullSessionId) lastStatusBySession.set(fullSessionId, status);
-  console.log(
-    `${TAG} op=event sessionId=${sessionId} accountId=${accountId.slice(0, 8)} activity=${status}`
-  );
-  notify("webchat-pointer", accountId);
-  return { resource: "webchat-pointer", accountId };
-}
-var connections = 0;
-var started = false;
-var abort = null;
-function startManagerEventsSubscriber() {
-  if (started) return;
-  started = true;
-  abort = new AbortController();
-  void connectLoop(abort.signal);
-}
-async function connectLoop(signal) {
-  let backoffMs = 1e3;
-  for (; ; ) {
-    if (signal.aborted) return;
-    let port2;
-    try {
-      port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "webchat-pointer" });
-    } catch {
-      console.error(`${TAG} op=drop reason=manager-port-unset`);
-      return;
+  return async (c, next) => {
+    if (c.finalized) {
+      return next();
     }
-    const connectedAt = Date.now();
-    try {
-      const res = await fetch(`http://127.0.0.1:${port2}/events`, { signal });
-      if (!res.ok || !res.body) throw new Error(`status ${res.status}`);
-      connections += 1;
-      console.log(`${TAG} op=subscribe upstream-count=${connections}`);
-      const reader = res.body.getReader();
-      const decoder = new TextDecoder();
-      let buffer = "";
-      for (; ; ) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        buffer += decoder.decode(value, { stream: true });
-        let cut = buffer.indexOf("\n\n");
-        while (cut !== -1) {
-          handleManagerFrame(buffer.slice(0, cut));
-          buffer = buffer.slice(cut + 2);
-          cut = buffer.indexOf("\n\n");
+    let filename;
+    if (optionPath) {
+      filename = optionPath;
+    } else {
+      try {
+        filename = tryDecodeURI(c.req.path);
+        if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
+          throw new Error();
         }
+      } catch {
+        await options.onNotFound?.(c.req.path, c);
+        return next();
       }
-      connections -= 1;
-    } catch (err) {
-      if (connections > 0) connections -= 1;
-      if (signal.aborted) return;
-      console.error(`${TAG} op=drop reason=${err instanceof Error ? err.message : String(err)}`);
     }
-    if (signal.aborted) return;
-    if (Date.now() - connectedAt >= STABLE_CONNECTION_MS) backoffMs = 1e3;
-    console.log(`${TAG} op=reconnect inMs=${backoffMs} upstream-count=${connections}`);
-    await new Promise((r) => setTimeout(r, backoffMs));
-    backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
-  }
-}
-
-// server/index.ts
-import { monitorEventLoopDelay } from "perf_hooks";
-
-// server/lib/event-loop-lag.ts
-function readAndResetWindow(hist, windowMs) {
-  const toMs = (ns) => Math.round(ns / 1e6);
-  const w = {
-    p50Ms: toMs(hist.percentile(50)),
-    p99Ms: toMs(hist.percentile(99)),
-    maxMs: toMs(hist.max),
-    // Read before the reset.
-    count: hist.count,
-    windowMs
+    let path3 = join2(
+      root,
+      !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename
+    );
+    let stats = getStats(path3);
+    if (stats && stats.isDirectory()) {
+      const indexFile2 = options.index ?? "index.html";
+      path3 = join2(path3, indexFile2);
+      stats = getStats(path3);
+    }
+    if (!stats) {
+      await options.onNotFound?.(path3, c);
+      return next();
+    }
+    const mimeType = getMimeType(path3);
+    c.header("Content-Type", mimeType || "application/octet-stream");
+    if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
+      const acceptEncodingSet = new Set(
+        c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim())
+      );
+      for (const encoding of ENCODINGS_ORDERED_KEYS) {
+        if (!acceptEncodingSet.has(encoding)) {
+          continue;
+        }
+        const precompressedStats = getStats(path3 + ENCODINGS[encoding]);
+        if (precompressedStats) {
+          c.header("Content-Encoding", encoding);
+          c.header("Vary", "Accept-Encoding", { append: true });
+          stats = precompressedStats;
+          path3 = path3 + ENCODINGS[encoding];
+          break;
+        }
+      }
+    }
+    let result;
+    const size = stats.size;
+    const range = c.req.header("range") || "";
+    if (c.req.method == "HEAD" || c.req.method == "OPTIONS") {
+      c.header("Content-Length", size.toString());
+      c.status(200);
+      result = c.body(null);
+    } else if (!range) {
+      c.header("Content-Length", size.toString());
+      result = c.body(createStreamBody(createReadStream(path3)), 200);
+    } else {
+      c.header("Accept-Ranges", "bytes");
+      c.header("Date", stats.birthtime.toUTCString());
+      const parts = range.replace(/bytes=/, "").split("-", 2);
+      const start = parseInt(parts[0], 10) || 0;
+      let end = parseInt(parts[1], 10) || size - 1;
+      if (size < end - start + 1) {
+        end = size - 1;
+      }
+      const chunksize = end - start + 1;
+      const stream2 = createReadStream(path3, { start, end });
+      c.header("Content-Length", chunksize.toString());
+      c.header("Content-Range", `bytes ${start}-${end}/${stats.size}`);
+      result = c.body(createStreamBody(stream2), 206);
+    }
+    await options.onFound?.(path3, c);
+    return result;
   };
-  hist.reset();
-  return w;
-}
-function formatLagWindow(w) {
-  return `[event-loop] op=lag-window p50=${w.p50Ms} p99=${w.p99Ms} max=${w.maxMs} n=${w.count} windowMs=${w.windowMs}`;
-}
+};
 
 // server/lib/static-cache.ts
 import { statSync as statSync3 } from "fs";
@@ -2459,6 +2459,18 @@ function staticCacheHeaders(root) {
   };
 }
 
+// server/lib/static-mounts.ts
+function mountStaticFiles(app70, root) {
+  app70.use("/*", staticCacheHeaders(root));
+  app70.use("/assets/*", assetsVary);
+  app70.use("/assets/*", serveStatic({ root, precompressed: true }));
+  app70.use("/*", serveStatic({ root }));
+}
+var assetsVary = async (c, next) => {
+  await next();
+  if (!c.res.headers.has("Vary")) c.res.headers.set("Vary", "Accept-Encoding");
+};
+
 // app/lib/whatsapp/inbound/media-download-guard.ts
 var TAG2 = "[media-guard]";
 var inFlight2 = 0;
@@ -2653,14 +2665,14 @@ function readAllConversationsCached(accountId) {
   for (const file of dir) {
     if (!file.endsWith(".jsonl")) continue;
     const path3 = join5(STORE_ROOT(), accountId, file);
-    let stat11;
+    let stat12;
     try {
-      stat11 = statSync4(path3);
+      stat12 = statSync4(path3);
     } catch {
       continue;
     }
     const hit = idCache.get(path3);
-    if (hit && hit.size === stat11.size && hit.mtimeMs === stat11.mtimeMs) {
+    if (hit && hit.size === stat12.size && hit.mtimeMs === stat12.mtimeMs) {
       out.set(file, hit.ids);
       continue;
     }
@@ -2677,7 +2689,7 @@ function readAllConversationsCached(accountId) {
     } catch {
       continue;
     }
-    idCache.set(path3, { size: stat11.size, mtimeMs: stat11.mtimeMs, ids: parsed });
+    idCache.set(path3, { size: stat12.size, mtimeMs: stat12.mtimeMs, ids: parsed });
     out.set(file, parsed);
   }
   return out;
@@ -11583,11 +11595,12 @@ function runReconcileLivenessAudit(statePath, nowMs, intervalMs, emit) {
 }
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync21, watch as watch2, statSync as statSync9, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
+import { readFileSync as readFileSync21, watch as watch2, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
 import { basename as basename6, dirname as dirname7, isAbsolute, join as join22, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync19 } from "fs";
+import { readFile as readFile4, stat as stat5 } from "fs/promises";
 import { dirname as dirname5, join as join20, resolve as resolve15 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
@@ -11817,15 +11830,27 @@ async function fetchLiveSessions() {
   return out;
 }
 function loadUserTitles(accountDir) {
-  const out = /* @__PURE__ */ new Map();
-  if (!accountDir) return out;
-  const path3 = join20(accountDir, "session-titles.json");
+  if (!accountDir) return /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = readFileSync19(path3, "utf8");
+    raw = readFileSync19(join20(accountDir, "session-titles.json"), "utf8");
   } catch {
-    return out;
+    return /* @__PURE__ */ new Map();
+  }
+  return parseUserTitles(raw);
+}
+async function loadUserTitlesAsync(accountDir) {
+  if (!accountDir) return /* @__PURE__ */ new Map();
+  let raw;
+  try {
+    raw = await readFile4(join20(accountDir, "session-titles.json"), "utf8");
+  } catch {
+    return /* @__PURE__ */ new Map();
   }
+  return parseUserTitles(raw);
+}
+function parseUserTitles(raw) {
+  const out = /* @__PURE__ */ new Map();
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -11845,20 +11870,34 @@ function loadUserTitles(accountDir) {
   return out;
 }
 function readSidecarMeta(metaPath) {
-  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null, accountId: null };
   let raw;
   try {
     raw = readFileSync19(metaPath, "utf8");
   } catch {
-    return empty;
+    return emptySidecarMeta();
+  }
+  return parseSidecarMeta(raw);
+}
+function emptySidecarMeta() {
+  return { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null, accountId: null };
+}
+async function readSidecarMetaAsync(metaPath) {
+  let raw;
+  try {
+    raw = await readFile4(metaPath, "utf8");
+  } catch {
+    return emptySidecarMeta();
   }
+  return parseSidecarMeta(raw);
+}
+function parseSidecarMeta(raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return empty;
+    return emptySidecarMeta();
   }
-  if (!parsed || typeof parsed !== "object") return empty;
+  if (!parsed || typeof parsed !== "object") return emptySidecarMeta();
   const r = parsed;
   const bridgeIds = Array.isArray(r.bridgeIds) ? r.bridgeIds.filter((b) => typeof b === "string" && b.length > 0) : [];
   return {
@@ -11963,8 +12002,8 @@ async function computeSessionList(scopeAccountId) {
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
   const accountDir = scopeAccountId ? resolve15(ACCOUNTS_DIR, scopeAccountId) : null;
-  const userTitles = loadUserTitles(accountDir);
-  const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : resolveAccount();
+  const userTitles = await loadUserTitlesAsync(accountDir);
+  const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : validAccounts[0] ?? null;
   let channelUsers = [];
   if (account) {
     try {
@@ -12003,8 +12042,8 @@ async function computeSessionList(scopeAccountId) {
     let body;
     let mtimeMs;
     try {
-      body = readFileSync19(path3, "utf8");
-      mtimeMs = statSync7(path3).mtimeMs;
+      body = await readFile4(path3, "utf8");
+      mtimeMs = (await stat5(path3)).mtimeMs;
     } catch {
       continue;
     }
@@ -12013,7 +12052,7 @@ async function computeSessionList(scopeAccountId) {
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
     const metaPath = join20(projectDir, `${sessionId}.meta.json`);
-    const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = readSidecarMeta(metaPath);
+    const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = await readSidecarMetaAsync(metaPath);
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
       if (rowAccountId !== scopeAccountId) continue;
@@ -12414,7 +12453,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync8, realpathSync as realpathSync5 } from "fs";
+import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync7, realpathSync as realpathSync5 } from "fs";
 import { basename as basename5, dirname as dirname6, join as join21, resolve as resolve16, sep as sep4 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
@@ -12465,7 +12504,7 @@ function claudeUploadAttachmentsFromText(text, sessionId) {
       attachmentId: filename,
       filename,
       mimeType: detectMimeType(filename),
-      sizeBytes: statSync8(real).size,
+      sizeBytes: statSync7(real).size,
       source: "claude-upload"
     });
     accepted.push(m[0]);
@@ -12885,7 +12924,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   return c.json(value);
 });
 function readFrom(path3, from) {
-  const end = statSync9(path3).size;
+  const end = statSync8(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync(path3, "r");
   try {
@@ -13011,7 +13050,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync9(join22(c.subagentsDir, name));
+      const st = statSync8(join22(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -13079,7 +13118,7 @@ data: ${JSON.stringify(turn)}
     start(controller) {
       const fileEnd0 = (() => {
         try {
-          return statSync9(jsonlPath).size;
+          return statSync8(jsonlPath).size;
         } catch {
           return 0;
         }
@@ -13216,7 +13255,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync9(join22(dir, name)).size;
+      len = statSync8(join22(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -13322,7 +13361,7 @@ data: ${JSON.stringify(payload)}
       };
       const fileEnd0 = (() => {
         try {
-          return statSync9(file).size;
+          return statSync8(file).size;
         } catch {
           return 0;
         }
@@ -13540,7 +13579,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
       const absolute = resolved.absolute;
       let size = -1;
       try {
-        const st = statSync9(absolute);
+        const st = statSync8(absolute);
         size = st.isFile() ? st.size : -1;
       } catch {
         size = -1;
@@ -13669,7 +13708,7 @@ app5.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
-import { statSync as statSync10, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
+import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
 import { basename as basename7, dirname as dirname8, join as join23, resolve as resolve18, sep as sep6 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
@@ -13803,7 +13842,7 @@ function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   }
 }
 function readFrom2(path3, from) {
-  const end = statSync10(path3).size;
+  const end = statSync9(path3).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync2(path3, "r");
   try {
@@ -13969,7 +14008,7 @@ var public_reader_default = app6;
 // server/routes/webchat.ts
 import { basename as basename8, dirname as dirname9 } from "path";
 import { join as join26 } from "path";
-import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync11, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync7, renameSync as renameSync2 } from "fs";
@@ -14013,6 +14052,31 @@ function writeCanonicalOverrideId(accountDir, userId, sessionId) {
   renameSync2(tmp, path3);
 }
 
+// server/routes/admin/_account-scope.ts
+function accountDirForSession(cacheKey) {
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return null;
+  const match = listValidAccounts().find((a) => a.accountId === accountId);
+  return match ? { accountId, accountDir: match.accountDir, config: match.config } : null;
+}
+function validateAccountId2(accountId) {
+  if (!accountId) return null;
+  const match = listValidAccounts().find((a) => a.accountId === accountId);
+  return match ? { accountId, accountDir: match.accountDir, config: match.config } : null;
+}
+async function authorizeAccountWrite(c, accountId) {
+  const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
+  const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+  if (peerIsLoopback && !c.req.header("x-forwarded-for")) return { ok: true, via: "on-device" };
+  const { fingerprint, signedSessionToken } = await resolveCacheKey(c);
+  if (!fingerprint || !validateSession(fingerprint, "admin", signedSessionToken).ok) {
+    return { ok: false, reason: "no-session" };
+  }
+  const acct = accountDirForSession(fingerprint);
+  if (!acct || acct.accountId !== accountId) return { ok: false, reason: "account-mismatch" };
+  return { ok: true, via: "session" };
+}
+
 // ../lib/models/src/index.ts
 var OPUS_MODEL = "claude-opus-5[1m]";
 var SONNET_MODEL = "claude-sonnet-5";
@@ -14231,7 +14295,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync11(join26(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync10(join26(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -14334,15 +14398,7 @@ async function managerInterrupt(sessionId, trigger, escalate = false) {
   }
 }
 var MODEL_ID_PATTERN = /^claude-[a-z0-9][a-z0-9.-]*(\[1m\])?$/;
-function readLevers(preResolved) {
-  let account = preResolved;
-  if (account === void 0) {
-    try {
-      account = resolveAccount();
-    } catch {
-      return { leverModel: null, leverEffort: null, leverMode: null };
-    }
-  }
+function readLevers(account) {
   if (!account) return { leverModel: null, leverEffort: null, leverMode: null };
   const model = account.config.adminModel;
   const effort = account.config.effort;
@@ -14375,7 +14431,7 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync11(path3).mtimeMs;
+      mtimeMs = statSync10(path3).mtimeMs;
     } catch {
       continue;
     }
@@ -14608,12 +14664,7 @@ ${note}` : note;
     const sendId = sendIdFromResolve ?? ++sendSeq;
     let turnSessionId = deliverySessionId;
     if (turnSessionId === void 0) {
-      let canonAccount;
-      try {
-        canonAccount = resolveAccount();
-      } catch {
-        canonAccount = null;
-      }
+      const canonAccount = scopeAccountId ? validateAccountId2(scopeAccountId) : null;
       turnSessionId = resolveCanonical(accountId, canonAccount?.accountDir ?? null, requesterUserId, primaryUserId, scopeAccountId, multiAccount).sessionId;
     }
     const keyDisplay2 = deliveryKey.startsWith("session:") ? deliveryKey.slice(0, "session:".length + 8) : WEBCHAT_ADMIN_KEY;
@@ -14673,14 +14724,10 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${JSON.stringify(value)} reason=invalid-value`);
       return c.json({ error: `invalid ${op} value` }, 400);
     }
-    let account;
-    try {
-      account = resolveAccount();
-    } catch {
-      account = null;
-    }
+    const cacheKey = c.get("cacheKey");
+    const account = cacheKey ? accountDirForSession(cacheKey) : null;
     if (!account) {
-      console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
+      console.error(`[webchat:settings] op=${op} outcome=refused value=${value} accountId=none reason=no-account-for-session`);
       return c.json({ error: "account unresolved" }, 503);
     }
     const accountJsonPath = join26(account.accountDir, "account.json");
@@ -14698,7 +14745,7 @@ ${note}` : note;
       return c.json({ error: "persist failed" }, 500);
     }
     const settingsApplied = await reapplyLeversViaManager();
-    console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
+    console.log(`[webchat:settings] op=${op} outcome=accepted accountId=${account.accountId.slice(0, 8)} value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
   app70.get("/session", requireAdminSession, async (c) => {
@@ -14744,14 +14791,9 @@ ${note}` : note;
       }
       const known = resolvedProjectDir !== null || sessionSidecarExists(target);
       const indicators2 = await fetchComposerIndicators(target);
-      return c.json({ sessionId: target, projectDir: resolvedProjectDir, transcriptSessionId, channelBinding: conflictingBinding(channel), known, sizeBytes: jsonlSizeBytes(projectDir2, target), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${target}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${target}`) ?? null, ...indicators2, ...readLevers() });
-    }
-    let account;
-    try {
-      account = resolveAccount();
-    } catch {
-      account = null;
+      return c.json({ sessionId: target, projectDir: resolvedProjectDir, transcriptSessionId, channelBinding: conflictingBinding(channel), known, sizeBytes: jsonlSizeBytes(projectDir2, target), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${target}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${target}`) ?? null, ...indicators2, ...readLevers(scopeAccountId ? validateAccountId2(scopeAccountId) : null) });
     }
+    const account = scopeAccountId ? validateAccountId2(scopeAccountId) : null;
     const { sessionId, source } = resolveCanonical(accountId, account?.accountDir ?? null, requesterUserId, primaryUserId, scopeAccountId, multiAccount);
     if (requesterUserId === null) {
       console.error(`[webchat:inbound] op=session-resolve-no-identity key=${sessionId.slice(0, 8)}`);
@@ -15336,7 +15378,7 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync12, appendFileSync as appendFileSync3 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync11, appendFileSync as appendFileSync3 } from "fs";
 import { dirname as dirname10, join as join30 } from "path";
 function id8(value) {
   return value.slice(0, 8);
@@ -15460,7 +15502,7 @@ function computeAdminStoreDivergence(input) {
       if (entry.startsWith(".")) continue;
       const accountDir = join30(input.accountsDir, entry);
       try {
-        if (!statSync12(accountDir).isDirectory()) continue;
+        if (!statSync11(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -15907,7 +15949,7 @@ ${body.newPin}
 var onboarding_default = app10;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync13 } from "fs";
+import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync12 } from "fs";
 import { join as join32 } from "path";
 var CLIENT_ERRORS_LOG = join32(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -15967,7 +16009,7 @@ function stackHead(stack) {
 function rotateIfNeeded() {
   try {
     if (!existsSync25(CLIENT_ERRORS_LOG)) return;
-    const stats = statSync13(CLIENT_ERRORS_LOG);
+    const stats = statSync12(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
@@ -16108,7 +16150,7 @@ async function resolveUserIdentity(accountId, userId) {
   return { userName, avatar: null };
 }
 async function createAdminSession(accountId, thinkingView, userId, userName, role, avatar) {
-  const account = resolveAccount();
+  const account = validateAccountId2(accountId);
   const effectiveThinkingView = thinkingView ?? account?.config.thinkingView ?? "default";
   const signedSessionToken = randomUUID9();
   const cacheKey = fingerprintSessionKey(signedSessionToken);
@@ -16184,11 +16226,11 @@ app12.get("/", async (c) => {
   if (!accountId) {
     return c.json({ error: "Session has no account binding" }, 401);
   }
-  const account = resolveAccount();
+  const account = validateAccountId2(accountId);
   const thinkingView = account?.config.thinkingView ?? "default";
   const businessName = await fetchAccountName(accountId) || void 0;
   const role = getRoleForSession(cacheKey);
-  console.log(`[admin-session] role=${role ?? "null"} cacheKey=${cacheKey.slice(0, 8)} phase=restore`);
+  console.log(`[admin-session] role=${role ?? "null"} accountId=${accountId.slice(0, 8)} cacheKey=${cacheKey.slice(0, 8)} phase=restore`);
   const restoredUserId = getUserIdForSession(cacheKey);
   let restoredUserName = getUserNameForSession(cacheKey);
   let restoredAvatar = null;
@@ -16293,7 +16335,7 @@ app13.get("/", requireAdminSession, async (c) => {
 var accounts_default = app13;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync14 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync20, readFileSync as readFileSync31, statSync as statSync13 } from "fs";
 import { resolve as resolve21, basename as basename9 } from "path";
 
 // app/lib/logs-read-resolve.ts
@@ -16320,10 +16362,7 @@ app14.get("/", async (c) => {
   const sessionIdParam = c.req.query("sessionId");
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
-  const account = resolveAccount();
-  const accountLogDir = account ? resolve21(account.accountDir, "logs") : null;
-  const logDirs = [];
-  if (accountLogDir) logDirs.push(accountLogDir);
+  const logDirs = listValidAccounts().slice().sort((a, b) => a.accountId.localeCompare(b.accountId)).map((a) => resolve21(a.accountDir, "logs"));
   logDirs.push(LOG_DIR);
   if (fileParam) {
     const safe = basename9(fileParam);
@@ -16333,13 +16372,13 @@ app14.get("/", async (c) => {
       searched.push(filePath);
       try {
         const buffer = readFileSync31(filePath);
-        const onDiskBytes = statSync14(filePath).size;
+        const onDiskBytes = statSync13(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
         };
         if (download) headers["Content-Disposition"] = `attachment; filename="${safe}"`;
-        console.info(`[stream-log-download] file=${safe} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
+        console.info(`[stream-log-download] file=${safe} dir=${dir} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
         return new Response(buffer, { headers });
       } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
@@ -16398,13 +16437,13 @@ app14.get("/", async (c) => {
       try {
         const filename = basename9(hit.path);
         const buffer = readFileSync31(hit.path);
-        const onDiskBytes = statSync14(hit.path).size;
+        const onDiskBytes = statSync13(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
         };
         if (download) headers["Content-Disposition"] = `attachment; filename="${filename}"`;
-        console.info(`[stream-log-download] file=${filename} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
+        console.info(`[stream-log-download] file=${filename} dir=${hit.dir} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
         return new Response(buffer, { headers });
       } catch (err) {
         const reason2 = err instanceof Error ? err.message : String(err);
@@ -16441,7 +16480,7 @@ app14.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync14(resolve21(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync13(resolve21(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
         const content = readFileSync31(resolve21(dir, name));
@@ -16461,7 +16500,12 @@ var logs_default = app14;
 // server/routes/admin/claude-info.ts
 import { execFileSync as execFileSync5 } from "child_process";
 var app15 = new Hono();
-app15.get("/", (c) => {
+app15.get("/", requireAdminSession, (c) => {
+  const account = accountDirForSession(c.var.cacheKey);
+  if (!account) {
+    console.error("[admin/claude-info] auth-rejected reason=no-account-for-session accountId=none");
+    return c.json({ error: "no account for session", reason: "no-account-for-session" }, 401);
+  }
   const claudeEnv = { ...process.env };
   let version = "unknown";
   try {
@@ -16469,21 +16513,21 @@ app15.get("/", (c) => {
     version = raw.trim().replace(" (Claude Code)", "");
   } catch {
   }
-  let account = {};
+  let claudeAccount = {};
   try {
     const raw = execFileSync5(claudeBin(), ["auth", "status"], { env: claudeEnv, encoding: "utf-8", timeout: 5e3 });
-    account = JSON.parse(raw);
+    claudeAccount = JSON.parse(raw);
   } catch {
   }
-  const resolvedAccount = resolveAccount();
-  const model = resolvedAccount?.config.adminModel ?? "unknown";
-  const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
-  return c.json({ version, account, model, thinkingView });
+  const model = account.config.adminModel ?? "unknown";
+  const thinkingView = account.config.thinkingView ?? "default";
+  console.log(`[admin/claude-info] op=read accountId=${account.accountId.slice(0, 8)} model=${model}`);
+  return c.json({ version, account: claudeAccount, model, thinkingView });
 });
 var claude_info_default = app15;
 
 // server/routes/admin/attachment.ts
-import { readFile as readFile4, readdir as readdir2 } from "fs/promises";
+import { readFile as readFile5, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync28 } from "fs";
 import { resolve as resolve22 } from "path";
 var app16 = new Hono();
@@ -16532,7 +16576,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile4(metaPath, "utf-8"));
+    meta = JSON.parse(await readFile5(metaPath, "utf-8"));
   } catch {
     return new Response("Not found", { status: 404 });
   }
@@ -16542,7 +16586,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const filePath = resolve22(dir, dataFile);
-  const buffer = await readFile4(filePath);
+  const buffer = await readFile5(filePath);
   const inlineSafe = isInlineSafeMime(meta.mimeType);
   const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
   if (!inlineSafe) {
@@ -16560,8 +16604,8 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app16;
 
 // server/routes/admin/session-upload.ts
-import { readFile as readFile5 } from "fs/promises";
-import { existsSync as existsSync29, statSync as statSync15 } from "fs";
+import { readFile as readFile6 } from "fs/promises";
+import { existsSync as existsSync29, statSync as statSync14 } from "fs";
 var app17 = new Hono();
 app17.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -16582,7 +16626,7 @@ app17.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   const resolution = resolveClaudeUploadsPath(`${sessionId}/${file}`);
-  if (!resolution.ok || !existsSync29(resolution.absolute) || !statSync15(resolution.absolute).isFile()) {
+  if (!resolution.ok || !existsSync29(resolution.absolute) || !statSync14(resolution.absolute).isFile()) {
     console.log(`[session-upload] op=miss session=${short2} file=${file} status=404 reason=absent`);
     return c.json({ error: "Not found" }, 404);
   }
@@ -16590,7 +16634,7 @@ app17.get("/", requireAdminSession, async (c) => {
   const inlineSafe = isInlineSafeMime(mimeType);
   const safeName = file.replace(/["\\\r\n]/g, "_");
   console.log(`[session-upload] op=served session=${short2} file=${file} disposition=${inlineSafe ? "inline" : "attachment"} mime=${mimeType}`);
-  const buffer = await readFile5(resolution.absolute);
+  const buffer = await readFile6(resolution.absolute);
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": mimeType,
@@ -16606,33 +16650,8 @@ var session_upload_default = app17;
 import { resolve as resolve23 } from "path";
 import { readdirSync as readdirSync22, readFileSync as readFileSync33, existsSync as existsSync31, rmSync as rmSync2, renameSync as renameSync9, mkdirSync as mkdirSync7, writeFileSync as writeFileSync13 } from "fs";
 
-// server/routes/admin/_account-scope.ts
-function accountDirForSession(cacheKey) {
-  const accountId = getAccountIdForSession(cacheKey);
-  if (!accountId) return null;
-  const match = listValidAccounts().find((a) => a.accountId === accountId);
-  return match ? { accountId, accountDir: match.accountDir } : null;
-}
-function validateAccountId2(accountId) {
-  if (!accountId) return null;
-  const match = listValidAccounts().find((a) => a.accountId === accountId);
-  return match ? { accountId, accountDir: match.accountDir } : null;
-}
-async function authorizeAccountWrite(c, accountId) {
-  const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
-  const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
-  if (peerIsLoopback && !c.req.header("x-forwarded-for")) return { ok: true, via: "on-device" };
-  const { fingerprint, signedSessionToken } = await resolveCacheKey(c);
-  if (!fingerprint || !validateSession(fingerprint, "admin", signedSessionToken).ok) {
-    return { ok: false, reason: "no-session" };
-  }
-  const acct = accountDirForSession(fingerprint);
-  if (!acct || acct.accountId !== accountId) return { ok: false, reason: "account-mismatch" };
-  return { ok: true, via: "session" };
-}
-
 // ../services/claude-session-manager/src/tool-surface.ts
-import { readFileSync as readFileSync32, readdirSync as readdirSync21, statSync as statSync16, existsSync as existsSync30 } from "fs";
+import { readFileSync as readFileSync32, readdirSync as readdirSync21, statSync as statSync15, existsSync as existsSync30 } from "fs";
 import { createHash as createHash5 } from "crypto";
 import { join as join34 } from "path";
 
@@ -16889,7 +16908,7 @@ function loadToolSurface(pluginsRoots) {
   const loadOne = (pluginsRoot, plugin) => {
     const pluginDir = join34(pluginsRoot, plugin);
     try {
-      if (!statSync16(pluginDir).isDirectory()) return;
+      if (!statSync15(pluginDir).isDirectory()) return;
     } catch {
       return;
     }
@@ -16944,7 +16963,7 @@ function loadToolSurface(pluginsRoots) {
       const subRoot = join34(pluginDir, "plugins");
       let subEntries;
       try {
-        if (!statSync16(subRoot).isDirectory()) continue;
+        if (!statSync15(subRoot).isDirectory()) continue;
         subEntries = readdirSync21(subRoot).sort();
       } catch {
         continue;
@@ -18208,7 +18227,7 @@ app19.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app19;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync33, readFileSync as readFileSync34, readdirSync as readdirSync23, statSync as statSync17 } from "fs";
+import { existsSync as existsSync33, readFileSync as readFileSync34, readdirSync as readdirSync23, statSync as statSync16 } from "fs";
 import { dirname as dirname12, resolve as resolve24, join as join35 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -18311,7 +18330,7 @@ function listPluginDirs(accountPluginsDir) {
     for (const name of readdirSync23(platformPlugins)) {
       const dir = join35(platformPlugins, name);
       try {
-        if (statSync17(dir).isDirectory()) out.set(name, dir);
+        if (statSync16(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
@@ -18325,7 +18344,7 @@ function listPluginDirs(accountPluginsDir) {
         for (const name of readdirSync23(bundlePlugins)) {
           const dir = join35(bundlePlugins, name);
           try {
-            if (statSync17(dir).isDirectory()) out.set(name, dir);
+            if (statSync16(dir).isDirectory()) out.set(name, dir);
           } catch {
           }
         }
@@ -18339,7 +18358,7 @@ function listPluginDirs(accountPluginsDir) {
         if (out.has(name)) continue;
         const dir = join35(accountPluginsDir, name);
         try {
-          if (statSync17(dir).isDirectory()) out.set(name, dir);
+          if (statSync16(dir).isDirectory()) out.set(name, dir);
         } catch {
         }
       }
@@ -18356,7 +18375,7 @@ function listAccountPluginNames(accountPluginsDir) {
   try {
     return readdirSync23(accountPluginsDir).filter((name) => {
       try {
-        return statSync17(join35(accountPluginsDir, name)).isDirectory();
+        return statSync16(join35(accountPluginsDir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -18866,7 +18885,7 @@ var events_default = app22;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync35 } from "fs";
-import { readdir as readdir4, readFile as readFile7, stat as stat6, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
+import { readdir as readdir4, readFile as readFile8, stat as stat7, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
 import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
 import { basename as basename11, dirname as dirname13, join as join37, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
@@ -19725,7 +19744,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile7(join37(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile8(join37(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -19747,7 +19766,7 @@ async function readAccountNames() {
     if (!UUID_RE4.test(name)) continue;
     const configPath2 = resolve27(accountsDir, name, "account.json");
     try {
-      const raw = await readFile7(configPath2, "utf8");
+      const raw = await readFile8(configPath2, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed?.name === "string" && parsed.name.length > 0) {
         map.set(name, parsed.name);
@@ -19789,7 +19808,7 @@ async function enrich(absolute, entry, accountNames) {
         let size = null;
         let modifiedAt = entry.modifiedAt;
         try {
-          const st = await stat6(join37(dirAbs, innerName));
+          const st = await stat7(join37(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
@@ -19964,7 +19983,7 @@ app23.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   try {
-    const info = await stat6(absolute);
+    const info = await stat7(absolute);
     if (!info.isDirectory()) {
       return c.json({ error: "Path is not a directory \u2014 use /api/admin/files/download for files" }, 400);
     }
@@ -19983,7 +20002,7 @@ app23.get("/", requireAdminSession, async (c) => {
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
         const entryPath = join37(absolute, name);
-        const s = await stat6(entryPath);
+        const s = await stat7(entryPath);
         entries2.push({
           name,
           kind: s.isDirectory() ? "directory" : s.isFile() ? "file" : "other",
@@ -20011,7 +20030,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const displayPath = buildDisplayPath(relPath, accountNames);
     if (groupReq || isAccountRoot(relPath)) {
       const acctId = relPath.split("/")[1] ?? accountId;
-      const schemaMd = await readFile7(join37(absolute, "SCHEMA.md"), "utf8").catch(() => null);
+      const schemaMd = await readFile8(join37(absolute, "SCHEMA.md"), "utf8").catch(() => null);
       const groups = classifyAccountRoot(schemaMd, entries2.map((e) => e.name));
       console.error(
         `[data-schema] op=classify account=${acctId} status=${groups.parsed ? "ok" : "parse-failed"} reason=${groups.reason} entries=${entries2.length} home=${groups.home.join(",") || "none"} system=${groups.system.length} unknown=${groups.unknown.join(",") || "none"}`
@@ -20141,7 +20160,7 @@ app23.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   try {
-    const info = await stat6(absolute);
+    const info = await stat7(absolute);
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
@@ -20238,7 +20257,7 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
     if (entries2.length >= maxFiles) return c.json({ error: `Too many files (max ${maxFiles})` }, 413);
     total += size;
     if (total > maxTotalBytes) return c.json({ error: "Selection too large to zip" }, 413);
-    entries2.push({ name: member, data: await readFile7(absolute) });
+    entries2.push({ name: member, data: await readFile8(absolute) });
     return null;
   };
   for (const rawPath of rawPaths) {
@@ -20255,7 +20274,7 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
       return c.json({ error: "Not found" }, 404);
     }
     try {
-      const info = await stat6(absolute);
+      const info = await stat7(absolute);
       if (info.isDirectory()) {
         dirsWalked++;
         const parentAbs = dirname13(absolute);
@@ -20263,7 +20282,7 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
           const within = relative5(absolute, fileAbs).split(sep8).join("/");
           const fileRel = relPath === "" || relPath === "." ? within : `${relPath}/${within}`;
           if (crossesForeignAccountPartition(fileRel, accountId)) continue;
-          const fileInfo = await stat6(fileAbs);
+          const fileInfo = await stat7(fileAbs);
           const member = relative5(parentAbs, fileAbs).split(sep8).join("/");
           const over = await addFile(fileAbs, fileInfo.size, member);
           if (over) return over;
@@ -20334,7 +20353,7 @@ async function resolveUploadTarget(c, accountId, uid) {
     const firstCreated = await mkdir4(destDir, { recursive: true });
     if (firstCreated) console.error(`[data-upload] op=mkdir uid=${uid} token=${token} dir="${destRel}"`);
   } else {
-    const info = await stat6(destDir).catch(() => null);
+    const info = await stat7(destDir).catch(() => null);
     if (!info || !info.isDirectory()) return { ok: false, status: 400, error: "Upload destination is not a directory" };
   }
   const dataRootReal = realpathSync7(DATA_ROOT);
@@ -20686,7 +20705,7 @@ app23.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: "Protected file \u2014 refusing to delete" }, 403);
   }
   try {
-    const info = await stat6(absolute);
+    const info = await stat7(absolute);
     if (info.isDirectory()) {
       return c.json({ error: "Directory deletion not supported" }, 400);
     }
@@ -20763,7 +20782,7 @@ app23.post("/folder", requireAdminSession, async (c) => {
   const newAbs = resolve27(parent.absolute, name);
   const newRel = `${parent.relative}/${name}`;
   try {
-    const info = await stat6(parent.absolute);
+    const info = await stat7(parent.absolute);
     if (!info.isDirectory()) return c.json({ error: "Parent is not a directory" }, 400);
     await mkdir4(newAbs, { recursive: false });
   } catch (err) {
@@ -20808,7 +20827,7 @@ app23.post("/rename", requireAdminSession, async (c) => {
   try {
     let collision = true;
     try {
-      await stat6(destAbs);
+      await stat7(destAbs);
     } catch (e) {
       if (e.code === "ENOENT") collision = false;
     }
@@ -23086,7 +23105,7 @@ var WRITE_CYPHER = `
 var graph_default_view_default = app29;
 
 // server/routes/admin/sidebar-artefacts.ts
-import { readdir as readdir5, stat as stat7 } from "fs/promises";
+import { readdir as readdir5, stat as stat8 } from "fs/promises";
 import { resolve as resolve29, relative as relative6, isAbsolute as isAbsolute2, sep as sep9, basename as basename12 } from "path";
 import { existsSync as existsSync36 } from "fs";
 var LIMIT = 50;
@@ -23237,7 +23256,7 @@ async function readAgentTemplateRow(inp) {
   }
   if (!chosenPath) return null;
   try {
-    const st = await stat7(chosenPath);
+    const st = await stat8(chosenPath);
     const dlPath = toDataRootRelPath(chosenPath);
     return {
       id: inp.id,
@@ -23803,16 +23822,18 @@ app37.post("/", requireAdminSession, async (c) => {
       return c.json(parsed ?? { error: text }, res.status);
     }
     try {
-      const account = resolveAccount();
+      const account = cacheKey ? accountDirForSession(cacheKey) : null;
       if (account && adminUserId) {
-        const accountId2 = resolvePlatformAccountId();
+        const platformAccountId = resolvePlatformAccountId();
         const primaryUserId = resolvePrimaryAdminUserId();
-        const canonicalId = adminSessionIdFor(accountId2, WEBCHAT_ADMIN_KEY, adminUserId);
+        const canonicalId = adminSessionIdFor(platformAccountId, WEBCHAT_ADMIN_KEY, adminUserId);
         const currentOverride = readCanonicalOverrideId(account.accountDir, adminUserId, primaryUserId);
         if (fromSessionId === canonicalId || fromSessionId === currentOverride) {
           writeCanonicalOverrideId(account.accountDir, adminUserId, plan.sessionId);
-          console.log(`[chat-reseat] op=canonical-forward reseatReqId=${reseatReqId} from=${fromSessionId} to=${plan.sessionId}`);
+          console.log(`[chat-reseat] op=canonical-forward reseatReqId=${reseatReqId} accountId=${account.accountId.slice(0, 8)} from=${fromSessionId} to=${plan.sessionId}`);
         }
+      } else if (!account) {
+        console.error(`[chat-reseat] op=canonical-forward-skipped reseatReqId=${reseatReqId} accountId=none reason=no-account-for-session`);
       }
     } catch (err) {
       console.error(`[session-reseat] canonical-forward-failed err=${err instanceof Error ? err.message : String(err)}`);
@@ -23849,7 +23870,7 @@ app37.post("/", requireAdminSession, async (c) => {
 var session_reseat_default = app37;
 
 // server/routes/admin/system-stats.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 import { cpus, loadavg, totalmem, freemem } from "os";
 function parseCpuStat(blob) {
   const line = blob.split("\n", 1)[0] ?? "";
@@ -23893,11 +23914,11 @@ function parseMeminfo(blob) {
 }
 var SAMPLE_DELAY_MS = 100;
 async function sampleLinux() {
-  const a = parseCpuStat(await readFile8("/proc/stat", "utf-8"));
+  const a = parseCpuStat(await readFile9("/proc/stat", "utf-8"));
   await new Promise((r) => setTimeout(r, SAMPLE_DELAY_MS));
-  const b = parseCpuStat(await readFile8("/proc/stat", "utf-8"));
-  const meminfo = parseMeminfo(await readFile8("/proc/meminfo", "utf-8"));
-  const loadavgRaw = (await readFile8("/proc/loadavg", "utf-8")).trim();
+  const b = parseCpuStat(await readFile9("/proc/stat", "utf-8"));
+  const meminfo = parseMeminfo(await readFile9("/proc/meminfo", "utf-8"));
+  const loadavgRaw = (await readFile9("/proc/loadavg", "utf-8")).trim();
   const [l1, l5, l15] = loadavgRaw.split(/\s+/, 3).map(Number);
   if (![l1, l5, l15].every(Number.isFinite)) {
     throw new Error(`malformed /proc/loadavg: ${loadavgRaw}`);
@@ -25229,25 +25250,26 @@ app47.delete("/meetings/:id", requireAdminSession, async (c) => {
   }
 });
 app47.get("/booking-link", requireAdminSession, (c) => {
+  const account = accountDirForSession(c.var.cacheKey);
+  if (!account) {
+    console.error("[calendar] op=booking-link auth-rejected reason=no-account-for-session accountId=none");
+    return c.json({ error: "no account for session", reason: "no-account-for-session" }, 401);
+  }
+  const id82 = account.accountId.slice(0, 8);
   try {
-    const account = resolveAccount();
-    if (!account) {
-      console.error('[calendar] op=booking-link-fail err="no account configured"');
-      return c.json({ bookingDomain: null });
-    }
     if (!existsSync38(join44(account.accountDir, AVAILABILITY_FILENAME))) {
-      console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
+      console.log(`[calendar] op=booking-link accountId=${id82} bookingDomain=none source=availability-config`);
       return c.json({ bookingDomain: null });
     }
     const config = readAvailabilityConfig(account.accountDir);
     const bookingDomain = typeof config.bookingDomain === "string" && config.bookingDomain.trim() ? config.bookingDomain.trim() : null;
     console.log(
-      `[calendar] op=booking-link bookingDomain=${bookingDomain ?? "none"} source=availability-config`
+      `[calendar] op=booking-link accountId=${id82} bookingDomain=${bookingDomain ?? "none"} source=availability-config`
     );
     return c.json({ bookingDomain });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[calendar] op=booking-link-fail err="${message}"`);
+    console.error(`[calendar] op=booking-link-fail accountId=${id82} err="${message}"`);
     return c.json({ bookingDomain: null });
   }
 });
@@ -26568,7 +26590,7 @@ app61.route("/request-magic-link", request_magic_link_default);
 var access_default = app61;
 
 // server/routes/sites.ts
-import { existsSync as existsSync41, readFileSync as readFileSync42, realpathSync as realpathSync8, statSync as statSync19 } from "fs";
+import { existsSync as existsSync41, readFileSync as readFileSync42, realpathSync as realpathSync8, statSync as statSync18 } from "fs";
 import { resolve as resolve36 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -26632,13 +26654,13 @@ app62.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat11;
+  let stat12;
   try {
-    stat11 = existsSync41(filePath) ? statSync19(filePath) : null;
+    stat12 = existsSync41(filePath) ? statSync18(filePath) : null;
   } catch {
-    stat11 = null;
+    stat12 = null;
   }
-  if (stat11?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat12?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -26646,7 +26668,7 @@ app62.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat11?.isDirectory()) {
+  if (stat12?.isDirectory()) {
     filePath = resolve36(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
@@ -27637,7 +27659,7 @@ var calendar_public_default = app67;
 
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
-import { stat as stat8, readFile as readFile9, realpath } from "fs/promises";
+import { stat as stat9, readFile as readFile10, realpath } from "fs/promises";
 import { join as join46, resolve as resolve38, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
 var app68 = new Hono();
@@ -27694,7 +27716,7 @@ async function readAccountSecret(accountId) {
   const path3 = resolve38(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
-    text = await readFile9(path3, "utf8");
+    text = await readFile10(path3, "utf8");
   } catch {
     console.error(`${TAG50} op=no-secret account="${accountId}" path="${path3}"`);
     return "";
@@ -27711,7 +27733,7 @@ function isValidAccountId2(value) {
 }
 async function readExposeFolders2(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile9(join46(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile10(join46(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -27720,7 +27742,7 @@ async function readExposeFolders2(accountDir) {
 async function resolveFetchTarget(accountDir, relPath, ownerId) {
   let schemaText = null;
   try {
-    schemaText = await readFile9(join46(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile10(join46(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -27746,7 +27768,7 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
     return { ok: false, reason: "not-exposed" };
   }
   try {
-    const st = await stat8(absolute);
+    const st = await stat9(absolute);
     if (!st.isFile()) return { ok: false, reason: "enoent" };
     return { ok: true, absolute, sizeBytes: st.size };
   } catch {
@@ -27890,7 +27912,7 @@ function startTimeEntryCensus(openSession, opts = {}) {
 }
 
 // app/lib/ledger-census.ts
-import { readdirSync as readdirSync28, readFileSync as readFileSync45, statSync as statSync20 } from "fs";
+import { readdirSync as readdirSync28, readFileSync as readFileSync45, statSync as statSync19 } from "fs";
 import { join as join47 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
@@ -27947,7 +27969,7 @@ function countWriteRejects24h(logDir, now) {
   for (const name of entries2) {
     const path3 = join47(logDir, name);
     try {
-      if (now - statSync20(path3).mtimeMs > DAY_MS) continue;
+      if (now - statSync19(path3).mtimeMs > DAY_MS) continue;
       for (const line of readFileSync45(path3, "utf8").split("\n")) {
         if (line.includes("[graph-write] reject")) total += 1;
       }
@@ -28442,7 +28464,7 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir7, readFile as readFile10, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
+import { readdir as readdir7, readFile as readFile11, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
 import { existsSync as existsSync44 } from "fs";
 import { join as join48 } from "path";
 var ADMIN_ROLE2 = "admin";
@@ -28455,7 +28477,7 @@ var defaultResolveName = async (_accountId, userId) => {
 async function readRaw3(path3) {
   let raw;
   try {
-    raw = await readFile10(path3, "utf8");
+    raw = await readFile11(path3, "utf8");
   } catch {
     return null;
   }
@@ -30819,7 +30841,7 @@ function buildTelegramSpawnRequest(input) {
 
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
-import { readFile as readFile11, stat as stat10 } from "fs/promises";
+import { readFile as readFile12, stat as stat11 } from "fs/promises";
 import { resolve as resolve42, basename as basename13 } from "path";
 var TAG56 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
@@ -30860,7 +30882,7 @@ async function sendTelegramDocument(input) {
     console.error(`${TAG56} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
-  const fileStat = await stat10(resolvedPath);
+  const fileStat = await stat11(resolvedPath);
   if (fileStat.size > TELEGRAM_DOCUMENT_MAX_BYTES) {
     return {
       ok: false,
@@ -30869,7 +30891,7 @@ async function sendTelegramDocument(input) {
     };
   }
   const filename = basename13(resolvedPath);
-  const buffer = Buffer.from(await readFile11(resolvedPath));
+  const buffer = Buffer.from(await readFile12(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
   if (caption) form.append("caption", caption);
@@ -31268,7 +31290,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash7, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync46, readFileSync as readFileSync47, statSync as statSync21 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync47, statSync as statSync20 } from "fs";
 import { resolve as resolve44 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -31320,8 +31342,8 @@ function resolveEntitlement(brand, account) {
   if (!existsSync46(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat11 = statSync21(entitlementPath);
-  const key = memoKey(stat11.mtimeMs, account);
+  const stat12 = statSync20(entitlementPath);
+  const key = memoKey(stat12.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
   }
@@ -32720,8 +32742,7 @@ if (brandFaviconPath !== "/favicon.ico") {
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app69.use("/*", staticCacheHeaders("./public"));
-app69.use("/*", serveStatic({ root: "./public" }));
+mountStaticFiles(app69, "./public");
 app69.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
@@ -32843,7 +32864,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve45(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
         if (!existsSync47(pendingPath2)) continue;
-        const ageMs2 = now - statSync22(pendingPath2).mtimeMs;
+        const ageMs2 = now - statSync21(pendingPath2).mtimeMs;
         if (ageMs2 > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs2 / 1e3)}`);
         }