volute 0.24.0 → 0.26.0

package/dist/daemon.js

@@ -7,7 +7,7 @@ import {
   sharedMerge,
   sharedPull,
   sharedStatus
-} from "./chunk-PHHKNGA3.js";
+} from "./chunk-3TV4GLFO.js";
 import {
   applyInitFiles,
   composeTemplate,
@@ -18,6 +18,7 @@ import {
 } from "./chunk-AKPFNL7L.js";
 import {
   addMessage,
+  announceToSystem,
   approveUser,
   changePassword,
   countAdmins,
@@ -28,6 +29,7 @@ import {
   deleteMindUser as deleteMindUser2,
   deleteUser,
   deliverMessage,
+  ensureSystemChannel,
   extractTextContent,
   findDMConversation,
   fireWebhook,
@@ -58,6 +60,7 @@ import {
   isParticipant,
   isParticipantOrOwner,
   joinChannel,
+  joinSystemChannel,
   leaveChannel,
   listChannels,
   listConversationsForUser,
@@ -66,6 +69,7 @@ import {
   listUsers,
   listUsersByType,
   markConversationRead,
+  migrateMindRoles,
   publish,
   publish2,
   publishTypingForChannels,
@@ -78,19 +82,21 @@ import {
   subscribe2 as subscribe3,
   updateUserProfile,
   verifyUser
-} from "./chunk-OOW675I3.js";
+} from "./chunk-3CFRE2VC.js";
 import {
-  readSystemsConfig
+  deleteSystemsConfig,
+  readSystemsConfig,
+  writeSystemsConfig
 } from "./chunk-HFCBO2GL.js";
 import {
   getActiveMinds,
   onMindEvent,
   stopAll
-} from "./chunk-E7GOKNOT.js";
+} from "./chunk-NWI2425I.js";
 import {
   broadcast,
   subscribe
-} from "./chunk-BFK6SOEJ.js";
+} from "./chunk-J2CO4WEV.js";
 import {
   PROMPT_DEFAULTS,
   PROMPT_KEYS,
@@ -100,28 +106,10 @@ import {
   getPrompt,
   getPromptIfCustom,
   initMindManager,
+  resolveMindToken,
   substitute
-} from "./chunk-NOBRGACV.js";
-import {
-  findOpenClawSession,
-  importOpenClawConnectors,
-  importPiSession,
-  parseNameFromIdentity
-} from "./chunk-4TJ72QQ3.js";
-import {
-  readVoluteConfig,
-  writeVoluteConfig
-} from "./chunk-XLC342FO.js";
-import {
-  loadMergedEnv,
-  mindEnvPath,
-  readEnv,
-  sharedEnvPath,
-  writeEnv
-} from "./chunk-PHU4DEAJ.js";
-import {
-  isHomeOnlyArchive
-} from "./chunk-KTJGZ7M7.js";
+} from "./chunk-2VO7453N.js";
+import "./chunk-UTL75LP6.js";
 import {
   SEED_SKILLS,
   STANDARD_SKILLS,
@@ -137,25 +125,53 @@ import {
   syncBuiltinSkills,
   uninstallSkill,
   updateSkill
-} from "./chunk-P3W36ZGD.js";
+} from "./chunk-USNBKHYG.js";
 import {
   activity,
   conversations,
   getDb,
   mindHistory,
+  noteComments,
+  noteReactions,
+  notes,
   sessions,
-  systemPrompts
-} from "./chunk-33XAVCS4.js";
+  systemPrompts,
+  users
+} from "./chunk-WBHMQ5OZ.js";
 import {
   logBuffer,
   logger_default
 } from "./chunk-YUIHSKR6.js";
-import "./chunk-D424ZQGI.js";
+import {
+  checkForUpdate,
+  checkForUpdateCached,
+  getCurrentVersion
+} from "./chunk-ON3FF5JA.js";
+import {
+  findOpenClawSession,
+  importOpenClawConnectors,
+  importPiSession,
+  parseNameFromIdentity
+} from "./chunk-5Y3PBKW6.js";
+import {
+  readVoluteConfig,
+  writeVoluteConfig
+} from "./chunk-SIAG3QMM.js";
+import {
+  loadMergedEnv,
+  mindEnvPath,
+  readEnv,
+  sharedEnvPath,
+  writeEnv
+} from "./chunk-PHU4DEAJ.js";
+import {
+  isHomeOnlyArchive
+} from "./chunk-KTJGZ7M7.js";
 import {
   exec,
   gitExec,
   resolveVoluteBin
-} from "./chunk-JTDFJWI2.js";
+} from "./chunk-YJA7P64S.js";
 import {
   chownMindDir,
   createMindUser,
@@ -163,12 +179,8 @@ import {
   ensureVoluteGroup,
   isIsolationEnabled,
   wrapForIsolation
-} from "./chunk-NWPT4ASZ.js";
-import {
-  checkForUpdate,
-  checkForUpdateCached,
-  getCurrentVersion
-} from "./chunk-ON3FF5JA.js";
+} from "./chunk-XOXLRRR2.js";
+import "./chunk-D424ZQGI.js";
 import {
   buildVoluteSlug,
   resolveChannelId,
@@ -176,6 +188,7 @@ import {
   splitMessage,
   writeChannelEntry
 } from "./chunk-WSLPZF72.js";
+import "./chunk-TZKJLDQN.js";
 import {
   addMind,
   addVariant,
@@ -210,7 +223,7 @@ import {
 import { randomBytes as randomBytes2 } from "crypto";
 import { mkdirSync as mkdirSync9, readFileSync as readFileSync11, unlinkSync, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 import { format } from "util";
 
 // src/lib/migrate-agents-to-minds.ts
@@ -360,6 +373,17 @@ function migrateDotVoluteDir(name) {
     console.warn(`[migrate] both .volute/ and .mind/ exist for ${name}, skipping rename`);
   }
 }
+function migratePagesDirToPublic(name) {
+  const dir = mindDir(name);
+  const oldPagesDir = resolve2(dir, "home", "pages");
+  const newPublicDir = resolve2(dir, "home", "public");
+  const newPagesDir = resolve2(newPublicDir, "pages");
+  if (existsSync2(oldPagesDir) && !existsSync2(newPagesDir)) {
+    mkdirSync(newPublicDir, { recursive: true });
+    renameSync2(oldPagesDir, newPagesDir);
+    logger_default.info(`migrated pages/ \u2192 public/pages/ for ${name}`);
+  }
+}
 function migrateMindState(name) {
   const src = resolve2(mindDir(name), ".mind");
   if (!existsSync2(src)) return;
@@ -396,7 +420,7 @@ function isValidDaemonToken(token) {
   if (!expected || token.length !== expected.length) return false;
   return timingSafeEqual(Buffer.from(token), Buffer.from(expected));
 }
-var SESSION_MAX_AGE = 864e5;
+var SESSION_MAX_AGE = 365 * 24 * 60 * 60 * 1e3;
 var SESSION_CACHE_TTL = 5 * 60 * 1e3;
 var sessionCache = /* @__PURE__ */ new Map();
 function invalidateSessionCache(sessionId) {
@@ -435,6 +459,24 @@ var requireAdmin = createMiddleware(async (c, next) => {
   }
   await next();
 });
+async function resolveSession(sessionId) {
+  const cached = sessionCache.get(sessionId);
+  if (cached && cached.expires > Date.now()) {
+    return cached.user;
+  }
+  const userId = await getSessionUserId(sessionId);
+  if (userId == null) {
+    sessionCache.delete(sessionId);
+    return null;
+  }
+  const user = await getUser(userId);
+  if (!user) {
+    sessionCache.delete(sessionId);
+    return null;
+  }
+  sessionCache.set(sessionId, { userId, user, expires: Date.now() + SESSION_CACHE_TTL });
+  return user;
+}
 var authMiddleware = createMiddleware(async (c, next) => {
   const authHeader = c.req.header("Authorization");
   if (authHeader?.startsWith("Bearer ")) {
@@ -442,7 +484,7 @@ var authMiddleware = createMiddleware(async (c, next) => {
     if (token && isValidDaemonToken(token)) {
       c.set("user", {
         id: 0,
-        username: "cli",
+        username: "daemon",
         role: "admin",
         user_type: "brain",
         display_name: null,
@@ -452,41 +494,52 @@ var authMiddleware = createMiddleware(async (c, next) => {
       await next();
       return;
     }
+    const mindName = resolveMindToken(token);
+    if (mindName) {
+      const mindUser = await getOrCreateMindUser(mindName);
+      c.set("user", mindUser);
+      await next();
+      return;
+    }
+    if (token) {
+      const user2 = await resolveSession(token);
+      if (user2) {
+        if (user2.role === "pending") return c.json({ error: "Account pending approval" }, 403);
+        c.set("user", user2);
+        await next();
+        return;
+      }
+    }
   }
   const sessionId = getCookie(c, "volute_session");
   if (!sessionId) return c.json({ error: "Unauthorized" }, 401);
-  const cached = sessionCache.get(sessionId);
-  if (cached && cached.expires > Date.now()) {
-    if (cached.user.role === "pending") return c.json({ error: "Account pending approval" }, 403);
-    c.set("user", cached.user);
-    await next();
-    return;
-  }
-  const userId = await getSessionUserId(sessionId);
-  if (userId == null) {
-    sessionCache.delete(sessionId);
-    return c.json({ error: "Unauthorized" }, 401);
-  }
-  const user = await getUser(userId);
-  if (!user) {
-    sessionCache.delete(sessionId);
-    return c.json({ error: "Unauthorized" }, 401);
-  }
+  const user = await resolveSession(sessionId);
+  if (!user) return c.json({ error: "Unauthorized" }, 401);
   if (user.role === "pending") return c.json({ error: "Account pending approval" }, 403);
-  sessionCache.set(sessionId, { userId, user, expires: Date.now() + SESSION_CACHE_TTL });
   c.set("user", user);
   await next();
 });
+var requireSelf = (paramName = "name") => createMiddleware(async (c, next) => {
+  const user = c.get("user");
+  if (user.role !== "admin") {
+    const target = c.req.param(paramName) ?? "";
+    const [baseName] = target.split("@", 2);
+    if (user.username !== baseName) {
+      return c.json({ error: "Forbidden" }, 403);
+    }
+  }
+  await next();
+});
 
 // src/web/server.ts
 import { existsSync as existsSync13 } from "fs";
-import { readFile as readFile3, stat as stat3 } from "fs/promises";
+import { readFile as readFile4, stat as stat4 } from "fs/promises";
 import { createServer as createHttpsServer } from "https";
-import { dirname, extname as extname4, resolve as resolve17 } from "path";
+import { dirname, extname as extname5, resolve as resolve18 } from "path";
 import { serve } from "@hono/node-server";
 
 // src/web/app.ts
-import { Hono as Hono28 } from "hono";
+import { Hono as Hono30 } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { csrf } from "hono/csrf";
 import { HTTPException } from "hono/http-exception";
@@ -538,7 +591,7 @@ var app = new Hono().get("/events", async (c) => {
       });
       cleanups.push(unsubActivity);
       for (const conv of conversations2) {
-        const unsubConv = subscribe3(conv.id, (event) => {
+        const unsubConv = subscribe2(conv.id, (event) => {
           stream.writeSSE({
             data: JSON.stringify({ event: "conversation", conversationId: conv.id, ...event })
           }).catch((err) => {
@@ -553,8 +606,8 @@ var app = new Hono().get("/events", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve19) => {
-        stream.onAbort(() => resolve19());
+      await new Promise((resolve20) => {
+        stream.onAbort(() => resolve20());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -575,6 +628,17 @@ import { zValidator } from "@hono/zod-validator";
 import { Hono as Hono2 } from "hono";
 import { deleteCookie, getCookie as getCookie2, setCookie } from "hono/cookie";
 import { z } from "zod";
+function tryJoinSystem(userId) {
+  if (!process.env.VOLUTE_DAEMON_TOKEN) return;
+  joinSystemChannel(userId).catch(() => {
+  });
+}
+var SESSION_COOKIE_OPTIONS = {
+  path: "/",
+  httpOnly: true,
+  sameSite: "Lax",
+  maxAge: Math.floor(SESSION_MAX_AGE / 1e3)
+};
 var credentialsSchema = z.object({
   username: z.string().min(1),
   password: z.string().min(1)
@@ -610,6 +674,11 @@ var authenticated = new Hono2().use(authMiddleware).post("/change-password", zVa
   await updateUserProfile(user.id, body);
   const sessionId = getCookie2(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
+  broadcast({
+    type: "profile_updated",
+    mind: user.username,
+    summary: `${user.username} profile updated`
+  });
   return c.json({ ok: true });
 }).post("/avatar", async (c) => {
   const user = c.get("user");
@@ -637,6 +706,11 @@ var authenticated = new Hono2().use(authMiddleware).post("/change-password", zVa
   await updateUserProfile(user.id, { avatar: filename });
   const sessionId = getCookie2(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
+  broadcast({
+    type: "profile_updated",
+    mind: user.username,
+    summary: `${user.username} avatar updated`
+  });
   return c.json({ ok: true, avatar: filename });
 }).delete("/avatar", async (c) => {
   const user = c.get("user");
@@ -647,6 +721,11 @@ var authenticated = new Hono2().use(authMiddleware).post("/change-password", zVa
   await updateUserProfile(user.id, { avatar: null });
   const sessionId = getCookie2(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
+  broadcast({
+    type: "profile_updated",
+    mind: user.username,
+    summary: `${user.username} avatar removed`
+  });
   return c.json({ ok: true });
 });
 var admin = new Hono2().use(authMiddleware).get("/users", async (c) => {
@@ -700,6 +779,14 @@ var admin = new Hono2().use(authMiddleware).get("/users", async (c) => {
   if (Number.isNaN(id)) return c.json({ error: "Invalid user ID" }, 400);
   const body = c.req.valid("json");
   await updateUserProfile(id, body);
+  const updatedUser = await getUser(id);
+  if (updatedUser) {
+    broadcast({
+      type: "profile_updated",
+      mind: updatedUser.username,
+      summary: `${updatedUser.username} profile updated`
+    });
+  }
   return c.json({ ok: true });
 }).delete("/users/:id", async (c) => {
   const user = c.get("user");
@@ -728,8 +815,9 @@ var app2 = new Hono2().post("/register", zValidator("json", credentialsSchema),
   const user = await createUser(username, password);
   if (user.role === "admin") {
     const sessionId = await createSession(user.id);
-    setCookie(c, "volute_session", sessionId, { path: "/", httpOnly: true, sameSite: "Lax" });
+    setCookie(c, "volute_session", sessionId, SESSION_COOKIE_OPTIONS);
   }
+  tryJoinSystem(user.id);
   return c.json({ id: user.id, username: user.username, role: user.role });
 }).post("/login", zValidator("json", credentialsSchema), async (c) => {
   const { username, password } = c.req.valid("json");
@@ -738,13 +826,22 @@ var app2 = new Hono2().post("/register", zValidator("json", credentialsSchema),
     return c.json({ error: "Invalid credentials" }, 401);
   }
   const sessionId = await createSession(user.id);
-  setCookie(c, "volute_session", sessionId, { path: "/", httpOnly: true, sameSite: "Lax" });
-  return c.json({ id: user.id, username: user.username, role: user.role });
+  setCookie(c, "volute_session", sessionId, SESSION_COOKIE_OPTIONS);
+  tryJoinSystem(user.id);
+  return c.json({ id: user.id, username: user.username, role: user.role, sessionId });
 }).post("/logout", async (c) => {
-  const sessionId = getCookie2(c, "volute_session");
-  if (sessionId) {
-    await deleteSession(sessionId);
+  const cookieSession = getCookie2(c, "volute_session");
+  if (cookieSession) {
+    await deleteSession(cookieSession);
     deleteCookie(c, "volute_session", { path: "/" });
+    return c.json({ ok: true });
+  }
+  const authHeader = c.req.header("Authorization");
+  if (authHeader?.startsWith("Bearer ")) {
+    const token = authHeader.slice(7);
+    if (token) {
+      await deleteSession(token);
+    }
   }
   return c.json({ ok: true });
 }).get("/me", async (c) => {
@@ -1053,8 +1150,8 @@ async function listConversations2(env) {
   const userMap = /* @__PURE__ */ new Map();
   const imChannels = data.channels.filter((ch) => ch.is_im && ch.user);
   if (imChannels.length > 0) {
-    const users = await listUsers3(env);
-    for (const u of users) {
+    const users2 = await listUsers3(env);
+    for (const u of users2) {
       userMap.set(u.id, u.username);
     }
   }
@@ -1446,7 +1543,7 @@ function resolveChannelId2(env, slug) {
 function buildEnv(name) {
   return { ...loadMergedEnv(name), VOLUTE_MIND: name, VOLUTE_MIND_DIR: mindDir(name) };
 }
-var app3 = new Hono3().post("/:name/channels/send", requireAdmin, async (c) => {
+var app3 = new Hono3().post("/:name/channels/send", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const { platform, uri, message, images, sender } = await c.req.json();
@@ -1512,12 +1609,12 @@ var app3 = new Hono3().post("/:name/channels/send", requireAdmin, async (c) => {
     return c.json({ error: `Platform ${platform} does not support listing users` }, 400);
   const env = buildEnv(name);
   try {
-    const users = await driver.listUsers(env);
-    return c.json(users);
+    const users2 = await driver.listUsers(env);
+    return c.json(users2);
   } catch (err) {
     return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
   }
-}).post("/:name/channels/create", requireAdmin, async (c) => {
+}).post("/:name/channels/create", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const {
@@ -1872,7 +1969,7 @@ async function notifyMind(port, message, channel, sender) {
     console.warn(`[file-sharing] notify mind on port ${port} failed:`, err);
   }
 }
-var app6 = new Hono6().post("/:name/files/send", async (c) => {
+var app6 = new Hono6().post("/:name/files/send", requireSelf(), async (c) => {
   const senderName = c.req.param("name");
   const senderEntry = findMind(senderName);
   if (!senderEntry) return c.json({ error: "Sender mind not found" }, 404);
@@ -1886,13 +1983,13 @@ var app6 = new Hono6().post("/:name/files/send", async (c) => {
   if (pathErr) return c.json({ error: pathErr }, 400);
   const senderDir = mindDir(senderName);
   const filePath = resolve6(senderDir, "home", body.filePath);
-  const MAX_FILE_SIZE = 50 * 1024 * 1024;
-  const stat4 = statSync(filePath, { throwIfNoEntry: false });
-  if (!stat4) return c.json({ error: `File not found: ${body.filePath}` }, 404);
-  if (stat4.size > MAX_FILE_SIZE) {
+  const MAX_FILE_SIZE2 = 50 * 1024 * 1024;
+  const stat5 = statSync(filePath, { throwIfNoEntry: false });
+  if (!stat5) return c.json({ error: `File not found: ${body.filePath}` }, 404);
+  if (stat5.size > MAX_FILE_SIZE2) {
     return c.json(
       {
-        error: `File too large (${formatFileSize(stat4.size)}, max ${formatFileSize(MAX_FILE_SIZE)})`
+        error: `File too large (${formatFileSize(stat5.size)}, max ${formatFileSize(MAX_FILE_SIZE2)})`
       },
       413
     );
@@ -2020,12 +2117,12 @@ var app7 = new Hono7().get("/:name/avatar", async (c) => {
   if (!entry) return c.json({ error: "Mind not found" }, 404);
   const dir = mindDir(name);
   const config = readVoluteConfig(dir);
-  if (!config?.avatar) return c.json({ error: "No avatar configured" }, 404);
-  const ext = extname2(config.avatar).toLowerCase();
+  if (!config?.profile?.avatar) return c.json({ error: "No avatar configured" }, 404);
+  const ext = extname2(config.profile.avatar).toLowerCase();
   const mime = AVATAR_MIME2[ext];
   if (!mime) return c.json({ error: "Invalid avatar extension" }, 400);
   const homeDir = resolve7(dir, "home");
-  const avatarPath = resolve7(homeDir, config.avatar);
+  const avatarPath = resolve7(homeDir, config.profile.avatar);
   if (!avatarPath.startsWith(`${homeDir}/`)) return c.json({ error: "Invalid avatar path" }, 400);
   let realAvatarPath;
   try {
@@ -2197,9 +2294,9 @@ var app9 = new Hono9().get("/:name/logs", async (c) => {
     stream.onAbort(() => {
       tail.kill();
     });
-    await new Promise((resolve19) => {
-      tail.on("exit", resolve19);
-      stream.onAbort(resolve19);
+    await new Promise((resolve20) => {
+      tail.on("exit", resolve20);
+      stream.onAbort(resolve20);
     });
   });
 }).get("/:name/logs/tail", async (c) => {
@@ -2217,8 +2314,8 @@ var app9 = new Hono9().get("/:name/logs", async (c) => {
   tail.stdout.on("data", (data) => {
     output += data.toString();
   });
-  await new Promise((resolve19) => {
-    tail.on("exit", resolve19);
+  await new Promise((resolve20) => {
+    tail.on("exit", resolve20);
   });
   return c.text(output);
 });
@@ -2246,12 +2343,12 @@ var app10 = new Hono10().get("/:name/skills", async (c) => {
     const { skillId } = c.req.valid("json");
     const dir = mindDir(name);
     try {
-      await installSkill(name, dir, skillId);
+      const result = await installSkill(name, dir, skillId);
+      return c.json({ ok: true, ...result });
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       return c.json({ error: msg }, 400);
     }
-    return c.json({ ok: true });
   }
 ).post(
   "/:name/skills/update",
@@ -2606,7 +2703,7 @@ async function getMindStatus(name, port) {
   const manager = getMindManager();
   let status = "stopped";
   try {
-    const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+    const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
     if (getSleepManagerIfReady()?.isSleeping(name)) {
       status = "sleeping";
     }
@@ -2641,9 +2738,9 @@ async function getMindStatus(name, port) {
   return {
     status,
     channels,
-    displayName: config?.displayName,
-    description: config?.description,
-    avatar: config?.avatar
+    displayName: config?.profile?.displayName,
+    description: config?.profile?.description,
+    avatar: config?.profile?.avatar
   };
 }
 var TEMPLATE_BRANCH = "volute/template";
@@ -3004,11 +3101,30 @@ var app11 = new Hono11().post("/", requireAdmin, zValidator3("json", createMindS
     copyTemplateToDir(composedDir, dest, name, manifest);
     applyInitFiles(dest);
     const { publicKeyPem } = generateIdentity(dest);
-    if (body.description) {
-      const seedConfig = readVoluteConfig(dest);
-      if (!seedConfig) throw new Error("Failed to read volute.json after identity generation");
-      seedConfig.description = body.description;
-      writeVoluteConfig(dest, seedConfig);
+    {
+      const config = readVoluteConfig(dest);
+      if (!config) throw new Error("Failed to read volute.json after identity generation");
+      if (body.description) {
+        config.profile = { ...config.profile, description: body.description };
+      }
+      if (!config.sleep) {
+        config.sleep = {
+          enabled: true,
+          schedule: { sleep: "0 0 * * *", wake: "0 8 * * *" }
+        };
+      }
+      if (!config.schedules || config.schedules.length === 0) {
+        config.schedules = [
+          {
+            id: "heartbeat",
+            cron: "0 12,16,20 * * *",
+            message: "A quiet moment. You might write something \u2014 a note, a journal entry, a page. You could explore a topic that interests you, check in on #system, or just think. No obligations, just time.",
+            enabled: true,
+            skipWhenSleeping: true
+          }
+        ];
+      }
+      writeVoluteConfig(dest, config);
     }
     if (body.model) {
       const configPath2 = resolve12(dest, "home/.config/config.json");
@@ -3094,6 +3210,8 @@ The human who planted you described you as: "${body.description}"
         description: body.description
       }
     });
+    announceToSystem(`${name} has joined`).catch(() => {
+    });
     return c.json({
       ok: true,
       name,
@@ -3247,7 +3365,7 @@ ${user.trimEnd()}
   const minds = await Promise.all(
     entries.map(async (entry) => {
       const mindStatus = await getMindStatus(entry.name, entry.port);
-      const hasPages = existsSync10(resolve12(mindDir(entry.name), "home", "pages"));
+      const hasPages = existsSync10(resolve12(mindDir(entry.name), "home", "public", "pages"));
       return {
         ...entry,
         ...mindStatus,
@@ -3280,7 +3398,7 @@ ${user.trimEnd()}
       return { name: v.name, port: v.port, status: variantStatus };
     })
   );
-  const hasPages = existsSync10(resolve12(mindDir(name), "home", "pages"));
+  const hasPages = existsSync10(resolve12(mindDir(name), "home", "public", "pages"));
   return c.json({ ...entry, ...mindStatus, variants: variantStatuses, hasPages });
 }).post("/:name/start", requireAdmin, async (c) => {
   const name = c.req.param("name");
@@ -3305,7 +3423,7 @@ ${user.trimEnd()}
   } catch (err) {
     return c.json({ error: err instanceof Error ? err.message : "Failed to start mind" }, 500);
   }
-}).post("/:name/restart", requireAdmin, async (c) => {
+}).post("/:name/restart", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const [baseName, variantName] = name.split("@", 2);
   const entry = findMind(baseName);
@@ -3331,6 +3449,14 @@ ${user.trimEnd()}
   }
   const manager = getMindManager();
   try {
+    if (context?.type === "reload") {
+      const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
+      const sleepState = getSleepManagerIfReady()?.getState(name);
+      if (sleepState?.sleeping) {
+        logger_default.info(`skipping reload for ${name} during sleep \u2014 will apply on next wake`);
+        return c.json({ ok: true, deferred: true, port: targetPort });
+      }
+    }
     if (manager.isRunning(name)) {
       await stopMindFull(name);
     }
@@ -3380,7 +3506,7 @@ ${user.trimEnd()}
         }
       }
     }
-    if (context) {
+    if (context && context.type !== "reload") {
       manager.setPendingContext(name, context);
     }
     if (context?.type === "sprouted" && !variantName) {
@@ -3424,7 +3550,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+  const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
   const sm = getSleepManagerIfReady();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   return c.json(sm.getState(name));
@@ -3432,7 +3558,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+  const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
   const sm = getSleepManagerIfReady();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   if (sm.isSleeping(name)) return c.json({ error: "Mind is already sleeping" }, 409);
@@ -3452,17 +3578,22 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+  const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
   const sm = getSleepManagerIfReady();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
-  if (!sm.isSleeping(name)) return c.json({ error: "Mind is not sleeping" }, 409);
-  sm.initiateWake(name).catch((err) => logger_default.error(`failed to wake ${name}`, logger_default.errorData(err)));
+  const sleepState = sm.getState(name);
+  if (!sleepState.sleeping) return c.json({ error: "Mind is not sleeping" }, 409);
+  if (sleepState.wokenByTrigger) {
+    sm.convertTriggerToFullWake(name);
+  } else {
+    sm.initiateWake(name).catch((err) => logger_default.error(`failed to wake ${name}`, logger_default.errorData(err)));
+  }
   return c.json({ ok: true });
 }).post("/:name/sleep/messages", requireAdmin, async (c) => {
   const name = c.req.param("name");
   const entry = findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+  const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
   const sm = getSleepManagerIfReady();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const flushed = await sm.flushQueuedMessages(name);
@@ -3670,7 +3801,7 @@ ${user.trimEnd()}
       500
     );
   }
-}).post("/:name/message", async (c) => {
+}).post("/:name/message", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const [baseName, variantName] = name.split("@", 2);
   const entry = findMind(baseName);
@@ -3680,7 +3811,7 @@ ${user.trimEnd()}
     if (!variant) return c.json({ error: `Unknown variant: ${variantName}` }, 404);
   }
   try {
-    const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+    const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
     const sm = getSleepManagerIfReady();
     if (sm?.isSleeping(baseName)) {
       const body2 = await c.req.text();
@@ -3903,7 +4034,7 @@ ${user.trimEnd()}
     logger_default.error(`failed to get pending deliveries for ${baseName}`, logger_default.errorData(err));
     return c.json({ error: "Failed to retrieve pending messages" }, 500);
   }
-}).post("/:name/events", async (c) => {
+}).post("/:name/events", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const [baseName] = name.split("@", 2);
   let body;
@@ -3929,7 +4060,7 @@ ${user.trimEnd()}
   } catch (err) {
     logger_default.error(`failed to persist event for ${baseName}`, logger_default.errorData(err));
   }
-  publish(baseName, {
+  publish2(baseName, {
     mind: baseName,
     type: body.type,
     session: body.session,
@@ -3988,7 +4119,7 @@ ${user.trimEnd()}
           unsubscribe?.();
         }
       }, 15e3);
-      unsubscribe = subscribe2(baseName, (event) => {
+      unsubscribe = subscribe3(baseName, (event) => {
         if (typeFilter && !typeFilter.includes(event.type)) return;
         if (sessionFilter && event.session !== sessionFilter) return;
         if (channelFilter && event.channel !== channelFilter) return;
@@ -4016,7 +4147,7 @@ ${user.trimEnd()}
       Connection: "keep-alive"
     }
   });
-}).post("/:name/history", async (c) => {
+}).post("/:name/history", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const [baseName] = name.split("@", 2);
   let body;
@@ -4087,10 +4218,330 @@ ${user.trimEnd()}
 });
 var minds_default = app11;
 
+// src/web/api/notes.ts
+import { zValidator as zValidator4 } from "@hono/zod-validator";
+import { Hono as Hono12 } from "hono";
+import { z as z4 } from "zod";
+
+// src/lib/notes.ts
+import { and as and2, count, desc as desc3, eq as eq3, inArray, sql as sql2 } from "drizzle-orm";
+async function createNote(authorId, title, content, replyToId) {
+  const db = await getDb();
+  let slug = slugify(title) || "untitled";
+  const existing = await db.select({ slug: notes.slug }).from(notes).where(eq3(notes.author_id, authorId)).all();
+  const existingSlugs = new Set(existing.map((r) => r.slug));
+  if (existingSlugs.has(slug)) {
+    let i = 2;
+    while (existingSlugs.has(`${slug}-${i}`)) i++;
+    slug = `${slug}-${i}`;
+  }
+  const [row] = await db.insert(notes).values({ author_id: authorId, title, slug, content, reply_to_id: replyToId ?? null }).returning();
+  const author = await db.select().from(users).where(eq3(users.id, authorId)).get();
+  return {
+    ...row,
+    author_username: author?.username ?? "unknown",
+    author_display_name: author?.display_name ?? null,
+    comment_count: 0
+  };
+}
+async function getNote(authorUsername, slug) {
+  const db = await getDb();
+  const row = await db.select({
+    id: notes.id,
+    author_id: notes.author_id,
+    title: notes.title,
+    slug: notes.slug,
+    content: notes.content,
+    reply_to_id: notes.reply_to_id,
+    created_at: notes.created_at,
+    updated_at: notes.updated_at,
+    author_username: users.username,
+    author_display_name: users.display_name
+  }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(and2(eq3(users.username, authorUsername), eq3(notes.slug, slug))).get();
+  if (!row) return null;
+  const comments = await getComments(row.id);
+  const reactions = await getReactions(row.id);
+  let reply_to = null;
+  if (row.reply_to_id) {
+    const parent = await db.select({
+      title: notes.title,
+      slug: notes.slug,
+      author_username: users.username
+    }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(eq3(notes.id, row.reply_to_id)).get();
+    if (parent) {
+      reply_to = parent;
+    }
+  }
+  const replies = await db.select({
+    author_username: users.username,
+    slug: notes.slug,
+    title: notes.title,
+    created_at: notes.created_at
+  }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(eq3(notes.reply_to_id, row.id)).orderBy(notes.created_at).all();
+  return { ...row, comment_count: comments.length, comments, reactions, reply_to, replies };
+}
+async function listNotes(opts) {
+  const db = await getDb();
+  const limit = opts?.limit ?? 50;
+  const offset = opts?.offset ?? 0;
+  const conditions = [];
+  if (opts?.authorUsername) {
+    conditions.push(eq3(users.username, opts.authorUsername));
+  }
+  const rows = await db.select({
+    id: notes.id,
+    author_id: notes.author_id,
+    title: notes.title,
+    slug: notes.slug,
+    content: notes.content,
+    reply_to_id: notes.reply_to_id,
+    created_at: notes.created_at,
+    updated_at: notes.updated_at,
+    author_username: users.username,
+    author_display_name: users.display_name
+  }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(conditions.length > 0 ? and2(...conditions) : void 0).orderBy(desc3(notes.created_at)).limit(limit).offset(offset).all();
+  const noteIds = rows.map((r) => r.id);
+  if (noteIds.length === 0) return [];
+  const commentCounts = await db.select({
+    note_id: noteComments.note_id,
+    count: count()
+  }).from(noteComments).where(inArray(noteComments.note_id, noteIds)).groupBy(noteComments.note_id).all();
+  const countMap = new Map(commentCounts.map((r) => [r.note_id, r.count]));
+  const allReactions = await db.select({
+    note_id: noteReactions.note_id,
+    emoji: noteReactions.emoji,
+    count: count()
+  }).from(noteReactions).where(inArray(noteReactions.note_id, noteIds)).groupBy(noteReactions.note_id, noteReactions.emoji).all();
+  const reactionMap = /* @__PURE__ */ new Map();
+  for (const r of allReactions) {
+    if (!reactionMap.has(r.note_id)) reactionMap.set(r.note_id, []);
+    reactionMap.get(r.note_id).push({ emoji: r.emoji, count: r.count });
+  }
+  const replyToIds = [...new Set(rows.filter((r) => r.reply_to_id).map((r) => r.reply_to_id))];
+  const replyToMap = /* @__PURE__ */ new Map();
+  if (replyToIds.length > 0) {
+    const parents = await db.select({
+      id: notes.id,
+      title: notes.title,
+      slug: notes.slug,
+      author_username: users.username
+    }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(inArray(notes.id, replyToIds)).all();
+    for (const parent of parents) {
+      replyToMap.set(parent.id, {
+        author_username: parent.author_username,
+        slug: parent.slug,
+        title: parent.title
+      });
+    }
+  }
+  return rows.map((r) => {
+    const reactions = reactionMap.get(r.id);
+    const topReactions = reactions ? reactions.sort((a, b) => b.count - a.count).slice(0, 3).map((rx) => ({ ...rx, usernames: [] })) : void 0;
+    return {
+      ...r,
+      comment_count: countMap.get(r.id) ?? 0,
+      reactions: topReactions,
+      reply_to: r.reply_to_id ? replyToMap.get(r.reply_to_id) ?? null : null
+    };
+  });
+}
+async function updateNote(authorUsername, slug, updates) {
+  const db = await getDb();
+  const existing = await db.select({ id: notes.id, author_id: notes.author_id }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(and2(eq3(users.username, authorUsername), eq3(notes.slug, slug))).get();
+  if (!existing) return null;
+  const set = { updated_at: sql2`(datetime('now'))` };
+  if (updates.title !== void 0) set.title = updates.title;
+  if (updates.content !== void 0) set.content = updates.content;
+  await db.update(notes).set(set).where(eq3(notes.id, existing.id));
+  return getNote(authorUsername, slug).then(
+    (n) => n ? { ...n, comments: void 0 } : null
+  );
+}
+async function deleteNote(authorUsername, slug, authorId) {
+  const db = await getDb();
+  const existing = await db.select({ id: notes.id, author_id: notes.author_id }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(and2(eq3(users.username, authorUsername), eq3(notes.slug, slug))).get();
+  if (!existing || existing.author_id !== authorId) return false;
+  await db.delete(notes).where(eq3(notes.id, existing.id));
+  return true;
+}
+async function addComment(noteId, authorId, content) {
+  const db = await getDb();
+  const [row] = await db.insert(noteComments).values({ note_id: noteId, author_id: authorId, content }).returning();
+  const author = await db.select().from(users).where(eq3(users.id, authorId)).get();
+  return {
+    ...row,
+    author_username: author?.username ?? "unknown",
+    author_display_name: author?.display_name ?? null
+  };
+}
+async function getComments(noteId) {
+  const db = await getDb();
+  return db.select({
+    id: noteComments.id,
+    note_id: noteComments.note_id,
+    author_id: noteComments.author_id,
+    content: noteComments.content,
+    created_at: noteComments.created_at,
+    author_username: users.username,
+    author_display_name: users.display_name
+  }).from(noteComments).innerJoin(users, eq3(noteComments.author_id, users.id)).where(eq3(noteComments.note_id, noteId)).orderBy(noteComments.created_at).all();
+}
+async function deleteComment(commentId, authorId) {
+  const db = await getDb();
+  const existing = await db.select({ id: noteComments.id, author_id: noteComments.author_id }).from(noteComments).where(eq3(noteComments.id, commentId)).get();
+  if (!existing || existing.author_id !== authorId) return false;
+  await db.delete(noteComments).where(eq3(noteComments.id, commentId));
+  return true;
+}
+async function toggleReaction(noteId, userId, emoji) {
+  const db = await getDb();
+  const existing = await db.select({ id: noteReactions.id }).from(noteReactions).where(
+    and2(
+      eq3(noteReactions.note_id, noteId),
+      eq3(noteReactions.user_id, userId),
+      eq3(noteReactions.emoji, emoji)
+    )
+  ).get();
+  if (existing) {
+    await db.delete(noteReactions).where(eq3(noteReactions.id, existing.id));
+    return { added: false };
+  }
+  await db.insert(noteReactions).values({ note_id: noteId, user_id: userId, emoji });
+  return { added: true };
+}
+async function getReactions(noteId) {
+  const db = await getDb();
+  const rows = await db.select({
+    emoji: noteReactions.emoji,
+    username: users.username
+  }).from(noteReactions).innerJoin(users, eq3(noteReactions.user_id, users.id)).where(eq3(noteReactions.note_id, noteId)).orderBy(noteReactions.emoji).all();
+  const grouped = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    if (!grouped.has(r.emoji)) grouped.set(r.emoji, []);
+    grouped.get(r.emoji).push(r.username);
+  }
+  return [...grouped.entries()].map(([emoji, usernames]) => ({
+    emoji,
+    count: usernames.length,
+    usernames
+  }));
+}
+async function resolveNoteId(authorSlug) {
+  const [author, slug] = authorSlug.split("/", 2);
+  if (!author || !slug) return null;
+  const db = await getDb();
+  const row = await db.select({ id: notes.id }).from(notes).innerJoin(users, eq3(notes.author_id, users.id)).where(and2(eq3(users.username, author), eq3(notes.slug, slug))).get();
+  return row?.id ?? null;
+}
+
+// src/web/api/notes.ts
+var createSchema = z4.object({
+  title: z4.string().min(1).max(200),
+  content: z4.string().min(1),
+  reply_to: z4.string().optional()
+});
+var updateSchema = z4.object({
+  title: z4.string().min(1).max(200).optional(),
+  content: z4.string().min(1).optional()
+});
+var commentSchema = z4.object({
+  content: z4.string().min(1)
+});
+var reactionSchema = z4.object({
+  emoji: z4.string().min(1).max(32)
+});
+async function resolveUserId(c) {
+  const user = c.get("user");
+  if (user.id === 0) {
+    const asUser = c.req.query("as");
+    if (!asUser) return null;
+    try {
+      const mindUser = await getOrCreateMindUser(asUser);
+      return { id: mindUser.id, username: mindUser.username };
+    } catch {
+      const brainUser = await getUserByUsername(asUser);
+      if (brainUser) return { id: brainUser.id, username: brainUser.username };
+      return null;
+    }
+  }
+  return { id: user.id, username: user.username };
+}
+var app12 = new Hono12().get("/", async (c) => {
+  const author = c.req.query("author");
+  const limit = c.req.query("limit") ? parseInt(c.req.query("limit"), 10) : void 0;
+  const offset = c.req.query("offset") ? parseInt(c.req.query("offset"), 10) : void 0;
+  const result = await listNotes({ authorUsername: author, limit, offset });
+  return c.json(result);
+}).post("/", zValidator4("json", createSchema), async (c) => {
+  const actor = await resolveUserId(c);
+  if (!actor) return c.json({ error: "Missing ?as=<username> for CLI requests" }, 400);
+  const { title, content, reply_to } = c.req.valid("json");
+  let replyToId;
+  if (reply_to) {
+    const id = await resolveNoteId(reply_to);
+    if (id === null) return c.json({ error: `Reply target not found: ${reply_to}` }, 404);
+    replyToId = id;
+  }
+  const note = await createNote(actor.id, title, content, replyToId);
+  const replyInfo = reply_to ? ` (in reply to ${reply_to})` : "";
+  announceToSystem(`${actor.username} published a note: ${title}${replyInfo}`).catch(() => {
+  });
+  return c.json(note, 201);
+}).get("/:author/:slug", async (c) => {
+  const { author, slug } = c.req.param();
+  const note = await getNote(author, slug);
+  if (!note) return c.json({ error: "Note not found" }, 404);
+  return c.json(note);
+}).put("/:author/:slug", zValidator4("json", updateSchema), async (c) => {
+  const actor = await resolveUserId(c);
+  if (!actor) return c.json({ error: "Missing ?as=<username> for CLI requests" }, 400);
+  const { author, slug } = c.req.param();
+  if (actor.username !== author) return c.json({ error: "Forbidden" }, 403);
+  const updates = c.req.valid("json");
+  const note = await updateNote(author, slug, updates);
+  if (!note) return c.json({ error: "Note not found" }, 404);
+  return c.json(note);
+}).delete("/:author/:slug", async (c) => {
+  const actor = await resolveUserId(c);
+  if (!actor) return c.json({ error: "Missing ?as=<username> for CLI requests" }, 400);
+  const { author, slug } = c.req.param();
+  const deleted = await deleteNote(author, slug, actor.id);
+  if (!deleted) return c.json({ error: "Note not found or not authorized" }, 404);
+  return c.json({ ok: true });
+}).post("/:author/:slug/reactions", zValidator4("json", reactionSchema), async (c) => {
+  const actor = await resolveUserId(c);
+  if (!actor) return c.json({ error: "Missing ?as=<username> for CLI requests" }, 400);
+  const { author, slug } = c.req.param();
+  const note = await getNote(author, slug);
+  if (!note) return c.json({ error: "Note not found" }, 404);
+  const { emoji } = c.req.valid("json");
+  const result = await toggleReaction(note.id, actor.id, emoji);
+  const reactions = await getReactions(note.id);
+  return c.json({ ...result, reactions });
+}).post("/:author/:slug/comments", zValidator4("json", commentSchema), async (c) => {
+  const actor = await resolveUserId(c);
+  if (!actor) return c.json({ error: "Missing ?as=<username> for CLI requests" }, 400);
+  const { author, slug } = c.req.param();
+  const note = await getNote(author, slug);
+  if (!note) return c.json({ error: "Note not found" }, 404);
+  const { content } = c.req.valid("json");
+  const comment = await addComment(note.id, actor.id, content);
+  return c.json(comment, 201);
+}).delete("/:author/:slug/comments/:id", async (c) => {
+  const actor = await resolveUserId(c);
+  if (!actor) return c.json({ error: "Missing ?as=<username> for CLI requests" }, 400);
+  const commentId = parseInt(c.req.param("id"), 10);
+  if (Number.isNaN(commentId)) return c.json({ error: "Invalid comment ID" }, 400);
+  const deleted = await deleteComment(commentId, actor.id);
+  if (!deleted) return c.json({ error: "Comment not found or not authorized" }, 404);
+  return c.json({ ok: true });
+});
+var notes_default = app12;
+
 // src/web/api/pages.ts
 import { readFile as readFile2, stat as stat2 } from "fs/promises";
 import { extname as extname3, resolve as resolve13 } from "path";
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 var MIME_TYPES = {
   ".html": "text/html",
   ".js": "application/javascript",
@@ -4107,14 +4558,14 @@ var MIME_TYPES = {
   ".txt": "text/plain",
   ".xml": "application/xml"
 };
-var app12 = new Hono12().get("/:name/*", async (c) => {
+var app13 = new Hono13().get("/:name/*", async (c) => {
   const name = c.req.param("name");
   let pagesRoot;
   if (name === "_system") {
     pagesRoot = resolve13(voluteHome(), "shared", "pages");
   } else {
     if (!findMind(name)) return c.text("Not found", 404);
-    pagesRoot = resolve13(mindDir(name), "home", "pages");
+    pagesRoot = resolve13(mindDir(name), "home", "public", "pages");
   }
   const wildcard = c.req.path.replace(`/pages/${name}`, "") || "/";
   const requestedPath = resolve13(pagesRoot, wildcard.slice(1));
@@ -4137,14 +4588,14 @@ var app12 = new Hono12().get("/:name/*", async (c) => {
   }
   return c.text("Not found", 404);
 });
-var pages_default = app12;
+var pages_default = app13;
 
 // src/web/api/prompts.ts
-import { zValidator as zValidator4 } from "@hono/zod-validator";
-import { eq as eq3, sql as sql2 } from "drizzle-orm";
-import { Hono as Hono13 } from "hono";
-import { z as z4 } from "zod";
-var app13 = new Hono13().get("/", async (c) => {
+import { zValidator as zValidator5 } from "@hono/zod-validator";
+import { eq as eq4, sql as sql3 } from "drizzle-orm";
+import { Hono as Hono14 } from "hono";
+import { z as z5 } from "zod";
+var app14 = new Hono14().get("/", async (c) => {
   let rows;
   try {
     const db = await getDb();
@@ -4167,16 +4618,16 @@ var app13 = new Hono13().get("/", async (c) => {
     };
   });
   return c.json(prompts);
-}).put("/:key", requireAdmin, zValidator4("json", z4.object({ content: z4.string() })), async (c) => {
+}).put("/:key", requireAdmin, zValidator5("json", z5.object({ content: z5.string() })), async (c) => {
   const key = c.req.param("key");
   if (!PROMPT_KEYS.includes(key)) {
     return c.json({ error: "Unknown prompt key" }, 404);
   }
   const { content } = c.req.valid("json");
   const db = await getDb();
-  await db.insert(systemPrompts).values({ key, content, updated_at: sql2`(datetime('now'))` }).onConflictDoUpdate({
+  await db.insert(systemPrompts).values({ key, content, updated_at: sql3`(datetime('now'))` }).onConflictDoUpdate({
     target: systemPrompts.key,
-    set: { content, updated_at: sql2`(datetime('now'))` }
+    set: { content, updated_at: sql3`(datetime('now'))` }
   });
   return c.json({ ok: true });
 }).delete("/:key", requireAdmin, async (c) => {
@@ -4185,14 +4636,103 @@ var app13 = new Hono13().get("/", async (c) => {
     return c.json({ error: "Unknown prompt key" }, 404);
   }
   const db = await getDb();
-  await db.delete(systemPrompts).where(eq3(systemPrompts.key, key));
+  await db.delete(systemPrompts).where(eq4(systemPrompts.key, key));
   return c.json({ ok: true });
 });
-var prompts_default = app13;
+var prompts_default = app14;
+
+// src/web/api/public-files.ts
+import { readdir as readdir2, readFile as readFile3, stat as stat3 } from "fs/promises";
+import { extname as extname4, resolve as resolve14 } from "path";
+import { Hono as Hono15 } from "hono";
+var MAX_FILE_SIZE = 50 * 1024 * 1024;
+function resolvePublicRoot(name) {
+  if (name === "_system") return resolve14(voluteHome(), "shared");
+  if (!findMind(name)) return null;
+  return resolve14(mindDir(name), "home", "public");
+}
+function hasDotSegment(relativePath) {
+  return relativePath.split("/").some((seg) => seg.startsWith("."));
+}
+var MIME_TYPES2 = {
+  ".html": "text/html",
+  ".js": "application/javascript",
+  ".css": "text/css",
+  ".json": "application/json",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain",
+  ".xml": "application/xml",
+  ".md": "text/markdown",
+  ".webp": "image/webp"
+};
+async function listDir(dirPath) {
+  let entries;
+  try {
+    entries = await readdir2(dirPath, { withFileTypes: true });
+  } catch (err) {
+    if (err?.code === "ENOENT") return [];
+    throw err;
+  }
+  return entries.filter((e) => !e.name.startsWith(".")).map((e) => ({
+    name: e.name,
+    type: e.isDirectory() ? "directory" : "file"
+  }));
+}
+var app15 = new Hono15().get("/:name/", async (c) => {
+  const name = c.req.param("name");
+  const publicRoot = resolvePublicRoot(name);
+  if (!publicRoot) return c.json({ error: "Not found" }, 404);
+  return c.json(await listDir(publicRoot));
+}).get("/:name/*", async (c) => {
+  const name = c.req.param("name");
+  const publicRoot = resolvePublicRoot(name);
+  if (!publicRoot) return c.text("Not found", 404);
+  const wildcard = c.req.path.replace(`/public/${name}`, "") || "/";
+  const relativePath = wildcard.slice(1);
+  const requestedPath = resolve14(publicRoot, relativePath);
+  if (!requestedPath.startsWith(publicRoot)) return c.text("Forbidden", 403);
+  if (hasDotSegment(relativePath)) return c.text("Forbidden", 403);
+  let fileStat;
+  try {
+    fileStat = await stat3(requestedPath);
+  } catch (err) {
+    if (err?.code === "ENOENT") return c.text("Not found", 404);
+    if (err?.code === "EACCES") return c.text("Forbidden", 403);
+    return c.text("Internal server error", 500);
+  }
+  if (fileStat.isDirectory()) {
+    if (wildcard.endsWith("/")) {
+      return c.json(await listDir(requestedPath));
+    }
+    return c.text("Not found", 404);
+  }
+  if (fileStat.isFile()) {
+    if (fileStat.size > MAX_FILE_SIZE) return c.text("File too large", 413);
+    const ext = extname4(requestedPath);
+    const mime = MIME_TYPES2[ext] || "application/octet-stream";
+    try {
+      const body = await readFile3(requestedPath);
+      return c.body(body, 200, { "Content-Type": mime });
+    } catch (err) {
+      if (err?.code === "ENOENT") return c.text("Not found", 404);
+      if (err?.code === "EACCES") return c.text("Forbidden", 403);
+      return c.text("Failed to read file", 500);
+    }
+  }
+  return c.text("Not found", 404);
+});
+var public_files_default = app15;
 
 // src/web/api/schedules.ts
 import { CronExpressionParser } from "cron-parser";
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono16 } from "hono";
 var slog = logger_default.child("schedules");
 function readSchedules(name) {
   return readVoluteConfig(mindDir(name))?.schedules ?? [];
@@ -4209,7 +4749,7 @@ function writeSchedules(name, schedules) {
     data: { schedules }
   });
 }
-var app14 = new Hono14().get("/:name/schedules", (c) => {
+var app16 = new Hono16().get("/:name/schedules", (c) => {
   const name = c.req.param("name");
   if (!findMind(name)) return c.json({ error: "Mind not found" }, 404);
   return c.json(readSchedules(name));
@@ -4242,6 +4782,7 @@ var app14 = new Hono14().get("/:name/schedules", (c) => {
   const schedule = { id, cron: body.cron, enabled: body.enabled ?? true };
   if (body.message) schedule.message = body.message;
   if (body.script) schedule.script = body.script;
+  if (body.channel) schedule.channel = body.channel;
   schedules.push(schedule);
   writeSchedules(name, schedules);
   return c.json({ ok: true, id }, 201);
@@ -4273,6 +4814,7 @@ var app14 = new Hono14().get("/:name/schedules", (c) => {
     delete schedules[idx].message;
   }
   if (body.enabled !== void 0) schedules[idx].enabled = body.enabled;
+  if (body.channel !== void 0) schedules[idx].channel = body.channel || void 0;
   writeSchedules(name, schedules);
   return c.json({ ok: true });
 }).delete("/:name/schedules/:id", requireAdmin, (c) => {
@@ -4312,11 +4854,11 @@ var app14 = new Hono14().get("/:name/schedules", (c) => {
     return c.json({ error: "Failed to reach mind" }, 502);
   }
 });
-var schedules_default = app14;
+var schedules_default = app16;
 
 // src/web/api/shared.ts
-import { Hono as Hono15 } from "hono";
-var app15 = new Hono15().post("/:name/shared/merge", requireAdmin, async (c) => {
+import { Hono as Hono17 } from "hono";
+var app17 = new Hono17().post("/:name/shared/merge", requireAdmin, async (c) => {
   const name = c.req.param("name");
   const entry = findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -4365,15 +4907,15 @@ var app15 = new Hono15().post("/:name/shared/merge", requireAdmin, async (c) =>
     return c.json({ error: err instanceof Error ? err.message : "Failed to get status" }, 500);
   }
 });
-var shared_default = app15;
+var shared_default = app17;
 
 // src/web/api/skills.ts
 import { existsSync as existsSync11, mkdtempSync, readdirSync as readdirSync5, rmSync as rmSync5 } from "fs";
 import { tmpdir } from "os";
-import { join as join2, resolve as resolve14 } from "path";
+import { join as join2, resolve as resolve15 } from "path";
 import AdmZip from "adm-zip";
-import { Hono as Hono16 } from "hono";
-var app16 = new Hono16().get("/", async (c) => {
+import { Hono as Hono18 } from "hono";
+var app18 = new Hono18().get("/", async (c) => {
   const skills = await listSharedSkills();
   return c.json(skills);
 }).get("/:id", async (c) => {
@@ -4397,7 +4939,7 @@ var app16 = new Hono16().get("/", async (c) => {
   try {
     const zip = new AdmZip(buffer2);
     for (const entry of zip.getEntries()) {
-      const target = resolve14(tmpDir, entry.entryName);
+      const target = resolve15(tmpDir, entry.entryName);
       if (!target.startsWith(tmpDir)) {
         return c.json({ error: "Invalid zip: paths must not escape archive" }, 400);
       }
@@ -4438,12 +4980,15 @@ var app16 = new Hono16().get("/", async (c) => {
   }
   return c.json({ ok: true });
 });
-var skills_default = app16;
+var skills_default = app18;
 
 // src/web/api/system.ts
-import { Hono as Hono17 } from "hono";
+import { zValidator as zValidator6 } from "@hono/zod-validator";
+import { Hono as Hono19 } from "hono";
 import { streamSSE as streamSSE3 } from "hono/streaming";
-var app17 = new Hono17().post("/restart", requireAdmin, (c) => {
+import { z as z6 } from "zod";
+var DEFAULT_API_URL = "https://volute.systems";
+var app19 = new Hono19().post("/restart", requireAdmin, (c) => {
   setTimeout(() => process.exit(1), 200);
   return c.json({ ok: true });
 }).post("/stop", requireAdmin, (c) => {
@@ -4460,29 +5005,107 @@ var app17 = new Hono17().post("/restart", requireAdmin, (c) => {
       stream.writeSSE({ data: JSON.stringify(entry) }).catch(() => {
       });
     });
-    await new Promise((resolve19) => {
+    await new Promise((resolve20) => {
       stream.onAbort(() => {
         unsubscribe();
-        resolve19();
+        resolve20();
       });
     });
   });
 }).get("/info", (c) => {
   const config = readSystemsConfig();
   return c.json({ system: config?.system ?? null });
+}).post(
+  "/register",
+  requireAdmin,
+  zValidator6("json", z6.object({ name: z6.string().min(1) })),
+  async (c) => {
+    const existing = readSystemsConfig();
+    if (existing) {
+      return c.json({ error: `Already registered as "${existing.system}"` }, 400);
+    }
+    const { name } = c.req.valid("json");
+    const apiUrl = process.env.VOLUTE_SYSTEMS_URL || DEFAULT_API_URL;
+    let apiKey;
+    let system;
+    try {
+      const res = await fetch(`${apiUrl}/api/register`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ name: name.trim() })
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));
+        return c.json({ error: err.error }, 502);
+      }
+      ({ apiKey, system } = await res.json());
+    } catch (err) {
+      return c.json({ error: `Connection failed: ${err.message}` }, 502);
+    }
+    try {
+      writeSystemsConfig({ apiKey, system, apiUrl });
+    } catch (err) {
+      return c.json(
+        {
+          error: `Registered as "${system}" but failed to save config: ${err.message}`
+        },
+        500
+      );
+    }
+    return c.json({ system });
+  }
+).post(
+  "/login",
+  requireAdmin,
+  zValidator6("json", z6.object({ key: z6.string().min(1) })),
+  async (c) => {
+    const existing = readSystemsConfig();
+    if (existing) {
+      return c.json({ error: `Already logged in as "${existing.system}"` }, 400);
+    }
+    const { key } = c.req.valid("json");
+    const apiUrl = process.env.VOLUTE_SYSTEMS_URL || DEFAULT_API_URL;
+    let system;
+    try {
+      const res = await fetch(`${apiUrl}/api/whoami`, {
+        headers: { Authorization: `Bearer ${key.trim()}` }
+      });
+      if (!res.ok) {
+        const err = await res.json().catch(() => ({ error: `HTTP ${res.status}` }));
+        return c.json({ error: err.error }, 502);
+      }
+      ({ system } = await res.json());
+    } catch (err) {
+      return c.json({ error: `Connection failed: ${err.message}` }, 502);
+    }
+    try {
+      writeSystemsConfig({ apiKey: key.trim(), system, apiUrl });
+    } catch (err) {
+      return c.json(
+        {
+          error: `Logged in as "${system}" but failed to save config: ${err.message}`
+        },
+        500
+      );
+    }
+    return c.json({ system });
+  }
+).post("/logout", requireAdmin, (c) => {
+  deleteSystemsConfig();
+  return c.json({ ok: true });
 });
-var system_default = app17;
+var system_default = app19;
 
 // src/web/api/typing.ts
-import { zValidator as zValidator5 } from "@hono/zod-validator";
-import { Hono as Hono18 } from "hono";
-import { z as z5 } from "zod";
-var typingSchema = z5.object({
-  channel: z5.string().min(1),
-  sender: z5.string().min(1),
-  active: z5.boolean()
+import { zValidator as zValidator7 } from "@hono/zod-validator";
+import { Hono as Hono20 } from "hono";
+import { z as z7 } from "zod";
+var typingSchema = z7.object({
+  channel: z7.string().min(1),
+  sender: z7.string().min(1),
+  active: z7.boolean()
 });
-var app18 = new Hono18().post("/:name/typing", zValidator5("json", typingSchema), (c) => {
+var app20 = new Hono20().post("/:name/typing", zValidator7("json", typingSchema), (c) => {
   const { channel, sender, active } = c.req.valid("json");
   const map = getTypingMap();
   if (active) {
@@ -4493,7 +5116,7 @@ var app18 = new Hono18().post("/:name/typing", zValidator5("json", typingSchema)
   const volutePrefix = "volute:";
   if (channel.startsWith(volutePrefix)) {
     const conversationId = channel.slice(volutePrefix.length);
-    publish2(conversationId, { type: "typing", senders: map.get(channel) });
+    publish(conversationId, { type: "typing", senders: map.get(channel) });
   }
   return c.json({ ok: true });
 }).get("/:name/typing", (c) => {
@@ -4504,13 +5127,13 @@ var app18 = new Hono18().post("/:name/typing", zValidator5("json", typingSchema)
   const map = getTypingMap();
   return c.json({ typing: map.get(channel) });
 });
-var typing_default = app18;
+var typing_default = app20;
 
 // src/web/api/update.ts
 import { spawn as spawn2 } from "child_process";
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono21 } from "hono";
 var bin;
-var app19 = new Hono19().get("/update", async (c) => {
+var app21 = new Hono21().get("/update", async (c) => {
   const result = await checkForUpdate();
   return c.json(result);
 }).post("/update", requireAdmin, async (c) => {
@@ -4525,21 +5148,21 @@ var app19 = new Hono19().get("/update", async (c) => {
   child.unref();
   return c.json({ ok: true, message: "Updating..." });
 });
-var update_default = app19;
+var update_default = app21;
 
 // src/web/api/v1/chat.ts
-import { zValidator as zValidator6 } from "@hono/zod-validator";
-import { Hono as Hono20 } from "hono";
+import { zValidator as zValidator8 } from "@hono/zod-validator";
+import { Hono as Hono22 } from "hono";
 import { streamSSE as streamSSE4 } from "hono/streaming";
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 async function fanOutToMinds(opts) {
   const participants = await getParticipants(opts.conversationId);
   const mindParticipants = participants.filter((p) => p.userType === "mind");
   const participantNames = participants.map((p) => p.username);
   const isDM = opts.isDM ?? participants.length === 2;
   const channelEntryType = opts.channelEntryType ?? (isDM ? "dm" : "group");
-  const { getMindManager: getMindManager2 } = await import("./mind-manager-ZNRIYEK3.js");
-  const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+  const { getMindManager: getMindManager2 } = await import("./mind-manager-VVK67AY3.js");
+  const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
   const manager = getMindManager2();
   const sm = getSleepManagerIfReady();
   const targetMinds = mindParticipants.map((ap) => {
@@ -4588,18 +5211,18 @@ async function fanOutToMinds(opts) {
     });
   }
 }
-var mindChatSchema = z6.object({
-  message: z6.string().optional(),
-  conversationId: z6.string().optional(),
-  sender: z6.string().optional(),
-  images: z6.array(z6.object({ media_type: z6.string(), data: z6.string() })).optional()
+var mindChatSchema = z8.object({
+  message: z8.string().optional(),
+  conversationId: z8.string().optional(),
+  sender: z8.string().optional(),
+  images: z8.array(z8.object({ media_type: z8.string(), data: z8.string() })).optional()
 });
-var unifiedChatSchema = z6.object({
-  message: z6.string().optional(),
-  conversationId: z6.string(),
-  images: z6.array(z6.object({ media_type: z6.string(), data: z6.string() })).optional()
+var unifiedChatSchema = z8.object({
+  message: z8.string().optional(),
+  conversationId: z8.string(),
+  images: z8.array(z8.object({ media_type: z8.string(), data: z8.string() })).optional()
 });
-var app20 = new Hono20().use("*", authMiddleware).post("/minds/:name/chat", zValidator6("json", mindChatSchema), async (c) => {
+var app22 = new Hono22().use("*", authMiddleware).post("/minds/:name/chat", zValidator8("json", mindChatSchema), async (c) => {
   const name = c.req.param("name");
   const [baseName] = name.split("@", 2);
   const entry = findMind(baseName);
@@ -4672,7 +5295,7 @@ var app20 = new Hono20().use("*", authMiddleware).post("/minds/:name/chat", zVal
     return c.json({ error: "Conversation not found" }, 404);
   }
   return streamSSE4(c, async (stream) => {
-    const unsubscribe = subscribe3(conversationId, (event) => {
+    const unsubscribe = subscribe2(conversationId, (event) => {
       stream.writeSSE({ data: JSON.stringify(event) }).catch((err) => {
         if (!stream.aborted) logger_default.error("[v1-chat] SSE write error:", logger_default.errorData(err));
       });
@@ -4682,15 +5305,15 @@ var app20 = new Hono20().use("*", authMiddleware).post("/minds/:name/chat", zVal
         if (!stream.aborted) logger_default.error("[v1-chat] SSE ping error:", logger_default.errorData(err));
       });
     }, 15e3);
-    await new Promise((resolve19) => {
+    await new Promise((resolve20) => {
       stream.onAbort(() => {
         unsubscribe();
         clearInterval(keepAlive);
-        resolve19();
+        resolve20();
       });
     });
   });
-}).post("/chat", zValidator6("json", unifiedChatSchema), async (c) => {
+}).post("/chat", zValidator8("json", unifiedChatSchema), async (c) => {
   const user = c.get("user");
   const body = c.req.valid("json");
   if (!body.message && (!body.images || body.images.length === 0)) {
@@ -4722,17 +5345,17 @@ var app20 = new Hono20().use("*", authMiddleware).post("/minds/:name/chat", zVal
   });
   return c.json({ ok: true, conversationId: body.conversationId });
 });
-var chat_default = app20;
+var chat_default = app22;
 
 // src/web/api/v1/conversations.ts
-import { zValidator as zValidator7 } from "@hono/zod-validator";
-import { Hono as Hono21 } from "hono";
-import { z as z7 } from "zod";
-var createSchema = z7.object({
-  title: z7.string().optional(),
-  participantNames: z7.array(z7.string()).min(1)
+import { zValidator as zValidator9 } from "@hono/zod-validator";
+import { Hono as Hono23 } from "hono";
+import { z as z9 } from "zod";
+var createSchema2 = z9.object({
+  title: z9.string().optional(),
+  participantNames: z9.array(z9.string()).min(1)
 });
-var app21 = new Hono21().use("*", authMiddleware).get("/", async (c) => {
+var app23 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
   const user = c.get("user");
   const convs = await listConversationsWithParticipants(user.id);
   return c.json(convs);
@@ -4763,7 +5386,7 @@ var app21 = new Hono21().use("*", authMiddleware).get("/", async (c) => {
   }
   const participants = await getParticipants(id);
   return c.json(participants);
-}).post("/", zValidator7("json", createSchema), async (c) => {
+}).post("/", zValidator9("json", createSchema2), async (c) => {
   const user = c.get("user");
   const body = c.req.valid("json");
   const participantIds = /* @__PURE__ */ new Set();
@@ -4809,30 +5432,30 @@ var app21 = new Hono21().use("*", authMiddleware).get("/", async (c) => {
   if (!deleted) return c.json({ error: "Conversation not found" }, 404);
   return c.json({ ok: true });
 });
-var conversations_default = app21;
+var conversations_default = app23;
 
 // src/web/api/v1/events.ts
-import { desc as desc3 } from "drizzle-orm";
-import { Hono as Hono22 } from "hono";
+import { desc as desc4 } from "drizzle-orm";
+import { Hono as Hono24 } from "hono";
 import { streamSSE as streamSSE5 } from "hono/streaming";
 
 // src/lib/events/brain-presence.ts
 var connections = /* @__PURE__ */ new Map();
 function addConnection(username) {
-  const count = connections.get(username) ?? 0;
-  connections.set(username, count + 1);
-  if (count === 0) {
+  const count2 = connections.get(username) ?? 0;
+  connections.set(username, count2 + 1);
+  if (count2 === 0) {
     broadcast({ type: "brain_online", mind: username, summary: `${username} connected` });
   }
 }
 function removeConnection(username) {
-  const count = connections.get(username);
-  if (count == null) return;
-  if (count <= 1) {
+  const count2 = connections.get(username);
+  if (count2 == null) return;
+  if (count2 <= 1) {
     connections.delete(username);
     broadcast({ type: "brain_offline", mind: username, summary: `${username} disconnected` });
   } else {
-    connections.set(username, count - 1);
+    connections.set(username, count2 - 1);
   }
 }
 function getOnlineBrains() {
@@ -4860,7 +5483,7 @@ function getEventsSince(sinceId) {
 }
 
 // src/web/api/v1/events.ts
-var app22 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
+var app24 = new Hono24().use("*", authMiddleware).get("/", async (c) => {
   const user = c.get("user");
   const since = c.req.query("since");
   const sinceId = since ? Number(since) : 0;
@@ -4883,7 +5506,7 @@ var app22 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
       let recentActivity = [];
       try {
         const db = await getDb();
-        recentActivity = await db.select().from(activity).orderBy(desc3(activity.created_at)).limit(50);
+        recentActivity = await db.select().from(activity).orderBy(desc4(activity.created_at)).limit(50);
         recentActivity = recentActivity.map((row) => ({
           ...row,
           metadata: row.metadata ? JSON.parse(row.metadata) : null
@@ -4936,7 +5559,7 @@ var app22 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
       });
       cleanups.push(unsubActivity);
       for (const conv of conversations2) {
-        const unsubConv = subscribe3(conv.id, (event) => {
+        const unsubConv = subscribe2(conv.id, (event) => {
           const data = { event: "conversation", conversationId: conv.id, ...event };
           const eventId = bufferEvent(data);
           stream.writeSSE({
@@ -4954,8 +5577,8 @@ var app22 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve19) => {
-        stream.onAbort(() => resolve19());
+      await new Promise((resolve20) => {
+        stream.onAbort(() => resolve20());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -4967,19 +5590,19 @@ var app22 = new Hono22().use("*", authMiddleware).get("/", async (c) => {
     }
   });
 });
-var events_default = app22;
+var events_default = app24;
 
 // src/web/api/variants.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve16 } from "path";
-import { Hono as Hono23 } from "hono";
+import { resolve as resolve17 } from "path";
+import { Hono as Hono25 } from "hono";
 
 // src/lib/spawn-server.ts
 import { spawn as spawn3 } from "child_process";
 import { closeSync, mkdirSync as mkdirSync7, openSync, readFileSync as readFileSync10 } from "fs";
-import { resolve as resolve15 } from "path";
+import { resolve as resolve16 } from "path";
 function tsxBin(cwd) {
-  return resolve15(cwd, "node_modules", ".bin", "tsx");
+  return resolve16(cwd, "node_modules", ".bin", "tsx");
 }
 function spawnServer(cwd, port, options) {
   if (options?.detached) {
@@ -4992,31 +5615,31 @@ function spawnAttached(cwd, port) {
     cwd,
     stdio: ["ignore", "pipe", "pipe"]
   });
-  return new Promise((resolve19) => {
-    const timeout = setTimeout(() => resolve19(null), 3e4);
+  return new Promise((resolve20) => {
+    const timeout = setTimeout(() => resolve20(null), 3e4);
     function checkOutput(data) {
       const match = data.toString().match(/listening on :(\d+)/);
       if (match) {
         clearTimeout(timeout);
-        resolve19({ child, actualPort: parseInt(match[1], 10) });
+        resolve20({ child, actualPort: parseInt(match[1], 10) });
       }
     }
     child.stdout?.on("data", checkOutput);
     child.stderr?.on("data", checkOutput);
     child.on("error", () => {
       clearTimeout(timeout);
-      resolve19(null);
+      resolve20(null);
     });
     child.on("exit", () => {
       clearTimeout(timeout);
-      resolve19(null);
+      resolve20(null);
     });
   });
 }
 function spawnDetached(cwd, port, logDir) {
-  const logsDir = logDir ?? resolve15(cwd, ".mind", "logs");
+  const logsDir = logDir ?? resolve16(cwd, ".mind", "logs");
   mkdirSync7(logsDir, { recursive: true });
-  const logPath = resolve15(logsDir, "mind.log");
+  const logPath = resolve16(logsDir, "mind.log");
   const logFd = openSync(logPath, "a");
   const child = spawn3(tsxBin(cwd), ["src/server.ts", "--port", String(port)], {
     cwd,
@@ -5088,7 +5711,7 @@ async function verify2(port) {
 }
 
 // src/web/api/variants.ts
-var app23 = new Hono23().get("/:name/variants", async (c) => {
+var app25 = new Hono25().get("/:name/variants", async (c) => {
   const name = c.req.param("name");
   const entry = findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5128,11 +5751,11 @@ var app23 = new Hono23().get("/:name/variants", async (c) => {
   const err = validateBranchName(variantName);
   if (err) return c.json({ error: err }, 400);
   const projectRoot = mindDir(mindName);
-  const variantDir = resolve16(projectRoot, ".variants", variantName);
+  const variantDir = resolve17(projectRoot, ".variants", variantName);
   if (existsSync12(variantDir)) {
     return c.json({ error: `Variant directory already exists: ${variantDir}` }, 409);
   }
-  mkdirSync8(resolve16(projectRoot, ".variants"), { recursive: true });
+  mkdirSync8(resolve17(projectRoot, ".variants"), { recursive: true });
   try {
     await gitExec(["worktree", "add", "-b", variantName, variantDir], { cwd: projectRoot });
   } catch (e) {
@@ -5145,7 +5768,7 @@ var app23 = new Hono23().get("/:name/variants", async (c) => {
       const [cmd, args] = wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: variantDir,
-        env: { ...process.env, HOME: resolve16(variantDir, "home") }
+        env: { ...process.env, HOME: resolve17(variantDir, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: variantDir });
@@ -5155,7 +5778,7 @@ var app23 = new Hono23().get("/:name/variants", async (c) => {
     return c.json({ error: `npm install failed: ${msg}` }, 500);
   }
   if (body.soul) {
-    writeFileSync8(resolve16(variantDir, "home/SOUL.md"), body.soul);
+    writeFileSync8(resolve17(variantDir, "home/SOUL.md"), body.soul);
   }
   const variantPort = body.port ?? nextPort();
   const variant = {
@@ -5266,7 +5889,7 @@ var app23 = new Hono23().get("/:name/variants", async (c) => {
       const [cmd, args] = wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: projectRoot,
-        env: { ...process.env, HOME: resolve16(projectRoot, "home") }
+        env: { ...process.env, HOME: resolve17(projectRoot, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: projectRoot });
@@ -5304,19 +5927,19 @@ var app23 = new Hono23().get("/:name/variants", async (c) => {
   await cleanupVariant(mindName, variantName, projectRoot, variant.path, { stop: true });
   return c.json({ ok: true });
 });
-var variants_default = app23;
+var variants_default = app25;
 
 // src/web/api/volute/channels.ts
-import { zValidator as zValidator8 } from "@hono/zod-validator";
-import { Hono as Hono24 } from "hono";
-import { z as z8 } from "zod";
-var createSchema2 = z8.object({
-  name: z8.string().min(1).max(50).regex(/^[a-z0-9][a-z0-9-]*$/, "Channel names must be lowercase alphanumeric with hyphens")
+import { zValidator as zValidator10 } from "@hono/zod-validator";
+import { Hono as Hono26 } from "hono";
+import { z as z10 } from "zod";
+var createSchema3 = z10.object({
+  name: z10.string().min(1).max(50).regex(/^[a-z0-9][a-z0-9-]*$/, "Channel names must be lowercase alphanumeric with hyphens")
 });
-var inviteSchema = z8.object({
-  username: z8.string().min(1)
+var inviteSchema = z10.object({
+  username: z10.string().min(1)
 });
-var app24 = new Hono24().get("/", async (c) => {
+var app26 = new Hono26().get("/", async (c) => {
   const user = c.get("user");
   const channels = await listChannels();
   const results = await Promise.all(
@@ -5327,7 +5950,7 @@ var app24 = new Hono24().get("/", async (c) => {
     })
   );
   return c.json(results);
-}).post("/", zValidator8("json", createSchema2), async (c) => {
+}).post("/", zValidator10("json", createSchema3), async (c) => {
   const user = c.get("user");
   const body = c.req.valid("json");
   try {
@@ -5360,7 +5983,7 @@ var app24 = new Hono24().get("/", async (c) => {
   if (!ch) return c.json({ error: "Channel not found" }, 404);
   const participants = await getParticipants(ch.id);
   return c.json(participants);
-}).post("/:name/invite", zValidator8("json", inviteSchema), async (c) => {
+}).post("/:name/invite", zValidator10("json", inviteSchema), async (c) => {
   const name = c.req.param("name");
   const inviter = c.get("user");
   const { username } = c.req.valid("json");
@@ -5380,21 +6003,21 @@ var app24 = new Hono24().get("/", async (c) => {
   ]);
   return c.json({ ok: true });
 });
-var channels_default2 = app24;
+var channels_default2 = app26;
 
 // src/web/api/volute/chat.ts
-import { zValidator as zValidator9 } from "@hono/zod-validator";
-import { Hono as Hono25 } from "hono";
+import { zValidator as zValidator11 } from "@hono/zod-validator";
+import { Hono as Hono27 } from "hono";
 import { streamSSE as streamSSE6 } from "hono/streaming";
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 async function fanOutToMinds2(opts) {
   const participants = await getParticipants(opts.conversationId);
   const mindParticipants = participants.filter((p) => p.userType === "mind");
   const participantNames = participants.map((p) => p.username);
   const isDM = opts.isDM ?? participants.length === 2;
   const channelEntryType = opts.channelEntryType ?? (isDM ? "dm" : "group");
-  const { getMindManager: getMindManager2 } = await import("./mind-manager-ZNRIYEK3.js");
-  const { getSleepManagerIfReady } = await import("./sleep-manager-XXSWQQLE.js");
+  const { getMindManager: getMindManager2 } = await import("./mind-manager-VVK67AY3.js");
+  const { getSleepManagerIfReady } = await import("./sleep-manager-EE4NRN2Q.js");
   const manager = getMindManager2();
   const sm = getSleepManagerIfReady();
   const targetMinds = mindParticipants.map((ap) => {
@@ -5442,18 +6065,18 @@ async function fanOutToMinds2(opts) {
     });
   }
 }
-var chatSchema = z9.object({
-  message: z9.string().optional(),
-  conversationId: z9.string().optional(),
-  sender: z9.string().optional(),
-  images: z9.array(
-    z9.object({
-      media_type: z9.string(),
-      data: z9.string()
+var chatSchema = z11.object({
+  message: z11.string().optional(),
+  conversationId: z11.string().optional(),
+  sender: z11.string().optional(),
+  images: z11.array(
+    z11.object({
+      media_type: z11.string(),
+      data: z11.string()
     })
   ).optional()
 });
-var app25 = new Hono25().post("/:name/chat", zValidator9("json", chatSchema), async (c) => {
+var app27 = new Hono27().post("/:name/chat", zValidator11("json", chatSchema), async (c) => {
   const name = c.req.param("name");
   const [baseName] = name.split("@", 2);
   const entry = findMind(baseName);
@@ -5530,7 +6153,7 @@ var app25 = new Hono25().post("/:name/chat", zValidator9("json", chatSchema), as
     return c.json({ error: "Conversation not found" }, 404);
   }
   return streamSSE6(c, async (stream) => {
-    const unsubscribe = subscribe3(conversationId, (event) => {
+    const unsubscribe = subscribe2(conversationId, (event) => {
       stream.writeSSE({ data: JSON.stringify(event) }).catch((err) => {
         if (!stream.aborted) console.error("[chat] SSE write error:", err);
       });
@@ -5540,23 +6163,23 @@ var app25 = new Hono25().post("/:name/chat", zValidator9("json", chatSchema), as
         if (!stream.aborted) console.error("[chat] SSE ping error:", err);
       });
     }, 15e3);
-    await new Promise((resolve19) => {
+    await new Promise((resolve20) => {
       stream.onAbort(() => {
         unsubscribe();
         clearInterval(keepAlive);
-        resolve19();
+        resolve20();
       });
     });
   });
 });
-var unifiedChatSchema2 = z9.object({
-  message: z9.string().optional(),
-  conversationId: z9.string(),
-  images: z9.array(z9.object({ media_type: z9.string(), data: z9.string() })).optional()
+var unifiedChatSchema2 = z11.object({
+  message: z11.string().optional(),
+  conversationId: z11.string(),
+  images: z11.array(z11.object({ media_type: z11.string(), data: z11.string() })).optional()
 });
-var unifiedChatApp = new Hono25().post(
+var unifiedChatApp = new Hono27().post(
   "/chat",
-  zValidator9("json", unifiedChatSchema2),
+  zValidator11("json", unifiedChatSchema2),
   async (c) => {
     const user = c.get("user");
     const body = c.req.valid("json");
@@ -5590,18 +6213,18 @@ var unifiedChatApp = new Hono25().post(
     return c.json({ ok: true, conversationId: body.conversationId });
   }
 );
-var chat_default2 = app25;
+var chat_default2 = app27;
 
 // src/web/api/volute/conversations.ts
-import { zValidator as zValidator10 } from "@hono/zod-validator";
-import { Hono as Hono26 } from "hono";
-import { z as z10 } from "zod";
-var createConvSchema = z10.object({
-  title: z10.string().optional(),
-  participantIds: z10.array(z10.number()).optional(),
-  participantNames: z10.array(z10.string()).optional()
+import { zValidator as zValidator12 } from "@hono/zod-validator";
+import { Hono as Hono28 } from "hono";
+import { z as z12 } from "zod";
+var createConvSchema = z12.object({
+  title: z12.string().optional(),
+  participantIds: z12.array(z12.number()).optional(),
+  participantNames: z12.array(z12.string()).optional()
 });
-var app26 = new Hono26().get("/:name/conversations", async (c) => {
+var app28 = new Hono28().get("/:name/conversations", async (c) => {
   const name = c.req.param("name");
   const user = c.get("user");
   let lookupId = user.id;
@@ -5612,7 +6235,7 @@ var app26 = new Hono26().get("/:name/conversations", async (c) => {
   const all = await listConversationsForUser(lookupId);
   const convs = all.filter((c2) => c2.mind_name === name || c2.type === "channel");
   return c.json(convs);
-}).post("/:name/conversations", zValidator10("json", createConvSchema), async (c) => {
+}).post("/:name/conversations", zValidator12("json", createConvSchema), async (c) => {
   const name = c.req.param("name");
   const user = c.get("user");
   const body = c.req.valid("json");
@@ -5686,18 +6309,18 @@ var app26 = new Hono26().get("/:name/conversations", async (c) => {
   if (!deleted) return c.json({ error: "Conversation not found" }, 404);
   return c.json({ ok: true });
 });
-var conversations_default2 = app26;
+var conversations_default2 = app28;
 
 // src/web/api/volute/user-conversations.ts
-import { zValidator as zValidator11 } from "@hono/zod-validator";
-import { Hono as Hono27 } from "hono";
+import { zValidator as zValidator13 } from "@hono/zod-validator";
+import { Hono as Hono29 } from "hono";
 import { streamSSE as streamSSE7 } from "hono/streaming";
-import { z as z11 } from "zod";
-var createSchema3 = z11.object({
-  title: z11.string().optional(),
-  participantNames: z11.array(z11.string()).min(1)
+import { z as z13 } from "zod";
+var createSchema4 = z13.object({
+  title: z13.string().optional(),
+  participantNames: z13.array(z13.string()).min(1)
 });
-var app27 = new Hono27().use("*", authMiddleware).get("/", async (c) => {
+var app29 = new Hono29().use("*", authMiddleware).get("/", async (c) => {
   const user = c.get("user");
   const convs = await listConversationsWithParticipants(user.id);
   return c.json(convs);
@@ -5709,7 +6332,7 @@ var app27 = new Hono27().use("*", authMiddleware).get("/", async (c) => {
   }
   const msgs = await getMessages(id);
   return c.json(msgs);
-}).post("/", zValidator11("json", createSchema3), async (c) => {
+}).post("/", zValidator13("json", createSchema4), async (c) => {
   const user = c.get("user");
   const body = c.req.valid("json");
   const participantIds = /* @__PURE__ */ new Set();
@@ -5746,7 +6369,7 @@ var app27 = new Hono27().use("*", authMiddleware).get("/", async (c) => {
     return c.json({ error: "Conversation not found" }, 404);
   }
   return streamSSE7(c, async (stream) => {
-    const unsubscribe = subscribe3(conversationId, (event) => {
+    const unsubscribe = subscribe2(conversationId, (event) => {
       stream.writeSSE({ data: JSON.stringify(event) }).catch((err) => {
         if (!stream.aborted) console.error("[chat] SSE write error:", err);
       });
@@ -5756,11 +6379,11 @@ var app27 = new Hono27().use("*", authMiddleware).get("/", async (c) => {
         if (!stream.aborted) console.error("[chat] SSE ping error:", err);
       });
     }, 15e3);
-    await new Promise((resolve19) => {
+    await new Promise((resolve20) => {
       stream.onAbort(() => {
         unsubscribe();
         clearInterval(keepAlive);
-        resolve19();
+        resolve20();
       });
     });
   });
@@ -5771,12 +6394,12 @@ var app27 = new Hono27().use("*", authMiddleware).get("/", async (c) => {
   if (!deleted) return c.json({ error: "Conversation not found" }, 404);
   return c.json({ ok: true });
 });
-var user_conversations_default = app27;
+var user_conversations_default = app29;
 
 // src/web/app.ts
 var httpLog = logger_default.child("http");
-var app28 = new Hono28();
-app28.onError((err, c) => {
+var app30 = new Hono30();
+app30.onError((err, c) => {
   if (err instanceof HTTPException) {
     return err.getResponse();
   }
@@ -5787,10 +6410,10 @@ app28.onError((err, c) => {
   });
   return c.json({ error: "Internal server error" }, 500);
 });
-app28.notFound((c) => {
+app30.notFound((c) => {
   return c.json({ error: "Not found" }, 404);
 });
-app28.use("*", async (c, next) => {
+app30.use("*", async (c, next) => {
   const start = Date.now();
   await next();
   const duration = Date.now() - start;
@@ -5801,7 +6424,7 @@ app28.use("*", async (c, next) => {
     httpLog.debug("request", data);
   }
 });
-app28.get("/api/health", (c) => {
+app30.get("/api/health", (c) => {
   let version = "unknown";
   let cached = null;
   try {
@@ -5816,38 +6439,40 @@ app28.get("/api/health", (c) => {
     ...cached?.updateAvailable ? { updateAvailable: true, latest: cached.latest } : {}
   });
 });
-app28.use("/api/*", bodyLimit({ maxSize: 10 * 1024 * 1024 }));
-app28.use("/api/*", csrf());
-app28.use("/api/activity/*", authMiddleware);
-app28.use("/api/minds/*", authMiddleware);
-app28.use("/api/conversations/*", authMiddleware);
-app28.use("/api/volute/*", authMiddleware);
-app28.use("/api/system/*", authMiddleware);
-app28.use("/api/env/*", authMiddleware);
-app28.use("/api/prompts/*", authMiddleware);
-app28.use("/api/skills/*", authMiddleware);
-app28.use("/api/v1/*", authMiddleware);
-app28.route("/pages", pages_default);
-var routes = app28.route("/api/activity", activity_default).route("/api/keys", keys_default).route("/api/auth", auth_default).route("/api/system", system_default).route("/api/system", update_default).route("/api/minds", minds_default).route("/api/minds", chat_default2).route("/api/minds", connectors_default).route("/api/minds", schedules_default).route("/api/minds", logs_default).route("/api/minds", typing_default).route("/api/minds", variants_default).route("/api/minds", file_sharing_default).route("/api/minds", files_default).route("/api/minds", channels_default).route("/api/minds", shared_default).route("/api/minds", env_default).route("/api/minds", mind_skills_default).route("/api/minds", conversations_default2).route("/api/env", sharedEnvApp).route("/api/prompts", prompts_default).route("/api/skills", skills_default).route("/api/conversations", user_conversations_default).route("/api/volute/channels", channels_default2).route("/api/volute", unifiedChatApp).route("/api/v1/conversations", conversations_default).route("/api/v1/events", events_default).route("/api/v1", chat_default);
-app28.route("/api/v1/minds", minds_default);
-app28.route("/api/v1/minds", typing_default);
-app28.route("/api/v1/minds", variants_default);
-app28.route("/api/v1/minds", files_default);
-app28.route("/api/v1/minds", env_default);
-app28.route("/api/v1/minds", mind_skills_default);
-app28.route("/api/v1/minds", connectors_default);
-app28.route("/api/v1/minds", schedules_default);
-app28.route("/api/v1/minds", logs_default);
-app28.route("/api/v1/system", system_default);
-app28.route("/api/v1/system", update_default);
-app28.route("/api/v1/prompts", prompts_default);
-app28.route("/api/v1/skills", skills_default);
-app28.route("/api/v1/env", sharedEnvApp);
-app28.route("/api/v1/channels", channels_default2);
-var app_default = app28;
+app30.use("/api/*", bodyLimit({ maxSize: 10 * 1024 * 1024 }));
+app30.use("/api/*", csrf());
+app30.use("/api/activity/*", authMiddleware);
+app30.use("/api/minds/*", authMiddleware);
+app30.use("/api/conversations/*", authMiddleware);
+app30.use("/api/volute/*", authMiddleware);
+app30.use("/api/system/*", authMiddleware);
+app30.use("/api/env/*", authMiddleware);
+app30.use("/api/prompts/*", authMiddleware);
+app30.use("/api/skills/*", authMiddleware);
+app30.use("/api/notes/*", authMiddleware);
+app30.use("/api/v1/*", authMiddleware);
+app30.route("/pages", pages_default);
+app30.route("/public", public_files_default);
+var routes = app30.route("/api/activity", activity_default).route("/api/keys", keys_default).route("/api/auth", auth_default).route("/api/system", system_default).route("/api/system", update_default).route("/api/minds", minds_default).route("/api/minds", chat_default2).route("/api/minds", connectors_default).route("/api/minds", schedules_default).route("/api/minds", logs_default).route("/api/minds", typing_default).route("/api/minds", variants_default).route("/api/minds", file_sharing_default).route("/api/minds", files_default).route("/api/minds", channels_default).route("/api/minds", shared_default).route("/api/minds", env_default).route("/api/minds", mind_skills_default).route("/api/minds", conversations_default2).route("/api/env", sharedEnvApp).route("/api/notes", notes_default).route("/api/prompts", prompts_default).route("/api/skills", skills_default).route("/api/conversations", user_conversations_default).route("/api/volute/channels", channels_default2).route("/api/volute", unifiedChatApp).route("/api/v1/conversations", conversations_default).route("/api/v1/events", events_default).route("/api/v1", chat_default);
+app30.route("/api/v1/minds", minds_default);
+app30.route("/api/v1/minds", typing_default);
+app30.route("/api/v1/minds", variants_default);
+app30.route("/api/v1/minds", files_default);
+app30.route("/api/v1/minds", env_default);
+app30.route("/api/v1/minds", mind_skills_default);
+app30.route("/api/v1/minds", connectors_default);
+app30.route("/api/v1/minds", schedules_default);
+app30.route("/api/v1/minds", logs_default);
+app30.route("/api/v1/system", system_default);
+app30.route("/api/v1/system", update_default);
+app30.route("/api/v1/prompts", prompts_default);
+app30.route("/api/v1/skills", skills_default);
+app30.route("/api/v1/env", sharedEnvApp);
+app30.route("/api/v1/channels", channels_default2);
+var app_default = app30;
 
 // src/web/server.ts
-var MIME_TYPES2 = {
+var MIME_TYPES3 = {
   ".html": "text/html",
   ".js": "application/javascript",
   ".css": "text/css",
@@ -5864,7 +6489,7 @@ async function startServer({
   let assetsDir = "";
   let searchDir = dirname(new URL(import.meta.url).pathname);
   for (let i = 0; i < 5; i++) {
-    const candidate = resolve17(searchDir, "dist", "web-assets");
+    const candidate = resolve18(searchDir, "dist", "web-assets");
     if (existsSync13(candidate)) {
       assetsDir = candidate;
       break;
@@ -5875,19 +6500,19 @@ async function startServer({
     app_default.get("*", async (c) => {
       const urlPath = new URL(c.req.url).pathname;
       if (urlPath.startsWith("/api/")) return c.notFound();
-      const filePath = resolve17(assetsDir, urlPath.slice(1));
+      const filePath = resolve18(assetsDir, urlPath.slice(1));
       if (!filePath.startsWith(assetsDir)) return c.text("Forbidden", 403);
-      const s = await stat3(filePath).catch(() => null);
+      const s = await stat4(filePath).catch(() => null);
       if (s?.isFile()) {
-        const ext = extname4(filePath);
-        const mime = MIME_TYPES2[ext] || "application/octet-stream";
-        const body = await readFile3(filePath);
+        const ext = extname5(filePath);
+        const mime = MIME_TYPES3[ext] || "application/octet-stream";
+        const body = await readFile4(filePath);
         return c.body(body, 200, { "Content-Type": mime });
       }
-      const indexPath = resolve17(assetsDir, "index.html");
-      const indexStat = await stat3(indexPath).catch(() => null);
+      const indexPath = resolve18(assetsDir, "index.html");
+      const indexStat = await stat4(indexPath).catch(() => null);
       if (indexStat?.isFile()) {
-        const body = await readFile3(indexPath, "utf-8");
+        const body = await readFile4(indexPath, "utf-8");
         return c.html(body);
       }
       return c.text("Not found", 404);
@@ -5901,10 +6526,10 @@ async function startServer({
       createServer: createHttpsServer,
       serverOptions: { key: tls.key, cert: tls.cert }
     });
-    await new Promise((resolve19, reject) => {
+    await new Promise((resolve20, reject) => {
       server2.on("listening", () => {
         logger_default.info("Volute UI running (https)", { hostname, port });
-        resolve19();
+        resolve20();
       });
       server2.on("error", (err) => {
         reject(err);
@@ -5912,13 +6537,13 @@ async function startServer({
     });
     const internalPort = port + 1;
     const internalServer = serve({ fetch: app_default.fetch, port: internalPort, hostname: "127.0.0.1" });
-    await new Promise((resolve19, reject) => {
+    await new Promise((resolve20, reject) => {
       internalServer.on("listening", () => {
         logger_default.info("Volute API running (http, internal)", {
           hostname: "127.0.0.1",
           port: internalPort
         });
-        resolve19();
+        resolve20();
       });
       internalServer.on("error", (err) => {
         reject(err);
@@ -5927,10 +6552,10 @@ async function startServer({
     return { server: server2, internalPort };
   }
   const server = serve({ fetch: app_default.fetch, port, hostname });
-  await new Promise((resolve19, reject) => {
+  await new Promise((resolve20, reject) => {
     server.on("listening", () => {
       logger_default.info("Volute API running (http)", { hostname, port });
-      resolve19();
+      resolve20();
     });
     server.on("error", (err) => {
       reject(err);
@@ -5941,7 +6566,7 @@ async function startServer({
 
 // src/daemon.ts
 if (!process.env.VOLUTE_HOME) {
-  process.env.VOLUTE_HOME = resolve18(homedir2(), ".volute");
+  process.env.VOLUTE_HOME = resolve19(homedir2(), ".volute");
 }
 if (process.env.VOLUTE_TIMEZONE && !process.env.TZ) {
   process.env.TZ = process.env.VOLUTE_TIMEZONE;
@@ -5951,7 +6576,7 @@ async function startDaemon(opts) {
   const myPid = String(process.pid);
   const home = voluteHome();
   if (!opts.foreground) {
-    const rotatingLog = new RotatingLog(resolve18(home, "daemon.log"));
+    const rotatingLog = new RotatingLog(resolve19(home, "daemon.log"));
     logger_default.setOutput((line) => rotatingLog.write(`${line}
 `));
     const write = (...args) => rotatingLog.write(`${format(...args)}
@@ -5961,8 +6586,8 @@ async function startDaemon(opts) {
     console.warn = write;
     console.info = write;
   }
-  const DAEMON_PID_PATH = resolve18(home, "daemon.pid");
-  const DAEMON_JSON_PATH = resolve18(home, "daemon.json");
+  const DAEMON_PID_PATH = resolve19(home, "daemon.pid");
+  const DAEMON_JSON_PATH = resolve19(home, "daemon.json");
   mkdirSync9(home, { recursive: true });
   migrateAgentsToMinds();
   try {
@@ -5971,11 +6596,18 @@ async function startDaemon(opts) {
     logger_default.warn("failed to initialize shared repo", logger_default.errorData(err));
   }
   initRegistryCache();
+  const { initSandbox } = await import("./sandbox-EHGFF52K.js");
+  await initSandbox();
   try {
     await syncBuiltinSkills();
   } catch (err) {
     logger_default.error("failed to sync built-in skills", logger_default.errorData(err));
   }
+  try {
+    await ensureSystemChannel();
+  } catch (err) {
+    logger_default.warn("failed to ensure #system channel", logger_default.errorData(err));
+  }
   const token = process.env.VOLUTE_DAEMON_TOKEN || randomBytes2(32).toString("hex");
   let tls;
   if (opts.tailscale) {
@@ -6021,11 +6653,12 @@ async function startDaemon(opts) {
   const unsubscribeWebhook = initWebhook();
   const registry = readRegistry();
   for (const entry of registry) {
-    try {
-      migrateDotVoluteDir(entry.name);
-      migrateMindState(entry.name);
-    } catch (err) {
-      logger_default.warn(`failed to migrate state for ${entry.name}`, logger_default.errorData(err));
+    for (const migrate of [migrateDotVoluteDir, migrateMindState, migratePagesDirToPublic]) {
+      try {
+        migrate(entry.name);
+      } catch (err) {
+        logger_default.warn(`failed to migrate state for ${entry.name}`, logger_default.errorData(err));
+      }
     }
   }
   const runningEntries = registry.filter((e) => e.running);
@@ -6075,7 +6708,7 @@ async function startDaemon(opts) {
     });
     await Promise.all(workers);
   }
-  import("./cloud-sync-DIU3OCPV.js").then(
+  import("./cloud-sync-NI2K3C7G.js").then(
     ({ consumeQueuedMessages }) => consumeQueuedMessages().catch((err) => {
       logger_default.warn("failed to consume queued cloud messages", logger_default.errorData(err));
     })
@@ -6083,7 +6716,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to load cloud-sync module", logger_default.errorData(err));
   });
   try {
-    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-SZ75QRGO.js");
+    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-USFZBWMG.js");
     backfillTemplateHashes();
     notifyVersionUpdate().catch((err) => {
       logger_default.warn("failed to send version update notifications", logger_default.errorData(err));
@@ -6097,6 +6730,9 @@ async function startDaemon(opts) {
   cleanExpiredSessions().catch((err) => {
     logger_default.warn("failed to clean expired sessions", logger_default.errorData(err));
   });
+  migrateMindRoles().catch((err) => {
+    logger_default.warn("failed to migrate mind roles", logger_default.errorData(err));
+  });
   logger_default.info(`running on ${hostname}:${port}, pid ${myPid}`);
   function cleanup() {
     try {
@@ -6158,6 +6794,7 @@ if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith
   let hostname = "127.0.0.1";
   let foreground = false;
   let tailscale = false;
+  let noSandbox = false;
   for (let i = 2; i < process.argv.length; i++) {
     if (process.argv[i] === "--port" && process.argv[i + 1]) {
       port = parseInt(process.argv[i + 1], 10);
@@ -6169,8 +6806,13 @@ if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith
       foreground = true;
     } else if (process.argv[i] === "--tailscale") {
       tailscale = true;
+    } else if (process.argv[i] === "--no-sandbox") {
+      noSandbox = true;
     }
   }
+  if (noSandbox) {
+    process.env.VOLUTE_SANDBOX = "0";
+  }
   startDaemon({ port, hostname, foreground, tailscale });
 }
 export {