volute 0.40.0 → 0.40.2

package/dist/daemon.js

@@ -6,21 +6,21 @@ import {
   rejectPending,
   stageFile,
   validateFilePath
-} from "./chunk-DNQPHLGM.js";
+} from "./chunk-YHWGN4FX.js";
 import {
   findOpenClawSession,
   importOpenClawConnectors,
   importPiSession,
   parseNameFromIdentity
-} from "./chunk-HEZM5GCV.js";
+} from "./chunk-SVXOBKQY.js";
 import {
   checkForUpdate,
   checkForUpdateCached,
   getCurrentVersion
-} from "./chunk-FRJ73IWR.js";
+} from "./chunk-MNUXL4XN.js";
 import {
   isHomeOnlyArchive
-} from "./chunk-76Q6YLJL.js";
+} from "./chunk-I57LLNAQ.js";
 import {
   computeTemplateHash
 } from "./chunk-KAB6UGOL.js";
@@ -30,7 +30,7 @@ import {
   fixModelEscapes,
   getPlatformDriver,
   routeOutboundBridge
-} from "./chunk-JSITYTIL.js";
+} from "./chunk-WOWRLBL2.js";
 import {
   getBridgeConfig,
   readBridgesConfig,
@@ -39,35 +39,24 @@ import {
   resolveChannelMapping,
   setBridgeConfig,
   setChannelMapping
-} from "./chunk-S4YO5OWV.js";
+} from "./chunk-PKGA23XM.js";
 import {
-  PROMPT_DEFAULTS,
-  PROMPT_KEYS,
   RestartTracker,
   RotatingLog,
   announceToSystem,
-  assignSession,
   clearDeliveredNotices,
-  completeOrphanedTurns,
-  completeTurn,
-  createTurn,
   deleteSystemsConfig,
   deliverMessage,
   drainNotices,
   ensureSystemChannel,
   formatNotices,
   generateSystemReply,
-  getActiveTurnId,
   getAllDiscoveredExtensions,
   getAllDiscoveredExtensionsDetailed,
   getDeliveryManager,
   getExtensionStandardSkills,
-  getLastToolUseEventId,
   getLoadedExtensions,
   getMindManager,
-  getMindPromptDefaults,
-  getPrompt,
-  getPromptIfCustom,
   getScheduler,
   getSleepManagerIfReady,
   getTokenBudget,
@@ -77,17 +66,14 @@ import {
   initMindManager,
   initScheduler,
   initSleepManager,
-  initSummarizer,
   initTokenBudget,
   installNpmExtension,
   isConversationId,
   joinSystemChannel,
   linkToolResultToTurn,
   loadAllExtensions,
-  markErrored,
   notifyExtensionsDaemonStart,
   notifyExtensionsDaemonStop,
-  publish as publish2,
   publishTypingForChannels,
   readSystemsConfig,
   recordInbound,
@@ -97,27 +83,20 @@ import {
   setExtensionEnabled,
   startMindFull,
   stopMindFull,
-  subscribe as subscribe3,
-  subscribeAll,
-  substitute,
-  summarizeOrphanedTurns,
-  summarizeTurn,
   syncProviderToMinds,
   tagUntaggedInbound,
   tagUntaggedOutbound,
-  takeErrored,
-  trackToolUse,
   uninstallNpmExtension,
   writeSystemsConfig
-} from "./chunk-XUJR6NZW.js";
+} from "./chunk-ZOI6D2YH.js";
 import {
   loadMergedEnv,
   mindEnvPath,
   readEnv,
   sharedEnvPath,
   writeEnv
-} from "./chunk-HAJHDGBV.js";
-import "./chunk-WGRMLXTH.js";
+} from "./chunk-ITH5ZLZJ.js";
+import "./chunk-NRJ3ZYFP.js";
 import {
   applyInitFiles,
   composeTemplate,
@@ -144,7 +123,7 @@ import {
   syncBuiltinSkills,
   uninstallSkill,
   updateSkill
-} from "./chunk-T26YLQPU.js";
+} from "./chunk-UX7FPDDO.js";
 import {
   addMessage,
   createChannel,
@@ -176,25 +155,48 @@ import {
   setConversationPrivate,
   subscribe as subscribe2,
   updateChannelSettings
-} from "./chunk-B7YJUWMM.js";
+} from "./chunk-3Y7UDHO7.js";
 import {
   readVoluteConfig,
   writeVoluteConfig
 } from "./chunk-CU6OFXMM.js";
-import "./chunk-PIRL2HAO.js";
+import "./chunk-KMHC36CA.js";
 import {
   getActiveMinds,
   onMindEvent,
   stopAll
-} from "./chunk-RMZSICLS.js";
+} from "./chunk-42UMLIQR.js";
 import {
   extractTextContent
-} from "./chunk-PC55DGNX.js";
+} from "./chunk-NERYUSER.js";
+import {
+  PROMPT_DEFAULTS,
+  PROMPT_KEYS,
+  assignSession,
+  completeOrphanedTurns,
+  completeTurn,
+  createTurn,
+  getActiveTurnId,
+  getLastToolUseEventId,
+  getMindPromptDefaults,
+  getPrompt,
+  getPromptIfCustom,
+  initSummarizer,
+  markErrored,
+  publish as publish2,
+  subscribe as subscribe3,
+  subscribeAll,
+  substitute,
+  summarizeOrphanedTurns,
+  summarizeTurn,
+  takeErrored,
+  trackToolUse
+} from "./chunk-YMMYN2V3.js";
 import {
   exec,
   gitExec,
   resolveVoluteBin
-} from "./chunk-3XSFMN3H.js";
+} from "./chunk-AEAZRTEV.js";
 import {
   chownMindDir,
   createMindUser,
@@ -202,7 +204,7 @@ import {
   ensureVoluteGroup,
   isIsolationEnabled,
   wrapForIsolation
-} from "./chunk-FBV22PFY.js";
+} from "./chunk-6SYHHEQ7.js";
 import {
   getAiConfig,
   getAvailableModels,
@@ -219,12 +221,12 @@ import {
   setProviderRefreshHook,
   setUtilityModel,
   unqualifyModelId
-} from "./chunk-PGX52NFO.js";
+} from "./chunk-ZXPWTH4I.js";
 import {
   isSetupComplete,
   readGlobalConfig,
   writeGlobalConfig
-} from "./chunk-2AQCEQYN.js";
+} from "./chunk-DNU6XLE2.js";
 import {
   approveUser,
   changePassword,
@@ -243,11 +245,11 @@ import {
   syncMindProfile,
   updateUserProfile,
   verifyUser
-} from "./chunk-PHR4XQPL.js";
+} from "./chunk-E25SO3QW.js";
 import {
   broadcast,
   subscribe
-} from "./chunk-5VBXKFPO.js";
+} from "./chunk-QYI65HCL.js";
 import {
   logBuffer,
   logger_default
@@ -277,7 +279,7 @@ import {
   validateMindName,
   voluteHome,
   voluteSystemDir
-} from "./chunk-PDSA3ILI.js";
+} from "./chunk-B4WPXYPI.js";
 import {
   activity,
   channels,
@@ -289,14 +291,14 @@ import {
   systemPrompts,
   turns,
   users
-} from "./chunk-MHFAWJCC.js";
-import "./chunk-K3NQKI34.js";
+} from "./chunk-2HZRJ35V.js";
+import "./chunk-LMMQX4CK.js";
 
 // packages/daemon/src/daemon.ts
 import { randomBytes } from "crypto";
 import { mkdirSync as mkdirSync10, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 import { format } from "util";
 
 // packages/daemon/src/lib/daemon/bridge-manager.ts
@@ -506,8 +508,8 @@ var BridgeManager = class {
     if (!tracked) return;
     this.stopping.add(platform);
     this.bridges.delete(platform);
-    await new Promise((resolve17) => {
-      tracked.child.on("exit", () => resolve17());
+    await new Promise((resolve18) => {
+      tracked.child.on("exit", () => resolve18());
       try {
         if (tracked.child.pid) {
           process.kill(-tracked.child.pid, "SIGTERM");
@@ -518,7 +520,7 @@ var BridgeManager = class {
         if (err instanceof Error && err.code !== "ESRCH") {
           blog.warn(`failed to stop bridge ${platform}`, logger_default.errorData(err));
         }
-        resolve17();
+        resolve18();
       }
       setTimeout(() => {
         try {
@@ -529,7 +531,7 @@ var BridgeManager = class {
           }
         } catch {
         }
-        resolve17();
+        resolve18();
       }, 5e3);
     });
     this.stopping.delete(platform);
@@ -627,9 +629,9 @@ async function cleanExpiredLogs() {
 }
 
 // packages/daemon/src/web/api/system.ts
+import { getOAuthProvider, getOAuthProviders } from "@earendil-works/pi-ai/oauth";
+import { getBuiltinProviders } from "@earendil-works/pi-ai/providers/all";
 import { zValidator } from "@hono/zod-validator";
-import { getProviders } from "@mariozechner/pi-ai";
-import { getOAuthProvider, getOAuthProviders } from "@mariozechner/pi-ai/oauth";
 import { Hono } from "hono";
 import { streamSSE } from "hono/streaming";
 import { z } from "zod";
@@ -993,10 +995,10 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
       stream.writeSSE({ data: JSON.stringify(entry) }).catch(() => {
       });
     });
-    await new Promise((resolve17) => {
+    await new Promise((resolve18) => {
       stream.onAbort(() => {
         unsubscribe();
-        resolve17();
+        resolve18();
       });
     });
   });
@@ -1200,7 +1202,7 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
   if (!key) return c.json({ error: "No key available" }, 404);
   return c.json({ key });
 }).get("/ai/providers", requireAdmin, (c) => {
-  const allProviders = getProviders();
+  const allProviders = getBuiltinProviders();
   const oauthProviders = getOAuthProviders();
   const oauthMap = new Map(oauthProviders.map((p) => [p.id, p]));
   const ai = getAiConfig();
@@ -1223,8 +1225,8 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
     };
   });
   return c.json(result);
-}).get("/ai/models", requireAdmin, (c) => {
-  const models = getAvailableModels();
+}).get("/ai/models", requireAdmin, async (c) => {
+  const models = await getAvailableModels();
   const enabled = new Set(getEnabledModels());
   return c.json(
     models.map((m) => ({
@@ -1309,8 +1311,8 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
       createdAt: Date.now()
     };
     oauthFlows.set(flowId, flow);
-    const promptPromise = needsManualCode ? new Promise((resolve17) => {
-      flow.resolveCode = resolve17;
+    const promptPromise = needsManualCode ? new Promise((resolve18) => {
+      flow.resolveCode = resolve18;
     }) : void 0;
     oauthProvider.login({
       onAuth: (info) => {
@@ -1318,6 +1320,15 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
         if (existing)
           Object.assign(existing, { url: info.url, instructions: info.instructions });
       },
+      onDeviceCode: (info) => {
+        const existing = oauthFlows.get(flowId);
+        if (existing)
+          Object.assign(existing, {
+            url: info.verificationUri,
+            instructions: `Enter code: ${info.userCode}`
+          });
+      },
+      onSelect: async (_prompt) => void 0,
       onPrompt: async (_prompt) => {
         if (promptPromise) {
           const existing = oauthFlows.get(flowId);
@@ -1340,7 +1351,7 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
         existing.error = err instanceof Error ? err.message : String(err);
       }
     });
-    await new Promise((resolve17) => setTimeout(resolve17, 2e3));
+    await new Promise((resolve18) => setTimeout(resolve18, 2e3));
     const state = oauthFlows.get(flowId);
     return c.json({
       flowId,
@@ -1484,7 +1495,7 @@ function needsRefresh(oauth) {
 }
 async function refreshApiKeyCache() {
   const ai = getAiConfig();
-  const providers = getConfiguredProviders();
+  const providers = await getConfiguredProviders();
   for (const id of oauthHealth.keys()) {
     if (!providers.includes(id)) oauthHealth.delete(id);
   }
@@ -1598,8 +1609,8 @@ var app2 = new Hono2().get("/events", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve17) => {
-        stream.onAbort(() => resolve17());
+      await new Promise((resolve18) => {
+        stream.onAbort(() => resolve18());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -2002,7 +2013,7 @@ var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSch
   }
   const participants = await getParticipants(channel.id);
   if (!participants.some((p) => p.userId === puppet.id)) {
-    const { addParticipant } = await import("./conversations-LUVHGQSS.js");
+    const { addParticipant } = await import("./conversations-AYLXPOGC.js");
     await addParticipant(channel.id, puppet.id);
   }
   const contentBlocks = body.content;
@@ -2095,8 +2106,8 @@ async function fanOutToBridgedMinds(opts) {
   const participants = await getParticipants(opts.conversationId);
   const mindParticipants = participants.filter((p) => p.userType === "mind");
   const participantNames = participants.map((p) => p.username);
-  const { getMindManager: getMindManager2 } = await import("./mind-manager-4Q6KGZHL.js");
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-27S7MKJO.js");
+  const { getMindManager: getMindManager2 } = await import("./mind-manager-4NFK4GEU.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
   const manager = getMindManager2();
   const sm = getSleepManagerIfReady2();
   const targetMinds = mindParticipants.filter((ap) => {
@@ -2155,9 +2166,9 @@ var channels_default = app5;
 // packages/daemon/src/web/api/config.ts
 import { Hono as Hono6 } from "hono";
 var config = new Hono6();
-config.get("/models", (c) => {
+config.get("/models", async (c) => {
   const enabled = new Set(getEnabledModels());
-  const all = getAvailableModels();
+  const all = await getAvailableModels();
   const models = all.map((m) => ({
     id: m.id,
     name: m.name,
@@ -2166,8 +2177,8 @@ config.get("/models", (c) => {
   }));
   return c.json(models);
 });
-config.get("/providers", (c) => {
-  const configured = getConfiguredProviders();
+config.get("/providers", async (c) => {
+  const configured = await getConfiguredProviders();
   return c.json(configured.map((id) => ({ id, configured: true })));
 });
 config.get("/status", (c) => {
@@ -2182,13 +2193,13 @@ var config_default = config;
 
 // packages/daemon/src/web/api/env.ts
 import { Hono as Hono7 } from "hono";
-var app6 = new Hono7().get("/:name/env", async (c) => {
+var app6 = new Hono7().get("/:name/env", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const shared = readEnv(sharedEnvPath());
   const mind = readEnv(mindEnvPath(name));
   return c.json({ shared, mind });
-}).get("/:name/env/:key", async (c) => {
+}).get("/:name/env/:key", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const key = c.req.param("key");
@@ -2225,7 +2236,7 @@ var app6 = new Hono7().get("/:name/env", async (c) => {
   writeEnv(path, env);
   return c.json({ ok: true });
 });
-var sharedEnvApp = new Hono7().get("/", (c) => {
+var sharedEnvApp = new Hono7().get("/", requireAdmin, (c) => {
   return c.json(readEnv(sharedEnvPath()));
 }).put("/:key", requireAdmin, async (c) => {
   const key = c.req.param("key");
@@ -2261,7 +2272,7 @@ var app7 = new Hono8().get("/", (c) => {
 }).get("/all", (c) => {
   const detail = c.req.query("detail") === "true";
   return c.json(detail ? getAllDiscoveredExtensionsDetailed() : getAllDiscoveredExtensions());
-}).put("/:id/enabled", async (c) => {
+}).put("/:id/enabled", requireAdmin, async (c) => {
   const { id } = c.req.param();
   const body = await c.req.json().catch(() => null);
   if (!body || typeof body.enabled !== "boolean") {
@@ -2273,7 +2284,7 @@ var app7 = new Hono8().get("/", (c) => {
     return c.json({ error: err.message }, 404);
   }
   return c.json({ ok: true, requiresRestart: true });
-}).post("/install", async (c) => {
+}).post("/install", requireAdmin, async (c) => {
   const body = await c.req.json();
   const pkg = body.package?.trim();
   if (!pkg) {
@@ -2287,7 +2298,7 @@ var app7 = new Hono8().get("/", (c) => {
     const isValidation = message.includes("already installed") || message.includes("Invalid package");
     return c.json({ error: message }, isValidation ? 400 : 500);
   }
-}).delete("/uninstall/:package", async (c) => {
+}).delete("/uninstall/:package", requireAdmin, async (c) => {
   const pkg = c.req.param("package");
   try {
     await uninstallNpmExtension(pkg);
@@ -2308,7 +2319,7 @@ async function notifyMind(mindName, message) {
   const entry = await findMind(mindName);
   if (!entry) return;
   try {
-    const { sendSystemMessage } = await import("./system-chat-EIINIHFB.js");
+    const { sendSystemMessage } = await import("./system-chat-7CA2PP6A.js");
     await sendSystemMessage(mindName, message);
   } catch (err) {
     logger_default.warn(`[file-sharing] notify mind ${mindName} failed`, logger_default.errorData(err));
@@ -2357,11 +2368,11 @@ var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
     `[file] ${senderName} sent ${filename} (${sizeStr}) \u2014 run: volute chat accept ${id}`
   );
   return c.json({ status: "pending", id }, 200);
-}).get("/:name/files/pending", async (c) => {
+}).get("/:name/files/pending", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   return c.json(listPending(name));
-}).post("/:name/files/accept", async (c) => {
+}).post("/:name/files/accept", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -2383,7 +2394,7 @@ var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
   }
   await notifyMind(result.sender, `[file] ${name} accepted ${result.filename}`);
   return c.json({ ok: true, destPath: result.destPath });
-}).post("/:name/files/reject", async (c) => {
+}).post("/:name/files/reject", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const body = await c.req.json();
@@ -2400,7 +2411,7 @@ var app8 = new Hono9().post("/:name/files/send", requireSelf(), async (c) => {
   }
   await notifyMind(result.sender, `[file] ${name} rejected ${result.filename}`);
   return c.json({ ok: true });
-}).post("/:name/files/stage", async (c) => {
+}).post("/:name/files/stage", requireSelf(), async (c) => {
   const receiverName = c.req.param("name");
   const receiverEntry = await findMind(receiverName);
   if (!receiverEntry) return c.json({ error: "Mind not found" }, 404);
@@ -2433,8 +2444,34 @@ var file_sharing_default = app8;
 // packages/daemon/src/web/api/files.ts
 import { mkdirSync as mkdirSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { readdir, readFile, realpath, stat } from "fs/promises";
-import { extname as extname2, resolve as resolve5 } from "path";
+import { extname as extname2, resolve as resolve6 } from "path";
 import { Hono as Hono10 } from "hono";
+
+// packages/daemon/src/lib/util/paths.ts
+import { resolve as resolve5, sep } from "path";
+var PathTraversalError = class extends Error {
+  constructor(base, userPath) {
+    super(`Path "${userPath}" escapes base directory "${base}"`);
+    this.name = "PathTraversalError";
+  }
+};
+function resolveWithinBase(base, userPath) {
+  const resolvedBase = resolve5(base);
+  const target = resolve5(resolvedBase, userPath);
+  if (target !== resolvedBase && !target.startsWith(resolvedBase + sep)) {
+    throw new PathTraversalError(base, userPath);
+  }
+  return target;
+}
+function safeResolveWithinBase(base, userPath) {
+  try {
+    return resolveWithinBase(base, userPath);
+  } catch {
+    return null;
+  }
+}
+
+// packages/daemon/src/web/api/files.ts
 var AVATAR_MIME2 = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -2478,13 +2515,14 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
     return c.json({ error: "Invalid file type (png, jpg, gif, webp only)" }, 400);
   }
   const dir = entry.dir ?? mindDir(name);
-  const homeDir = resolve5(dir, "home");
+  const homeDir = resolve6(dir, "home");
   const filename = `avatar${ext}`;
-  const avatarPath = resolve5(homeDir, filename);
+  const avatarPath = resolve6(homeDir, filename);
   const config2 = readVoluteConfig(dir) ?? {};
   const oldAvatar = config2.profile?.avatar;
   if (oldAvatar && oldAvatar !== filename) {
-    rmSync2(resolve5(homeDir, oldAvatar), { force: true });
+    const oldAvatarPath = safeResolveWithinBase(homeDir, oldAvatar);
+    if (oldAvatarPath) rmSync2(oldAvatarPath, { force: true });
   }
   const buffer2 = Buffer.from(await file.arrayBuffer());
   mkdirSync3(homeDir, { recursive: true });
@@ -2506,8 +2544,8 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const ext = extname2(config2.profile.avatar).toLowerCase();
   const mime = AVATAR_MIME2[ext];
   if (!mime) return c.json({ error: "Invalid avatar extension" }, 400);
-  const homeDir = resolve5(dir, "home");
-  const avatarPath = resolve5(homeDir, config2.profile.avatar);
+  const homeDir = resolve6(dir, "home");
+  const avatarPath = resolve6(homeDir, config2.profile.avatar);
   if (!avatarPath.startsWith(`${homeDir}/`)) return c.json({ error: "Invalid avatar path" }, 400);
   let realAvatarPath;
   try {
@@ -2535,7 +2573,7 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const homeDir = resolve5(entry.dir ?? mindDir(name), "home");
+  const homeDir = resolve6(entry.dir ?? mindDir(name), "home");
   let entries;
   try {
     entries = await readdir(homeDir, { withFileTypes: true });
@@ -2550,10 +2588,10 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const homeDir = resolve5(entry.dir ?? mindDir(name), "home");
+  const homeDir = resolve6(entry.dir ?? mindDir(name), "home");
   const wildcard = c.req.path.replace(new RegExp(`^.*/minds/${name}/files`), "") || "/";
   const relativePath = wildcard.slice(1);
-  const requestedPath = resolve5(homeDir, relativePath);
+  const requestedPath = resolve6(homeDir, relativePath);
   if (requestedPath !== homeDir && !requestedPath.startsWith(`${homeDir}/`))
     return c.text("Forbidden", 403);
   if (relativePath.split("/").some((seg) => seg.startsWith("."))) return c.text("Forbidden", 403);
@@ -2985,16 +3023,16 @@ import { Hono as Hono12 } from "hono";
 // packages/daemon/src/lib/mind/identity.ts
 import { createHash, generateKeyPairSync, sign, verify } from "crypto";
 import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 function generateIdentity(mindDir2) {
-  const identityDir = resolve6(mindDir2, ".mind/identity");
+  const identityDir = resolve7(mindDir2, ".mind/identity");
   mkdirSync4(identityDir, { recursive: true });
   const { publicKey, privateKey } = generateKeyPairSync("ed25519", {
     publicKeyEncoding: { type: "spki", format: "pem" },
     privateKeyEncoding: { type: "pkcs8", format: "pem" }
   });
-  const privatePath = resolve6(identityDir, "private.pem");
-  const publicPath = resolve6(identityDir, "public.pem");
+  const privatePath = resolve7(identityDir, "private.pem");
+  const publicPath = resolve7(identityDir, "public.pem");
   writeFileSync4(privatePath, privateKey, { mode: 384 });
   writeFileSync4(publicPath, publicKey, { mode: 420 });
   const config2 = readVoluteConfig(mindDir2) ?? {};
@@ -3009,7 +3047,7 @@ function getPublicKey(mindDir2) {
   const config2 = readVoluteConfig(mindDir2);
   const relPath = config2?.identity?.publicKey;
   if (!relPath) return null;
-  const fullPath = resolve6(mindDir2, relPath);
+  const fullPath = resolve7(mindDir2, relPath);
   if (!existsSync4(fullPath)) return null;
   return readFileSync5(fullPath, "utf-8");
 }
@@ -3059,14 +3097,14 @@ var keys_default = app10;
 // packages/daemon/src/web/api/logs.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync5 } from "fs";
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 import { Hono as Hono13 } from "hono";
 import { streamSSE as streamSSE3 } from "hono/streaming";
-var app11 = new Hono13().get("/:name/logs", async (c) => {
+var app11 = new Hono13().get("/:name/logs", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const logFile = resolve7(stateDir(name), "logs", "mind.log");
+  const logFile = resolve8(stateDir(name), "logs", "mind.log");
   if (!existsSync5(logFile)) {
     return c.json({ error: "No log file found" }, 404);
   }
@@ -3085,16 +3123,16 @@ var app11 = new Hono13().get("/:name/logs", async (c) => {
     stream.onAbort(() => {
       tail.kill();
     });
-    await new Promise((resolve17) => {
-      tail.on("exit", resolve17);
-      stream.onAbort(resolve17);
+    await new Promise((resolve18) => {
+      tail.on("exit", resolve18);
+      stream.onAbort(resolve18);
     });
   });
-}).get("/:name/logs/tail", async (c) => {
+}).get("/:name/logs/tail", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const logFile = resolve7(stateDir(name), "logs", "mind.log");
+  const logFile = resolve8(stateDir(name), "logs", "mind.log");
   if (!existsSync5(logFile)) {
     return c.json({ error: "No log file found" }, 404);
   }
@@ -3105,8 +3143,8 @@ var app11 = new Hono13().get("/:name/logs", async (c) => {
   tail.stdout.on("data", (data) => {
     output += data.toString();
   });
-  await new Promise((resolve17) => {
-    tail.on("exit", resolve17);
+  await new Promise((resolve18) => {
+    tail.on("exit", resolve18);
   });
   return c.text(output);
 });
@@ -3203,7 +3241,7 @@ import {
   rmSync as rmSync4,
   writeFileSync as writeFileSync7
 } from "fs";
-import { resolve as resolve10 } from "path";
+import { basename, resolve as resolve11 } from "path";
 import { zValidator as zValidator5 } from "@hono/zod-validator";
 import { and as and4, desc as desc3, eq as eq5, sql as sql2 } from "drizzle-orm";
 import { Hono as Hono15 } from "hono";
@@ -3248,18 +3286,18 @@ function classify(raw) {
 
 // packages/daemon/src/lib/mind/consolidate.ts
 import { readdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 async function consolidateMemory(mindDir2) {
-  const soulPath = resolve8(mindDir2, "home/SOUL.md");
-  const memoryPath = resolve8(mindDir2, "home/MEMORY.md");
-  const memoryDir = resolve8(mindDir2, "home/memory");
+  const soulPath = resolve9(mindDir2, "home/SOUL.md");
+  const memoryPath = resolve9(mindDir2, "home/MEMORY.md");
+  const memoryDir = resolve9(mindDir2, "home/memory");
   const soul = readFileSync6(soulPath, "utf-8");
   const logs = [];
   try {
     const files = readdirSync(memoryDir).filter((f) => /^\d{4}-\d{2}-\d{2}\.md$/.test(f)).sort();
     for (const filename of files) {
       const date = filename.replace(".md", "");
-      const content2 = readFileSync6(resolve8(memoryDir, filename), "utf-8").trim();
+      const content2 = readFileSync6(resolve9(memoryDir, filename), "utf-8").trim();
       if (content2) {
         logs.push(`### ${date}
 
@@ -3327,7 +3365,7 @@ async function cleanupVariant(variantName, projectRoot, variantPath, opts) {
       logger_default.warn(`failed to stop variant ${variantName}`, logger_default.errorData(err));
     }
   }
-  const { findMind: findMind2 } = await import("./registry-L272BZJR.js");
+  const { findMind: findMind2 } = await import("./registry-GV35XFT7.js");
   const variantEntry = await findMind2(variantName);
   const branchName = variantEntry?.branch ?? variantName;
   if (existsSync6(variantPath)) {
@@ -3379,7 +3417,7 @@ function validateBranchName(branch) {
 import { randomUUID } from "crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
 import { homedir } from "os";
-import { resolve as resolve9 } from "path";
+import { resolve as resolve10 } from "path";
 function convertSession(opts) {
   const lines = readFileSync7(opts.sessionPath, "utf-8").trim().split("\n");
   const sessionId = randomUUID();
@@ -3495,9 +3533,9 @@ function convertSession(opts) {
     }
   }
   const projectId = opts.projectDir.replace(/\//g, "-");
-  const sdkDir = resolve9(homedir(), ".claude", "projects", projectId);
+  const sdkDir = resolve10(homedir(), ".claude", "projects", projectId);
   mkdirSync5(sdkDir, { recursive: true });
-  const sdkPath = resolve9(sdkDir, `${sessionId}.jsonl`);
+  const sdkPath = resolve10(sdkDir, `${sessionId}.jsonl`);
   writeFileSync6(sdkPath, `${sdkEvents.join("\n")}
 `);
   console.log(`Converted ${sdkEvents.length} messages \u2192 ${sdkPath}`);
@@ -3584,7 +3622,7 @@ async function getMindStatus(name, port, registryRunning) {
   const manager = getMindManager();
   let status = "stopped";
   try {
-    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-27S7MKJO.js");
+    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
     if (getSleepManagerIfReady2()?.isSleeping(name)) {
       status = "sleeping";
     }
@@ -3630,7 +3668,7 @@ async function initTemplateBranch(projectRoot, composedDir, manifest, mindName,
   await gitExec(["commit", "-m", "initial commit"], opts);
 }
 async function updateTemplateBranch(projectRoot, template, mindName) {
-  const tempWorktree = resolve10(projectRoot, ".variants", "_template_update");
+  const tempWorktree = resolve11(projectRoot, ".variants", "_template_update");
   let branchExists = false;
   try {
     await gitExec(["rev-parse", "--verify", TEMPLATE_BRANCH], { cwd: projectRoot });
@@ -3662,15 +3700,15 @@ async function updateTemplateBranch(projectRoot, template, mindName) {
       });
     }
     copyTemplateToDir(composedDir, tempWorktree, mindName, manifest);
-    const initDir = resolve10(tempWorktree, ".init");
+    const initDir = resolve11(tempWorktree, ".init");
     if (existsSync7(initDir)) {
       rmSync4(initDir, { recursive: true, force: true });
     }
-    const homeDir = resolve10(tempWorktree, "home");
+    const homeDir = resolve11(tempWorktree, "home");
     if (existsSync7(homeDir)) {
       for (const entry of readdirSync2(homeDir)) {
         if (entry !== "VOLUTE.md") {
-          rmSync4(resolve10(homeDir, entry), { recursive: true, force: true });
+          rmSync4(resolve11(homeDir, entry), { recursive: true, force: true });
         }
       }
     }
@@ -3711,7 +3749,7 @@ async function mergeTemplateBranch(worktreeDir) {
 async function npmInstallAsMind(cwd, mindName) {
   if (isIsolationEnabled()) {
     const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
-    await exec(cmd, args, { cwd, env: { ...process.env, HOME: resolve10(cwd, "home") } });
+    await exec(cmd, args, { cwd, env: { ...process.env, HOME: resolve11(cwd, "home") } });
   } else {
     await exec("npm", ["install"], { cwd });
   }
@@ -3762,7 +3800,7 @@ async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariant
   return { ok: true };
 }
 async function importFromArchive(c, tempDir, nameOverride, manifest) {
-  const extractedMindDir = resolve10(tempDir, "mind");
+  const extractedMindDir = resolve11(tempDir, "mind");
   if (!existsSync7(extractedMindDir)) {
     return c.json({ error: "Invalid archive: missing mind/ directory" }, 400);
   }
@@ -3789,9 +3827,9 @@ async function importFromFullArchive(c, tempDir, extractedMindDir, nameOverride,
     }
     const state = stateDir(name);
     mkdirSync6(state, { recursive: true });
-    const envJson = resolve10(tempDir, "state/env.json");
+    const envJson = resolve11(tempDir, "state/env.json");
     if (existsSync7(envJson)) {
-      cpSync(envJson, resolve10(state, "env.json"));
+      cpSync(envJson, resolve11(state, "env.json"));
     }
     const port = await nextPort();
     await addMind(name, port, manifest.stage, manifest.template);
@@ -3800,23 +3838,23 @@ async function importFromFullArchive(c, tempDir, extractedMindDir, nameOverride,
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
     await npmInstallAsMind(dest, name);
     await importHistoryFromArchive(name, tempDir);
     importSessionsFromArchive(dest, tempDir);
-    if (!existsSync7(resolve10(dest, ".git"))) {
+    if (!existsSync7(resolve11(dest, ".git"))) {
       try {
-        const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dest, "home") } : void 0;
+        const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dest, "home") } : void 0;
         await gitExec(["init"], { cwd: dest, mindName: name, env });
         await configureGitIdentity(name, { cwd: dest, mindName: name, env });
         await gitExec(["add", "-A"], { cwd: dest, mindName: name, env });
         await gitExec(["commit", "-m", "import from archive"], { cwd: dest, mindName: name, env });
       } catch (err) {
         logger_default.error(`git setup failed for imported mind ${name}`, logger_default.errorData(err));
-        rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
+        rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
       }
     }
     chownMindDir(dest, name);
@@ -3849,22 +3887,22 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
   try {
     copyTemplateToDir(composedDir, dest, name, templateManifest);
     applyInitFiles(dest);
-    const extractedHome = resolve10(extractedMindDir, "home");
+    const extractedHome = resolve11(extractedMindDir, "home");
     if (existsSync7(extractedHome)) {
-      cpSync(extractedHome, resolve10(dest, "home"), { recursive: true });
+      cpSync(extractedHome, resolve11(dest, "home"), { recursive: true });
     }
-    const extractedMindInternal = resolve10(extractedMindDir, ".mind");
+    const extractedMindInternal = resolve11(extractedMindDir, ".mind");
     if (existsSync7(extractedMindInternal)) {
-      cpSync(extractedMindInternal, resolve10(dest, ".mind"), { recursive: true });
+      cpSync(extractedMindInternal, resolve11(dest, ".mind"), { recursive: true });
     }
-    const identityDir = resolve10(dest, ".mind/identity");
+    const identityDir = resolve11(dest, ".mind/identity");
     let publicKeyPem;
-    if (!manifest.includes.identity || !existsSync7(resolve10(identityDir, "private.pem"))) {
+    if (!manifest.includes.identity || !existsSync7(resolve11(identityDir, "private.pem"))) {
       ({ publicKeyPem } = generateIdentity(dest));
     } else {
-      publicKeyPem = readFileSync8(resolve10(identityDir, "public.pem"), "utf-8");
+      publicKeyPem = readFileSync8(resolve11(identityDir, "public.pem"), "utf-8");
     }
-    const promptsPath = resolve10(dest, "home/.config/prompts.json");
+    const promptsPath = resolve11(dest, "home/.config/prompts.json");
     if (!existsSync7(promptsPath)) {
       const mindPrompts = await getMindPromptDefaults();
       writeFileSync7(promptsPath, `${JSON.stringify(mindPrompts, null, 2)}
@@ -3872,13 +3910,13 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
     }
     const state = stateDir(name);
     mkdirSync6(state, { recursive: true });
-    const envJson = resolve10(tempDir, "state/env.json");
+    const envJson = resolve11(tempDir, "state/env.json");
     if (existsSync7(envJson)) {
-      cpSync(envJson, resolve10(state, "env.json"));
+      cpSync(envJson, resolve11(state, "env.json"));
     }
     const port = await nextPort();
     await addMind(name, port, manifest.stage, manifest.template);
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
@@ -3891,7 +3929,7 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
       await initTemplateBranch(dest, composedDir, templateManifest, name, env);
     } catch (err) {
       logger_default.error(`git setup failed for imported mind ${name}`, logger_default.errorData(err));
-      rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
+      rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
       gitWarning = "Git setup failed \u2014 variants and upgrades won't be available until git is initialized.";
     }
     const skillSet = manifest.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions();
@@ -3934,7 +3972,7 @@ async function importFromHomeOnlyArchive(c, tempDir, extractedMindDir, nameOverr
   }
 }
 async function importHistoryFromArchive(name, tempDir) {
-  const historyJsonl = resolve10(tempDir, "history.jsonl");
+  const historyJsonl = resolve11(tempDir, "history.jsonl");
   if (!existsSync7(historyJsonl)) return;
   try {
     const db = await getDb();
@@ -3974,13 +4012,13 @@ async function importHistoryFromArchive(name, tempDir) {
   }
 }
 function importSessionsFromArchive(dest, tempDir) {
-  const sessionsDir = resolve10(tempDir, "sessions");
+  const sessionsDir = resolve11(tempDir, "sessions");
   if (!existsSync7(sessionsDir)) return;
   try {
-    const destSessions = resolve10(dest, ".mind/sessions");
+    const destSessions = resolve11(dest, ".mind/sessions");
     mkdirSync6(destSessions, { recursive: true });
     for (const file of readdirSync2(sessionsDir)) {
-      cpSync(resolve10(sessionsDir, file), resolve10(destSessions, file));
+      cpSync(resolve11(sessionsDir, file), resolve11(destSessions, file));
     }
   } catch (err) {
     logger_default.error("Failed to import sessions from archive", logger_default.errorData(err));
@@ -4041,7 +4079,7 @@ async function proxyToMind(c, path) {
 var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", createMindSchema), async (c) => {
   const body = c.req.valid("json");
   const { name } = body;
-  const template = body.template ?? resolveTemplate(body.model);
+  const template = body.template ?? await resolveTemplate(body.model);
   const nameErr = validateMindName(name);
   if (nameErr) return c.json({ error: nameErr }, 400);
   if (await findMind(name)) return c.json({ error: `Mind already exists: ${name}` }, 409);
@@ -4055,7 +4093,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     applyInitFiles(dest);
     const { publicKeyPem } = generateIdentity(dest);
     {
-      const { readGlobalConfig: readGlobal } = await import("./setup-IL7QJZN4.js");
+      const { readGlobalConfig: readGlobal } = await import("./setup-OTEC3ZPM.js");
       const mindDefaults = readGlobal().mindDefaults;
       const config2 = readVoluteConfig(dest);
       if (!config2) throw new Error("Failed to read volute.json after identity generation");
@@ -4092,7 +4130,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
       }
       writeVoluteConfig(dest, config2);
       const modelId = body.model ?? cog?.model;
-      const sdkConfigPath = resolve10(dest, "home/.config/config.json");
+      const sdkConfigPath = resolve11(dest, "home/.config/config.json");
       if (modelId || cog?.compaction) {
         const existing = existsSync7(sdkConfigPath) ? JSON.parse(readFileSync8(sdkConfigPath, "utf-8")) : {};
         if (modelId) {
@@ -4107,7 +4145,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     }
     const mindPrompts = await getMindPromptDefaults();
     writeFileSync7(
-      resolve10(dest, "home/.config/prompts.json"),
+      resolve11(dest, "home/.config/prompts.json"),
       `${JSON.stringify(mindPrompts, null, 2)}
 `
     );
@@ -4119,7 +4157,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
@@ -4132,7 +4170,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
       await initTemplateBranch(dest, composedDir, manifest, name, env);
     } catch (err) {
       logger_default.error(`git setup failed for ${name}`, logger_default.errorData(err));
-      rmSync4(resolve10(dest, ".git"), { recursive: true, force: true });
+      rmSync4(resolve11(dest, ".git"), { recursive: true, force: true });
       gitWarning = "Git setup failed \u2014 variants and upgrades won't be available until git is initialized.";
     }
     chownMindDir(dest, name);
@@ -4142,11 +4180,11 @@ The human who planted you described you as: "${body.description}"
 ` : "";
       const seedSoulRaw = body.seedSoul ?? await getPrompt("seed_soul", { name, description: descLine });
       const seedSoul = body.seedSoul ? substitute(seedSoulRaw, { name, description: descLine }) : seedSoulRaw;
-      writeFileSync7(resolve10(dest, "home/SOUL.md"), seedSoul);
+      writeFileSync7(resolve11(dest, "home/SOUL.md"), seedSoul);
     }
     let skillSet = body.skills ?? (body.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions());
     if (body.stage === "seed" && !body.skills) {
-      const { isImagegenEnabled } = await import("./setup-IL7QJZN4.js");
+      const { isImagegenEnabled } = await import("./setup-OTEC3ZPM.js");
       if (isImagegenEnabled()) {
         skillSet = [...skillSet, "imagegen"];
       }
@@ -4164,7 +4202,7 @@ The human who planted you described you as: "${body.description}"
       try {
         const spiritEntry = await findMind("volute");
         if (spiritEntry) {
-          const { spiritDir } = await import("./spirit-7BUHSEO2.js");
+          const { spiritDir } = await import("./spirit-T6GK5GEP.js");
           const sDir = spiritEntry.dir ?? spiritDir();
           const spiritConfig = readVoluteConfig(sDir) ?? {};
           const schedules = spiritConfig.schedules ?? [];
@@ -4179,7 +4217,7 @@ The human who planted you described you as: "${body.description}"
             });
             spiritConfig.schedules = schedules;
             writeVoluteConfig(sDir, spiritConfig);
-            const { getScheduler: getScheduler2 } = await import("./scheduler-7E22Q7IC.js");
+            const { getScheduler: getScheduler2 } = await import("./scheduler-PDARH4CE.js");
             getScheduler2().loadSchedules("volute", sDir);
           }
         }
@@ -4190,11 +4228,11 @@ The human who planted you described you as: "${body.description}"
     if (body.stage !== "seed") {
       const customSoul = await getPromptIfCustom("default_soul");
       if (customSoul) {
-        writeFileSync7(resolve10(dest, "home/SOUL.md"), customSoul.replace(/\{\{name\}\}/g, name));
+        writeFileSync7(resolve11(dest, "home/SOUL.md"), customSoul.replace(/\{\{name\}\}/g, name));
       }
       const customMemory = await getPromptIfCustom("default_memory");
       if (customMemory) {
-        writeFileSync7(resolve10(dest, "home/MEMORY.md"), customMemory);
+        writeFileSync7(resolve11(dest, "home/MEMORY.md"), customMemory);
       }
     }
     publishPublicKey(name, publicKeyPem).catch(
@@ -4243,12 +4281,12 @@ The human who planted you described you as: "${body.description}"
     return importFromArchive(c, body.archivePath, body.name, body.manifest);
   }
   const wsDir = body.workspacePath;
-  if (!wsDir || !existsSync7(resolve10(wsDir, "SOUL.md")) || !existsSync7(resolve10(wsDir, "IDENTITY.md"))) {
+  if (!wsDir || !existsSync7(resolve11(wsDir, "SOUL.md")) || !existsSync7(resolve11(wsDir, "IDENTITY.md"))) {
     return c.json({ error: "Invalid workspace: missing SOUL.md or IDENTITY.md" }, 400);
   }
-  const soul = readFileSync8(resolve10(wsDir, "SOUL.md"), "utf-8");
-  const identity = readFileSync8(resolve10(wsDir, "IDENTITY.md"), "utf-8");
-  const userPath = resolve10(wsDir, "USER.md");
+  const soul = readFileSync8(resolve11(wsDir, "SOUL.md"), "utf-8");
+  const identity = readFileSync8(resolve11(wsDir, "IDENTITY.md"), "utf-8");
+  const userPath = resolve11(wsDir, "USER.md");
   const user = existsSync7(userPath) ? readFileSync8(userPath, "utf-8") : "";
   const name = body.name ?? parseNameFromIdentity(identity) ?? "imported-mind";
   const template = body.template ?? "claude";
@@ -4276,26 +4314,26 @@ ${user.trimEnd()}
     copyTemplateToDir(composedDir, dest, name, manifest);
     applyInitFiles(dest);
     const { publicKeyPem: importPublicKey } = generateIdentity(dest);
-    writeFileSync7(resolve10(dest, "home/SOUL.md"), mergedSoul);
-    const wsMemoryPath = resolve10(wsDir, "MEMORY.md");
+    writeFileSync7(resolve11(dest, "home/SOUL.md"), mergedSoul);
+    const wsMemoryPath = resolve11(wsDir, "MEMORY.md");
     const hasMemory = existsSync7(wsMemoryPath);
     if (hasMemory) {
       const existingMemory = readFileSync8(wsMemoryPath, "utf-8");
       writeFileSync7(
-        resolve10(dest, "home/MEMORY.md"),
+        resolve11(dest, "home/MEMORY.md"),
         `${existingMemory.trimEnd()}${mergedMemoryExtra}`
       );
     } else if (user) {
-      writeFileSync7(resolve10(dest, "home/MEMORY.md"), `${user.trimEnd()}
+      writeFileSync7(resolve11(dest, "home/MEMORY.md"), `${user.trimEnd()}
 `);
     }
-    const wsMemoryDir = resolve10(wsDir, "memory");
+    const wsMemoryDir = resolve11(wsDir, "memory");
     let dailyLogCount = 0;
     if (existsSync7(wsMemoryDir)) {
-      const destMemoryDir = resolve10(dest, "home/memory");
+      const destMemoryDir = resolve11(dest, "home/memory");
       const files = readdirSync2(wsMemoryDir).filter((f) => f.endsWith(".md"));
       for (const file of files) {
-        cpSync(resolve10(wsMemoryDir, file), resolve10(destMemoryDir, file));
+        cpSync(resolve11(wsMemoryDir, file), resolve11(destMemoryDir, file));
       }
       dailyLogCount = files.length;
     }
@@ -4306,7 +4344,7 @@ ${user.trimEnd()}
     } catch (err) {
       logger_default.warn(`failed to set template hash for ${name}`, logger_default.errorData(err));
     }
-    const homeDir = resolve10(dest, "home");
+    const homeDir = resolve11(dest, "home");
     ensureVoluteGroup();
     createMindUser(name, homeDir);
     chownMindDir(dest, name);
@@ -4314,20 +4352,20 @@ ${user.trimEnd()}
     if (!hasMemory && dailyLogCount > 0) {
       await consolidateMemory(dest);
     }
-    const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dest, "home") } : void 0;
+    const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dest, "home") } : void 0;
     await gitExec(["init"], { cwd: dest, mindName: name, env });
     await configureGitIdentity(name, { cwd: dest, mindName: name, env });
     await gitExec(["add", "-A"], { cwd: dest, mindName: name, env });
     await gitExec(["commit", "-m", "import from OpenClaw"], { cwd: dest, mindName: name, env });
-    const sessionFile = body.sessionPath ? resolve10(body.sessionPath) : findOpenClawSession(wsDir);
+    const sessionFile = body.sessionPath ? resolve11(body.sessionPath) : findOpenClawSession(wsDir);
     if (sessionFile && existsSync7(sessionFile)) {
       if (template === "pi") {
         importPiSession(sessionFile, dest);
       } else if (template === "claude") {
         const sessionId = convertSession({ sessionPath: sessionFile, projectDir: dest });
-        const mindRuntimeDir = resolve10(dest, ".mind");
+        const mindRuntimeDir = resolve11(dest, ".mind");
         mkdirSync6(mindRuntimeDir, { recursive: true });
-        writeFileSync7(resolve10(mindRuntimeDir, "session.json"), JSON.stringify({ sessionId }));
+        writeFileSync7(resolve11(mindRuntimeDir, "session.json"), JSON.stringify({ sessionId }));
       }
     }
     importOpenClawConnectors(name, dest);
@@ -4368,7 +4406,7 @@ ${user.trimEnd()}
   const minds = await Promise.all(
     entries.map(async (entry) => {
       const mindStatus = await getMindStatus(entry.name, entry.port, entry.running);
-      const hasPages = existsSync7(resolve10(mindDir(entry.name), "home", "pages"));
+      const hasPages = existsSync7(resolve11(mindDir(entry.name), "home", "pages"));
       return {
         ...entry,
         ...mindStatus,
@@ -4397,9 +4435,9 @@ ${user.trimEnd()}
       return { name: s.name, port: s.port, status: variantStatus };
     })
   );
-  const hasPages = existsSync7(resolve10(mindDir(name), "home", "pages"));
+  const hasPages = existsSync7(resolve11(mindDir(name), "home", "pages"));
   return c.json({ ...entry, ...mindStatus, variants: variantStatuses, hasPages });
-}).get("/:name/context", async (c) => proxyToMind(c, "context")).get("/:name/context/messages", async (c) => proxyToMind(c, "context/messages")).post("/:name/start", requireSelf(), async (c) => {
+}).get("/:name/context", requireSelf(), async (c) => proxyToMind(c, "context")).get("/:name/context/messages", requireSelf(), async (c) => proxyToMind(c, "context/messages")).post("/:name/start", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -4444,7 +4482,7 @@ ${user.trimEnd()}
   const manager = getMindManager();
   try {
     if (context?.type === "reload") {
-      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-27S7MKJO.js");
+      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
       const sleepState = getSleepManagerIfReady2()?.getState(name);
       if (sleepState?.sleeping) {
         logger_default.info(`skipping reload for ${name} during sleep \u2014 will apply on next wake`);
@@ -4539,7 +4577,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-27S7MKJO.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   return c.json(sm.getState(name));
@@ -4547,7 +4585,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-27S7MKJO.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   if (sm.isSleeping(name)) return c.json({ error: "Mind is already sleeping" }, 409);
@@ -4567,7 +4605,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-27S7MKJO.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const sleepState = sm.getState(name);
@@ -4582,7 +4620,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-27S7MKJO.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const flushed = await sm.flushQueuedMessages(name);
@@ -4597,10 +4635,10 @@ ${user.trimEnd()}
   const profile = config2.profile ?? {};
   if (body.displayName !== void 0) profile.displayName = body.displayName;
   if (body.description !== void 0) profile.description = body.description;
-  if (body.avatar !== void 0) profile.avatar = body.avatar;
+  if (body.avatar !== void 0) profile.avatar = basename(body.avatar);
   config2.profile = profile;
   writeVoluteConfig(dir, config2);
-  const { syncMindProfile: syncMindProfile2 } = await import("./auth-2IMZ6N5G.js");
+  const { syncMindProfile: syncMindProfile2 } = await import("./auth-X6ZITZ7D.js");
   await syncMindProfile2(name, profile);
   broadcast({ type: "profile_updated", mind: name, summary: `${name} profile updated` });
   return c.json({ ok: true });
@@ -4640,14 +4678,14 @@ ${user.trimEnd()}
     return c.json({ output: "" });
   }
   const dir = entry.dir ?? mindDir(name);
-  const soulPath = resolve10(dir, "home/SOUL.md");
-  const memoryPath = resolve10(dir, "home/MEMORY.md");
+  const soulPath = resolve11(dir, "home/SOUL.md");
+  const memoryPath = resolve11(dir, "home/MEMORY.md");
   const soulCustom = existsSync7(soulPath) && !readFileSync8(soulPath, "utf-8").includes(ORIENTATION_MARKER);
   const memoryWritten = existsSync7(memoryPath) && readFileSync8(memoryPath, "utf-8").trim().length > 0;
   const config2 = readVoluteConfig(dir);
   const displayNameSet = !!config2?.profile?.displayName;
   const avatarSet = !!config2?.profile?.avatar;
-  const { isImagegenEnabled } = await import("./setup-IL7QJZN4.js");
+  const { isImagegenEnabled } = await import("./setup-OTEC3ZPM.js");
   const imagegenEnabled = isImagegenEnabled();
   const done = [];
   const remaining = [];
@@ -4685,7 +4723,7 @@ ${user.trimEnd()}
   try {
     const spiritEntry = await findMind("volute");
     if (spiritEntry) {
-      const { spiritDir } = await import("./spirit-7BUHSEO2.js");
+      const { spiritDir } = await import("./spirit-T6GK5GEP.js");
       const sDir = spiritEntry.dir ?? spiritDir();
       const spiritConfig = readVoluteConfig(sDir);
       if (spiritConfig?.schedules) {
@@ -4693,7 +4731,7 @@ ${user.trimEnd()}
         spiritConfig.schedules = spiritConfig.schedules.filter((s) => s.id !== nurtureId);
         if (spiritConfig.schedules.length === 0) spiritConfig.schedules = void 0;
         writeVoluteConfig(sDir, spiritConfig);
-        const { getScheduler: getScheduler2 } = await import("./scheduler-7E22Q7IC.js");
+        const { getScheduler: getScheduler2 } = await import("./scheduler-PDARH4CE.js");
         getScheduler2().loadSchedules("volute", sDir);
       }
     }
@@ -4748,16 +4786,16 @@ ${user.trimEnd()}
   const template = body.template ?? entry.template ?? "claude";
   const UPGRADE_BRANCH = "upgrade";
   const upgradeVariantName = `${mindName}-upgrade`;
-  const worktreeDir = resolve10(dir, ".variants", UPGRADE_BRANCH);
+  const worktreeDir = resolve11(dir, ".variants", UPGRADE_BRANCH);
   if (body.abort) {
     if (!existsSync7(worktreeDir)) {
       return c.json({ error: "No upgrade in progress" }, 400);
     }
     try {
       try {
-        const gitDirContent = readFileSync8(resolve10(worktreeDir, ".git"), "utf-8").trim();
+        const gitDirContent = readFileSync8(resolve11(worktreeDir, ".git"), "utf-8").trim();
         const gitDir = gitDirContent.replace("gitdir: ", "");
-        if (existsSync7(resolve10(gitDir, "MERGE_HEAD"))) {
+        if (existsSync7(resolve11(gitDir, "MERGE_HEAD"))) {
           await gitExec(["merge", "--abort"], { cwd: worktreeDir });
         }
       } catch {
@@ -4840,7 +4878,7 @@ ${user.trimEnd()}
   }
   if (body.diff) {
     try {
-      if (!existsSync7(resolve10(dir, ".git"))) {
+      if (!existsSync7(resolve11(dir, ".git"))) {
         return c.json({ error: "Mind has no git history \u2014 nothing to diff against" }, 400);
       }
       await updateTemplateBranch(dir, template, mindName);
@@ -4864,16 +4902,16 @@ ${user.trimEnd()}
       409
     );
   }
-  if (!existsSync7(resolve10(dir, ".git"))) {
+  if (!existsSync7(resolve11(dir, ".git"))) {
     try {
-      const env = isIsolationEnabled() ? { ...process.env, HOME: resolve10(dir, "home") } : void 0;
+      const env = isIsolationEnabled() ? { ...process.env, HOME: resolve11(dir, "home") } : void 0;
       await gitExec(["init"], { cwd: dir, mindName, env });
       await configureGitIdentity(mindName, { cwd: dir, mindName, env });
       await gitExec(["add", "-A"], { cwd: dir, mindName, env });
       await gitExec(["commit", "-m", "initial commit"], { cwd: dir, mindName, env });
       chownMindDir(dir, mindName);
     } catch (err) {
-      rmSync4(resolve10(dir, ".git"), { recursive: true, force: true });
+      rmSync4(resolve11(dir, ".git"), { recursive: true, force: true });
       return c.json(
         {
           error: `Git initialization failed: ${err instanceof Error ? err.message : String(err)}`
@@ -4888,7 +4926,7 @@ ${user.trimEnd()}
   } catch {
   }
   await updateTemplateBranch(dir, template, mindName);
-  const parentDir = resolve10(dir, ".variants");
+  const parentDir = resolve11(dir, ".variants");
   if (!existsSync7(parentDir)) {
     mkdirSync6(parentDir, { recursive: true });
   }
@@ -5007,13 +5045,13 @@ ${user.trimEnd()}
   }
   const result = await getMessagesPaginated(convId, { before, limit });
   return c.json({ items: result.messages, hasMore: result.hasMore });
-}).get("/:name/budget", async (c) => {
+}).get("/:name/budget", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const baseName = await getBaseName(name);
   const usage = getTokenBudget().getUsage(baseName);
   if (!usage) return c.json({ error: "No budget configured" }, 404);
   return c.json(usage);
-}).get("/:name/config", async (c) => {
+}).get("/:name/config", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5021,7 +5059,7 @@ ${user.trimEnd()}
   if (!existsSync7(dir)) return c.json({ error: "Mind directory missing" }, 404);
   let config2 = readVoluteConfig(dir);
   if (!config2 && entry.template === "pi") {
-    const piConfigPath = resolve10(dir, "home/.config/config.json");
+    const piConfigPath = resolve11(dir, "home/.config/config.json");
     if (existsSync7(piConfigPath)) {
       try {
         config2 = JSON.parse(readFileSync8(piConfigPath, "utf-8"));
@@ -5030,7 +5068,7 @@ ${user.trimEnd()}
     }
   }
   let templateConfig = {};
-  const configJsonPath = resolve10(dir, "home/.config/config.json");
+  const configJsonPath = resolve11(dir, "home/.config/config.json");
   if (existsSync7(configJsonPath)) {
     try {
       templateConfig = JSON.parse(readFileSync8(configJsonPath, "utf-8"));
@@ -5122,12 +5160,12 @@ ${user.trimEnd()}
     }
     writeVoluteConfig(dir, existing);
     if (body.unescapeNewlines !== void 0) {
-      const { clearEchoTextCache } = await import("./echo-text-TJWCUBPB.js");
+      const { clearEchoTextCache } = await import("./echo-text-JUNRP4ER.js");
       clearEchoTextCache(name);
     }
     const needsConfigJson = body.model !== void 0 || body.thinkingLevel !== void 0 || body.maxThinkingTokens !== void 0 || body.compaction !== void 0;
     if (needsConfigJson) {
-      const configJsonPath = resolve10(dir, "home/.config/config.json");
+      const configJsonPath = resolve11(dir, "home/.config/config.json");
       let templateConfig = {};
       if (existsSync7(configJsonPath)) {
         try {
@@ -5199,7 +5237,7 @@ ${user.trimEnd()}
     }
     if (entry.mindType === "spirit" && body.model !== void 0) {
       try {
-        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-IL7QJZN4.js");
+        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-OTEC3ZPM.js");
         const globalConfig = readGlobalConfig2();
         globalConfig.spiritModel = body.model;
         writeGlobalConfig2(globalConfig);
@@ -5209,7 +5247,7 @@ ${user.trimEnd()}
     }
     return c.json({ ok: true });
   }
-).get("/:name/delivery/pending", async (c) => {
+).get("/:name/delivery/pending", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const baseName = await getBaseName(name);
   try {
@@ -5227,7 +5265,7 @@ ${user.trimEnd()}
   if (!body.systemPrompt || !body.message) {
     return c.json({ error: "systemPrompt and message required" }, 400);
   }
-  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-JMV4KZN4.js");
+  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-EVLKMAJD.js");
   if (!isAiConfigured()) {
     return c.json({ error: "AI service not configured" }, 503);
   }
@@ -5409,7 +5447,7 @@ ${user.trimEnd()}
     }
   }
   return c.json({ ok: true });
-}).get("/:name/events", async (c) => {
+}).get("/:name/events", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const baseName = await getBaseName(name);
   const entry = await findMind(baseName);
@@ -5491,7 +5529,7 @@ ${user.trimEnd()}
     return c.json({ error: "Failed to persist" }, 500);
   }
   return c.json({ ok: true });
-}).get("/:name/history/sessions", async (c) => {
+}).get("/:name/history/sessions", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const db = await getDb();
   const rows = await db.select({
@@ -5502,18 +5540,18 @@ ${user.trimEnd()}
     tool_count: sql2`SUM(CASE WHEN ${mindHistory.type}='tool_use' THEN 1 ELSE 0 END)`
   }).from(mindHistory).where(and4(eq5(mindHistory.mind, name), sql2`${mindHistory.session} IS NOT NULL`)).groupBy(mindHistory.session).orderBy(sql2`MIN(${mindHistory.created_at}) DESC`);
   return c.json(rows);
-}).get("/:name/history/channels", async (c) => {
+}).get("/:name/history/channels", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const db = await getDb();
   const rows = await db.selectDistinct({ channel: mindHistory.channel }).from(mindHistory).where(eq5(mindHistory.mind, name));
   return c.json(rows.map((r) => r.channel));
-}).get("/:name/history/export", async (c) => {
+}).get("/:name/history/export", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const db = await getDb();
   const rows = await db.select().from(mindHistory).where(eq5(mindHistory.mind, name));
   return c.json(rows);
-}).get("/:name/history/turn", async (c) => {
+}).get("/:name/history/turn", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const turnId = c.req.query("turn_id");
   const detail = c.req.query("detail") === "1";
@@ -5540,7 +5578,7 @@ ${user.trimEnd()}
     ).orderBy(mindHistory.id);
   }
   return c.json(rows);
-}).get("/:name/history/cross-session", async (c) => {
+}).get("/:name/history/cross-session", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const currentSession = c.req.query("session");
   const db = await getDb();
@@ -5596,7 +5634,7 @@ ${lines.join("\n")}` });
   const maxId = notices.reduce((m, n) => Math.max(m, n.id), 0);
   noticeDrainWatermarks.set(`${baseName}:${session}`, maxId);
   return c.json({ context: formatNotices(notices), notices });
-}).get("/:name/history", async (c) => {
+}).get("/:name/history", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const channel = c.req.query("channel");
   const session = c.req.query("session");
@@ -5747,7 +5785,7 @@ function writeSchedules(name, dir, schedules) {
     data: { schedules }
   });
 }
-var app15 = new Hono17().get("/:name/clock/status", async (c) => {
+var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5806,7 +5844,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   upcoming.sort((a, b) => a.at.localeCompare(b.at));
   previous.sort((a, b) => b.at.localeCompare(a.at));
   return c.json({ sleep: sleepState, sleepConfig, schedules, upcoming, previous });
-}).get("/:name/sleep/config", async (c) => {
+}).get("/:name/sleep/config", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5838,7 +5876,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   writeVoluteConfig(dir, config2);
   getSleepManagerIfReady()?.invalidateSleepConfig(name);
   return c.json({ ok: true });
-}).get("/:name/schedules", async (c) => {
+}).get("/:name/schedules", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
@@ -5963,7 +6001,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   }
   writeSchedules(name, dir, filtered);
   return c.json({ ok: true });
-}).post("/:name/webhook/:event", async (c) => {
+}).post("/:name/webhook/:event", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const event = c.req.param("event");
   const entry = await findMind(name);
@@ -5971,7 +6009,7 @@ var app15 = new Hono17().get("/:name/clock/status", async (c) => {
   const body = await c.req.text();
   const message = `[webhook: ${event}] ${body}`;
   try {
-    const { sendSystemMessage } = await import("./system-chat-EIINIHFB.js");
+    const { sendSystemMessage } = await import("./system-chat-7CA2PP6A.js");
     await sendSystemMessage(name, message);
     return c.json({ ok: true });
   } catch (err) {
@@ -5984,14 +6022,14 @@ var schedules_default = app15;
 // packages/daemon/src/web/api/setup.ts
 import { mkdirSync as mkdirSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 import { Hono as Hono18 } from "hono";
 import { setCookie as setCookie2 } from "hono/cookie";
 var DEFAULT_API_URL2 = "https://volute.systems";
 var setup = new Hono18();
 function writeSetupConfig(systemName, description) {
-  const configHome = process.env.VOLUTE_HOME ?? resolve11(homedir2(), ".volute");
-  const mindsDir = resolve11(configHome, "minds");
+  const configHome = process.env.VOLUTE_HOME ?? resolve12(homedir2(), ".volute");
+  const mindsDir = resolve12(configHome, "minds");
   mkdirSync7(configHome, { recursive: true });
   mkdirSync7(mindsDir, { recursive: true });
   const existingConfig = readGlobalConfig();
@@ -6025,7 +6063,7 @@ setup.get("/status", async (c) => {
   let hasAccount = false;
   if (hasSystem) {
     try {
-      const { listUsersByType: listUsersByType2 } = await import("./auth-2IMZ6N5G.js");
+      const { listUsersByType: listUsersByType2 } = await import("./auth-X6ZITZ7D.js");
       const brains = await listUsersByType2("brain");
       hasAccount = brains.length > 0;
     } catch (err) {
@@ -6236,7 +6274,7 @@ setup.post("/account", async (c) => {
     }
   }
   try {
-    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-2IMZ6N5G.js");
+    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-X6ZITZ7D.js");
     const user = await createUser2(body.username.trim(), body.password);
     if (body.displayName?.trim()) {
       await updateUserProfile2(user.id, { display_name: body.displayName.trim() });
@@ -6282,7 +6320,7 @@ setup.post("/models", async (c) => {
     return c.json({ error: "Spirit model is required" }, 400);
   }
   try {
-    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-JMV4KZN4.js");
+    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-EVLKMAJD.js");
     setEnabledModels3(body.models);
     const config2 = readGlobalConfig();
     config2.spiritModel = body.spiritModel.trim();
@@ -6300,15 +6338,15 @@ setup.post("/complete", async (c) => {
     return c.json({ error: "Setup already complete" }, 400);
   }
   try {
-    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-7BUHSEO2.js");
-    const { startSpiritFull } = await import("./mind-service-7OD4PRO5.js");
+    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-T6GK5GEP.js");
+    const { startSpiritFull } = await import("./mind-service-X7FH3NA4.js");
     await ensureSpiritProject();
     await syncSpiritTemplate();
     const warnings = [];
     const config2 = readGlobalConfig();
     if (config2.setup?.service && config2.setup?.type === "local") {
       try {
-        const { installUserService } = await import("./service-install-HVAEUBAH.js");
+        const { installUserService } = await import("./service-install-W3FQXJKB.js");
         const installed = await installUserService(config2.port, config2.hostname);
         if (!installed) {
           warnings.push("Service installation is not supported on this platform.");
@@ -6336,8 +6374,8 @@ setup.post("/complete", async (c) => {
     }
     let spiritConversationId;
     try {
-      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-2IMZ6N5G.js");
-      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-LUVHGQSS.js");
+      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-X6ZITZ7D.js");
+      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-AYLXPOGC.js");
       const spiritUser = await getOrCreateMindUser2("volute");
       const brains = await listUsersByType2("brain");
       const admin2 = brains.find((u) => u.role === "admin");
@@ -6359,8 +6397,8 @@ setup.post("/complete", async (c) => {
     logger_default.info("setup complete state", { spiritConversationId, spiritStarted });
     if (spiritConversationId && spiritStarted) {
       try {
-        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-VBBAJX3J.js");
-        const { listUsersByType: listUsers2 } = await import("./auth-2IMZ6N5G.js");
+        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-Q7TU24IA.js");
+        const { listUsersByType: listUsers2 } = await import("./auth-X6ZITZ7D.js");
         const admins = await listUsers2("brain");
         const admin2 = admins.find((u) => u.role === "admin");
         const adminName = admin2?.display_name || admin2?.username || "the admin";
@@ -6399,7 +6437,7 @@ var setup_default = setup;
 // packages/daemon/src/web/api/skills.ts
 import { existsSync as existsSync8, mkdtempSync, readdirSync as readdirSync3, rmSync as rmSync5 } from "fs";
 import { tmpdir } from "os";
-import { join, resolve as resolve12 } from "path";
+import { join, resolve as resolve13 } from "path";
 import AdmZip from "adm-zip";
 import { Hono as Hono19 } from "hono";
 var app16 = new Hono19().get("/", async (c) => {
@@ -6475,7 +6513,7 @@ var app16 = new Hono19().get("/", async (c) => {
   try {
     const zip = new AdmZip(buffer2);
     for (const entry of zip.getEntries()) {
-      const target = resolve12(tmpDir, entry.entryName);
+      const target = resolve13(tmpDir, entry.entryName);
       if (!target.startsWith(tmpDir)) {
         return c.json({ error: "Invalid zip: paths must not escape archive" }, 400);
       }
@@ -6817,8 +6855,8 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
         });
       }, 15e3);
       cleanups.push(() => clearInterval(keepAlive));
-      await new Promise((resolve17) => {
-        stream.onAbort(() => resolve17());
+      await new Promise((resolve18) => {
+        stream.onAbort(() => resolve18());
       });
     } finally {
       for (const cleanup of cleanups) {
@@ -6834,15 +6872,15 @@ var events_default = app20;
 
 // packages/daemon/src/web/api/variants.ts
 import { existsSync as existsSync9, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8 } from "fs";
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 import { Hono as Hono24 } from "hono";
 
 // packages/daemon/src/lib/mind/spawn-server.ts
 import { spawn as spawn4 } from "child_process";
 import { closeSync, mkdirSync as mkdirSync8, openSync, readFileSync as readFileSync9 } from "fs";
-import { resolve as resolve13 } from "path";
+import { resolve as resolve14 } from "path";
 function tsxBin(cwd) {
-  return resolve13(cwd, "node_modules", ".bin", "tsx");
+  return resolve14(cwd, "node_modules", ".bin", "tsx");
 }
 function spawnServer(cwd, port, options) {
   if (options?.detached) {
@@ -6855,31 +6893,31 @@ function spawnAttached(cwd, port) {
     cwd,
     stdio: ["ignore", "pipe", "pipe"]
   });
-  return new Promise((resolve17) => {
-    const timeout = setTimeout(() => resolve17(null), 3e4);
+  return new Promise((resolve18) => {
+    const timeout = setTimeout(() => resolve18(null), 3e4);
     function checkOutput(data) {
       const match = data.toString().match(/listening on :(\d+)/);
       if (match) {
         clearTimeout(timeout);
-        resolve17({ child, actualPort: parseInt(match[1], 10) });
+        resolve18({ child, actualPort: parseInt(match[1], 10) });
       }
     }
     child.stdout?.on("data", checkOutput);
     child.stderr?.on("data", checkOutput);
     child.on("error", () => {
       clearTimeout(timeout);
-      resolve17(null);
+      resolve18(null);
     });
     child.on("exit", () => {
       clearTimeout(timeout);
-      resolve17(null);
+      resolve18(null);
     });
   });
 }
 function spawnDetached(cwd, port, logDir) {
-  const logsDir = logDir ?? resolve13(cwd, ".mind", "logs");
+  const logsDir = logDir ?? resolve14(cwd, ".mind", "logs");
   mkdirSync8(logsDir, { recursive: true });
-  const logPath = resolve13(logsDir, "mind.log");
+  const logPath = resolve14(logsDir, "mind.log");
   const logFd = openSync(logPath, "a");
   const child = spawn4(tsxBin(cwd), ["src/server.ts", "--port", String(port)], {
     cwd,
@@ -6995,11 +7033,11 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     return c.json({ error: `Name already in use: ${variantName}` }, 409);
   }
   const projectRoot = mindDir(mindName);
-  const variantDir = resolve14(projectRoot, ".variants", variantName);
+  const variantDir = resolve15(projectRoot, ".variants", variantName);
   if (existsSync9(variantDir)) {
     return c.json({ error: `Variant directory already exists: ${variantDir}` }, 409);
   }
-  mkdirSync9(resolve14(projectRoot, ".variants"), { recursive: true });
+  mkdirSync9(resolve15(projectRoot, ".variants"), { recursive: true });
   try {
     await gitExec(["worktree", "add", "-b", variantName, variantDir], { cwd: projectRoot });
   } catch (e) {
@@ -7012,7 +7050,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
       const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: variantDir,
-        env: { ...process.env, HOME: resolve14(variantDir, "home") }
+        env: { ...process.env, HOME: resolve15(variantDir, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: variantDir });
@@ -7022,7 +7060,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     return c.json({ error: `npm install failed: ${msg}` }, 500);
   }
   if (body.soul) {
-    writeFileSync8(resolve14(variantDir, "home/SOUL.md"), body.soul);
+    writeFileSync8(resolve15(variantDir, "home/SOUL.md"), body.soul);
   }
   const variantPort = body.port ?? await nextPort();
   await addVariant(variantName, mindName, variantPort, variantDir, variantName);
@@ -7117,8 +7155,8 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
   await cleanupVariant(variantName, projectRoot, variantEntry.dir);
   if (variantName.endsWith("-upgrade") || variantName === "upgrade") {
     try {
-      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-SSIBEEYK.js");
-      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-L272BZJR.js");
+      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-DMHSLRDX.js");
+      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-GV35XFT7.js");
       const tmpl = parentEntry.template ?? "claude";
       await setMindTemplateHash2(mindName, computeTemplateHash2(tmpl));
     } catch (err) {
@@ -7131,7 +7169,7 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
       const [cmd, args] = await wrapForIsolation("npm", ["install"], mindName);
       await exec(cmd, args, {
         cwd: projectRoot,
-        env: { ...process.env, HOME: resolve14(projectRoot, "home") }
+        env: { ...process.env, HOME: resolve15(projectRoot, "home") }
       });
     } else {
       await exec("npm", ["install"], { cwd: projectRoot });
@@ -7548,11 +7586,11 @@ var app23 = new Hono26().get("/:name/conversations/:id/events", async (c) => {
         if (!stream.aborted) console.error("[chat] SSE ping error:", err);
       });
     }, 15e3);
-    await new Promise((resolve17) => {
+    await new Promise((resolve18) => {
       stream.onAbort(() => {
         unsubscribe();
         clearInterval(keepAlive);
-        resolve17();
+        resolve18();
       });
     });
   });
@@ -7765,7 +7803,7 @@ var app_default = app25;
 import { existsSync as existsSync10 } from "fs";
 import { readFile as readFile2, stat as stat2 } from "fs/promises";
 import { createServer as createHttpsServer } from "https";
-import { dirname as dirname2, extname as extname3, resolve as resolve15 } from "path";
+import { dirname as dirname2, extname as extname3, resolve as resolve16 } from "path";
 import { serve } from "@hono/node-server";
 var MIME_TYPES2 = {
   ".html": "text/html",
@@ -7784,7 +7822,7 @@ async function startServer({
   let assetsDir = "";
   let searchDir = dirname2(new URL(import.meta.url).pathname);
   for (let i = 0; i < 5; i++) {
-    const candidate = resolve15(searchDir, "dist", "web-assets");
+    const candidate = resolve16(searchDir, "dist", "web-assets");
     if (existsSync10(candidate)) {
       assetsDir = candidate;
       break;
@@ -7795,20 +7833,20 @@ async function startServer({
     app_default.get("*", async (c) => {
       const urlPath = new URL(c.req.url).pathname;
       if (urlPath.startsWith("/api/") || urlPath.startsWith("/ext/")) return c.notFound();
-      const filePath = resolve15(assetsDir, urlPath.slice(1));
+      const filePath = resolve16(assetsDir, urlPath.slice(1));
       if (!filePath.startsWith(assetsDir)) return c.text("Forbidden", 403);
       const s = await stat2(filePath).catch(() => null);
       if (s?.isFile()) {
         const ext = extname3(filePath);
         const mime = MIME_TYPES2[ext] || "application/octet-stream";
         const body = await readFile2(filePath);
-        const basename = filePath.slice(filePath.lastIndexOf("/") + 1);
-        const nameWithoutExt = basename.slice(0, basename.lastIndexOf("."));
+        const basename2 = filePath.slice(filePath.lastIndexOf("/") + 1);
+        const nameWithoutExt = basename2.slice(0, basename2.lastIndexOf("."));
         const isHashed = /[-.][\da-f]{8,}$/.test(nameWithoutExt);
         const cacheControl = isHashed ? "public, max-age=31536000, immutable" : "no-cache";
         return c.body(body, 200, { "Content-Type": mime, "Cache-Control": cacheControl });
       }
-      const indexPath = resolve15(assetsDir, "index.html");
+      const indexPath = resolve16(assetsDir, "index.html");
       const indexStat = await stat2(indexPath).catch(() => null);
       if (indexStat?.isFile()) {
         const body = await readFile2(indexPath, "utf-8");
@@ -7825,10 +7863,10 @@ async function startServer({
       createServer: createHttpsServer,
       serverOptions: { key: tls.key, cert: tls.cert }
     });
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve18, reject) => {
       server2.on("listening", () => {
         logger_default.info("Volute UI running (https)", { hostname, port });
-        resolve17();
+        resolve18();
       });
       server2.on("error", (err) => {
         reject(err);
@@ -7836,13 +7874,13 @@ async function startServer({
     });
     const internalPort = port + 1;
     const internalServer = serve({ fetch: app_default.fetch, port: internalPort, hostname: "127.0.0.1" });
-    await new Promise((resolve17, reject) => {
+    await new Promise((resolve18, reject) => {
       internalServer.on("listening", () => {
         logger_default.info("Volute API running (http, internal)", {
           hostname: "127.0.0.1",
           port: internalPort
         });
-        resolve17();
+        resolve18();
       });
       internalServer.on("error", (err) => {
         reject(err);
@@ -7851,10 +7889,10 @@ async function startServer({
     return { server: server2, internalPort };
   }
   const server = serve({ fetch: app_default.fetch, port, hostname });
-  await new Promise((resolve17, reject) => {
+  await new Promise((resolve18, reject) => {
     server.on("listening", () => {
       logger_default.info("Volute API running (http)", { hostname, port });
-      resolve17();
+      resolve18();
     });
     server.on("error", (err) => {
       reject(err);
@@ -7865,7 +7903,7 @@ async function startServer({
 
 // packages/daemon/src/daemon.ts
 if (!process.env.VOLUTE_HOME) {
-  process.env.VOLUTE_HOME = resolve16(homedir3(), ".volute");
+  process.env.VOLUTE_HOME = resolve17(homedir3(), ".volute");
 }
 if (process.env.VOLUTE_TIMEZONE && !process.env.TZ) {
   process.env.TZ = process.env.VOLUTE_TIMEZONE;
@@ -7876,7 +7914,7 @@ async function startDaemon(opts) {
   const home = voluteHome();
   const systemDir = voluteSystemDir();
   if (!opts.foreground) {
-    const rotatingLog = new RotatingLog(resolve16(systemDir, "daemon.log"));
+    const rotatingLog = new RotatingLog(resolve17(systemDir, "daemon.log"));
     logger_default.setOutput((line) => rotatingLog.write(`${line}
 `));
     const write = (...args) => rotatingLog.write(`${format(...args)}
@@ -7886,22 +7924,22 @@ async function startDaemon(opts) {
     console.warn = write;
     console.info = write;
   }
-  const DAEMON_PID_PATH = resolve16(systemDir, "daemon.pid");
-  const DAEMON_JSON_PATH = resolve16(systemDir, "daemon.json");
+  const DAEMON_PID_PATH = resolve17(systemDir, "daemon.pid");
+  const DAEMON_JSON_PATH = resolve17(systemDir, "daemon.json");
   mkdirSync10(home, { recursive: true });
   ensureSystemDir();
-  const { migrateSetupCompleted } = await import("./setup-IL7QJZN4.js");
+  const { migrateSetupCompleted } = await import("./setup-OTEC3ZPM.js");
   migrateSetupCompleted();
-  await (await import("./db-2GIS7HSG.js")).getDb();
+  await (await import("./db-ZEPKEJJD.js")).getDb();
   try {
     const { eq: eq7, and: and5 } = await import("drizzle-orm");
-    const { users: users2 } = await import("./schema-HHYJDG7B.js");
-    const db = await (await import("./db-2GIS7HSG.js")).getDb();
+    const { users: users2 } = await import("./schema-LYQUDL7G.js");
+    const db = await (await import("./db-ZEPKEJJD.js")).getDb();
     await db.update(users2).set({ role: "system" }).where(and5(eq7(users2.user_type, "system"), eq7(users2.role, "user")));
   } catch (err) {
     logger_default.warn("failed to migrate system user role", logger_default.errorData(err));
   }
-  const { initSandbox } = await import("./sandbox-BQAFYHLE.js");
+  const { initSandbox } = await import("./sandbox-5R32QKWQ.js");
   await initSandbox();
   try {
     await syncBuiltinSkills();
@@ -7928,7 +7966,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to ensure #system channel", logger_default.errorData(err));
   }
   try {
-    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-2IMZ6N5G.js");
+    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-X6ZITZ7D.js");
     await getOrCreateSystemUser2();
   } catch (err) {
     logger_default.warn(
@@ -7937,12 +7975,12 @@ async function startDaemon(opts) {
     );
   }
   const token = process.env.VOLUTE_DAEMON_TOKEN || randomBytes(32).toString("hex");
-  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-IL7QJZN4.js");
+  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-OTEC3ZPM.js");
   const globalCfg = readGlobalConfig2();
   let tls;
   if (opts.tailscale || globalCfg.tailscale) {
     try {
-      const { getTailscaleTls } = await import("./tailscale-6MHNLBAX.js");
+      const { getTailscaleTls } = await import("./tailscale-X4HRKRTW.js");
       const tlsConfig = await getTailscaleTls();
       tls = { key: tlsConfig.key, cert: tlsConfig.cert };
       logger_default.info("Tailscale HTTPS enabled", { hostname: tlsConfig.hostname });
@@ -8021,10 +8059,10 @@ async function startDaemon(opts) {
     await Promise.all(workers);
   }
   try {
-    const { isSetupComplete: isSetupComplete2 } = await import("./setup-IL7QJZN4.js");
+    const { isSetupComplete: isSetupComplete2 } = await import("./setup-OTEC3ZPM.js");
     if (isSetupComplete2()) {
-      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-7BUHSEO2.js");
-      const { startSpiritFull } = await import("./mind-service-7OD4PRO5.js");
+      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-T6GK5GEP.js");
+      const { startSpiritFull } = await import("./mind-service-X7FH3NA4.js");
       await ensureSpiritProject();
       await syncSpiritTemplate();
       const spiritEntry = await findMind("volute");
@@ -8041,7 +8079,7 @@ async function startDaemon(opts) {
   bridgeManager.startBridges(daemonPort).catch((err) => {
     logger_default.warn("failed to start bridges", logger_default.errorData(err));
   });
-  import("./cloud-sync-5JF2Z7VM.js").then(
+  import("./cloud-sync-GOSJZIHH.js").then(
     ({ consumeQueuedMessages }) => consumeQueuedMessages().catch((err) => {
       logger_default.warn("failed to consume queued cloud messages", logger_default.errorData(err));
     })
@@ -8049,7 +8087,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to load cloud-sync module", logger_default.errorData(err));
   });
   try {
-    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-NFQMI5IY.js");
+    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-DK6AHWX7.js");
     backfillTemplateHashes();
     notifyVersionUpdate().catch((err) => {
       logger_default.warn("failed to send version update notifications", logger_default.errorData(err));