volute 0.40.2 → 0.41.1

package/dist/daemon.js

@@ -6,31 +6,31 @@ import {
   rejectPending,
   stageFile,
   validateFilePath
-} from "./chunk-YHWGN4FX.js";
+} from "./chunk-M2YMNTHK.js";
 import {
   findOpenClawSession,
   importOpenClawConnectors,
   importPiSession,
   parseNameFromIdentity
-} from "./chunk-SVXOBKQY.js";
+} from "./chunk-KUJVCDWT.js";
 import {
   checkForUpdate,
   checkForUpdateCached,
   getCurrentVersion
-} from "./chunk-MNUXL4XN.js";
+} from "./chunk-E7XWFDZL.js";
 import {
   isHomeOnlyArchive
-} from "./chunk-I57LLNAQ.js";
+} from "./chunk-OEJFZHZZ.js";
 import {
   computeTemplateHash
-} from "./chunk-KAB6UGOL.js";
+} from "./chunk-QMJCNZ6C.js";
 import {
   PLATFORMS,
   echoTextToChannel,
   fixModelEscapes,
   getPlatformDriver,
   routeOutboundBridge
-} from "./chunk-WOWRLBL2.js";
+} from "./chunk-ULNQ6OC4.js";
 import {
   getBridgeConfig,
   readBridgesConfig,
@@ -39,12 +39,17 @@ import {
   resolveChannelMapping,
   setBridgeConfig,
   setChannelMapping
-} from "./chunk-PKGA23XM.js";
+} from "./chunk-QPTQKGGF.js";
 import {
   RestartTracker,
   RotatingLog,
+  SESSION_MAX_AGE,
   announceToSystem,
+  authMiddleware,
+  cleanExpiredSessions,
   clearDeliveredNotices,
+  createSession,
+  deleteSession,
   deleteSystemsConfig,
   deliverMessage,
   drainNotices,
@@ -58,6 +63,7 @@ import {
   getLoadedExtensions,
   getMindManager,
   getScheduler,
+  getSessionUserId,
   getSleepManagerIfReady,
   getTokenBudget,
   getTypingMap,
@@ -68,6 +74,8 @@ import {
   initSleepManager,
   initTokenBudget,
   installNpmExtension,
+  invalidateMindUserCache,
+  invalidateSessionCache,
   isConversationId,
   joinSystemChannel,
   linkToolResultToTurn,
@@ -79,7 +87,9 @@ import {
   recordInbound,
   recordNotice,
   recordOutbound,
-  resolveMindToken,
+  requireAdmin,
+  requireAdminOrSystem,
+  requireSelf,
   setExtensionEnabled,
   startMindFull,
   stopMindFull,
@@ -88,22 +98,24 @@ import {
   tagUntaggedOutbound,
   uninstallNpmExtension,
   writeSystemsConfig
-} from "./chunk-ZOI6D2YH.js";
+} from "./chunk-F44AEQAW.js";
 import {
   loadMergedEnv,
   mindEnvPath,
   readEnv,
   sharedEnvPath,
   writeEnv
-} from "./chunk-ITH5ZLZJ.js";
-import "./chunk-NRJ3ZYFP.js";
+} from "./chunk-BLOAJLGI.js";
+import "./chunk-MYJSKXGH.js";
 import {
   applyInitFiles,
+  applyTemplateHomeFiles,
   composeTemplate,
   copyTemplateToDir,
   findTemplatesRoot,
+  isKnownTemplate,
   listFiles
-} from "./chunk-46DYYHN6.js";
+} from "./chunk-QLWG3C2Z.js";
 import {
   SEED_SKILLS,
   STANDARD_SKILLS,
@@ -123,7 +135,7 @@ import {
   syncBuiltinSkills,
   uninstallSkill,
   updateSkill
-} from "./chunk-UX7FPDDO.js";
+} from "./chunk-MJIJFCAH.js";
 import {
   addMessage,
   createChannel,
@@ -155,20 +167,23 @@ import {
   setConversationPrivate,
   subscribe as subscribe2,
   updateChannelSettings
-} from "./chunk-3Y7UDHO7.js";
+} from "./chunk-YLTIEEVL.js";
 import {
   readVoluteConfig,
   writeVoluteConfig
 } from "./chunk-CU6OFXMM.js";
-import "./chunk-KMHC36CA.js";
+import {
+  isSandboxEnabled,
+  wrapForSandbox
+} from "./chunk-763WUVJQ.js";
 import {
   getActiveMinds,
   onMindEvent,
   stopAll
-} from "./chunk-42UMLIQR.js";
+} from "./chunk-VBKRZCR7.js";
 import {
   extractTextContent
-} from "./chunk-NERYUSER.js";
+} from "./chunk-62ICA2FF.js";
 import {
   PROMPT_DEFAULTS,
   PROMPT_KEYS,
@@ -191,12 +206,12 @@ import {
   summarizeTurn,
   takeErrored,
   trackToolUse
-} from "./chunk-YMMYN2V3.js";
+} from "./chunk-GCS64EAD.js";
 import {
   exec,
   gitExec,
   resolveVoluteBin
-} from "./chunk-AEAZRTEV.js";
+} from "./chunk-GN52E2DP.js";
 import {
   chownMindDir,
   createMindUser,
@@ -204,7 +219,7 @@ import {
   ensureVoluteGroup,
   isIsolationEnabled,
   wrapForIsolation
-} from "./chunk-6SYHHEQ7.js";
+} from "./chunk-TFBQESH7.js";
 import {
   getAiConfig,
   getAvailableModels,
@@ -221,12 +236,12 @@ import {
   setProviderRefreshHook,
   setUtilityModel,
   unqualifyModelId
-} from "./chunk-ZXPWTH4I.js";
+} from "./chunk-IJCZAYGT.js";
 import {
   isSetupComplete,
   readGlobalConfig,
   writeGlobalConfig
-} from "./chunk-DNU6XLE2.js";
+} from "./chunk-MA7MYEOK.js";
 import {
   approveUser,
   changePassword,
@@ -245,11 +260,11 @@ import {
   syncMindProfile,
   updateUserProfile,
   verifyUser
-} from "./chunk-E25SO3QW.js";
+} from "./chunk-5QG36RV7.js";
 import {
   broadcast,
   subscribe
-} from "./chunk-QYI65HCL.js";
+} from "./chunk-K547QOCM.js";
 import {
   logBuffer,
   logger_default
@@ -268,35 +283,36 @@ import {
   getBaseName,
   getDb,
   mindDir,
+  mindTmpDir,
   nextPort,
   readAllMinds,
   readRegistry,
   removeMind,
   setMindRunning,
   setMindStage,
+  setMindTemplate,
   setMindTemplateHash,
   stateDir,
   validateMindName,
   voluteHome,
   voluteSystemDir
-} from "./chunk-B4WPXYPI.js";
+} from "./chunk-IUZ3EV2D.js";
 import {
   activity,
   channels,
   conversationParticipants,
   conversations,
   mindHistory,
-  sessions,
   summaries,
   systemPrompts,
   turns,
   users
-} from "./chunk-2HZRJ35V.js";
-import "./chunk-LMMQX4CK.js";
+} from "./chunk-MHFAWJCC.js";
+import "./chunk-K3NQKI34.js";
 
 // packages/daemon/src/daemon.ts
 import { randomBytes } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
+import { chmodSync, mkdirSync as mkdirSync10, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
 import { resolve as resolve17 } from "path";
 import { format } from "util";
@@ -831,150 +847,6 @@ async function generateImage(model, prompt) {
   return PROVIDERS[providerId].generate(modelId, prompt, apiKey);
 }
 
-// packages/daemon/src/web/middleware/auth.ts
-import { timingSafeEqual } from "crypto";
-import { eq as eq2, lt as lt2 } from "drizzle-orm";
-import { getCookie } from "hono/cookie";
-import { createMiddleware } from "hono/factory";
-var MIND_USER_CACHE_TTL = 5 * 60 * 1e3;
-var mindUserCache = /* @__PURE__ */ new Map();
-function invalidateMindUserCache(mindName) {
-  mindUserCache.delete(mindName);
-}
-function isValidDaemonToken(token) {
-  const expected = process.env.VOLUTE_DAEMON_TOKEN;
-  if (!expected || token.length !== expected.length) return false;
-  return timingSafeEqual(Buffer.from(token), Buffer.from(expected));
-}
-var SESSION_MAX_AGE = 365 * 24 * 60 * 60 * 1e3;
-var SESSION_CACHE_TTL = 5 * 60 * 1e3;
-var sessionCache = /* @__PURE__ */ new Map();
-function invalidateSessionCache(sessionId) {
-  sessionCache.delete(sessionId);
-}
-async function createSession(userId) {
-  const db = await getDb();
-  const sessionId = crypto.randomUUID();
-  await db.insert(sessions).values({ id: sessionId, userId, createdAt: Date.now() });
-  return sessionId;
-}
-async function deleteSession(sessionId) {
-  sessionCache.delete(sessionId);
-  const db = await getDb();
-  await db.delete(sessions).where(eq2(sessions.id, sessionId));
-}
-async function getSessionUserId(sessionId) {
-  const db = await getDb();
-  const row = await db.select().from(sessions).where(eq2(sessions.id, sessionId)).get();
-  if (!row) return void 0;
-  if (Date.now() - row.createdAt > SESSION_MAX_AGE) {
-    await db.delete(sessions).where(eq2(sessions.id, sessionId));
-    return void 0;
-  }
-  return row.userId;
-}
-async function cleanExpiredSessions() {
-  const db = await getDb();
-  const cutoff = Date.now() - SESSION_MAX_AGE;
-  await db.delete(sessions).where(lt2(sessions.createdAt, cutoff));
-}
-var requireAdmin = createMiddleware(async (c, next) => {
-  const user = c.get("user");
-  if (user.role !== "admin") {
-    return c.json({ error: "Forbidden" }, 403);
-  }
-  await next();
-});
-var requireAdminOrSystem = createMiddleware(async (c, next) => {
-  const user = c.get("user");
-  if (user.role !== "admin" && user.role !== "system") {
-    return c.json({ error: "Forbidden" }, 403);
-  }
-  await next();
-});
-async function resolveSession(sessionId) {
-  const cached = sessionCache.get(sessionId);
-  if (cached && cached.expires > Date.now()) {
-    return cached.user;
-  }
-  const userId = await getSessionUserId(sessionId);
-  if (userId == null) {
-    sessionCache.delete(sessionId);
-    return null;
-  }
-  const user = await getUser(userId);
-  if (!user) {
-    sessionCache.delete(sessionId);
-    return null;
-  }
-  sessionCache.set(sessionId, { userId, user, expires: Date.now() + SESSION_CACHE_TTL });
-  return user;
-}
-var authMiddleware = createMiddleware(async (c, next) => {
-  const authHeader = c.req.header("Authorization");
-  if (authHeader?.startsWith("Bearer ")) {
-    const token = authHeader.slice(7);
-    if (token && isValidDaemonToken(token)) {
-      c.set("user", {
-        id: 0,
-        username: "daemon",
-        role: "admin",
-        user_type: "brain",
-        display_name: null,
-        description: null,
-        avatar: null
-      });
-      const mindSessionHeader = c.req.header("X-Volute-Session");
-      if (mindSessionHeader) c.set("mindSession", mindSessionHeader);
-      await next();
-      return;
-    }
-    const mindName = resolveMindToken(token);
-    if (mindName) {
-      const cached = mindUserCache.get(mindName);
-      let mindUser;
-      if (cached && Date.now() - cached.ts < MIND_USER_CACHE_TTL) {
-        mindUser = cached.user;
-      } else {
-        mindUser = await getOrCreateMindUser(mindName);
-        mindUserCache.set(mindName, { user: mindUser, ts: Date.now() });
-      }
-      c.set("user", mindUser);
-      const mindSessionHeader = c.req.header("X-Volute-Session");
-      if (mindSessionHeader) c.set("mindSession", mindSessionHeader);
-      await next();
-      return;
-    }
-    if (token) {
-      const user2 = await resolveSession(token);
-      if (user2) {
-        if (user2.role === "pending") return c.json({ error: "Account pending approval" }, 403);
-        c.set("user", user2);
-        await next();
-        return;
-      }
-    }
-  }
-  const sessionId = getCookie(c, "volute_session");
-  if (!sessionId) return c.json({ error: "Unauthorized" }, 401);
-  const user = await resolveSession(sessionId);
-  if (!user) return c.json({ error: "Unauthorized" }, 401);
-  if (user.role === "pending") return c.json({ error: "Account pending approval" }, 403);
-  c.set("user", user);
-  await next();
-});
-var requireSelf = (paramName = "name") => createMiddleware(async (c, next) => {
-  const user = c.get("user");
-  if (user.role !== "admin" && user.role !== "system") {
-    const target = c.req.param(paramName) ?? "";
-    const baseName = await getBaseName(target);
-    if (user.username !== baseName) {
-      return c.json({ error: "Forbidden" }, 403);
-    }
-  }
-  await next();
-});
-
 // packages/daemon/src/web/api/system.ts
 var DEFAULT_API_URL = "https://volute.systems";
 var igLog = logger_default.child("imagegen");
@@ -1629,7 +1501,7 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as rea
 import { extname, resolve as resolve3 } from "path";
 import { zValidator as zValidator2 } from "@hono/zod-validator";
 import { Hono as Hono3 } from "hono";
-import { deleteCookie, getCookie as getCookie2, setCookie } from "hono/cookie";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { z as z2 } from "zod";
 function tryJoinSystem(userId) {
   if (!process.env.VOLUTE_DAEMON_TOKEN) return;
@@ -1675,7 +1547,7 @@ var authenticated = new Hono3().use(authMiddleware).post("/change-password", zVa
   const user = c.get("user");
   const body = c.req.valid("json");
   await updateUserProfile(user.id, body);
-  const sessionId = getCookie2(c, "volute_session");
+  const sessionId = getCookie(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
   broadcast({
     type: "profile_updated",
@@ -1707,7 +1579,7 @@ var authenticated = new Hono3().use(authMiddleware).post("/change-password", zVa
     rmSync(oldPath, { force: true });
   }
   await updateUserProfile(user.id, { avatar: filename });
-  const sessionId = getCookie2(c, "volute_session");
+  const sessionId = getCookie(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
   broadcast({
     type: "profile_updated",
@@ -1722,7 +1594,7 @@ var authenticated = new Hono3().use(authMiddleware).post("/change-password", zVa
     rmSync(path, { force: true });
   }
   await updateUserProfile(user.id, { avatar: null });
-  const sessionId = getCookie2(c, "volute_session");
+  const sessionId = getCookie(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
   broadcast({
     type: "profile_updated",
@@ -1833,7 +1705,7 @@ var app3 = new Hono3().post("/register", zValidator2("json", credentialsSchema),
   tryJoinSystem(user.id);
   return c.json({ id: user.id, username: user.username, role: user.role, sessionId });
 }).post("/logout", async (c) => {
-  const cookieSession = getCookie2(c, "volute_session");
+  const cookieSession = getCookie(c, "volute_session");
   if (cookieSession) {
     await deleteSession(cookieSession);
     deleteCookie(c, "volute_session", { path: "/" });
@@ -1848,7 +1720,7 @@ var app3 = new Hono3().post("/register", zValidator2("json", credentialsSchema),
   }
   return c.json({ ok: true });
 }).get("/me", async (c) => {
-  let sessionId = getCookie2(c, "volute_session");
+  let sessionId = getCookie(c, "volute_session");
   if (!sessionId) {
     const authHeader = c.req.header("Authorization");
     if (authHeader?.startsWith("Bearer ")) {
@@ -1895,7 +1767,7 @@ import { Hono as Hono4 } from "hono";
 import { z as z3 } from "zod";
 
 // packages/daemon/src/lib/chat/puppets.ts
-import { and as and2, eq as eq3 } from "drizzle-orm";
+import { and as and2, eq as eq2 } from "drizzle-orm";
 async function findOrCreatePuppet(platform, platformId, displayName) {
   const username = `${platform}:${platformId}`;
   const db = await getDb();
@@ -1904,10 +1776,10 @@ async function findOrCreatePuppet(platform, platformId, displayName) {
     username: users.username,
     display_name: users.display_name,
     avatar: users.avatar
-  }).from(users).where(and2(eq3(users.username, username), eq3(users.user_type, "puppet"))).get();
+  }).from(users).where(and2(eq2(users.username, username), eq2(users.user_type, "puppet"))).get();
   if (existing) {
     if (existing.display_name !== displayName) {
-      await db.update(users).set({ display_name: displayName }).where(eq3(users.id, existing.id));
+      await db.update(users).set({ display_name: displayName }).where(eq2(users.id, existing.id));
       existing.display_name = displayName;
     }
     return existing;
@@ -1933,7 +1805,7 @@ async function findOrCreatePuppet(platform, platformId, displayName) {
         username: users.username,
         display_name: users.display_name,
         avatar: users.avatar
-      }).from(users).where(and2(eq3(users.username, username), eq3(users.user_type, "puppet"))).get();
+      }).from(users).where(and2(eq2(users.username, username), eq2(users.user_type, "puppet"))).get();
       if (retried) return retried;
     }
     throw err;
@@ -2013,7 +1885,7 @@ var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSch
   }
   const participants = await getParticipants(channel.id);
   if (!participants.some((p) => p.userId === puppet.id)) {
-    const { addParticipant } = await import("./conversations-AYLXPOGC.js");
+    const { addParticipant } = await import("./conversations-FSZCUUYO.js");
     await addParticipant(channel.id, puppet.id);
   }
   const contentBlocks = body.content;
@@ -2106,8 +1978,8 @@ async function fanOutToBridgedMinds(opts) {
   const participants = await getParticipants(opts.conversationId);
   const mindParticipants = participants.filter((p) => p.userType === "mind");
   const participantNames = participants.map((p) => p.username);
-  const { getMindManager: getMindManager2 } = await import("./mind-manager-4NFK4GEU.js");
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
+  const { getMindManager: getMindManager2 } = await import("./mind-manager-74XQZEGX.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-OHM3TO62.js");
   const manager = getMindManager2();
   const sm = getSleepManagerIfReady2();
   const targetMinds = mindParticipants.filter((ap) => {
@@ -2319,7 +2191,7 @@ async function notifyMind(mindName, message) {
   const entry = await findMind(mindName);
   if (!entry) return;
   try {
-    const { sendSystemMessage } = await import("./system-chat-7CA2PP6A.js");
+    const { sendSystemMessage } = await import("./system-chat-HZUKBIKJ.js");
     await sendSystemMessage(mindName, message);
   } catch (err) {
     logger_default.warn(`[file-sharing] notify mind ${mindName} failed`, logger_default.errorData(err));
@@ -2629,18 +2501,25 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
 var files_default = app9;
 
 // packages/daemon/src/web/api/history.ts
-import { and as and3, desc as desc2, eq as eq4, gte, inArray, sql } from "drizzle-orm";
+import { and as and3, desc as desc2, eq as eq3, gte, inArray, sql } from "drizzle-orm";
 import { Hono as Hono11 } from "hono";
+async function resolveMindFilter(c) {
+  const user = c.get("user");
+  if (user.role === "admin" || user.role === "system") {
+    return c.req.query("mind") ?? void 0;
+  }
+  return getBaseName(user.username);
+}
 var history = new Hono11().get("/turns", async (c) => {
-  const mindFilter = c.req.query("mind");
+  const mindFilter = await resolveMindFilter(c);
   const turnIdFilter = c.req.query("turnId");
   const turnIdsFilter = c.req.query("turnIds");
   const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 200);
   const offset = Math.max(parseInt(c.req.query("offset") ?? "0", 10) || 0, 0);
   const db = await getDb();
   const conditions = [];
-  if (mindFilter) conditions.push(eq4(turns.mind, mindFilter));
-  if (turnIdFilter) conditions.push(eq4(turns.id, turnIdFilter));
+  if (mindFilter) conditions.push(eq3(turns.mind, mindFilter));
+  if (turnIdFilter) conditions.push(eq3(turns.id, turnIdFilter));
   if (turnIdsFilter) {
     const ids = turnIdsFilter.split(",").filter(Boolean);
     if (ids.length > 0) conditions.push(inArray(turns.id, ids));
@@ -2648,7 +2527,7 @@ var history = new Hono11().get("/turns", async (c) => {
   const turnRows = await db.select().from(turns).where(conditions.length > 0 ? and3(...conditions) : void 0).orderBy(desc2(turns.created_at)).limit(limit).offset(offset);
   if (turnRows.length === 0) return c.json([]);
   const turnIds = turnRows.map((t) => t.id);
-  const summaryRows = await db.select().from(summaries).where(and3(eq4(summaries.period, "turn"), inArray(summaries.period_key, turnIds)));
+  const summaryRows = await db.select().from(summaries).where(and3(eq3(summaries.period, "turn"), inArray(summaries.period_key, turnIds)));
   const summaryByTurn = /* @__PURE__ */ new Map();
   for (const s of summaryRows) {
     summaryByTurn.set(s.period_key, { content: s.content, metadata: s.metadata });
@@ -2773,15 +2652,15 @@ var history = new Hono11().get("/turns", async (c) => {
           db.select({
             conversation_id: conversationParticipants.conversation_id,
             username: users.username
-          }).from(conversationParticipants).innerJoin(users, eq4(conversationParticipants.user_id, users.id))
+          }).from(conversationParticipants).innerJoin(users, eq3(conversationParticipants.user_id, users.id))
         );
         const dmRows = await db.with(cp2).select({
           id: conversations.id,
           targetUsername: users.username
         }).from(conversations).innerJoin(
           conversationParticipants,
-          eq4(conversations.id, conversationParticipants.conversation_id)
-        ).innerJoin(users, eq4(conversationParticipants.user_id, users.id)).where(and3(eq4(conversations.type, "dm"), inArray(users.username, targetNames)));
+          eq3(conversations.id, conversationParticipants.conversation_id)
+        ).innerJoin(users, eq3(conversationParticipants.user_id, users.id)).where(and3(eq3(conversations.type, "dm"), inArray(users.username, targetNames)));
         const dmCandidates = [];
         for (const row of dmRows) {
           const slug = `@${row.targetUsername}`;
@@ -2796,7 +2675,7 @@ var history = new Hono11().get("/turns", async (c) => {
           const verifyRows = await db.select({
             conversation_id: conversationParticipants.conversation_id,
             username: users.username
-          }).from(conversationParticipants).innerJoin(users, eq4(conversationParticipants.user_id, users.id)).where(
+          }).from(conversationParticipants).innerJoin(users, eq3(conversationParticipants.user_id, users.id)).where(
             and3(
               inArray(conversationParticipants.conversation_id, candidateConvIds),
               inArray(users.username, allMindNames)
@@ -2874,7 +2753,7 @@ var history = new Hono11().get("/turns", async (c) => {
   });
   return c.json(result);
 }).get("/events", async (c) => {
-  const mindFilter = c.req.query("mind");
+  const mindFilter = await resolveMindFilter(c);
   const stream = new ReadableStream({
     start(controller) {
       const encoder = new TextEncoder();
@@ -2929,7 +2808,9 @@ var history = new Hono11().get("/turns", async (c) => {
     }
   });
 }).get("/summaries", async (c) => {
-  const mind = c.req.query("mind") ?? "_system";
+  const user = c.get("user");
+  const privileged = user.role === "admin" || user.role === "system";
+  const mind = privileged ? c.req.query("mind") ?? "_system" : await getBaseName(user.username);
   const period = c.req.query("period");
   const ids = c.req.query("ids");
   const from = c.req.query("from");
@@ -2939,7 +2820,9 @@ var history = new Hono11().get("/turns", async (c) => {
     const db2 = await getDb();
     const idList = ids.split(",").map((s) => parseInt(s, 10)).filter((n) => !Number.isNaN(n));
     if (idList.length === 0) return c.json([]);
-    const rows2 = await db2.select().from(summaries).where(inArray(summaries.id, idList));
+    const idConditions = [inArray(summaries.id, idList)];
+    if (!privileged) idConditions.push(eq3(summaries.mind, mind));
+    const rows2 = await db2.select().from(summaries).where(and3(...idConditions));
     const result2 = rows2.map((r) => {
       let metadata = null;
       if (r.metadata) {
@@ -2957,7 +2840,7 @@ var history = new Hono11().get("/turns", async (c) => {
     return c.json({ error: "period is required (turn, hour, day, week, month)" }, 400);
   }
   const db = await getDb();
-  const conditions = [eq4(summaries.mind, mind), eq4(summaries.period, period)];
+  const conditions = [eq3(summaries.mind, mind), eq3(summaries.period, period)];
   if (from) conditions.push(gte(summaries.period_key, from));
   if (to) conditions.push(sql`${summaries.period_key} <= ${to}`);
   const rows = await db.select({
@@ -2982,13 +2865,13 @@ var history = new Hono11().get("/turns", async (c) => {
   });
   return c.json(result);
 }).get("/activity", async (c) => {
-  const mind = c.req.query("mind");
+  const mind = await resolveMindFilter(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
   const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "100", 10) || 100, 1), 500);
   const db = await getDb();
   const conditions = [];
-  if (mind) conditions.push(eq4(activity.mind, mind));
+  if (mind) conditions.push(eq3(activity.mind, mind));
   if (from) conditions.push(gte(activity.created_at, from));
   if (to) conditions.push(sql`${activity.created_at} <= ${to}`);
   conditions.push(
@@ -3243,7 +3126,7 @@ import {
 } from "fs";
 import { basename, resolve as resolve11 } from "path";
 import { zValidator as zValidator5 } from "@hono/zod-validator";
-import { and as and4, desc as desc3, eq as eq5, sql as sql2 } from "drizzle-orm";
+import { and as and4, desc as desc3, eq as eq4, sql as sql2 } from "drizzle-orm";
 import { Hono as Hono15 } from "hono";
 import { z as z5 } from "zod";
 
@@ -3365,7 +3248,7 @@ async function cleanupVariant(variantName, projectRoot, variantPath, opts) {
       logger_default.warn(`failed to stop variant ${variantName}`, logger_default.errorData(err));
     }
   }
-  const { findMind: findMind2 } = await import("./registry-GV35XFT7.js");
+  const { findMind: findMind2 } = await import("./registry-MDLNPTTI.js");
   const variantEntry = await findMind2(variantName);
   const branchName = variantEntry?.branch ?? variantName;
   if (existsSync6(variantPath)) {
@@ -3622,7 +3505,7 @@ async function getMindStatus(name, port, registryRunning) {
   const manager = getMindManager();
   let status = "stopped";
   try {
-    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
+    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-OHM3TO62.js");
     if (getSleepManagerIfReady2()?.isSleeping(name)) {
       status = "sleeping";
     }
@@ -3754,7 +3637,8 @@ async function npmInstallAsMind(cwd, mindName) {
     await exec("npm", ["install"], { cwd });
   }
 }
-async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariantName, upgradeBranch, template) {
+async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariantName, upgradeBranch, template, oldTemplate) {
+  const templateChanged = template !== oldTemplate;
   const mainStatus = (await gitExec(["status", "--porcelain"], { cwd: dir })).trim();
   if (mainStatus) {
     await gitExec(["add", "-A"], { cwd: dir });
@@ -3770,10 +3654,33 @@ async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariant
     await gitExec(["branch", "-D", upgradeBranch], { cwd: dir });
   } catch {
   }
+  let switchWarning;
+  if (templateChanged) {
+    try {
+      applyTemplateHomeFiles(resolve11(dir, "home"), template);
+      await gitExec(["add", "home/"], { cwd: dir });
+      try {
+        await gitExec(["diff", "--cached", "--quiet"], { cwd: dir });
+      } catch {
+        await gitExec(["commit", "-m", `swap template-owned home files for ${template}`], {
+          cwd: dir
+        });
+      }
+      chownMindDir(dir, mindName);
+      switchWarning = `Switched ${oldTemplate}\u2192${template}: config reset to ${template} defaults, mechanics doc replaced, conversation starts fresh (sessions aren't portable across runtimes).`;
+    } catch (err) {
+      logger_default.warn(`failed to swap template home files for ${mindName}`, logger_default.errorData(err));
+      return {
+        ok: true,
+        warning: `Upgrade merged but template switch ${oldTemplate}\u2192${template} failed: ${err instanceof Error ? err.message : String(err)}. The mind is still registered as ${oldTemplate}; re-run the switch or fix home/ manually.`
+      };
+    }
+  }
   try {
     await setMindTemplateHash(mindName, computeTemplateHash(template));
+    await setMindTemplate(mindName, template);
   } catch (err) {
-    logger_default.warn(`failed to update template hash for ${mindName}`, logger_default.errorData(err));
+    logger_default.warn(`failed to update template for ${mindName}`, logger_default.errorData(err));
   }
   try {
     await npmInstallAsMind(dir, mindName);
@@ -3797,7 +3704,7 @@ async function mergeUpgradeAndRestart(mindName, dir, worktreeDir, upgradeVariant
       warning: `Upgrade merged but mind restart failed: ${e instanceof Error ? e.message : String(e)}`
     };
   }
-  return { ok: true };
+  return { ok: true, warning: switchWarning };
 }
 async function importFromArchive(c, tempDir, nameOverride, manifest) {
   const extractedMindDir = resolve11(tempDir, "mind");
@@ -4093,7 +4000,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     applyInitFiles(dest);
     const { publicKeyPem } = generateIdentity(dest);
     {
-      const { readGlobalConfig: readGlobal } = await import("./setup-OTEC3ZPM.js");
+      const { readGlobalConfig: readGlobal } = await import("./setup-FPFWDMXD.js");
       const mindDefaults = readGlobal().mindDefaults;
       const config2 = readVoluteConfig(dest);
       if (!config2) throw new Error("Failed to read volute.json after identity generation");
@@ -4184,7 +4091,7 @@ The human who planted you described you as: "${body.description}"
     }
     let skillSet = body.skills ?? (body.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions());
     if (body.stage === "seed" && !body.skills) {
-      const { isImagegenEnabled } = await import("./setup-OTEC3ZPM.js");
+      const { isImagegenEnabled } = await import("./setup-FPFWDMXD.js");
       if (isImagegenEnabled()) {
         skillSet = [...skillSet, "imagegen"];
       }
@@ -4202,7 +4109,7 @@ The human who planted you described you as: "${body.description}"
       try {
         const spiritEntry = await findMind("volute");
         if (spiritEntry) {
-          const { spiritDir } = await import("./spirit-T6GK5GEP.js");
+          const { spiritDir } = await import("./spirit-ONLRFATY.js");
           const sDir = spiritEntry.dir ?? spiritDir();
           const spiritConfig = readVoluteConfig(sDir) ?? {};
           const schedules = spiritConfig.schedules ?? [];
@@ -4217,7 +4124,7 @@ The human who planted you described you as: "${body.description}"
             });
             spiritConfig.schedules = schedules;
             writeVoluteConfig(sDir, spiritConfig);
-            const { getScheduler: getScheduler2 } = await import("./scheduler-PDARH4CE.js");
+            const { getScheduler: getScheduler2 } = await import("./scheduler-MEBQF5MW.js");
             getScheduler2().loadSchedules("volute", sDir);
           }
         }
@@ -4482,7 +4389,7 @@ ${user.trimEnd()}
   const manager = getMindManager();
   try {
     if (context?.type === "reload") {
-      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
+      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-OHM3TO62.js");
       const sleepState = getSleepManagerIfReady2()?.getState(name);
       if (sleepState?.sleeping) {
         logger_default.info(`skipping reload for ${name} during sleep \u2014 will apply on next wake`);
@@ -4577,7 +4484,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-OHM3TO62.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   return c.json(sm.getState(name));
@@ -4585,7 +4492,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-OHM3TO62.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   if (sm.isSleeping(name)) return c.json({ error: "Mind is already sleeping" }, 409);
@@ -4605,7 +4512,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-OHM3TO62.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const sleepState = sm.getState(name);
@@ -4620,7 +4527,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-TTNOLIX5.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-OHM3TO62.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const flushed = await sm.flushQueuedMessages(name);
@@ -4638,7 +4545,7 @@ ${user.trimEnd()}
   if (body.avatar !== void 0) profile.avatar = basename(body.avatar);
   config2.profile = profile;
   writeVoluteConfig(dir, config2);
-  const { syncMindProfile: syncMindProfile2 } = await import("./auth-X6ZITZ7D.js");
+  const { syncMindProfile: syncMindProfile2 } = await import("./auth-EAASQPTN.js");
   await syncMindProfile2(name, profile);
   broadcast({ type: "profile_updated", mind: name, summary: `${name} profile updated` });
   return c.json({ ok: true });
@@ -4655,8 +4562,8 @@ ${user.trimEnd()}
   const spiritThreshold = Number.isNaN(rawSpirit) ? 15 : rawSpirit;
   const lastCreatorMsg = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(
     and4(
-      eq5(mindHistory.mind, name),
-      eq5(mindHistory.type, "inbound"),
+      eq4(mindHistory.mind, name),
+      eq4(mindHistory.type, "inbound"),
       sql2`${mindHistory.sender} != 'volute'`,
       sql2`${mindHistory.sender} != ${name}`,
       sql2`${mindHistory.sender} IS NOT NULL`
@@ -4664,9 +4571,9 @@ ${user.trimEnd()}
   ).orderBy(desc3(mindHistory.created_at)).limit(1);
   const lastSpiritMsg = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(
     and4(
-      eq5(mindHistory.mind, name),
-      eq5(mindHistory.type, "inbound"),
-      eq5(mindHistory.sender, "volute")
+      eq4(mindHistory.mind, name),
+      eq4(mindHistory.type, "inbound"),
+      eq4(mindHistory.sender, "volute")
     )
   ).orderBy(desc3(mindHistory.created_at)).limit(1);
   const now = Date.now();
@@ -4685,7 +4592,7 @@ ${user.trimEnd()}
   const config2 = readVoluteConfig(dir);
   const displayNameSet = !!config2?.profile?.displayName;
   const avatarSet = !!config2?.profile?.avatar;
-  const { isImagegenEnabled } = await import("./setup-OTEC3ZPM.js");
+  const { isImagegenEnabled } = await import("./setup-FPFWDMXD.js");
   const imagegenEnabled = isImagegenEnabled();
   const done = [];
   const remaining = [];
@@ -4723,7 +4630,7 @@ ${user.trimEnd()}
   try {
     const spiritEntry = await findMind("volute");
     if (spiritEntry) {
-      const { spiritDir } = await import("./spirit-T6GK5GEP.js");
+      const { spiritDir } = await import("./spirit-ONLRFATY.js");
       const sDir = spiritEntry.dir ?? spiritDir();
       const spiritConfig = readVoluteConfig(sDir);
       if (spiritConfig?.schedules) {
@@ -4731,7 +4638,7 @@ ${user.trimEnd()}
         spiritConfig.schedules = spiritConfig.schedules.filter((s) => s.id !== nurtureId);
         if (spiritConfig.schedules.length === 0) spiritConfig.schedules = void 0;
         writeVoluteConfig(sDir, spiritConfig);
-        const { getScheduler: getScheduler2 } = await import("./scheduler-PDARH4CE.js");
+        const { getScheduler: getScheduler2 } = await import("./scheduler-MEBQF5MW.js");
         getScheduler2().loadSchedules("volute", sDir);
       }
     }
@@ -4783,7 +4690,11 @@ ${user.trimEnd()}
     body = await c.req.json();
   } catch {
   }
-  const template = body.template ?? entry.template ?? "claude";
+  const oldTemplate = entry.template ?? "claude";
+  const template = body.template ?? oldTemplate;
+  if (!isKnownTemplate(template)) {
+    return c.json({ error: `Unknown template: ${template}` }, 400);
+  }
   const UPGRADE_BRANCH = "upgrade";
   const upgradeVariantName = `${mindName}-upgrade`;
   const worktreeDir = resolve11(dir, ".variants", UPGRADE_BRANCH);
@@ -4852,7 +4763,8 @@ ${user.trimEnd()}
         worktreeDir,
         upgradeVariantName,
         UPGRADE_BRANCH,
-        template
+        template,
+        oldTemplate
       );
       return c.json(result);
     } catch (err) {
@@ -4984,7 +4896,8 @@ ${user.trimEnd()}
       worktreeDir,
       upgradeVariantName,
       UPGRADE_BRANCH,
-      template
+      template,
+      oldTemplate
     );
     return c.json(result);
   } catch (err) {
@@ -5160,7 +5073,7 @@ ${user.trimEnd()}
     }
     writeVoluteConfig(dir, existing);
     if (body.unescapeNewlines !== void 0) {
-      const { clearEchoTextCache } = await import("./echo-text-JUNRP4ER.js");
+      const { clearEchoTextCache } = await import("./echo-text-GEDEEY7M.js");
       clearEchoTextCache(name);
     }
     const needsConfigJson = body.model !== void 0 || body.thinkingLevel !== void 0 || body.maxThinkingTokens !== void 0 || body.compaction !== void 0;
@@ -5237,7 +5150,7 @@ ${user.trimEnd()}
     }
     if (entry.mindType === "spirit" && body.model !== void 0) {
       try {
-        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-OTEC3ZPM.js");
+        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-FPFWDMXD.js");
         const globalConfig = readGlobalConfig2();
         globalConfig.spiritModel = body.model;
         writeGlobalConfig2(globalConfig);
@@ -5265,7 +5178,7 @@ ${user.trimEnd()}
   if (!body.systemPrompt || !body.message) {
     return c.json({ error: "systemPrompt and message required" }, 400);
   }
-  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-EVLKMAJD.js");
+  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-XCLE3MQP.js");
   if (!isAiConfigured()) {
     return c.json({ error: "AI service not configured" }, 503);
   }
@@ -5538,18 +5451,18 @@ ${user.trimEnd()}
     event_count: sql2`COUNT(*)`,
     message_count: sql2`SUM(CASE WHEN ${mindHistory.type} IN ('inbound','outbound') THEN 1 ELSE 0 END)`,
     tool_count: sql2`SUM(CASE WHEN ${mindHistory.type}='tool_use' THEN 1 ELSE 0 END)`
-  }).from(mindHistory).where(and4(eq5(mindHistory.mind, name), sql2`${mindHistory.session} IS NOT NULL`)).groupBy(mindHistory.session).orderBy(sql2`MIN(${mindHistory.created_at}) DESC`);
+  }).from(mindHistory).where(and4(eq4(mindHistory.mind, name), sql2`${mindHistory.session} IS NOT NULL`)).groupBy(mindHistory.session).orderBy(sql2`MIN(${mindHistory.created_at}) DESC`);
   return c.json(rows);
 }).get("/:name/history/channels", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const db = await getDb();
-  const rows = await db.selectDistinct({ channel: mindHistory.channel }).from(mindHistory).where(eq5(mindHistory.mind, name));
+  const rows = await db.selectDistinct({ channel: mindHistory.channel }).from(mindHistory).where(eq4(mindHistory.mind, name));
   return c.json(rows.map((r) => r.channel));
 }).get("/:name/history/export", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const db = await getDb();
-  const rows = await db.select().from(mindHistory).where(eq5(mindHistory.mind, name));
+  const rows = await db.select().from(mindHistory).where(eq4(mindHistory.mind, name));
   return c.json(rows);
 }).get("/:name/history/turn", requireSelf(), async (c) => {
   const name = c.req.param("name");
@@ -5559,7 +5472,7 @@ ${user.trimEnd()}
   const typeFilter = detail ? void 0 : sql2`${mindHistory.type} IN ('inbound','outbound','tool_use','tool_result','text','thinking','activity')`;
   let rows;
   if (turnId) {
-    rows = await db.select().from(mindHistory).where(and4(eq5(mindHistory.mind, name), eq5(mindHistory.turn_id, turnId), typeFilter)).orderBy(mindHistory.id);
+    rows = await db.select().from(mindHistory).where(and4(eq4(mindHistory.mind, name), eq4(mindHistory.turn_id, turnId), typeFilter)).orderBy(mindHistory.id);
   } else {
     const session = c.req.query("session");
     const fromId = parseInt(c.req.query("from_id") ?? "", 10);
@@ -5569,8 +5482,8 @@ ${user.trimEnd()}
     }
     rows = await db.select().from(mindHistory).where(
       and4(
-        eq5(mindHistory.mind, name),
-        eq5(mindHistory.session, session),
+        eq4(mindHistory.mind, name),
+        eq4(mindHistory.session, session),
         sql2`${mindHistory.id} >= ${fromId}`,
         sql2`${mindHistory.id} <= ${toId}`,
         typeFilter
@@ -5586,13 +5499,13 @@ ${user.trimEnd()}
   if (currentSession) {
     const lastTurn = await db.select({ turn_id: mindHistory.turn_id }).from(mindHistory).where(
       and4(
-        eq5(mindHistory.mind, name),
-        eq5(mindHistory.session, currentSession),
+        eq4(mindHistory.mind, name),
+        eq4(mindHistory.session, currentSession),
         sql2`${mindHistory.turn_id} IS NOT NULL`
       )
     ).orderBy(desc3(mindHistory.created_at)).limit(1);
     if (lastTurn.length > 0 && lastTurn[0].turn_id) {
-      const firstEvent = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(eq5(mindHistory.turn_id, lastTurn[0].turn_id)).orderBy(mindHistory.created_at).limit(1);
+      const firstEvent = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(eq4(mindHistory.turn_id, lastTurn[0].turn_id)).orderBy(mindHistory.created_at).limit(1);
       if (firstEvent.length > 0) {
         sinceTimestamp = firstEvent[0].created_at;
       }
@@ -5602,8 +5515,8 @@ ${user.trimEnd()}
     sinceTimestamp = new Date(Date.now() - 36e5).toISOString().replace("T", " ").slice(0, 19);
   }
   const conditions = [
-    eq5(summaries.mind, name),
-    eq5(summaries.period, "turn"),
+    eq4(summaries.mind, name),
+    eq4(summaries.period, "turn"),
     sql2`${summaries.created_at} > ${sinceTimestamp}`
   ];
   if (currentSession) {
@@ -5613,7 +5526,7 @@ ${user.trimEnd()}
     session: turns.session,
     content: summaries.content,
     created_at: summaries.created_at
-  }).from(summaries).innerJoin(turns, eq5(turns.id, summaries.period_key)).where(and4(...conditions)).orderBy(desc3(summaries.created_at)).limit(50);
+  }).from(summaries).innerJoin(turns, eq4(turns.id, summaries.period_key)).where(and4(...conditions)).orderBy(desc3(summaries.created_at)).limit(50);
   if (rows.length === 0) {
     return c.json({ context: null });
   }
@@ -5643,18 +5556,18 @@ ${lines.join("\n")}` });
   const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 200);
   const offset = Math.max(parseInt(c.req.query("offset") ?? "0", 10) || 0, 0);
   const db = await getDb();
-  const conditions = [eq5(mindHistory.mind, name)];
+  const conditions = [eq4(mindHistory.mind, name)];
   if (channel) {
-    conditions.push(eq5(mindHistory.channel, channel));
+    conditions.push(eq4(mindHistory.channel, channel));
   }
   if (session) {
-    conditions.push(eq5(mindHistory.session, session));
+    conditions.push(eq4(mindHistory.session, session));
   }
   const effectivePreset = full ? "all" : preset;
   if (!effectivePreset || effectivePreset === "summary") {
-    const sumConditions = [eq5(summaries.mind, name), eq5(summaries.period, "turn")];
+    const sumConditions = [eq4(summaries.mind, name), eq4(summaries.period, "turn")];
     if (session) {
-      sumConditions.push(eq5(turns.session, session));
+      sumConditions.push(eq4(turns.session, session));
       const sumRows2 = await db.select({
         id: summaries.id,
         mind: summaries.mind,
@@ -5664,7 +5577,7 @@ ${lines.join("\n")}` });
         metadata: summaries.metadata,
         created_at: summaries.created_at,
         session: turns.session
-      }).from(summaries).innerJoin(turns, eq5(turns.id, summaries.period_key)).where(and4(...sumConditions)).orderBy(desc3(summaries.created_at)).limit(limit).offset(offset);
+      }).from(summaries).innerJoin(turns, eq4(turns.id, summaries.period_key)).where(and4(...sumConditions)).orderBy(desc3(summaries.created_at)).limit(limit).offset(offset);
       return c.json(
         sumRows2.map((r) => ({
           id: r.id,
@@ -5717,7 +5630,7 @@ var minds_default = app13;
 
 // packages/daemon/src/web/api/prompts.ts
 import { zValidator as zValidator6 } from "@hono/zod-validator";
-import { eq as eq6, sql as sql3 } from "drizzle-orm";
+import { eq as eq5, sql as sql3 } from "drizzle-orm";
 import { Hono as Hono16 } from "hono";
 import { z as z6 } from "zod";
 var app14 = new Hono16().get("/", async (c) => {
@@ -5761,7 +5674,7 @@ var app14 = new Hono16().get("/", async (c) => {
     return c.json({ error: "Unknown prompt key" }, 404);
   }
   const db = await getDb();
-  await db.delete(systemPrompts).where(eq6(systemPrompts.key, key));
+  await db.delete(systemPrompts).where(eq5(systemPrompts.key, key));
   return c.json({ ok: true });
 });
 var prompts_default = app14;
@@ -6009,7 +5922,7 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
   const body = await c.req.text();
   const message = `[webhook: ${event}] ${body}`;
   try {
-    const { sendSystemMessage } = await import("./system-chat-7CA2PP6A.js");
+    const { sendSystemMessage } = await import("./system-chat-HZUKBIKJ.js");
     await sendSystemMessage(name, message);
     return c.json({ ok: true });
   } catch (err) {
@@ -6063,7 +5976,7 @@ setup.get("/status", async (c) => {
   let hasAccount = false;
   if (hasSystem) {
     try {
-      const { listUsersByType: listUsersByType2 } = await import("./auth-X6ZITZ7D.js");
+      const { listUsersByType: listUsersByType2 } = await import("./auth-EAASQPTN.js");
       const brains = await listUsersByType2("brain");
       hasAccount = brains.length > 0;
     } catch (err) {
@@ -6274,7 +6187,7 @@ setup.post("/account", async (c) => {
     }
   }
   try {
-    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-X6ZITZ7D.js");
+    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-EAASQPTN.js");
     const user = await createUser2(body.username.trim(), body.password);
     if (body.displayName?.trim()) {
       await updateUserProfile2(user.id, { display_name: body.displayName.trim() });
@@ -6320,7 +6233,7 @@ setup.post("/models", async (c) => {
     return c.json({ error: "Spirit model is required" }, 400);
   }
   try {
-    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-EVLKMAJD.js");
+    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-XCLE3MQP.js");
     setEnabledModels3(body.models);
     const config2 = readGlobalConfig();
     config2.spiritModel = body.spiritModel.trim();
@@ -6338,15 +6251,15 @@ setup.post("/complete", async (c) => {
     return c.json({ error: "Setup already complete" }, 400);
   }
   try {
-    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-T6GK5GEP.js");
-    const { startSpiritFull } = await import("./mind-service-X7FH3NA4.js");
+    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-ONLRFATY.js");
+    const { startSpiritFull } = await import("./mind-service-XGXSMQP6.js");
     await ensureSpiritProject();
     await syncSpiritTemplate();
     const warnings = [];
     const config2 = readGlobalConfig();
     if (config2.setup?.service && config2.setup?.type === "local") {
       try {
-        const { installUserService } = await import("./service-install-W3FQXJKB.js");
+        const { installUserService } = await import("./service-install-GTDUHP6R.js");
         const installed = await installUserService(config2.port, config2.hostname);
         if (!installed) {
           warnings.push("Service installation is not supported on this platform.");
@@ -6374,8 +6287,8 @@ setup.post("/complete", async (c) => {
     }
     let spiritConversationId;
     try {
-      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-X6ZITZ7D.js");
-      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-AYLXPOGC.js");
+      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-EAASQPTN.js");
+      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-FSZCUUYO.js");
       const spiritUser = await getOrCreateMindUser2("volute");
       const brains = await listUsersByType2("brain");
       const admin2 = brains.find((u) => u.role === "admin");
@@ -6397,8 +6310,8 @@ setup.post("/complete", async (c) => {
     logger_default.info("setup complete state", { spiritConversationId, spiritStarted });
     if (spiritConversationId && spiritStarted) {
       try {
-        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-Q7TU24IA.js");
-        const { listUsersByType: listUsers2 } = await import("./auth-X6ZITZ7D.js");
+        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-HPMELC4Q.js");
+        const { listUsersByType: listUsers2 } = await import("./auth-EAASQPTN.js");
         const admins = await listUsers2("brain");
         const admin2 = admins.find((u) => u.role === "admin");
         const adminName = admin2?.display_name || admin2?.username || "the admin";
@@ -6757,11 +6670,20 @@ function bufferEvent(data) {
   }
   return id;
 }
-function getEventsSince(sinceId) {
+function nextEventId() {
+  return nextId++;
+}
+function getEventsSince(sinceId, allowedConversationIds) {
   const now = Date.now();
   const startIdx = buffer.findIndex((e) => e.id > sinceId);
   if (startIdx === -1) return [];
-  return buffer.slice(startIdx).filter((e) => now - e.timestamp < MAX_AGE_MS);
+  return buffer.slice(startIdx).filter((e) => {
+    if (now - e.timestamp >= MAX_AGE_MS) return false;
+    const data = e.data;
+    if (data.event === "snapshot") return false;
+    if (data.event === "conversation") return allowedConversationIds.has(data.conversationId);
+    return true;
+  });
 }
 
 // packages/daemon/src/web/api/v1/events.ts
@@ -6776,8 +6698,22 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
       cleanups.push(() => removeConnection(user.username));
     }
     try {
+      let conversations2 = [];
+      try {
+        conversations2 = await listConversationsWithParticipants(user.id);
+        if (conversations2.length > 0) {
+          const convIds = conversations2.map((c2) => c2.id);
+          const unreads = await getUnreadCounts(user.id, convIds);
+          for (const conv of conversations2) {
+            conv.unreadCount = unreads[conv.id] ?? 0;
+          }
+        }
+      } catch (err) {
+        logger_default.error("[v1-events] failed to fetch conversations", logger_default.errorData(err));
+      }
+      const allowedConversationIds = new Set(conversations2.map((c2) => c2.id));
       if (sinceId > 0) {
-        const missed = getEventsSince(sinceId);
+        const missed = getEventsSince(sinceId, allowedConversationIds);
         for (const event of missed) {
           await stream.writeSSE({
             id: String(event.id),
@@ -6796,19 +6732,6 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
       } catch (err) {
         logger_default.error("[v1-events] failed to fetch recent activity", logger_default.errorData(err));
       }
-      let conversations2 = [];
-      try {
-        conversations2 = await listConversationsWithParticipants(user.id);
-        if (conversations2.length > 0) {
-          const convIds = conversations2.map((c2) => c2.id);
-          const unreads = await getUnreadCounts(user.id, convIds);
-          for (const conv of conversations2) {
-            conv.unreadCount = unreads[conv.id] ?? 0;
-          }
-        }
-      } catch (err) {
-        logger_default.error("[v1-events] failed to fetch conversations", logger_default.errorData(err));
-      }
       const snapshotData = {
         event: "snapshot",
         activity: recentActivity,
@@ -6816,7 +6739,7 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
         activeMinds: getActiveMinds(),
         onlineBrains: getOnlineBrains()
       };
-      const snapshotId = bufferEvent(snapshotData);
+      const snapshotId = nextEventId();
       await stream.writeSSE({
         id: String(snapshotId),
         data: JSON.stringify(snapshotData)
@@ -6882,14 +6805,23 @@ import { resolve as resolve14 } from "path";
 function tsxBin(cwd) {
   return resolve14(cwd, "node_modules", ".bin", "tsx");
 }
-function spawnServer(cwd, port, options) {
+async function spawnServer(cwd, port, options) {
+  let cmd = tsxBin(cwd);
+  let args = ["src/server.ts", "--port", String(port)];
+  if (options?.mindName) {
+    if (isIsolationEnabled()) {
+      [cmd, args] = await wrapForIsolation(cmd, args, options.mindName);
+    } else if (isSandboxEnabled() && options.template !== "codex") {
+      [cmd, args] = await wrapForSandbox(cmd, args, cwd, options.mindName, [cwd, mindTmpDir(cwd)]);
+    }
+  }
   if (options?.detached) {
-    return spawnDetached(cwd, port, options.logDir);
+    return spawnDetached(cmd, args, cwd, options.logDir);
   }
-  return spawnAttached(cwd, port);
+  return spawnAttached(cmd, args, cwd);
 }
-function spawnAttached(cwd, port) {
-  const child = spawn4(tsxBin(cwd), ["src/server.ts", "--port", String(port)], {
+function spawnAttached(cmd, args, cwd) {
+  const child = spawn4(cmd, args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -6914,12 +6846,12 @@ function spawnAttached(cwd, port) {
     });
   });
 }
-function spawnDetached(cwd, port, logDir) {
+function spawnDetached(cmd, args, cwd, logDir) {
   const logsDir = logDir ?? resolve14(cwd, ".mind", "logs");
   mkdirSync8(logsDir, { recursive: true });
   const logPath = resolve14(logsDir, "mind.log");
   const logFd = openSync(logPath, "a");
-  const child = spawn4(tsxBin(cwd), ["src/server.ts", "--port", String(port)], {
+  const child = spawn4(cmd, args, {
     cwd,
     stdio: ["ignore", logFd, logFd],
     detached: true
@@ -7114,7 +7046,11 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     }
   }
   if (!body.skipVerify) {
-    const result = await spawnServer(variantEntry.dir, 0, { detached: true });
+    const result = await spawnServer(variantEntry.dir, 0, {
+      detached: true,
+      mindName: variantName,
+      template: variantEntry.template
+    });
     if (!result) {
       return c.json(
         { error: "Failed to start server for verification. Use skipVerify to skip." },
@@ -7155,8 +7091,8 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
   await cleanupVariant(variantName, projectRoot, variantEntry.dir);
   if (variantName.endsWith("-upgrade") || variantName === "upgrade") {
     try {
-      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-DMHSLRDX.js");
-      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-GV35XFT7.js");
+      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-446HHH5V.js");
+      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-MDLNPTTI.js");
       const tmpl = parentEntry.template ?? "claude";
       await setMindTemplateHash2(mindName, computeTemplateHash2(tmpl));
     } catch (err) {
@@ -7270,9 +7206,13 @@ var app22 = new Hono25().get("/", async (c) => {
   });
 }).patch("/:name", zValidator9("json", channelSettingsSchema), async (c) => {
   const name = c.req.param("name");
+  const user = c.get("user");
   const body = c.req.valid("json");
   const ch = await getChannelByName(name);
   if (!ch) return c.json({ error: "Channel not found" }, 404);
+  if (user.role !== "admin" && user.role !== "system" && !await isParticipant(ch.id, user.id)) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
   await updateChannelSettings(name, body);
   const settings = await getChannelSettings(name);
   return c.json({ ...ch, channel_name: name, settings: formatChannelSettings(settings) });
@@ -7302,6 +7242,9 @@ var app22 = new Hono25().get("/", async (c) => {
   const { username } = c.req.valid("json");
   const ch = await getChannelByName(name);
   if (!ch) return c.json({ error: "Channel not found" }, 404);
+  if (inviter.role !== "admin" && inviter.role !== "system" && !await isParticipant(ch.id, inviter.id)) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
   let user = await getUserByUsername(username);
   if (!user && await findMind(username)) {
     user = await getOrCreateMindUser(username);
@@ -7908,6 +7851,11 @@ if (!process.env.VOLUTE_HOME) {
 if (process.env.VOLUTE_TIMEZONE && !process.env.TZ) {
   process.env.TZ = process.env.VOLUTE_TIMEZONE;
 }
+function writeDaemonConfig(path, config2) {
+  writeFileSync9(path, `${JSON.stringify(config2, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
 async function startDaemon(opts) {
   const { port, hostname } = opts;
   const myPid = String(process.pid);
@@ -7928,18 +7876,18 @@ async function startDaemon(opts) {
   const DAEMON_JSON_PATH = resolve17(systemDir, "daemon.json");
   mkdirSync10(home, { recursive: true });
   ensureSystemDir();
-  const { migrateSetupCompleted } = await import("./setup-OTEC3ZPM.js");
+  const { migrateSetupCompleted } = await import("./setup-FPFWDMXD.js");
   migrateSetupCompleted();
-  await (await import("./db-ZEPKEJJD.js")).getDb();
+  await (await import("./db-ZJJJYJBU.js")).getDb();
   try {
-    const { eq: eq7, and: and5 } = await import("drizzle-orm");
-    const { users: users2 } = await import("./schema-LYQUDL7G.js");
-    const db = await (await import("./db-ZEPKEJJD.js")).getDb();
-    await db.update(users2).set({ role: "system" }).where(and5(eq7(users2.user_type, "system"), eq7(users2.role, "user")));
+    const { eq: eq6, and: and5 } = await import("drizzle-orm");
+    const { users: users2 } = await import("./schema-HHYJDG7B.js");
+    const db = await (await import("./db-ZJJJYJBU.js")).getDb();
+    await db.update(users2).set({ role: "system" }).where(and5(eq6(users2.user_type, "system"), eq6(users2.role, "user")));
   } catch (err) {
     logger_default.warn("failed to migrate system user role", logger_default.errorData(err));
   }
-  const { initSandbox } = await import("./sandbox-5R32QKWQ.js");
+  const { initSandbox } = await import("./sandbox-ND53WZVU.js");
   await initSandbox();
   try {
     await syncBuiltinSkills();
@@ -7966,7 +7914,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to ensure #system channel", logger_default.errorData(err));
   }
   try {
-    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-X6ZITZ7D.js");
+    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-EAASQPTN.js");
     await getOrCreateSystemUser2();
   } catch (err) {
     logger_default.warn(
@@ -7975,12 +7923,12 @@ async function startDaemon(opts) {
     );
   }
   const token = process.env.VOLUTE_DAEMON_TOKEN || randomBytes(32).toString("hex");
-  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-OTEC3ZPM.js");
+  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-FPFWDMXD.js");
   const globalCfg = readGlobalConfig2();
   let tls;
   if (opts.tailscale || globalCfg.tailscale) {
     try {
-      const { getTailscaleTls } = await import("./tailscale-X4HRKRTW.js");
+      const { getTailscaleTls } = await import("./tailscale-TIRTGM6E.js");
       const tlsConfig = await getTailscaleTls();
       tls = { key: tlsConfig.key, cert: tlsConfig.cert };
       logger_default.info("Tailscale HTTPS enabled", { hostname: tlsConfig.hostname });
@@ -8011,8 +7959,7 @@ async function startDaemon(opts) {
   const daemonConfig = { port, hostname, token };
   if (internalPort) daemonConfig.internalPort = internalPort;
   if (tls) daemonConfig.tls = true;
-  writeFileSync9(DAEMON_JSON_PATH, `${JSON.stringify(daemonConfig, null, 2)}
-`, { mode: 420 });
+  writeDaemonConfig(DAEMON_JSON_PATH, daemonConfig);
   const delivery = initDeliveryManager();
   const manager = initMindManager();
   manager.loadCrashAttempts();
@@ -8059,10 +8006,10 @@ async function startDaemon(opts) {
     await Promise.all(workers);
   }
   try {
-    const { isSetupComplete: isSetupComplete2 } = await import("./setup-OTEC3ZPM.js");
+    const { isSetupComplete: isSetupComplete2 } = await import("./setup-FPFWDMXD.js");
     if (isSetupComplete2()) {
-      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-T6GK5GEP.js");
-      const { startSpiritFull } = await import("./mind-service-X7FH3NA4.js");
+      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-ONLRFATY.js");
+      const { startSpiritFull } = await import("./mind-service-XGXSMQP6.js");
       await ensureSpiritProject();
       await syncSpiritTemplate();
       const spiritEntry = await findMind("volute");
@@ -8079,7 +8026,7 @@ async function startDaemon(opts) {
   bridgeManager.startBridges(daemonPort).catch((err) => {
     logger_default.warn("failed to start bridges", logger_default.errorData(err));
   });
-  import("./cloud-sync-GOSJZIHH.js").then(
+  import("./cloud-sync-2XVXEOSU.js").then(
     ({ consumeQueuedMessages }) => consumeQueuedMessages().catch((err) => {
       logger_default.warn("failed to consume queued cloud messages", logger_default.errorData(err));
     })
@@ -8087,7 +8034,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to load cloud-sync module", logger_default.errorData(err));
   });
   try {
-    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-DK6AHWX7.js");
+    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-UFFDUPCX.js");
     backfillTemplateHashes();
     notifyVersionUpdate().catch((err) => {
       logger_default.warn("failed to send version update notifications", logger_default.errorData(err));
@@ -8192,8 +8139,12 @@ if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith
   if (noSandbox) {
     process.env.VOLUTE_SANDBOX = "0";
   }
-  startDaemon({ port, hostname, foreground, tailscale });
+  startDaemon({ port, hostname, foreground, tailscale }).catch((err) => {
+    logger_default.error("daemon failed to start", logger_default.errorData(err));
+    process.exit(1);
+  });
 }
 export {
-  startDaemon
+  startDaemon,
+  writeDaemonConfig
 };