volute 0.41.0 → 0.42.0

package/dist/daemon.js

@@ -6,31 +6,31 @@ import {
   rejectPending,
   stageFile,
   validateFilePath
-} from "./chunk-GSOEUMVO.js";
+} from "./chunk-M2YMNTHK.js";
 import {
   findOpenClawSession,
   importOpenClawConnectors,
   importPiSession,
   parseNameFromIdentity
-} from "./chunk-OQ7UEW67.js";
+} from "./chunk-KUJVCDWT.js";
 import {
   checkForUpdate,
   checkForUpdateCached,
   getCurrentVersion
-} from "./chunk-FEQPNCXB.js";
+} from "./chunk-E7XWFDZL.js";
 import {
   isHomeOnlyArchive
-} from "./chunk-MU2B7A3L.js";
+} from "./chunk-OEJFZHZZ.js";
 import {
   computeTemplateHash
-} from "./chunk-UU3Q65US.js";
+} from "./chunk-QMJCNZ6C.js";
 import {
   PLATFORMS,
   echoTextToChannel,
   fixModelEscapes,
   getPlatformDriver,
   routeOutboundBridge
-} from "./chunk-AXNAK3HT.js";
+} from "./chunk-2YRTSK5K.js";
 import {
   getBridgeConfig,
   readBridgesConfig,
@@ -39,12 +39,17 @@ import {
   resolveChannelMapping,
   setBridgeConfig,
   setChannelMapping
-} from "./chunk-CYUNO4BM.js";
+} from "./chunk-QPTQKGGF.js";
 import {
   RestartTracker,
   RotatingLog,
+  SESSION_MAX_AGE,
   announceToSystem,
+  authMiddleware,
+  cleanExpiredSessions,
   clearDeliveredNotices,
+  createSession,
+  deleteSession,
   deleteSystemsConfig,
   deliverMessage,
   drainNotices,
@@ -58,6 +63,7 @@ import {
   getLoadedExtensions,
   getMindManager,
   getScheduler,
+  getSessionUserId,
   getSleepManagerIfReady,
   getTokenBudget,
   getTypingMap,
@@ -68,6 +74,8 @@ import {
   initSleepManager,
   initTokenBudget,
   installNpmExtension,
+  invalidateMindUserCache,
+  invalidateSessionCache,
   isConversationId,
   joinSystemChannel,
   linkToolResultToTurn,
@@ -79,7 +87,9 @@ import {
   recordInbound,
   recordNotice,
   recordOutbound,
-  resolveMindToken,
+  requireAdmin,
+  requireAdminOrSystem,
+  requireSelf,
   setExtensionEnabled,
   startMindFull,
   stopMindFull,
@@ -88,15 +98,15 @@ import {
   tagUntaggedOutbound,
   uninstallNpmExtension,
   writeSystemsConfig
-} from "./chunk-W5Z2H3LU.js";
+} from "./chunk-52NMCDBS.js";
 import {
   loadMergedEnv,
   mindEnvPath,
   readEnv,
   sharedEnvPath,
   writeEnv
-} from "./chunk-6ZAT5PYV.js";
-import "./chunk-YN6ISG7A.js";
+} from "./chunk-BLOAJLGI.js";
+import "./chunk-VSUZE2PD.js";
 import {
   applyInitFiles,
   applyTemplateHomeFiles,
@@ -105,7 +115,7 @@ import {
   findTemplatesRoot,
   isKnownTemplate,
   listFiles
-} from "./chunk-WSRGS4XP.js";
+} from "./chunk-QLWG3C2Z.js";
 import {
   SEED_SKILLS,
   STANDARD_SKILLS,
@@ -125,7 +135,7 @@ import {
   syncBuiltinSkills,
   uninstallSkill,
   updateSkill
-} from "./chunk-JIGVTFIR.js";
+} from "./chunk-JLX3GC7T.js";
 import {
   addMessage,
   createChannel,
@@ -157,20 +167,23 @@ import {
   setConversationPrivate,
   subscribe as subscribe2,
   updateChannelSettings
-} from "./chunk-2R4JIZCB.js";
+} from "./chunk-YLTIEEVL.js";
 import {
   readVoluteConfig,
   writeVoluteConfig
 } from "./chunk-CU6OFXMM.js";
-import "./chunk-U7UASV36.js";
+import {
+  isSandboxEnabled,
+  wrapForSandbox
+} from "./chunk-WR7CSHQ4.js";
 import {
   getActiveMinds,
   onMindEvent,
   stopAll
-} from "./chunk-PP5CGT2P.js";
+} from "./chunk-VBKRZCR7.js";
 import {
   extractTextContent
-} from "./chunk-GMFCSXWB.js";
+} from "./chunk-62ICA2FF.js";
 import {
   PROMPT_DEFAULTS,
   PROMPT_KEYS,
@@ -193,12 +206,12 @@ import {
   summarizeTurn,
   takeErrored,
   trackToolUse
-} from "./chunk-YATR5BXD.js";
+} from "./chunk-TKOWXAHG.js";
 import {
   exec,
   gitExec,
   resolveVoluteBin
-} from "./chunk-Y2XLASFJ.js";
+} from "./chunk-GN52E2DP.js";
 import {
   chownMindDir,
   createMindUser,
@@ -206,15 +219,19 @@ import {
   ensureVoluteGroup,
   isIsolationEnabled,
   wrapForIsolation
-} from "./chunk-4ED2DBNC.js";
+} from "./chunk-TFBQESH7.js";
 import {
+  addCustomModel,
+  buildCustomModel,
   getAiConfig,
   getAvailableModels,
   getConfiguredProviders,
+  getCustomModels,
   getEnabledModels,
   getUtilityModel,
   qualifyModelId,
   removeAiConfig,
+  removeCustomModel,
   removeProviderConfig,
   resolveApiKey,
   resolveTemplate,
@@ -223,12 +240,12 @@ import {
   setProviderRefreshHook,
   setUtilityModel,
   unqualifyModelId
-} from "./chunk-VK2YD7VJ.js";
+} from "./chunk-4ZSUUBG5.js";
 import {
   isSetupComplete,
   readGlobalConfig,
   writeGlobalConfig
-} from "./chunk-N64Q7FMP.js";
+} from "./chunk-KZAL7HEQ.js";
 import {
   approveUser,
   changePassword,
@@ -247,11 +264,11 @@ import {
   syncMindProfile,
   updateUserProfile,
   verifyUser
-} from "./chunk-6TPRURK5.js";
+} from "./chunk-5QG36RV7.js";
 import {
   broadcast,
   subscribe
-} from "./chunk-2RQIIKFC.js";
+} from "./chunk-K547QOCM.js";
 import {
   logBuffer,
   logger_default
@@ -270,6 +287,7 @@ import {
   getBaseName,
   getDb,
   mindDir,
+  mindTmpDir,
   nextPort,
   readAllMinds,
   readRegistry,
@@ -282,14 +300,13 @@ import {
   validateMindName,
   voluteHome,
   voluteSystemDir
-} from "./chunk-VDODEQSJ.js";
+} from "./chunk-IUZ3EV2D.js";
 import {
   activity,
   channels,
   conversationParticipants,
   conversations,
   mindHistory,
-  sessions,
   summaries,
   systemPrompts,
   turns,
@@ -299,7 +316,7 @@ import "./chunk-K3NQKI34.js";
 
 // packages/daemon/src/daemon.ts
 import { randomBytes } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
+import { chmodSync, mkdirSync as mkdirSync10, readFileSync as readFileSync10, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
 import { resolve as resolve17 } from "path";
 import { format } from "util";
@@ -834,150 +851,6 @@ async function generateImage(model, prompt) {
   return PROVIDERS[providerId].generate(modelId, prompt, apiKey);
 }
 
-// packages/daemon/src/web/middleware/auth.ts
-import { timingSafeEqual } from "crypto";
-import { eq as eq2, lt as lt2 } from "drizzle-orm";
-import { getCookie } from "hono/cookie";
-import { createMiddleware } from "hono/factory";
-var MIND_USER_CACHE_TTL = 5 * 60 * 1e3;
-var mindUserCache = /* @__PURE__ */ new Map();
-function invalidateMindUserCache(mindName) {
-  mindUserCache.delete(mindName);
-}
-function isValidDaemonToken(token) {
-  const expected = process.env.VOLUTE_DAEMON_TOKEN;
-  if (!expected || token.length !== expected.length) return false;
-  return timingSafeEqual(Buffer.from(token), Buffer.from(expected));
-}
-var SESSION_MAX_AGE = 365 * 24 * 60 * 60 * 1e3;
-var SESSION_CACHE_TTL = 5 * 60 * 1e3;
-var sessionCache = /* @__PURE__ */ new Map();
-function invalidateSessionCache(sessionId) {
-  sessionCache.delete(sessionId);
-}
-async function createSession(userId) {
-  const db = await getDb();
-  const sessionId = crypto.randomUUID();
-  await db.insert(sessions).values({ id: sessionId, userId, createdAt: Date.now() });
-  return sessionId;
-}
-async function deleteSession(sessionId) {
-  sessionCache.delete(sessionId);
-  const db = await getDb();
-  await db.delete(sessions).where(eq2(sessions.id, sessionId));
-}
-async function getSessionUserId(sessionId) {
-  const db = await getDb();
-  const row = await db.select().from(sessions).where(eq2(sessions.id, sessionId)).get();
-  if (!row) return void 0;
-  if (Date.now() - row.createdAt > SESSION_MAX_AGE) {
-    await db.delete(sessions).where(eq2(sessions.id, sessionId));
-    return void 0;
-  }
-  return row.userId;
-}
-async function cleanExpiredSessions() {
-  const db = await getDb();
-  const cutoff = Date.now() - SESSION_MAX_AGE;
-  await db.delete(sessions).where(lt2(sessions.createdAt, cutoff));
-}
-var requireAdmin = createMiddleware(async (c, next) => {
-  const user = c.get("user");
-  if (user.role !== "admin") {
-    return c.json({ error: "Forbidden" }, 403);
-  }
-  await next();
-});
-var requireAdminOrSystem = createMiddleware(async (c, next) => {
-  const user = c.get("user");
-  if (user.role !== "admin" && user.role !== "system") {
-    return c.json({ error: "Forbidden" }, 403);
-  }
-  await next();
-});
-async function resolveSession(sessionId) {
-  const cached = sessionCache.get(sessionId);
-  if (cached && cached.expires > Date.now()) {
-    return cached.user;
-  }
-  const userId = await getSessionUserId(sessionId);
-  if (userId == null) {
-    sessionCache.delete(sessionId);
-    return null;
-  }
-  const user = await getUser(userId);
-  if (!user) {
-    sessionCache.delete(sessionId);
-    return null;
-  }
-  sessionCache.set(sessionId, { userId, user, expires: Date.now() + SESSION_CACHE_TTL });
-  return user;
-}
-var authMiddleware = createMiddleware(async (c, next) => {
-  const authHeader = c.req.header("Authorization");
-  if (authHeader?.startsWith("Bearer ")) {
-    const token = authHeader.slice(7);
-    if (token && isValidDaemonToken(token)) {
-      c.set("user", {
-        id: 0,
-        username: "daemon",
-        role: "admin",
-        user_type: "brain",
-        display_name: null,
-        description: null,
-        avatar: null
-      });
-      const mindSessionHeader = c.req.header("X-Volute-Session");
-      if (mindSessionHeader) c.set("mindSession", mindSessionHeader);
-      await next();
-      return;
-    }
-    const mindName = resolveMindToken(token);
-    if (mindName) {
-      const cached = mindUserCache.get(mindName);
-      let mindUser;
-      if (cached && Date.now() - cached.ts < MIND_USER_CACHE_TTL) {
-        mindUser = cached.user;
-      } else {
-        mindUser = await getOrCreateMindUser(mindName);
-        mindUserCache.set(mindName, { user: mindUser, ts: Date.now() });
-      }
-      c.set("user", mindUser);
-      const mindSessionHeader = c.req.header("X-Volute-Session");
-      if (mindSessionHeader) c.set("mindSession", mindSessionHeader);
-      await next();
-      return;
-    }
-    if (token) {
-      const user2 = await resolveSession(token);
-      if (user2) {
-        if (user2.role === "pending") return c.json({ error: "Account pending approval" }, 403);
-        c.set("user", user2);
-        await next();
-        return;
-      }
-    }
-  }
-  const sessionId = getCookie(c, "volute_session");
-  if (!sessionId) return c.json({ error: "Unauthorized" }, 401);
-  const user = await resolveSession(sessionId);
-  if (!user) return c.json({ error: "Unauthorized" }, 401);
-  if (user.role === "pending") return c.json({ error: "Account pending approval" }, 403);
-  c.set("user", user);
-  await next();
-});
-var requireSelf = (paramName = "name") => createMiddleware(async (c, next) => {
-  const user = c.get("user");
-  if (user.role !== "admin" && user.role !== "system") {
-    const target = c.req.param(paramName) ?? "";
-    const baseName = await getBaseName(target);
-    if (user.username !== baseName) {
-      return c.json({ error: "Forbidden" }, 403);
-    }
-  }
-  await next();
-});
-
 // packages/daemon/src/web/api/system.ts
 var DEFAULT_API_URL = "https://volute.systems";
 var igLog = logger_default.child("imagegen");
@@ -1231,6 +1104,7 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
 }).get("/ai/models", requireAdmin, async (c) => {
   const models = await getAvailableModels();
   const enabled = new Set(getEnabledModels());
+  const customIds = new Set(getCustomModels().map((m) => m.id));
   return c.json(
     models.map((m) => ({
       id: m.id,
@@ -1238,7 +1112,8 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
       provider: m.provider,
       contextWindow: m.contextWindow,
       maxTokens: m.maxTokens,
-      enabled: enabled.has(m.id)
+      enabled: enabled.has(m.id),
+      custom: customIds.has(m.id)
     }))
   );
 }).put(
@@ -1250,7 +1125,38 @@ var app = new Hono().post("/restart", requireAdmin, (c) => {
     setEnabledModels(models);
     return c.json({ ok: true });
   }
-).get("/ai/defaults", requireAdmin, (c) => {
+).post(
+  "/ai/models/custom",
+  requireAdmin,
+  zValidator(
+    "json",
+    z.object({ provider: z.string().min(1), id: z.string().min(1), name: z.string().optional() })
+  ),
+  (c) => {
+    const { provider, id, name } = c.req.valid("json");
+    if (!buildCustomModel(provider, id)) {
+      return c.json(
+        { error: `No built-in model for provider "${provider}" to clone metadata from` },
+        400
+      );
+    }
+    if (getCustomModels().some((m) => m.id === id && m.provider !== provider)) {
+      return c.json(
+        { error: `A custom model "${id}" is already registered under another provider` },
+        400
+      );
+    }
+    addCustomModel(provider, id, name);
+    setEnabledModels([.../* @__PURE__ */ new Set([...getEnabledModels(), id])]);
+    return c.json({ ok: true });
+  }
+).delete("/ai/models/custom", requireAdmin, (c) => {
+  const provider = c.req.query("provider");
+  const id = c.req.query("id");
+  if (!provider || !id) return c.json({ error: "provider and id are required" }, 400);
+  removeCustomModel(provider, id);
+  return c.json({ ok: true });
+}).get("/ai/defaults", requireAdmin, (c) => {
   const config2 = readGlobalConfig();
   return c.json({
     spiritModel: config2.spiritModel ?? null,
@@ -1632,7 +1538,7 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as rea
 import { extname, resolve as resolve3 } from "path";
 import { zValidator as zValidator2 } from "@hono/zod-validator";
 import { Hono as Hono3 } from "hono";
-import { deleteCookie, getCookie as getCookie2, setCookie } from "hono/cookie";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
 import { z as z2 } from "zod";
 function tryJoinSystem(userId) {
   if (!process.env.VOLUTE_DAEMON_TOKEN) return;
@@ -1678,7 +1584,7 @@ var authenticated = new Hono3().use(authMiddleware).post("/change-password", zVa
   const user = c.get("user");
   const body = c.req.valid("json");
   await updateUserProfile(user.id, body);
-  const sessionId = getCookie2(c, "volute_session");
+  const sessionId = getCookie(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
   broadcast({
     type: "profile_updated",
@@ -1710,7 +1616,7 @@ var authenticated = new Hono3().use(authMiddleware).post("/change-password", zVa
     rmSync(oldPath, { force: true });
   }
   await updateUserProfile(user.id, { avatar: filename });
-  const sessionId = getCookie2(c, "volute_session");
+  const sessionId = getCookie(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
   broadcast({
     type: "profile_updated",
@@ -1725,7 +1631,7 @@ var authenticated = new Hono3().use(authMiddleware).post("/change-password", zVa
     rmSync(path, { force: true });
   }
   await updateUserProfile(user.id, { avatar: null });
-  const sessionId = getCookie2(c, "volute_session");
+  const sessionId = getCookie(c, "volute_session");
   if (sessionId) invalidateSessionCache(sessionId);
   broadcast({
     type: "profile_updated",
@@ -1836,7 +1742,7 @@ var app3 = new Hono3().post("/register", zValidator2("json", credentialsSchema),
   tryJoinSystem(user.id);
   return c.json({ id: user.id, username: user.username, role: user.role, sessionId });
 }).post("/logout", async (c) => {
-  const cookieSession = getCookie2(c, "volute_session");
+  const cookieSession = getCookie(c, "volute_session");
   if (cookieSession) {
     await deleteSession(cookieSession);
     deleteCookie(c, "volute_session", { path: "/" });
@@ -1851,7 +1757,7 @@ var app3 = new Hono3().post("/register", zValidator2("json", credentialsSchema),
   }
   return c.json({ ok: true });
 }).get("/me", async (c) => {
-  let sessionId = getCookie2(c, "volute_session");
+  let sessionId = getCookie(c, "volute_session");
   if (!sessionId) {
     const authHeader = c.req.header("Authorization");
     if (authHeader?.startsWith("Bearer ")) {
@@ -1898,7 +1804,7 @@ import { Hono as Hono4 } from "hono";
 import { z as z3 } from "zod";
 
 // packages/daemon/src/lib/chat/puppets.ts
-import { and as and2, eq as eq3 } from "drizzle-orm";
+import { and as and2, eq as eq2 } from "drizzle-orm";
 async function findOrCreatePuppet(platform, platformId, displayName) {
   const username = `${platform}:${platformId}`;
   const db = await getDb();
@@ -1907,10 +1813,10 @@ async function findOrCreatePuppet(platform, platformId, displayName) {
     username: users.username,
     display_name: users.display_name,
     avatar: users.avatar
-  }).from(users).where(and2(eq3(users.username, username), eq3(users.user_type, "puppet"))).get();
+  }).from(users).where(and2(eq2(users.username, username), eq2(users.user_type, "puppet"))).get();
   if (existing) {
     if (existing.display_name !== displayName) {
-      await db.update(users).set({ display_name: displayName }).where(eq3(users.id, existing.id));
+      await db.update(users).set({ display_name: displayName }).where(eq2(users.id, existing.id));
       existing.display_name = displayName;
     }
     return existing;
@@ -1936,7 +1842,7 @@ async function findOrCreatePuppet(platform, platformId, displayName) {
         username: users.username,
         display_name: users.display_name,
         avatar: users.avatar
-      }).from(users).where(and2(eq3(users.username, username), eq3(users.user_type, "puppet"))).get();
+      }).from(users).where(and2(eq2(users.username, username), eq2(users.user_type, "puppet"))).get();
       if (retried) return retried;
     }
     throw err;
@@ -2016,7 +1922,7 @@ var app4 = new Hono4().post("/:platform/inbound", zValidator3("json", inboundSch
   }
   const participants = await getParticipants(channel.id);
   if (!participants.some((p) => p.userId === puppet.id)) {
-    const { addParticipant } = await import("./conversations-KW7IYESK.js");
+    const { addParticipant } = await import("./conversations-FSZCUUYO.js");
     await addParticipant(channel.id, puppet.id);
   }
   const contentBlocks = body.content;
@@ -2109,8 +2015,8 @@ async function fanOutToBridgedMinds(opts) {
   const participants = await getParticipants(opts.conversationId);
   const mindParticipants = participants.filter((p) => p.userType === "mind");
   const participantNames = participants.map((p) => p.username);
-  const { getMindManager: getMindManager2 } = await import("./mind-manager-VU3RGCXD.js");
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-T3AXQB3R.js");
+  const { getMindManager: getMindManager2 } = await import("./mind-manager-OYOIBGK6.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-FJLASHHW.js");
   const manager = getMindManager2();
   const sm = getSleepManagerIfReady2();
   const targetMinds = mindParticipants.filter((ap) => {
@@ -2322,7 +2228,7 @@ async function notifyMind(mindName, message) {
   const entry = await findMind(mindName);
   if (!entry) return;
   try {
-    const { sendSystemMessage } = await import("./system-chat-HCPHUQGI.js");
+    const { sendSystemMessage } = await import("./system-chat-P6KVGW4T.js");
     await sendSystemMessage(mindName, message);
   } catch (err) {
     logger_default.warn(`[file-sharing] notify mind ${mindName} failed`, logger_default.errorData(err));
@@ -2632,18 +2538,25 @@ var app9 = new Hono10().post("/:name/avatar", requireSelf(), async (c) => {
 var files_default = app9;
 
 // packages/daemon/src/web/api/history.ts
-import { and as and3, desc as desc2, eq as eq4, gte, inArray, sql } from "drizzle-orm";
+import { and as and3, desc as desc2, eq as eq3, gte, inArray, sql } from "drizzle-orm";
 import { Hono as Hono11 } from "hono";
+async function resolveMindFilter(c) {
+  const user = c.get("user");
+  if (user.role === "admin" || user.role === "system") {
+    return c.req.query("mind") ?? void 0;
+  }
+  return getBaseName(user.username);
+}
 var history = new Hono11().get("/turns", async (c) => {
-  const mindFilter = c.req.query("mind");
+  const mindFilter = await resolveMindFilter(c);
   const turnIdFilter = c.req.query("turnId");
   const turnIdsFilter = c.req.query("turnIds");
   const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 200);
   const offset = Math.max(parseInt(c.req.query("offset") ?? "0", 10) || 0, 0);
   const db = await getDb();
   const conditions = [];
-  if (mindFilter) conditions.push(eq4(turns.mind, mindFilter));
-  if (turnIdFilter) conditions.push(eq4(turns.id, turnIdFilter));
+  if (mindFilter) conditions.push(eq3(turns.mind, mindFilter));
+  if (turnIdFilter) conditions.push(eq3(turns.id, turnIdFilter));
   if (turnIdsFilter) {
     const ids = turnIdsFilter.split(",").filter(Boolean);
     if (ids.length > 0) conditions.push(inArray(turns.id, ids));
@@ -2651,7 +2564,7 @@ var history = new Hono11().get("/turns", async (c) => {
   const turnRows = await db.select().from(turns).where(conditions.length > 0 ? and3(...conditions) : void 0).orderBy(desc2(turns.created_at)).limit(limit).offset(offset);
   if (turnRows.length === 0) return c.json([]);
   const turnIds = turnRows.map((t) => t.id);
-  const summaryRows = await db.select().from(summaries).where(and3(eq4(summaries.period, "turn"), inArray(summaries.period_key, turnIds)));
+  const summaryRows = await db.select().from(summaries).where(and3(eq3(summaries.period, "turn"), inArray(summaries.period_key, turnIds)));
   const summaryByTurn = /* @__PURE__ */ new Map();
   for (const s of summaryRows) {
     summaryByTurn.set(s.period_key, { content: s.content, metadata: s.metadata });
@@ -2776,15 +2689,15 @@ var history = new Hono11().get("/turns", async (c) => {
           db.select({
             conversation_id: conversationParticipants.conversation_id,
             username: users.username
-          }).from(conversationParticipants).innerJoin(users, eq4(conversationParticipants.user_id, users.id))
+          }).from(conversationParticipants).innerJoin(users, eq3(conversationParticipants.user_id, users.id))
         );
         const dmRows = await db.with(cp2).select({
           id: conversations.id,
           targetUsername: users.username
         }).from(conversations).innerJoin(
           conversationParticipants,
-          eq4(conversations.id, conversationParticipants.conversation_id)
-        ).innerJoin(users, eq4(conversationParticipants.user_id, users.id)).where(and3(eq4(conversations.type, "dm"), inArray(users.username, targetNames)));
+          eq3(conversations.id, conversationParticipants.conversation_id)
+        ).innerJoin(users, eq3(conversationParticipants.user_id, users.id)).where(and3(eq3(conversations.type, "dm"), inArray(users.username, targetNames)));
         const dmCandidates = [];
         for (const row of dmRows) {
           const slug = `@${row.targetUsername}`;
@@ -2799,7 +2712,7 @@ var history = new Hono11().get("/turns", async (c) => {
           const verifyRows = await db.select({
             conversation_id: conversationParticipants.conversation_id,
             username: users.username
-          }).from(conversationParticipants).innerJoin(users, eq4(conversationParticipants.user_id, users.id)).where(
+          }).from(conversationParticipants).innerJoin(users, eq3(conversationParticipants.user_id, users.id)).where(
             and3(
               inArray(conversationParticipants.conversation_id, candidateConvIds),
               inArray(users.username, allMindNames)
@@ -2877,7 +2790,7 @@ var history = new Hono11().get("/turns", async (c) => {
   });
   return c.json(result);
 }).get("/events", async (c) => {
-  const mindFilter = c.req.query("mind");
+  const mindFilter = await resolveMindFilter(c);
   const stream = new ReadableStream({
     start(controller) {
       const encoder = new TextEncoder();
@@ -2932,7 +2845,9 @@ var history = new Hono11().get("/turns", async (c) => {
     }
   });
 }).get("/summaries", async (c) => {
-  const mind = c.req.query("mind") ?? "_system";
+  const user = c.get("user");
+  const privileged = user.role === "admin" || user.role === "system";
+  const mind = privileged ? c.req.query("mind") ?? "_system" : await getBaseName(user.username);
   const period = c.req.query("period");
   const ids = c.req.query("ids");
   const from = c.req.query("from");
@@ -2942,7 +2857,9 @@ var history = new Hono11().get("/turns", async (c) => {
     const db2 = await getDb();
     const idList = ids.split(",").map((s) => parseInt(s, 10)).filter((n) => !Number.isNaN(n));
     if (idList.length === 0) return c.json([]);
-    const rows2 = await db2.select().from(summaries).where(inArray(summaries.id, idList));
+    const idConditions = [inArray(summaries.id, idList)];
+    if (!privileged) idConditions.push(eq3(summaries.mind, mind));
+    const rows2 = await db2.select().from(summaries).where(and3(...idConditions));
     const result2 = rows2.map((r) => {
       let metadata = null;
       if (r.metadata) {
@@ -2960,7 +2877,7 @@ var history = new Hono11().get("/turns", async (c) => {
     return c.json({ error: "period is required (turn, hour, day, week, month)" }, 400);
   }
   const db = await getDb();
-  const conditions = [eq4(summaries.mind, mind), eq4(summaries.period, period)];
+  const conditions = [eq3(summaries.mind, mind), eq3(summaries.period, period)];
   if (from) conditions.push(gte(summaries.period_key, from));
   if (to) conditions.push(sql`${summaries.period_key} <= ${to}`);
   const rows = await db.select({
@@ -2985,13 +2902,13 @@ var history = new Hono11().get("/turns", async (c) => {
   });
   return c.json(result);
 }).get("/activity", async (c) => {
-  const mind = c.req.query("mind");
+  const mind = await resolveMindFilter(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
   const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "100", 10) || 100, 1), 500);
   const db = await getDb();
   const conditions = [];
-  if (mind) conditions.push(eq4(activity.mind, mind));
+  if (mind) conditions.push(eq3(activity.mind, mind));
   if (from) conditions.push(gte(activity.created_at, from));
   if (to) conditions.push(sql`${activity.created_at} <= ${to}`);
   conditions.push(
@@ -3246,7 +3163,7 @@ import {
 } from "fs";
 import { basename, resolve as resolve11 } from "path";
 import { zValidator as zValidator5 } from "@hono/zod-validator";
-import { and as and4, desc as desc3, eq as eq5, sql as sql2 } from "drizzle-orm";
+import { and as and4, desc as desc3, eq as eq4, sql as sql2 } from "drizzle-orm";
 import { Hono as Hono15 } from "hono";
 import { z as z5 } from "zod";
 
@@ -3368,7 +3285,7 @@ async function cleanupVariant(variantName, projectRoot, variantPath, opts) {
       logger_default.warn(`failed to stop variant ${variantName}`, logger_default.errorData(err));
     }
   }
-  const { findMind: findMind2 } = await import("./registry-RAXNFN7K.js");
+  const { findMind: findMind2 } = await import("./registry-MDLNPTTI.js");
   const variantEntry = await findMind2(variantName);
   const branchName = variantEntry?.branch ?? variantName;
   if (existsSync6(variantPath)) {
@@ -3625,7 +3542,7 @@ async function getMindStatus(name, port, registryRunning) {
   const manager = getMindManager();
   let status = "stopped";
   try {
-    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-T3AXQB3R.js");
+    const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-FJLASHHW.js");
     if (getSleepManagerIfReady2()?.isSleeping(name)) {
       status = "sleeping";
     }
@@ -4120,7 +4037,7 @@ var app13 = new Hono15().post("/", requireAdminOrSystem, zValidator5("json", cre
     applyInitFiles(dest);
     const { publicKeyPem } = generateIdentity(dest);
     {
-      const { readGlobalConfig: readGlobal } = await import("./setup-3434PQ5Q.js");
+      const { readGlobalConfig: readGlobal } = await import("./setup-IYOUPCIK.js");
       const mindDefaults = readGlobal().mindDefaults;
       const config2 = readVoluteConfig(dest);
       if (!config2) throw new Error("Failed to read volute.json after identity generation");
@@ -4211,7 +4128,7 @@ The human who planted you described you as: "${body.description}"
     }
     let skillSet = body.skills ?? (body.stage === "seed" ? SEED_SKILLS : getStandardSkillsWithExtensions());
     if (body.stage === "seed" && !body.skills) {
-      const { isImagegenEnabled } = await import("./setup-3434PQ5Q.js");
+      const { isImagegenEnabled } = await import("./setup-IYOUPCIK.js");
       if (isImagegenEnabled()) {
         skillSet = [...skillSet, "imagegen"];
       }
@@ -4229,7 +4146,7 @@ The human who planted you described you as: "${body.description}"
       try {
         const spiritEntry = await findMind("volute");
         if (spiritEntry) {
-          const { spiritDir } = await import("./spirit-KTBHLULO.js");
+          const { spiritDir } = await import("./spirit-NJFAY5CZ.js");
           const sDir = spiritEntry.dir ?? spiritDir();
           const spiritConfig = readVoluteConfig(sDir) ?? {};
           const schedules = spiritConfig.schedules ?? [];
@@ -4244,7 +4161,7 @@ The human who planted you described you as: "${body.description}"
             });
             spiritConfig.schedules = schedules;
             writeVoluteConfig(sDir, spiritConfig);
-            const { getScheduler: getScheduler2 } = await import("./scheduler-SXELVRWO.js");
+            const { getScheduler: getScheduler2 } = await import("./scheduler-KXUY2I7W.js");
             getScheduler2().loadSchedules("volute", sDir);
           }
         }
@@ -4509,7 +4426,7 @@ ${user.trimEnd()}
   const manager = getMindManager();
   try {
     if (context?.type === "reload") {
-      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-T3AXQB3R.js");
+      const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-FJLASHHW.js");
       const sleepState = getSleepManagerIfReady2()?.getState(name);
       if (sleepState?.sleeping) {
         logger_default.info(`skipping reload for ${name} during sleep \u2014 will apply on next wake`);
@@ -4604,7 +4521,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-T3AXQB3R.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-FJLASHHW.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   return c.json(sm.getState(name));
@@ -4612,7 +4529,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-T3AXQB3R.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-FJLASHHW.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   if (sm.isSleeping(name)) return c.json({ error: "Mind is already sleeping" }, 409);
@@ -4632,7 +4549,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-T3AXQB3R.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-FJLASHHW.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const sleepState = sm.getState(name);
@@ -4647,7 +4564,7 @@ ${user.trimEnd()}
   const name = c.req.param("name");
   const entry = await findMind(name);
   if (!entry) return c.json({ error: "Mind not found" }, 404);
-  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-T3AXQB3R.js");
+  const { getSleepManagerIfReady: getSleepManagerIfReady2 } = await import("./sleep-manager-FJLASHHW.js");
   const sm = getSleepManagerIfReady2();
   if (!sm) return c.json({ error: "Sleep manager not initialized" }, 503);
   const flushed = await sm.flushQueuedMessages(name);
@@ -4665,7 +4582,7 @@ ${user.trimEnd()}
   if (body.avatar !== void 0) profile.avatar = basename(body.avatar);
   config2.profile = profile;
   writeVoluteConfig(dir, config2);
-  const { syncMindProfile: syncMindProfile2 } = await import("./auth-VYW2ECCE.js");
+  const { syncMindProfile: syncMindProfile2 } = await import("./auth-EAASQPTN.js");
   await syncMindProfile2(name, profile);
   broadcast({ type: "profile_updated", mind: name, summary: `${name} profile updated` });
   return c.json({ ok: true });
@@ -4682,8 +4599,8 @@ ${user.trimEnd()}
   const spiritThreshold = Number.isNaN(rawSpirit) ? 15 : rawSpirit;
   const lastCreatorMsg = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(
     and4(
-      eq5(mindHistory.mind, name),
-      eq5(mindHistory.type, "inbound"),
+      eq4(mindHistory.mind, name),
+      eq4(mindHistory.type, "inbound"),
       sql2`${mindHistory.sender} != 'volute'`,
       sql2`${mindHistory.sender} != ${name}`,
       sql2`${mindHistory.sender} IS NOT NULL`
@@ -4691,9 +4608,9 @@ ${user.trimEnd()}
   ).orderBy(desc3(mindHistory.created_at)).limit(1);
   const lastSpiritMsg = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(
     and4(
-      eq5(mindHistory.mind, name),
-      eq5(mindHistory.type, "inbound"),
-      eq5(mindHistory.sender, "volute")
+      eq4(mindHistory.mind, name),
+      eq4(mindHistory.type, "inbound"),
+      eq4(mindHistory.sender, "volute")
     )
   ).orderBy(desc3(mindHistory.created_at)).limit(1);
   const now = Date.now();
@@ -4712,7 +4629,7 @@ ${user.trimEnd()}
   const config2 = readVoluteConfig(dir);
   const displayNameSet = !!config2?.profile?.displayName;
   const avatarSet = !!config2?.profile?.avatar;
-  const { isImagegenEnabled } = await import("./setup-3434PQ5Q.js");
+  const { isImagegenEnabled } = await import("./setup-IYOUPCIK.js");
   const imagegenEnabled = isImagegenEnabled();
   const done = [];
   const remaining = [];
@@ -4750,7 +4667,7 @@ ${user.trimEnd()}
   try {
     const spiritEntry = await findMind("volute");
     if (spiritEntry) {
-      const { spiritDir } = await import("./spirit-KTBHLULO.js");
+      const { spiritDir } = await import("./spirit-NJFAY5CZ.js");
       const sDir = spiritEntry.dir ?? spiritDir();
       const spiritConfig = readVoluteConfig(sDir);
       if (spiritConfig?.schedules) {
@@ -4758,7 +4675,7 @@ ${user.trimEnd()}
         spiritConfig.schedules = spiritConfig.schedules.filter((s) => s.id !== nurtureId);
         if (spiritConfig.schedules.length === 0) spiritConfig.schedules = void 0;
         writeVoluteConfig(sDir, spiritConfig);
-        const { getScheduler: getScheduler2 } = await import("./scheduler-SXELVRWO.js");
+        const { getScheduler: getScheduler2 } = await import("./scheduler-KXUY2I7W.js");
         getScheduler2().loadSchedules("volute", sDir);
       }
     }
@@ -5193,7 +5110,7 @@ ${user.trimEnd()}
     }
     writeVoluteConfig(dir, existing);
     if (body.unescapeNewlines !== void 0) {
-      const { clearEchoTextCache } = await import("./echo-text-QVPS6QDM.js");
+      const { clearEchoTextCache } = await import("./echo-text-YP3JVLNA.js");
       clearEchoTextCache(name);
     }
     const needsConfigJson = body.model !== void 0 || body.thinkingLevel !== void 0 || body.maxThinkingTokens !== void 0 || body.compaction !== void 0;
@@ -5270,7 +5187,7 @@ ${user.trimEnd()}
     }
     if (entry.mindType === "spirit" && body.model !== void 0) {
       try {
-        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-3434PQ5Q.js");
+        const { readGlobalConfig: readGlobalConfig2, writeGlobalConfig: writeGlobalConfig2 } = await import("./setup-IYOUPCIK.js");
         const globalConfig = readGlobalConfig2();
         globalConfig.spiritModel = body.model;
         writeGlobalConfig2(globalConfig);
@@ -5298,7 +5215,7 @@ ${user.trimEnd()}
   if (!body.systemPrompt || !body.message) {
     return c.json({ error: "systemPrompt and message required" }, 400);
   }
-  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-ZHEPFC3U.js");
+  const { aiComplete: aiCompleteFn, isAiConfigured } = await import("./ai-service-3GBOJGUA.js");
   if (!isAiConfigured()) {
     return c.json({ error: "AI service not configured" }, 503);
   }
@@ -5571,18 +5488,18 @@ ${user.trimEnd()}
     event_count: sql2`COUNT(*)`,
     message_count: sql2`SUM(CASE WHEN ${mindHistory.type} IN ('inbound','outbound') THEN 1 ELSE 0 END)`,
     tool_count: sql2`SUM(CASE WHEN ${mindHistory.type}='tool_use' THEN 1 ELSE 0 END)`
-  }).from(mindHistory).where(and4(eq5(mindHistory.mind, name), sql2`${mindHistory.session} IS NOT NULL`)).groupBy(mindHistory.session).orderBy(sql2`MIN(${mindHistory.created_at}) DESC`);
+  }).from(mindHistory).where(and4(eq4(mindHistory.mind, name), sql2`${mindHistory.session} IS NOT NULL`)).groupBy(mindHistory.session).orderBy(sql2`MIN(${mindHistory.created_at}) DESC`);
   return c.json(rows);
 }).get("/:name/history/channels", requireSelf(), async (c) => {
   const name = c.req.param("name");
   const db = await getDb();
-  const rows = await db.selectDistinct({ channel: mindHistory.channel }).from(mindHistory).where(eq5(mindHistory.mind, name));
+  const rows = await db.selectDistinct({ channel: mindHistory.channel }).from(mindHistory).where(eq4(mindHistory.mind, name));
   return c.json(rows.map((r) => r.channel));
 }).get("/:name/history/export", requireSelf(), async (c) => {
   const name = c.req.param("name");
   if (!await findMind(name)) return c.json({ error: "Mind not found" }, 404);
   const db = await getDb();
-  const rows = await db.select().from(mindHistory).where(eq5(mindHistory.mind, name));
+  const rows = await db.select().from(mindHistory).where(eq4(mindHistory.mind, name));
   return c.json(rows);
 }).get("/:name/history/turn", requireSelf(), async (c) => {
   const name = c.req.param("name");
@@ -5592,7 +5509,7 @@ ${user.trimEnd()}
   const typeFilter = detail ? void 0 : sql2`${mindHistory.type} IN ('inbound','outbound','tool_use','tool_result','text','thinking','activity')`;
   let rows;
   if (turnId) {
-    rows = await db.select().from(mindHistory).where(and4(eq5(mindHistory.mind, name), eq5(mindHistory.turn_id, turnId), typeFilter)).orderBy(mindHistory.id);
+    rows = await db.select().from(mindHistory).where(and4(eq4(mindHistory.mind, name), eq4(mindHistory.turn_id, turnId), typeFilter)).orderBy(mindHistory.id);
   } else {
     const session = c.req.query("session");
     const fromId = parseInt(c.req.query("from_id") ?? "", 10);
@@ -5602,8 +5519,8 @@ ${user.trimEnd()}
     }
     rows = await db.select().from(mindHistory).where(
       and4(
-        eq5(mindHistory.mind, name),
-        eq5(mindHistory.session, session),
+        eq4(mindHistory.mind, name),
+        eq4(mindHistory.session, session),
         sql2`${mindHistory.id} >= ${fromId}`,
         sql2`${mindHistory.id} <= ${toId}`,
         typeFilter
@@ -5619,13 +5536,13 @@ ${user.trimEnd()}
   if (currentSession) {
     const lastTurn = await db.select({ turn_id: mindHistory.turn_id }).from(mindHistory).where(
       and4(
-        eq5(mindHistory.mind, name),
-        eq5(mindHistory.session, currentSession),
+        eq4(mindHistory.mind, name),
+        eq4(mindHistory.session, currentSession),
         sql2`${mindHistory.turn_id} IS NOT NULL`
       )
     ).orderBy(desc3(mindHistory.created_at)).limit(1);
     if (lastTurn.length > 0 && lastTurn[0].turn_id) {
-      const firstEvent = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(eq5(mindHistory.turn_id, lastTurn[0].turn_id)).orderBy(mindHistory.created_at).limit(1);
+      const firstEvent = await db.select({ created_at: mindHistory.created_at }).from(mindHistory).where(eq4(mindHistory.turn_id, lastTurn[0].turn_id)).orderBy(mindHistory.created_at).limit(1);
       if (firstEvent.length > 0) {
         sinceTimestamp = firstEvent[0].created_at;
       }
@@ -5635,8 +5552,8 @@ ${user.trimEnd()}
     sinceTimestamp = new Date(Date.now() - 36e5).toISOString().replace("T", " ").slice(0, 19);
   }
   const conditions = [
-    eq5(summaries.mind, name),
-    eq5(summaries.period, "turn"),
+    eq4(summaries.mind, name),
+    eq4(summaries.period, "turn"),
     sql2`${summaries.created_at} > ${sinceTimestamp}`
   ];
   if (currentSession) {
@@ -5646,7 +5563,7 @@ ${user.trimEnd()}
     session: turns.session,
     content: summaries.content,
     created_at: summaries.created_at
-  }).from(summaries).innerJoin(turns, eq5(turns.id, summaries.period_key)).where(and4(...conditions)).orderBy(desc3(summaries.created_at)).limit(50);
+  }).from(summaries).innerJoin(turns, eq4(turns.id, summaries.period_key)).where(and4(...conditions)).orderBy(desc3(summaries.created_at)).limit(50);
   if (rows.length === 0) {
     return c.json({ context: null });
   }
@@ -5676,18 +5593,18 @@ ${lines.join("\n")}` });
   const limit = Math.min(Math.max(parseInt(c.req.query("limit") ?? "50", 10) || 50, 1), 200);
   const offset = Math.max(parseInt(c.req.query("offset") ?? "0", 10) || 0, 0);
   const db = await getDb();
-  const conditions = [eq5(mindHistory.mind, name)];
+  const conditions = [eq4(mindHistory.mind, name)];
   if (channel) {
-    conditions.push(eq5(mindHistory.channel, channel));
+    conditions.push(eq4(mindHistory.channel, channel));
   }
   if (session) {
-    conditions.push(eq5(mindHistory.session, session));
+    conditions.push(eq4(mindHistory.session, session));
   }
   const effectivePreset = full ? "all" : preset;
   if (!effectivePreset || effectivePreset === "summary") {
-    const sumConditions = [eq5(summaries.mind, name), eq5(summaries.period, "turn")];
+    const sumConditions = [eq4(summaries.mind, name), eq4(summaries.period, "turn")];
     if (session) {
-      sumConditions.push(eq5(turns.session, session));
+      sumConditions.push(eq4(turns.session, session));
       const sumRows2 = await db.select({
         id: summaries.id,
         mind: summaries.mind,
@@ -5697,7 +5614,7 @@ ${lines.join("\n")}` });
         metadata: summaries.metadata,
         created_at: summaries.created_at,
         session: turns.session
-      }).from(summaries).innerJoin(turns, eq5(turns.id, summaries.period_key)).where(and4(...sumConditions)).orderBy(desc3(summaries.created_at)).limit(limit).offset(offset);
+      }).from(summaries).innerJoin(turns, eq4(turns.id, summaries.period_key)).where(and4(...sumConditions)).orderBy(desc3(summaries.created_at)).limit(limit).offset(offset);
       return c.json(
         sumRows2.map((r) => ({
           id: r.id,
@@ -5750,7 +5667,7 @@ var minds_default = app13;
 
 // packages/daemon/src/web/api/prompts.ts
 import { zValidator as zValidator6 } from "@hono/zod-validator";
-import { eq as eq6, sql as sql3 } from "drizzle-orm";
+import { eq as eq5, sql as sql3 } from "drizzle-orm";
 import { Hono as Hono16 } from "hono";
 import { z as z6 } from "zod";
 var app14 = new Hono16().get("/", async (c) => {
@@ -5794,7 +5711,7 @@ var app14 = new Hono16().get("/", async (c) => {
     return c.json({ error: "Unknown prompt key" }, 404);
   }
   const db = await getDb();
-  await db.delete(systemPrompts).where(eq6(systemPrompts.key, key));
+  await db.delete(systemPrompts).where(eq5(systemPrompts.key, key));
   return c.json({ ok: true });
 });
 var prompts_default = app14;
@@ -6042,7 +5959,7 @@ var app15 = new Hono17().get("/:name/clock/status", requireSelf(), async (c) =>
   const body = await c.req.text();
   const message = `[webhook: ${event}] ${body}`;
   try {
-    const { sendSystemMessage } = await import("./system-chat-HCPHUQGI.js");
+    const { sendSystemMessage } = await import("./system-chat-P6KVGW4T.js");
     await sendSystemMessage(name, message);
     return c.json({ ok: true });
   } catch (err) {
@@ -6096,7 +6013,7 @@ setup.get("/status", async (c) => {
   let hasAccount = false;
   if (hasSystem) {
     try {
-      const { listUsersByType: listUsersByType2 } = await import("./auth-VYW2ECCE.js");
+      const { listUsersByType: listUsersByType2 } = await import("./auth-EAASQPTN.js");
       const brains = await listUsersByType2("brain");
       hasAccount = brains.length > 0;
     } catch (err) {
@@ -6307,7 +6224,7 @@ setup.post("/account", async (c) => {
     }
   }
   try {
-    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-VYW2ECCE.js");
+    const { createUser: createUser2, updateUserProfile: updateUserProfile2 } = await import("./auth-EAASQPTN.js");
     const user = await createUser2(body.username.trim(), body.password);
     if (body.displayName?.trim()) {
       await updateUserProfile2(user.id, { display_name: body.displayName.trim() });
@@ -6353,7 +6270,7 @@ setup.post("/models", async (c) => {
     return c.json({ error: "Spirit model is required" }, 400);
   }
   try {
-    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-ZHEPFC3U.js");
+    const { setEnabledModels: setEnabledModels3, setUtilityModel: setUtilityModel2 } = await import("./ai-service-3GBOJGUA.js");
     setEnabledModels3(body.models);
     const config2 = readGlobalConfig();
     config2.spiritModel = body.spiritModel.trim();
@@ -6371,15 +6288,15 @@ setup.post("/complete", async (c) => {
     return c.json({ error: "Setup already complete" }, 400);
   }
   try {
-    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-KTBHLULO.js");
-    const { startSpiritFull } = await import("./mind-service-L7LMMDYJ.js");
+    const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-NJFAY5CZ.js");
+    const { startSpiritFull } = await import("./mind-service-PR4PR4XI.js");
     await ensureSpiritProject();
     await syncSpiritTemplate();
     const warnings = [];
     const config2 = readGlobalConfig();
     if (config2.setup?.service && config2.setup?.type === "local") {
       try {
-        const { installUserService } = await import("./service-install-NLGAVTQS.js");
+        const { installUserService } = await import("./service-install-GTDUHP6R.js");
         const installed = await installUserService(config2.port, config2.hostname);
         if (!installed) {
           warnings.push("Service installation is not supported on this platform.");
@@ -6407,8 +6324,8 @@ setup.post("/complete", async (c) => {
     }
     let spiritConversationId;
     try {
-      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-VYW2ECCE.js");
-      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-KW7IYESK.js");
+      const { getOrCreateMindUser: getOrCreateMindUser2, listUsersByType: listUsersByType2 } = await import("./auth-EAASQPTN.js");
+      const { createConversation: createConversation2, findDMConversation: findDMConversation2 } = await import("./conversations-FSZCUUYO.js");
       const spiritUser = await getOrCreateMindUser2("volute");
       const brains = await listUsersByType2("brain");
       const admin2 = brains.find((u) => u.role === "admin");
@@ -6430,8 +6347,8 @@ setup.post("/complete", async (c) => {
     logger_default.info("setup complete state", { spiritConversationId, spiritStarted });
     if (spiritConversationId && spiritStarted) {
       try {
-        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-X4CZE2L6.js");
-        const { listUsersByType: listUsers2 } = await import("./auth-VYW2ECCE.js");
+        const { deliverMessage: deliverMessage2 } = await import("./message-delivery-FPIL26WV.js");
+        const { listUsersByType: listUsers2 } = await import("./auth-EAASQPTN.js");
         const admins = await listUsers2("brain");
         const admin2 = admins.find((u) => u.role === "admin");
         const adminName = admin2?.display_name || admin2?.username || "the admin";
@@ -6790,11 +6707,20 @@ function bufferEvent(data) {
   }
   return id;
 }
-function getEventsSince(sinceId) {
+function nextEventId() {
+  return nextId++;
+}
+function getEventsSince(sinceId, allowedConversationIds) {
   const now = Date.now();
   const startIdx = buffer.findIndex((e) => e.id > sinceId);
   if (startIdx === -1) return [];
-  return buffer.slice(startIdx).filter((e) => now - e.timestamp < MAX_AGE_MS);
+  return buffer.slice(startIdx).filter((e) => {
+    if (now - e.timestamp >= MAX_AGE_MS) return false;
+    const data = e.data;
+    if (data.event === "snapshot") return false;
+    if (data.event === "conversation") return allowedConversationIds.has(data.conversationId);
+    return true;
+  });
 }
 
 // packages/daemon/src/web/api/v1/events.ts
@@ -6809,8 +6735,22 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
       cleanups.push(() => removeConnection(user.username));
     }
     try {
+      let conversations2 = [];
+      try {
+        conversations2 = await listConversationsWithParticipants(user.id);
+        if (conversations2.length > 0) {
+          const convIds = conversations2.map((c2) => c2.id);
+          const unreads = await getUnreadCounts(user.id, convIds);
+          for (const conv of conversations2) {
+            conv.unreadCount = unreads[conv.id] ?? 0;
+          }
+        }
+      } catch (err) {
+        logger_default.error("[v1-events] failed to fetch conversations", logger_default.errorData(err));
+      }
+      const allowedConversationIds = new Set(conversations2.map((c2) => c2.id));
       if (sinceId > 0) {
-        const missed = getEventsSince(sinceId);
+        const missed = getEventsSince(sinceId, allowedConversationIds);
         for (const event of missed) {
           await stream.writeSSE({
             id: String(event.id),
@@ -6829,19 +6769,6 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
       } catch (err) {
         logger_default.error("[v1-events] failed to fetch recent activity", logger_default.errorData(err));
       }
-      let conversations2 = [];
-      try {
-        conversations2 = await listConversationsWithParticipants(user.id);
-        if (conversations2.length > 0) {
-          const convIds = conversations2.map((c2) => c2.id);
-          const unreads = await getUnreadCounts(user.id, convIds);
-          for (const conv of conversations2) {
-            conv.unreadCount = unreads[conv.id] ?? 0;
-          }
-        }
-      } catch (err) {
-        logger_default.error("[v1-events] failed to fetch conversations", logger_default.errorData(err));
-      }
       const snapshotData = {
         event: "snapshot",
         activity: recentActivity,
@@ -6849,7 +6776,7 @@ var app20 = new Hono23().use("*", authMiddleware).get("/", async (c) => {
         activeMinds: getActiveMinds(),
         onlineBrains: getOnlineBrains()
       };
-      const snapshotId = bufferEvent(snapshotData);
+      const snapshotId = nextEventId();
       await stream.writeSSE({
         id: String(snapshotId),
         data: JSON.stringify(snapshotData)
@@ -6915,14 +6842,23 @@ import { resolve as resolve14 } from "path";
 function tsxBin(cwd) {
   return resolve14(cwd, "node_modules", ".bin", "tsx");
 }
-function spawnServer(cwd, port, options) {
+async function spawnServer(cwd, port, options) {
+  let cmd = tsxBin(cwd);
+  let args = ["src/server.ts", "--port", String(port)];
+  if (options?.mindName) {
+    if (isIsolationEnabled()) {
+      [cmd, args] = await wrapForIsolation(cmd, args, options.mindName);
+    } else if (isSandboxEnabled() && options.template !== "codex") {
+      [cmd, args] = await wrapForSandbox(cmd, args, cwd, options.mindName, [cwd, mindTmpDir(cwd)]);
+    }
+  }
   if (options?.detached) {
-    return spawnDetached(cwd, port, options.logDir);
+    return spawnDetached(cmd, args, cwd, options.logDir);
   }
-  return spawnAttached(cwd, port);
+  return spawnAttached(cmd, args, cwd);
 }
-function spawnAttached(cwd, port) {
-  const child = spawn4(tsxBin(cwd), ["src/server.ts", "--port", String(port)], {
+function spawnAttached(cmd, args, cwd) {
+  const child = spawn4(cmd, args, {
     cwd,
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -6947,12 +6883,12 @@ function spawnAttached(cwd, port) {
     });
   });
 }
-function spawnDetached(cwd, port, logDir) {
+function spawnDetached(cmd, args, cwd, logDir) {
   const logsDir = logDir ?? resolve14(cwd, ".mind", "logs");
   mkdirSync8(logsDir, { recursive: true });
   const logPath = resolve14(logsDir, "mind.log");
   const logFd = openSync(logPath, "a");
-  const child = spawn4(tsxBin(cwd), ["src/server.ts", "--port", String(port)], {
+  const child = spawn4(cmd, args, {
     cwd,
     stdio: ["ignore", logFd, logFd],
     detached: true
@@ -7147,7 +7083,11 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
     }
   }
   if (!body.skipVerify) {
-    const result = await spawnServer(variantEntry.dir, 0, { detached: true });
+    const result = await spawnServer(variantEntry.dir, 0, {
+      detached: true,
+      mindName: variantName,
+      template: variantEntry.template
+    });
     if (!result) {
       return c.json(
         { error: "Failed to start server for verification. Use skipVerify to skip." },
@@ -7188,8 +7128,8 @@ var app21 = new Hono24().get("/:name/variants", async (c) => {
   await cleanupVariant(variantName, projectRoot, variantEntry.dir);
   if (variantName.endsWith("-upgrade") || variantName === "upgrade") {
     try {
-      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-JARTCRGS.js");
-      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-RAXNFN7K.js");
+      const { computeTemplateHash: computeTemplateHash2 } = await import("./template-hash-446HHH5V.js");
+      const { setMindTemplateHash: setMindTemplateHash2 } = await import("./registry-MDLNPTTI.js");
       const tmpl = parentEntry.template ?? "claude";
       await setMindTemplateHash2(mindName, computeTemplateHash2(tmpl));
     } catch (err) {
@@ -7303,9 +7243,13 @@ var app22 = new Hono25().get("/", async (c) => {
   });
 }).patch("/:name", zValidator9("json", channelSettingsSchema), async (c) => {
   const name = c.req.param("name");
+  const user = c.get("user");
   const body = c.req.valid("json");
   const ch = await getChannelByName(name);
   if (!ch) return c.json({ error: "Channel not found" }, 404);
+  if (user.role !== "admin" && user.role !== "system" && !await isParticipant(ch.id, user.id)) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
   await updateChannelSettings(name, body);
   const settings = await getChannelSettings(name);
   return c.json({ ...ch, channel_name: name, settings: formatChannelSettings(settings) });
@@ -7335,6 +7279,9 @@ var app22 = new Hono25().get("/", async (c) => {
   const { username } = c.req.valid("json");
   const ch = await getChannelByName(name);
   if (!ch) return c.json({ error: "Channel not found" }, 404);
+  if (inviter.role !== "admin" && inviter.role !== "system" && !await isParticipant(ch.id, inviter.id)) {
+    return c.json({ error: "Forbidden" }, 403);
+  }
   let user = await getUserByUsername(username);
   if (!user && await findMind(username)) {
     user = await getOrCreateMindUser(username);
@@ -7941,6 +7888,11 @@ if (!process.env.VOLUTE_HOME) {
 if (process.env.VOLUTE_TIMEZONE && !process.env.TZ) {
   process.env.TZ = process.env.VOLUTE_TIMEZONE;
 }
+function writeDaemonConfig(path, config2) {
+  writeFileSync9(path, `${JSON.stringify(config2, null, 2)}
+`, { mode: 384 });
+  chmodSync(path, 384);
+}
 async function startDaemon(opts) {
   const { port, hostname } = opts;
   const myPid = String(process.pid);
@@ -7961,18 +7913,19 @@ async function startDaemon(opts) {
   const DAEMON_JSON_PATH = resolve17(systemDir, "daemon.json");
   mkdirSync10(home, { recursive: true });
   ensureSystemDir();
-  const { migrateSetupCompleted } = await import("./setup-3434PQ5Q.js");
+  const { migrateConfigSecrets, migrateSetupCompleted } = await import("./setup-IYOUPCIK.js");
+  migrateConfigSecrets();
   migrateSetupCompleted();
-  await (await import("./db-D4FVCA5I.js")).getDb();
+  await (await import("./db-ZJJJYJBU.js")).getDb();
   try {
-    const { eq: eq7, and: and5 } = await import("drizzle-orm");
+    const { eq: eq6, and: and5 } = await import("drizzle-orm");
     const { users: users2 } = await import("./schema-HHYJDG7B.js");
-    const db = await (await import("./db-D4FVCA5I.js")).getDb();
-    await db.update(users2).set({ role: "system" }).where(and5(eq7(users2.user_type, "system"), eq7(users2.role, "user")));
+    const db = await (await import("./db-ZJJJYJBU.js")).getDb();
+    await db.update(users2).set({ role: "system" }).where(and5(eq6(users2.user_type, "system"), eq6(users2.role, "user")));
   } catch (err) {
     logger_default.warn("failed to migrate system user role", logger_default.errorData(err));
   }
-  const { initSandbox } = await import("./sandbox-O3GZTS7J.js");
+  const { initSandbox } = await import("./sandbox-E7RWZDVG.js");
   await initSandbox();
   try {
     await syncBuiltinSkills();
@@ -7999,7 +7952,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to ensure #system channel", logger_default.errorData(err));
   }
   try {
-    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-VYW2ECCE.js");
+    const { getOrCreateSystemUser: getOrCreateSystemUser2 } = await import("./auth-EAASQPTN.js");
     await getOrCreateSystemUser2();
   } catch (err) {
     logger_default.warn(
@@ -8008,12 +7961,12 @@ async function startDaemon(opts) {
     );
   }
   const token = process.env.VOLUTE_DAEMON_TOKEN || randomBytes(32).toString("hex");
-  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-3434PQ5Q.js");
+  const { readGlobalConfig: readGlobalConfig2 } = await import("./setup-IYOUPCIK.js");
   const globalCfg = readGlobalConfig2();
   let tls;
   if (opts.tailscale || globalCfg.tailscale) {
     try {
-      const { getTailscaleTls } = await import("./tailscale-PK3AI5EV.js");
+      const { getTailscaleTls } = await import("./tailscale-TIRTGM6E.js");
       const tlsConfig = await getTailscaleTls();
       tls = { key: tlsConfig.key, cert: tlsConfig.cert };
       logger_default.info("Tailscale HTTPS enabled", { hostname: tlsConfig.hostname });
@@ -8044,8 +7997,7 @@ async function startDaemon(opts) {
   const daemonConfig = { port, hostname, token };
   if (internalPort) daemonConfig.internalPort = internalPort;
   if (tls) daemonConfig.tls = true;
-  writeFileSync9(DAEMON_JSON_PATH, `${JSON.stringify(daemonConfig, null, 2)}
-`, { mode: 420 });
+  writeDaemonConfig(DAEMON_JSON_PATH, daemonConfig);
   const delivery = initDeliveryManager();
   const manager = initMindManager();
   manager.loadCrashAttempts();
@@ -8092,10 +8044,10 @@ async function startDaemon(opts) {
     await Promise.all(workers);
   }
   try {
-    const { isSetupComplete: isSetupComplete2 } = await import("./setup-3434PQ5Q.js");
+    const { isSetupComplete: isSetupComplete2 } = await import("./setup-IYOUPCIK.js");
     if (isSetupComplete2()) {
-      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-KTBHLULO.js");
-      const { startSpiritFull } = await import("./mind-service-L7LMMDYJ.js");
+      const { ensureSpiritProject, syncSpiritTemplate } = await import("./spirit-NJFAY5CZ.js");
+      const { startSpiritFull } = await import("./mind-service-PR4PR4XI.js");
       await ensureSpiritProject();
       await syncSpiritTemplate();
       const spiritEntry = await findMind("volute");
@@ -8112,7 +8064,7 @@ async function startDaemon(opts) {
   bridgeManager.startBridges(daemonPort).catch((err) => {
     logger_default.warn("failed to start bridges", logger_default.errorData(err));
   });
-  import("./cloud-sync-GV6O2HN2.js").then(
+  import("./cloud-sync-3OPHFOYQ.js").then(
     ({ consumeQueuedMessages }) => consumeQueuedMessages().catch((err) => {
       logger_default.warn("failed to consume queued cloud messages", logger_default.errorData(err));
     })
@@ -8120,7 +8072,7 @@ async function startDaemon(opts) {
     logger_default.warn("failed to load cloud-sync module", logger_default.errorData(err));
   });
   try {
-    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-SSNAWZMX.js");
+    const { backfillTemplateHashes, notifyVersionUpdate } = await import("./version-notify-TCKAX7ZA.js");
     backfillTemplateHashes();
     notifyVersionUpdate().catch((err) => {
       logger_default.warn("failed to send version update notifications", logger_default.errorData(err));
@@ -8225,8 +8177,12 @@ if (import.meta.url === `file://${process.argv[1]}` || process.argv[1]?.endsWith
   if (noSandbox) {
     process.env.VOLUTE_SANDBOX = "0";
   }
-  startDaemon({ port, hostname, foreground, tailscale });
+  startDaemon({ port, hostname, foreground, tailscale }).catch((err) => {
+    logger_default.error("daemon failed to start", logger_default.errorData(err));
+    process.exit(1);
+  });
 }
 export {
-  startDaemon
+  startDaemon,
+  writeDaemonConfig
 };