@agenticmail/core 0.9.5 → 0.9.7

package/dist/index.cjs

@@ -716,6 +716,7 @@ __export(index_exports, {
   CloudflareClient: () => CloudflareClient,
   DEFAULT_AGENT_NAME: () => DEFAULT_AGENT_NAME,
   DEFAULT_AGENT_ROLE: () => DEFAULT_AGENT_ROLE,
+  DEFAULT_SESSION_MAX_AGE_MS: () => DEFAULT_SESSION_MAX_AGE_MS,
   DNSConfigurator: () => DNSConfigurator,
   DependencyChecker: () => DependencyChecker,
   DependencyInstaller: () => DependencyInstaller,
@@ -752,12 +753,18 @@ __export(index_exports, {
   ensureDataDir: () => ensureDataDir,
   extractVerificationCode: () => extractVerificationCode,
   flushTelemetry: () => flushTelemetry,
+  forgetHostSession: () => forgetHostSession,
   getDatabase: () => getDatabase,
+  getOperatorEmail: () => getOperatorEmail,
+  hostSessionStoragePath: () => hostSessionStoragePath,
   isInternalEmail: () => isInternalEmail,
+  isSessionFresh: () => isSessionFresh,
   isValidPhoneNumber: () => isValidPhoneNumber,
+  loadHostSession: () => loadHostSession,
   normalizeAddress: () => normalizeAddress,
   normalizePhoneNumber: () => normalizePhoneNumber,
   normalizeSubject: () => normalizeSubject,
+  operatorPrefsStoragePath: () => operatorPrefsStoragePath,
   parseEmail: () => parseEmail,
   parseGoogleVoiceSms: () => parseGoogleVoiceSms,
   recordToolCall: () => recordToolCall,
@@ -767,8 +774,10 @@ __export(index_exports, {
   safeJoin: () => safeJoin,
   sanitizeEmail: () => sanitizeEmail,
   saveConfig: () => saveConfig,
+  saveHostSession: () => saveHostSession,
   scanOutboundEmail: () => scanOutboundEmail,
   scoreEmail: () => scoreEmail,
+  setOperatorEmail: () => setOperatorEmail,
   setTelemetryVersion: () => setTelemetryVersion,
   startRelayBridge: () => startRelayBridge,
   threadIdFor: () => threadIdFor,
@@ -1159,8 +1168,8 @@ var MailReceiver = class {
     }));
   }
   /** Create a new IMAP folder */
-  async createFolder(path) {
-    await this.client.mailboxCreate(path);
+  async createFolder(path2) {
+    await this.client.mailboxCreate(path2);
   }
   /** Batch mark multiple messages as seen */
   async batchMarkSeen(uids, mailbox = "INBOX") {
@@ -1700,8 +1709,8 @@ var StalwartAdmin = class {
   }
   baseUrl;
   authHeader;
-  async request(method, path, body) {
-    const url = `${this.baseUrl}/api${path}`;
+  async request(method, path2, body) {
+    const url = `${this.baseUrl}/api${path2}`;
     const response = await fetch(url, {
       method,
       headers: {
@@ -1862,14 +1871,14 @@ var StalwartAdmin = class {
     if (!isValidDomain(domain)) {
       throw new Error(`Invalid domain format: "${domain}"`);
     }
-    const { readFileSync: readFileSync7, writeFileSync: writeFileSync8 } = await import("fs");
-    const { homedir: homedir11 } = await import("os");
-    const { join: join13 } = await import("path");
-    const configPath = join13(homedir11(), ".agenticmail", "stalwart.toml");
+    const { readFileSync: readFileSync9, writeFileSync: writeFileSync10 } = await import("fs");
+    const { homedir: homedir13 } = await import("os");
+    const { join: join15 } = await import("path");
+    const configPath = join15(homedir13(), ".agenticmail", "stalwart.toml");
     try {
-      let config = readFileSync7(configPath, "utf-8");
+      let config = readFileSync9(configPath, "utf-8");
       config = config.replace(/^hostname\s*=\s*"[^"]*"/m, `hostname = "${escapeTomlString(domain)}"`);
-      writeFileSync8(configPath, config);
+      writeFileSync10(configPath, config);
       console.log(`[Stalwart] Updated hostname to "${domain}" in stalwart.toml`);
     } catch (err) {
       throw new Error(`Failed to set config server.hostname=${domain}`);
@@ -1878,15 +1887,15 @@ var StalwartAdmin = class {
   // --- DKIM ---
   /** Path to the host-side stalwart.toml (mounted read-only into container) */
   get configPath() {
-    const { homedir: homedir11 } = require("os");
-    const { join: join13 } = require("path");
-    return join13(homedir11(), ".agenticmail", "stalwart.toml");
+    const { homedir: homedir13 } = require("os");
+    const { join: join15 } = require("path");
+    return join15(homedir13(), ".agenticmail", "stalwart.toml");
   }
   /** Path to host-side DKIM key directory */
   get dkimDir() {
-    const { homedir: homedir11 } = require("os");
-    const { join: join13 } = require("path");
-    return join13(homedir11(), ".agenticmail");
+    const { homedir: homedir13 } = require("os");
+    const { join: join15 } = require("path");
+    return join15(homedir13(), ".agenticmail");
   }
   /**
    * Create/reuse a DKIM signing key for a domain.
@@ -1987,12 +1996,12 @@ var StalwartAdmin = class {
    * This bypasses the need for a PTR record on the sending IP.
    */
   async configureOutboundRelay(config) {
-    const { readFileSync: readFileSync7, writeFileSync: writeFileSync8 } = await import("fs");
-    const { homedir: homedir11 } = await import("os");
-    const { join: join13 } = await import("path");
+    const { readFileSync: readFileSync9, writeFileSync: writeFileSync10 } = await import("fs");
+    const { homedir: homedir13 } = await import("os");
+    const { join: join15 } = await import("path");
     const routeName = config.routeName ?? "gmail";
-    const tomlPath = join13(homedir11(), ".agenticmail", "stalwart.toml");
-    let toml = readFileSync7(tomlPath, "utf-8");
+    const tomlPath = join15(homedir13(), ".agenticmail", "stalwart.toml");
+    let toml = readFileSync9(tomlPath, "utf-8");
     toml = toml.replace(/\n\[queue\.route\.gmail\][\s\S]*?(?=\n\[|$)/, "");
     toml = toml.replace(/\n\[queue\.strategy\][\s\S]*?(?=\n\[|$)/, "");
     const safeRouteName = routeName.replace(/[^a-zA-Z0-9_-]/g, "");
@@ -2012,7 +2021,7 @@ auth.secret = "${escapeTomlString(config.password)}"
 route = [ { if = "is_local_domain('', rcpt_domain)", then = "'local'" },
            { else = "'${safeRouteName}'" } ]
 `;
-    writeFileSync8(tomlPath, toml, "utf-8");
+    writeFileSync10(tomlPath, toml, "utf-8");
     await this.restartContainer();
   }
 };
@@ -2395,11 +2404,11 @@ var AgentDeletionService = class {
     };
   }
   saveToFile(report) {
-    const dir = (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".agenticmail", "deletions");
-    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+    const dir2 = (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".agenticmail", "deletions");
+    (0, import_node_fs2.mkdirSync)(dir2, { recursive: true });
     const timestamp = report.deletedAt.replace(/[:.]/g, "-");
     const filename = `${report.agent.name}_${timestamp}.json`;
-    const filePath = (0, import_node_path2.join)(dir, filename);
+    const filePath = (0, import_node_path2.join)(dir2, filename);
     (0, import_node_fs2.writeFileSync)(filePath, JSON.stringify(report, null, 2), "utf-8");
     return filePath;
   }
@@ -4690,8 +4699,8 @@ var CloudflareClient = class {
     return resp.result;
   }
   // --- Internal ---
-  async request(method, path, body) {
-    const url = `${CF_API_BASE}${path}`;
+  async request(method, path2, body) {
+    const url = `${CF_API_BASE}${path2}`;
     const response = await fetch(url, {
       method,
       headers: {
@@ -5013,9 +5022,9 @@ var TunnelManager = class {
       throw new Error(`Failed to download cloudflared: ${response.statusText}`);
     }
     const buffer = Buffer.from(await response.arrayBuffer());
-    const { writeFile: writeFile2, rename: rename2 } = await import("fs/promises");
+    const { writeFile: writeFile4, rename: rename2 } = await import("fs/promises");
     const tmpPath = this.binPath + ".tmp";
-    await writeFile2(tmpPath, buffer);
+    await writeFile4(tmpPath, buffer);
     await (0, import_promises.chmod)(tmpPath, 493);
     await rename2(tmpPath, this.binPath);
     return this.binPath;
@@ -5308,6 +5317,33 @@ var SmsManager = class {
     meta.sms = config;
     this.db.prepare("UPDATE agents SET metadata = ?, updated_at = datetime('now') WHERE id = ?").run(JSON.stringify(meta), agentId);
   }
+  /**
+   * Resolve the operator's "where do I get pinged" address from an
+   * agent's SMS config. Used by the dispatcher's bridge-escalation
+   * path: when sub-agents mail a bridge with no fresh host session
+   * available, we email the operator a digest at this address. Their
+   * phone's Gmail push notification surfaces it within seconds —
+   * effectively a free, programmatic alert channel.
+   *
+   * Returns the configured `forwardingEmail` (the same Gmail Google
+   * Voice forwards inbound SMS to, which the operator already has
+   * push notifications enabled for) when SMS is configured AND
+   * enabled. Returns null otherwise — caller falls through to a
+   * silent log + system event.
+   *
+   * Why we don't try real-SMS delivery yet: Google Voice's
+   * `<number>@txt.voice.google.com` email-to-SMS gateway was
+   * deprecated by Google years ago. A future `carrier` field on
+   * SmsConfig (Verizon vtext.com / AT&T txt.att.net / etc) will let
+   * the operator opt into actual SMS, but that's a follow-up — the
+   * email path already gets the operator a phone notification.
+   */
+  getAlertEmail(agentId) {
+    const cfg = this.getSmsConfig(agentId);
+    if (!cfg || !cfg.enabled) return null;
+    if (typeof cfg.forwardingEmail !== "string" || !cfg.forwardingEmail.includes("@")) return null;
+    return cfg.forwardingEmail;
+  }
   /** Remove SMS config from agent metadata */
   removeSmsConfig(agentId) {
     const row = this.db.prepare("SELECT metadata FROM agents WHERE id = ?").get(agentId);
@@ -5923,12 +5959,12 @@ var GatewayManager = class {
       zone = await this.cfClient.createZone(domain);
     }
     const existingRecords = await this.cfClient.listDnsRecords(zone.id);
-    const { homedir: homedir11 } = await import("os");
-    const backupDir = (0, import_node_path4.join)(homedir11(), ".agenticmail");
+    const { homedir: homedir13 } = await import("os");
+    const backupDir = (0, import_node_path4.join)(homedir13(), ".agenticmail");
     const backupPath = (0, import_node_path4.join)(backupDir, `dns-backup-${domain}-${Date.now()}.json`);
-    const { writeFileSync: writeFileSync8, mkdirSync: mkdirSync9 } = await import("fs");
-    mkdirSync9(backupDir, { recursive: true });
-    writeFileSync8(backupPath, JSON.stringify({
+    const { writeFileSync: writeFileSync10, mkdirSync: mkdirSync11 } = await import("fs");
+    mkdirSync11(backupDir, { recursive: true });
+    writeFileSync10(backupPath, JSON.stringify({
       domain,
       zoneId: zone.id,
       backedUpAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6689,8 +6725,8 @@ function isDisabled() {
 function getInstallId() {
   if (installId) return installId;
   try {
-    const dir = (0, import_path.join)((0, import_os.homedir)(), ".agenticmail");
-    const idFile = (0, import_path.join)(dir, ".telemetry-id");
+    const dir2 = (0, import_path.join)((0, import_os.homedir)(), ".agenticmail");
+    const idFile = (0, import_path.join)(dir2, ".telemetry-id");
     if ((0, import_fs.existsSync)(idFile)) {
       const id = (0, import_fs.readFileSync)(idFile, "utf8").trim();
       if (id && id.length > 10) {
@@ -6699,7 +6735,7 @@ function getInstallId() {
       }
     }
     installId = (0, import_crypto.randomUUID)();
-    if (!(0, import_fs.existsSync)(dir)) (0, import_fs.mkdirSync)(dir, { recursive: true });
+    if (!(0, import_fs.existsSync)(dir2)) (0, import_fs.mkdirSync)(dir2, { recursive: true });
     (0, import_fs.writeFileSync)(idFile, installId, "utf8");
     return installId;
   } catch {
@@ -6870,6 +6906,131 @@ function redactObject(input, _depth = 0) {
   return out;
 }
 
+// src/operator-prefs.ts
+var import_node_fs4 = require("fs");
+var import_node_os4 = require("os");
+var import_node_path6 = require("path");
+function dir() {
+  return (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".agenticmail");
+}
+function path() {
+  return (0, import_node_path6.join)(dir(), "operator-prefs.json");
+}
+function readFile() {
+  if (!(0, import_node_fs4.existsSync)(path())) return { version: 1 };
+  try {
+    const raw = (0, import_node_fs4.readFileSync)(path(), "utf-8");
+    if (!raw.trim()) return { version: 1 };
+    const parsed = JSON.parse(raw);
+    return { version: 1, operatorEmail: typeof parsed.operatorEmail === "string" ? parsed.operatorEmail : void 0 };
+  } catch {
+    return { version: 1 };
+  }
+}
+function writeFile(shape) {
+  const d = dir();
+  const p = path();
+  if (!(0, import_node_fs4.existsSync)(d)) (0, import_node_fs4.mkdirSync)(d, { recursive: true });
+  const tmp = `${p}.agenticmail-tmp-${process.pid}`;
+  (0, import_node_fs4.writeFileSync)(tmp, JSON.stringify(shape, null, 2), "utf-8");
+  (0, import_node_fs4.renameSync)(tmp, p);
+}
+function getOperatorEmail() {
+  const shape = readFile();
+  const email = shape.operatorEmail;
+  if (typeof email !== "string") return null;
+  const trimmed = email.trim();
+  return trimmed.length > 0 && trimmed.includes("@") ? trimmed : null;
+}
+function setOperatorEmail(email) {
+  const shape = readFile();
+  if (!email || !email.trim()) {
+    delete shape.operatorEmail;
+    writeFile(shape);
+    return null;
+  }
+  const trimmed = email.trim();
+  if (!trimmed.includes("@")) {
+    throw new Error("operator email must contain an @");
+  }
+  shape.operatorEmail = trimmed;
+  writeFile(shape);
+  return trimmed;
+}
+function operatorPrefsStoragePath() {
+  return path();
+}
+
+// src/host-sessions.ts
+var import_node_fs5 = require("fs");
+var import_node_path7 = require("path");
+var import_node_os5 = require("os");
+function storageDir() {
+  return (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".agenticmail");
+}
+function storagePath() {
+  return (0, import_node_path7.join)(storageDir(), "host-sessions.json");
+}
+var DEFAULT_SESSION_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+function readFile2() {
+  const p = storagePath();
+  if (!(0, import_node_fs5.existsSync)(p)) return { version: 1, sessions: {} };
+  try {
+    const raw = (0, import_node_fs5.readFileSync)(p, "utf-8");
+    if (!raw.trim()) return { version: 1, sessions: {} };
+    const parsed = JSON.parse(raw);
+    return {
+      version: 1,
+      sessions: parsed.sessions && typeof parsed.sessions === "object" ? parsed.sessions : {}
+    };
+  } catch {
+    return { version: 1, sessions: {} };
+  }
+}
+function writeFile2(shape) {
+  const dir2 = storageDir();
+  const p = storagePath();
+  if (!(0, import_node_fs5.existsSync)(dir2)) (0, import_node_fs5.mkdirSync)(dir2, { recursive: true });
+  const tmp = `${p}.agenticmail-tmp-${process.pid}`;
+  (0, import_node_fs5.writeFileSync)(tmp, JSON.stringify(shape, null, 2), "utf-8");
+  (0, import_node_fs5.renameSync)(tmp, p);
+}
+function saveHostSession(host, session) {
+  if (!session.sessionId) return;
+  try {
+    const shape = readFile2();
+    shape.sessions[host] = {
+      ...session,
+      lastSeenMs: Date.now()
+    };
+    writeFile2(shape);
+  } catch {
+  }
+}
+function loadHostSession(host, maxAgeMs = DEFAULT_SESSION_MAX_AGE_MS) {
+  const shape = readFile2();
+  const record = shape.sessions[host];
+  if (!record) return null;
+  if (!isSessionFresh(record, maxAgeMs)) return null;
+  return record;
+}
+function isSessionFresh(session, maxAgeMs = DEFAULT_SESSION_MAX_AGE_MS) {
+  if (!session || !Number.isFinite(session.lastSeenMs)) return false;
+  return Date.now() - session.lastSeenMs <= maxAgeMs;
+}
+function forgetHostSession(host) {
+  try {
+    const shape = readFile2();
+    if (!shape.sessions[host]) return;
+    delete shape.sessions[host];
+    writeFile2(shape);
+  } catch {
+  }
+}
+function hostSessionStoragePath() {
+  return storagePath();
+}
+
 // src/util/safe-url.ts
 var UnsafeApiUrlError = class extends Error {
   constructor(raw, reason) {
@@ -6912,21 +7073,21 @@ function validateApiUrl(raw) {
   return parsed.origin;
 }
 function buildApiUrl(baseOrigin, pathAndQuery) {
-  const path = pathAndQuery.startsWith("/") ? pathAndQuery : `/${pathAndQuery}`;
-  return new URL(path, baseOrigin + "/").toString();
+  const path2 = pathAndQuery.startsWith("/") ? pathAndQuery : `/${pathAndQuery}`;
+  return new URL(path2, baseOrigin + "/").toString();
 }
 
 // src/setup/index.ts
 var import_node_crypto3 = require("crypto");
-var import_node_fs7 = require("fs");
-var import_node_path9 = require("path");
-var import_node_os7 = require("os");
+var import_node_fs9 = require("fs");
+var import_node_path11 = require("path");
+var import_node_os9 = require("os");
 
 // src/setup/deps.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs4 = require("fs");
-var import_node_path6 = require("path");
-var import_node_os4 = require("os");
+var import_node_fs6 = require("fs");
+var import_node_path8 = require("path");
+var import_node_os6 = require("os");
 var DependencyChecker = class {
   async checkAll() {
     return Promise.all([
@@ -6976,8 +7137,8 @@ var DependencyChecker = class {
     }
   }
   async checkCloudflared() {
-    const binPath = (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".agenticmail", "bin", "cloudflared");
-    if ((0, import_node_fs4.existsSync)(binPath)) {
+    const binPath = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin", "cloudflared");
+    if ((0, import_node_fs6.existsSync)(binPath)) {
       let version;
       try {
         const output = (0, import_node_child_process2.execFileSync)(binPath, ["--version"], { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
@@ -6999,10 +7160,10 @@ var DependencyChecker = class {
 
 // src/setup/installer.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs5 = require("fs");
+var import_node_fs7 = require("fs");
 var import_promises2 = require("fs/promises");
-var import_node_path7 = require("path");
-var import_node_os5 = require("os");
+var import_node_path9 = require("path");
+var import_node_os7 = require("os");
 function runShellWithRollingOutput(cmd, opts = {}) {
   const maxLines = opts.maxLines ?? 20;
   const timeout = opts.timeout ?? 3e5;
@@ -7112,7 +7273,7 @@ var DependencyInstaller = class {
    */
   async installDocker() {
     if (this.isDockerReady()) return;
-    const os = (0, import_node_os5.platform)();
+    const os = (0, import_node_os7.platform)();
     if (os === "darwin") {
       await this.installDockerMac();
     } else if (os === "linux") {
@@ -7178,15 +7339,15 @@ var DependencyInstaller = class {
     try {
       const composeBin = (0, import_node_child_process3.execFileSync)("which", ["docker-compose"], { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
       if (!composeBin) return;
-      const pluginDir = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".docker", "cli-plugins");
-      const pluginPath = (0, import_node_path7.join)(pluginDir, "docker-compose");
-      if ((0, import_node_fs5.existsSync)(pluginPath)) return;
+      const pluginDir = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".docker", "cli-plugins");
+      const pluginPath = (0, import_node_path9.join)(pluginDir, "docker-compose");
+      if ((0, import_node_fs7.existsSync)(pluginPath)) return;
       try {
-        (0, import_node_fs5.mkdirSync)(pluginDir, { recursive: true });
+        (0, import_node_fs7.mkdirSync)(pluginDir, { recursive: true });
       } catch {
       }
       try {
-        (0, import_node_fs5.symlinkSync)(composeBin, pluginPath);
+        (0, import_node_fs7.symlinkSync)(composeBin, pluginPath);
       } catch {
       }
     } catch {
@@ -7245,9 +7406,9 @@ var DependencyInstaller = class {
       return;
     }
     this.onProgress("__progress__:5:Installing Docker Engine...");
-    const tmpDir = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".agenticmail", "tmp");
+    const tmpDir = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail", "tmp");
     await (0, import_promises2.mkdir)(tmpDir, { recursive: true });
-    const scriptPath = (0, import_node_path7.join)(tmpDir, "install-docker.sh");
+    const scriptPath = (0, import_node_path9.join)(tmpDir, "install-docker.sh");
     const dlResult = await runShellWithRollingOutput(
       `curl -fsSL https://get.docker.com -o "${scriptPath}" && sudo sh "${scriptPath}"`,
       { timeout: 3e5 }
@@ -7315,8 +7476,8 @@ var DependencyInstaller = class {
       }
       try {
         const programFiles = process.env["ProgramFiles"] || "C:\\Program Files";
-        const dockerExe = (0, import_node_path7.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
-        if ((0, import_node_fs5.existsSync)(dockerExe)) {
+        const dockerExe = (0, import_node_path9.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
+        if ((0, import_node_fs7.existsSync)(dockerExe)) {
           (0, import_node_child_process3.execSync)(`start "" "${dockerExe}"`, { timeout: 1e4, stdio: "ignore", shell: "cmd.exe" });
         }
       } catch {
@@ -7366,8 +7527,8 @@ var DependencyInstaller = class {
         this.onProgress("__progress__:70:Docker Desktop installed. Starting...");
         try {
           const programFiles = process.env["ProgramFiles"] || "C:\\Program Files";
-          const dockerExe = (0, import_node_path7.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
-          if ((0, import_node_fs5.existsSync)(dockerExe)) {
+          const dockerExe = (0, import_node_path9.join)(programFiles, "Docker", "Docker", "Docker Desktop.exe");
+          if ((0, import_node_fs7.existsSync)(dockerExe)) {
             (0, import_node_child_process3.execSync)(`start "" "${dockerExe}"`, { timeout: 1e4, stdio: "ignore", shell: "cmd.exe" });
           }
         } catch {
@@ -7404,12 +7565,12 @@ var DependencyInstaller = class {
    * Start the Stalwart mail server Docker container.
    */
   async startStalwart(composePath) {
-    if (!(0, import_node_fs5.existsSync)(composePath)) {
+    if (!(0, import_node_fs7.existsSync)(composePath)) {
       throw new Error(`docker-compose.yml not found at: ${composePath}`);
     }
     if (!this.isDockerReady()) {
       this.onProgress("Starting Docker...");
-      const os = (0, import_node_os5.platform)();
+      const os = (0, import_node_os7.platform)();
       if (os === "darwin") {
         await this.startColima();
       } else if (os === "win32") {
@@ -7427,7 +7588,7 @@ var DependencyInstaller = class {
       }
     }
     this.onProgress("__progress__:10:Pulling mail server image...");
-    if ((0, import_node_os5.platform)() === "darwin") this.linkComposePlugin();
+    if ((0, import_node_os7.platform)() === "darwin") this.linkComposePlugin();
     let composeResult = await runSilent("docker", ["compose", "-f", composePath, "up", "-d"], { timeout: 12e4 });
     if (composeResult.exitCode !== 0 && hasCommand("docker-compose")) {
       composeResult = await runSilent("docker-compose", ["-f", composePath, "up", "-d"], { timeout: 12e4 });
@@ -7462,22 +7623,22 @@ var DependencyInstaller = class {
    * Returns the path to the installed binary.
    */
   async installCloudflared() {
-    const os = (0, import_node_os5.platform)();
-    const binDir = (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".agenticmail", "bin");
+    const os = (0, import_node_os7.platform)();
+    const binDir = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail", "bin");
     const binName = os === "win32" ? "cloudflared.exe" : "cloudflared";
-    const binPath = (0, import_node_path7.join)(binDir, binName);
-    if ((0, import_node_fs5.existsSync)(binPath)) {
+    const binPath = (0, import_node_path9.join)(binDir, binName);
+    if ((0, import_node_fs7.existsSync)(binPath)) {
       return binPath;
     }
     try {
       const whichCmd = os === "win32" ? "where" : "which";
       const sysPath = (0, import_node_child_process3.execFileSync)(whichCmd, ["cloudflared"], { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim().split("\n")[0];
-      if (sysPath && (0, import_node_fs5.existsSync)(sysPath)) return sysPath;
+      if (sysPath && (0, import_node_fs7.existsSync)(sysPath)) return sysPath;
     } catch {
     }
     this.onProgress("Downloading cloudflared...");
     await (0, import_promises2.mkdir)(binDir, { recursive: true });
-    const cpu = (0, import_node_os5.arch)();
+    const cpu = (0, import_node_os7.arch)();
     const archName = cpu === "arm64" ? "arm64" : "amd64";
     let downloadUrl;
     if (os === "darwin") {
@@ -7495,7 +7656,7 @@ var DependencyInstaller = class {
     }
     const buffer = Buffer.from(await response.arrayBuffer());
     if (os === "darwin") {
-      const tgzPath = (0, import_node_path7.join)(binDir, "cloudflared.tgz");
+      const tgzPath = (0, import_node_path9.join)(binDir, "cloudflared.tgz");
       await (0, import_promises2.writeFile)(tgzPath, buffer);
       try {
         (0, import_node_child_process3.execFileSync)("tar", ["-xzf", tgzPath, "-C", binDir, "cloudflared"], { timeout: 15e3, stdio: "ignore" });
@@ -7512,7 +7673,7 @@ var DependencyInstaller = class {
       if (os !== "win32") await (0, import_promises2.chmod)(tmpPath, 493);
       await (0, import_promises2.rename)(tmpPath, binPath);
     }
-    if (!(0, import_node_fs5.existsSync)(binPath)) {
+    if (!(0, import_node_fs7.existsSync)(binPath)) {
       throw new Error("cloudflared download succeeded but binary not found after extraction");
     }
     this.onProgress("cloudflared installed");
@@ -7530,23 +7691,23 @@ var DependencyInstaller = class {
 
 // src/setup/service.ts
 var import_node_child_process4 = require("child_process");
-var import_node_fs6 = require("fs");
-var import_node_path8 = require("path");
-var import_node_os6 = require("os");
+var import_node_fs8 = require("fs");
+var import_node_path10 = require("path");
+var import_node_os8 = require("os");
 var import_node_module2 = require("module");
 var import_meta2 = {};
 var PLIST_LABEL = "com.agenticmail.server";
 var SYSTEMD_UNIT = "agenticmail.service";
 var ServiceManager = class {
-  os = (0, import_node_os6.platform)();
+  os = (0, import_node_os8.platform)();
   /**
    * Get the path to the service file.
    */
   getServicePath() {
     if (this.os === "darwin") {
-      return (0, import_node_path8.join)((0, import_node_os6.homedir)(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+      return (0, import_node_path10.join)((0, import_node_os8.homedir)(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
     } else {
-      return (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".config", "systemd", "user", SYSTEMD_UNIT);
+      return (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".config", "systemd", "user", SYSTEMD_UNIT);
     }
   }
   /**
@@ -7580,40 +7741,40 @@ var ServiceManager = class {
     try {
       const req = (0, import_node_module2.createRequire)(import_meta2.url);
       const resolved = req.resolve("@agenticmail/api");
-      if ((0, import_node_fs6.existsSync)(resolved)) return resolved;
+      if ((0, import_node_fs8.existsSync)(resolved)) return resolved;
     } catch {
     }
     const parentPackages = [
-      (0, import_node_path8.join)("@agenticmail", "cli"),
+      (0, import_node_path10.join)("@agenticmail", "cli"),
       // current scoped package
       "agenticmail"
       // legacy unscoped package
     ];
     const baseDirs = [
       // user-local install
-      (0, import_node_path8.join)((0, import_node_os6.homedir)(), "node_modules")
+      (0, import_node_path10.join)((0, import_node_os8.homedir)(), "node_modules")
     ];
     try {
       const prefix = (0, import_node_child_process4.execSync)("npm prefix -g", { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-      baseDirs.push((0, import_node_path8.join)(prefix, "lib", "node_modules"));
-      baseDirs.push((0, import_node_path8.join)(prefix, "node_modules"));
+      baseDirs.push((0, import_node_path10.join)(prefix, "lib", "node_modules"));
+      baseDirs.push((0, import_node_path10.join)(prefix, "node_modules"));
     } catch {
     }
     baseDirs.push("/opt/homebrew/lib/node_modules");
     baseDirs.push("/usr/local/lib/node_modules");
     for (const base of baseDirs) {
-      const sibling = (0, import_node_path8.join)(base, "@agenticmail", "api", "dist", "index.js");
-      if ((0, import_node_fs6.existsSync)(sibling)) return sibling;
+      const sibling = (0, import_node_path10.join)(base, "@agenticmail", "api", "dist", "index.js");
+      if ((0, import_node_fs8.existsSync)(sibling)) return sibling;
       for (const parent of parentPackages) {
-        const nested = (0, import_node_path8.join)(base, parent, "node_modules", "@agenticmail", "api", "dist", "index.js");
-        if ((0, import_node_fs6.existsSync)(nested)) return nested;
+        const nested = (0, import_node_path10.join)(base, parent, "node_modules", "@agenticmail", "api", "dist", "index.js");
+        if ((0, import_node_fs8.existsSync)(nested)) return nested;
       }
     }
-    const dataDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail");
-    const entryCache = (0, import_node_path8.join)(dataDir, "api-entry.path");
-    if ((0, import_node_fs6.existsSync)(entryCache)) {
-      const cached = (0, import_node_fs6.readFileSync)(entryCache, "utf-8").trim();
-      if (cached && (0, import_node_fs6.existsSync)(cached)) return cached;
+    const dataDir = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail");
+    const entryCache = (0, import_node_path10.join)(dataDir, "api-entry.path");
+    if ((0, import_node_fs8.existsSync)(entryCache)) {
+      const cached = (0, import_node_fs8.readFileSync)(entryCache, "utf-8").trim();
+      if (cached && (0, import_node_fs8.existsSync)(cached)) return cached;
     }
     throw new Error("Could not find @agenticmail/api entry point. Run `agenticmail start` first to populate the cache.");
   }
@@ -7621,9 +7782,9 @@ var ServiceManager = class {
    * Cache the API entry path so the service can find it later.
    */
   cacheApiEntryPath(entryPath) {
-    const dataDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail");
-    if (!(0, import_node_fs6.existsSync)(dataDir)) (0, import_node_fs6.mkdirSync)(dataDir, { recursive: true });
-    (0, import_node_fs6.writeFileSync)((0, import_node_path8.join)(dataDir, "api-entry.path"), entryPath);
+    const dataDir = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail");
+    if (!(0, import_node_fs8.existsSync)(dataDir)) (0, import_node_fs8.mkdirSync)(dataDir, { recursive: true });
+    (0, import_node_fs8.writeFileSync)((0, import_node_path10.join)(dataDir, "api-entry.path"), entryPath);
   }
   /**
    * Get the current package version.
@@ -7636,36 +7797,36 @@ var ServiceManager = class {
     try {
       const req = (0, import_node_module2.createRequire)(import_meta2.url);
       const pkgJson = req.resolve("@agenticmail/cli/package.json");
-      if ((0, import_node_fs6.existsSync)(pkgJson)) {
-        const pkg = JSON.parse((0, import_node_fs6.readFileSync)(pkgJson, "utf-8"));
+      if ((0, import_node_fs8.existsSync)(pkgJson)) {
+        const pkg = JSON.parse((0, import_node_fs8.readFileSync)(pkgJson, "utf-8"));
         if (pkg.version) return pkg.version;
       }
     } catch {
     }
     try {
       const apiEntry = this.getApiEntryPath();
-      const apiPkg = (0, import_node_path8.join)(apiEntry, "..", "..", "package.json");
-      if ((0, import_node_fs6.existsSync)(apiPkg)) {
-        const pkg = JSON.parse((0, import_node_fs6.readFileSync)(apiPkg, "utf-8"));
+      const apiPkg = (0, import_node_path10.join)(apiEntry, "..", "..", "package.json");
+      if ((0, import_node_fs8.existsSync)(apiPkg)) {
+        const pkg = JSON.parse((0, import_node_fs8.readFileSync)(apiPkg, "utf-8"));
         if (pkg.version) return pkg.version;
       }
     } catch {
     }
     const candidates = [
-      (0, import_node_path8.join)((0, import_node_os6.homedir)(), "node_modules", "@agenticmail", "cli", "package.json"),
-      (0, import_node_path8.join)((0, import_node_os6.homedir)(), "node_modules", "agenticmail", "package.json"),
-      (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "package-version.json")
+      (0, import_node_path10.join)((0, import_node_os8.homedir)(), "node_modules", "@agenticmail", "cli", "package.json"),
+      (0, import_node_path10.join)((0, import_node_os8.homedir)(), "node_modules", "agenticmail", "package.json"),
+      (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "package-version.json")
     ];
     try {
       const prefix = (0, import_node_child_process4.execSync)("npm prefix -g", { timeout: 5e3, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-      candidates.push((0, import_node_path8.join)(prefix, "lib", "node_modules", "@agenticmail", "cli", "package.json"));
-      candidates.push((0, import_node_path8.join)(prefix, "lib", "node_modules", "agenticmail", "package.json"));
+      candidates.push((0, import_node_path10.join)(prefix, "lib", "node_modules", "@agenticmail", "cli", "package.json"));
+      candidates.push((0, import_node_path10.join)(prefix, "lib", "node_modules", "agenticmail", "package.json"));
     } catch {
     }
     for (const p of candidates) {
       try {
-        if ((0, import_node_fs6.existsSync)(p)) {
-          const pkg = JSON.parse((0, import_node_fs6.readFileSync)(p, "utf-8"));
+        if ((0, import_node_fs8.existsSync)(p)) {
+          const pkg = JSON.parse((0, import_node_fs8.readFileSync)(p, "utf-8"));
           if (pkg.version) return pkg.version;
         }
       } catch {
@@ -7678,9 +7839,9 @@ var ServiceManager = class {
    * This ensures AgenticMail doesn't fail on boot when Docker is still loading.
    */
   generateStartScript(nodePath, apiEntry) {
-    const scriptPath = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin", "start-server.sh");
-    const scriptDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin");
-    if (!(0, import_node_fs6.existsSync)(scriptDir)) (0, import_node_fs6.mkdirSync)(scriptDir, { recursive: true });
+    const scriptPath = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "bin", "start-server.sh");
+    const scriptDir = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "bin");
+    if (!(0, import_node_fs8.existsSync)(scriptDir)) (0, import_node_fs8.mkdirSync)(scriptDir, { recursive: true });
     const script = [
       "#!/bin/bash",
       "# AgenticMail auto-start script",
@@ -7731,7 +7892,7 @@ var ServiceManager = class {
       `log "Starting API server: ${nodePath} ${apiEntry}"`,
       `exec "${nodePath}" "${apiEntry}"`
     ].join("\n") + "\n";
-    (0, import_node_fs6.writeFileSync)(scriptPath, script, { mode: 493 });
+    (0, import_node_fs8.writeFileSync)(scriptPath, script, { mode: 493 });
     return scriptPath;
   }
   /**
@@ -7744,9 +7905,9 @@ var ServiceManager = class {
    * - Service version tracking in env vars
    */
   generatePlist(nodePath, apiEntry, configPath) {
-    const config = JSON.parse((0, import_node_fs6.readFileSync)(configPath, "utf-8"));
-    const logDir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "logs");
-    if (!(0, import_node_fs6.existsSync)(logDir)) (0, import_node_fs6.mkdirSync)(logDir, { recursive: true });
+    const config = JSON.parse((0, import_node_fs8.readFileSync)(configPath, "utf-8"));
+    const logDir = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "logs");
+    if (!(0, import_node_fs8.existsSync)(logDir)) (0, import_node_fs8.mkdirSync)(logDir, { recursive: true });
     const version = this.getVersion();
     const startScript = this.generateStartScript(nodePath, apiEntry);
     return `<?xml version="1.0" encoding="UTF-8"?>
@@ -7767,9 +7928,9 @@ var ServiceManager = class {
   <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key>
-    <string>${(0, import_node_os6.homedir)()}</string>
+    <string>${(0, import_node_os8.homedir)()}</string>
     <key>AGENTICMAIL_DATA_DIR</key>
-    <string>${config.dataDir || (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail")}</string>
+    <string>${config.dataDir || (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail")}</string>
     <key>PATH</key>
     <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
     <key>AGENTICMAIL_SERVICE_VERSION</key>
@@ -7822,8 +7983,8 @@ var ServiceManager = class {
    * - Proper dependency ordering
    */
   generateSystemdUnit(nodePath, apiEntry, configPath) {
-    const config = JSON.parse((0, import_node_fs6.readFileSync)(configPath, "utf-8"));
-    const dataDir = config.dataDir || (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail");
+    const config = JSON.parse((0, import_node_fs8.readFileSync)(configPath, "utf-8"));
+    const dataDir = config.dataDir || (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail");
     const version = this.getVersion();
     const startScript = this.generateStartScript(nodePath, apiEntry);
     return `[Unit]
@@ -7840,7 +8001,7 @@ Restart=always
 RestartSec=15
 TimeoutStartSec=660
 LimitNOFILE=8192
-Environment=HOME=${(0, import_node_os6.homedir)()}
+Environment=HOME=${(0, import_node_os8.homedir)()}
 Environment=AGENTICMAIL_DATA_DIR=${dataDir}
 Environment=PATH=/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin
 Environment=AGENTICMAIL_SERVICE_VERSION=${version}
@@ -7853,8 +8014,8 @@ WantedBy=default.target
    * Install the auto-start service.
    */
   install() {
-    const configPath = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "config.json");
-    if (!(0, import_node_fs6.existsSync)(configPath)) {
+    const configPath = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "config.json");
+    if (!(0, import_node_fs8.existsSync)(configPath)) {
       return { installed: false, message: "Config not found. Run agenticmail setup first." };
     }
     const nodePath = this.getNodePath();
@@ -7866,17 +8027,17 @@ WantedBy=default.target
     }
     const servicePath = this.getServicePath();
     if (this.os === "darwin") {
-      const dir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), "Library", "LaunchAgents");
-      if (!(0, import_node_fs6.existsSync)(dir)) (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
-      if ((0, import_node_fs6.existsSync)(servicePath)) {
+      const dir2 = (0, import_node_path10.join)((0, import_node_os8.homedir)(), "Library", "LaunchAgents");
+      if (!(0, import_node_fs8.existsSync)(dir2)) (0, import_node_fs8.mkdirSync)(dir2, { recursive: true });
+      if ((0, import_node_fs8.existsSync)(servicePath)) {
         try {
           (0, import_node_child_process4.execFileSync)("launchctl", ["unload", servicePath], { timeout: 1e4, stdio: "ignore" });
         } catch {
         }
       }
       const plist = this.generatePlist(nodePath, apiEntry, configPath);
-      (0, import_node_fs6.writeFileSync)(servicePath, plist);
-      (0, import_node_fs6.chmodSync)(servicePath, 384);
+      (0, import_node_fs8.writeFileSync)(servicePath, plist);
+      (0, import_node_fs8.chmodSync)(servicePath, 384);
       try {
         (0, import_node_child_process4.execFileSync)("launchctl", ["load", servicePath], { timeout: 1e4, stdio: "ignore" });
       } catch (err) {
@@ -7884,11 +8045,11 @@ WantedBy=default.target
       }
       return { installed: true, message: `Service installed at ${servicePath}` };
     } else if (this.os === "linux") {
-      const dir = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".config", "systemd", "user");
-      if (!(0, import_node_fs6.existsSync)(dir)) (0, import_node_fs6.mkdirSync)(dir, { recursive: true });
+      const dir2 = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".config", "systemd", "user");
+      if (!(0, import_node_fs8.existsSync)(dir2)) (0, import_node_fs8.mkdirSync)(dir2, { recursive: true });
       const unit = this.generateSystemdUnit(nodePath, apiEntry, configPath);
-      (0, import_node_fs6.writeFileSync)(servicePath, unit);
-      (0, import_node_fs6.chmodSync)(servicePath, 384);
+      (0, import_node_fs8.writeFileSync)(servicePath, unit);
+      (0, import_node_fs8.chmodSync)(servicePath, 384);
       try {
         (0, import_node_child_process4.execFileSync)("systemctl", ["--user", "daemon-reload"], { timeout: 1e4, stdio: "ignore" });
         (0, import_node_child_process4.execFileSync)("systemctl", ["--user", "enable", SYSTEMD_UNIT], { timeout: 1e4, stdio: "ignore" });
@@ -7910,7 +8071,7 @@ WantedBy=default.target
    */
   uninstall() {
     const servicePath = this.getServicePath();
-    if (!(0, import_node_fs6.existsSync)(servicePath)) {
+    if (!(0, import_node_fs8.existsSync)(servicePath)) {
       return { removed: false, message: "Service is not installed." };
     }
     if (this.os === "darwin") {
@@ -7919,7 +8080,7 @@ WantedBy=default.target
       } catch {
       }
       try {
-        (0, import_node_fs6.unlinkSync)(servicePath);
+        (0, import_node_fs8.unlinkSync)(servicePath);
       } catch {
       }
       return { removed: true, message: "Service removed." };
@@ -7930,7 +8091,7 @@ WantedBy=default.target
       } catch {
       }
       try {
-        (0, import_node_fs6.unlinkSync)(servicePath);
+        (0, import_node_fs8.unlinkSync)(servicePath);
       } catch {
       }
       try {
@@ -7948,7 +8109,7 @@ WantedBy=default.target
   status() {
     const servicePath = this.getServicePath();
     const plat = this.os === "darwin" ? "launchd" : this.os === "linux" ? "systemd" : "unsupported";
-    const installed = (0, import_node_fs6.existsSync)(servicePath);
+    const installed = (0, import_node_fs8.existsSync)(servicePath);
     let running = false;
     if (installed) {
       if (this.os === "darwin") {
@@ -8003,34 +8164,34 @@ WantedBy=default.target
   needsRepair() {
     if (this.os !== "darwin" && this.os !== "linux") return null;
     const servicePath = this.getServicePath();
-    if (!(0, import_node_fs6.existsSync)(servicePath)) return null;
+    if (!(0, import_node_fs8.existsSync)(servicePath)) return null;
     let serviceContent = "";
     try {
-      serviceContent = (0, import_node_fs6.readFileSync)(servicePath, "utf-8");
+      serviceContent = (0, import_node_fs8.readFileSync)(servicePath, "utf-8");
     } catch {
       return { reason: "Service file unreadable" };
     }
-    const startScript = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "bin", "start-server.sh");
+    const startScript = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "bin", "start-server.sh");
     if (serviceContent.includes(startScript)) {
-      if (!(0, import_node_fs6.existsSync)(startScript)) {
+      if (!(0, import_node_fs8.existsSync)(startScript)) {
         return { reason: "start-server.sh is missing" };
       }
       let scriptContent = "";
       try {
-        scriptContent = (0, import_node_fs6.readFileSync)(startScript, "utf-8");
+        scriptContent = (0, import_node_fs8.readFileSync)(startScript, "utf-8");
       } catch {
         return { reason: "start-server.sh unreadable" };
       }
       const apiPathMatch = scriptContent.match(/(\/[^"\s]+@agenticmail\/api\/dist\/index\.js)/);
       if (apiPathMatch) {
         const referenced = apiPathMatch[1];
-        if (!(0, import_node_fs6.existsSync)(referenced)) {
+        if (!(0, import_node_fs8.existsSync)(referenced)) {
           return { reason: `start-server.sh references missing path: ${referenced}` };
         }
       }
       if (/node_modules\/agenticmail\/(?!.*@agenticmail\/cli)/.test(scriptContent)) {
         const stale = /(\S*node_modules\/agenticmail\/\S*)/.exec(scriptContent)?.[1];
-        if (stale && !(0, import_node_fs6.existsSync)(stale)) {
+        if (stale && !(0, import_node_fs8.existsSync)(stale)) {
           return { reason: `start-server.sh references legacy unscoped path: ${stale}` };
         }
       }
@@ -8043,11 +8204,11 @@ WantedBy=default.target
         return { reason: `Service version drift (current CLI is v${currentVersion})` };
       }
     }
-    const entryCache = (0, import_node_path8.join)((0, import_node_os6.homedir)(), ".agenticmail", "api-entry.path");
-    if ((0, import_node_fs6.existsSync)(entryCache)) {
+    const entryCache = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "api-entry.path");
+    if ((0, import_node_fs8.existsSync)(entryCache)) {
       try {
-        const cached = (0, import_node_fs6.readFileSync)(entryCache, "utf-8").trim();
-        if (cached && !(0, import_node_fs6.existsSync)(cached)) {
+        const cached = (0, import_node_fs8.readFileSync)(entryCache, "utf-8").trim();
+        if (cached && !(0, import_node_fs8.existsSync)(cached)) {
           return { reason: `Cached API entry path no longer exists: ${cached}` };
         }
       } catch {
@@ -8086,8 +8247,8 @@ var SetupManager = class {
   async ensureStalwart(composePath) {
     const status = await this.checker.checkStalwart();
     if (status.installed) return;
-    const path = composePath ?? this.getComposePath();
-    await this.installer.startStalwart(path);
+    const path2 = composePath ?? this.getComposePath();
+    await this.installer.startStalwart(path2);
   }
   async ensureCloudflared() {
     return this.installer.installCloudflared();
@@ -8098,13 +8259,13 @@ var SetupManager = class {
    * falls back to monorepo location.
    */
   getComposePath() {
-    const standalonePath = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail", "docker-compose.yml");
-    if ((0, import_node_fs7.existsSync)(standalonePath)) return standalonePath;
+    const standalonePath = (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".agenticmail", "docker-compose.yml");
+    if ((0, import_node_fs9.existsSync)(standalonePath)) return standalonePath;
     const cwd = process.cwd();
-    const candidates = [cwd, (0, import_node_path9.join)(cwd, "..")];
-    for (const dir of candidates) {
-      const p = (0, import_node_path9.join)(dir, "docker-compose.yml");
-      if ((0, import_node_fs7.existsSync)(p)) return p;
+    const candidates = [cwd, (0, import_node_path11.join)(cwd, "..")];
+    for (const dir2 of candidates) {
+      const p = (0, import_node_path11.join)(dir2, "docker-compose.yml");
+      if ((0, import_node_fs9.existsSync)(p)) return p;
     }
     return standalonePath;
   }
@@ -8114,19 +8275,19 @@ var SetupManager = class {
    * Always regenerates Docker files to keep passwords in sync.
    */
   initConfig() {
-    const dataDir = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail");
-    const configPath = (0, import_node_path9.join)(dataDir, "config.json");
-    const envPath = (0, import_node_path9.join)(dataDir, ".env");
-    if ((0, import_node_fs7.existsSync)(configPath)) {
+    const dataDir = (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".agenticmail");
+    const configPath = (0, import_node_path11.join)(dataDir, "config.json");
+    const envPath = (0, import_node_path11.join)(dataDir, ".env");
+    if ((0, import_node_fs9.existsSync)(configPath)) {
       try {
-        const existing = JSON.parse((0, import_node_fs7.readFileSync)(configPath, "utf-8"));
+        const existing = JSON.parse((0, import_node_fs9.readFileSync)(configPath, "utf-8"));
         this.generateDockerFiles(existing);
         return { configPath, envPath, config: existing, isNew: false };
       } catch {
       }
     }
-    if (!(0, import_node_fs7.existsSync)(dataDir)) {
-      (0, import_node_fs7.mkdirSync)(dataDir, { recursive: true });
+    if (!(0, import_node_fs9.existsSync)(dataDir)) {
+      (0, import_node_fs9.mkdirSync)(dataDir, { recursive: true });
     }
     const masterKey = `mk_${(0, import_node_crypto3.randomBytes)(24).toString("hex")}`;
     const stalwartPassword = (0, import_node_crypto3.randomBytes)(16).toString("hex");
@@ -8142,8 +8303,8 @@ var SetupManager = class {
       api: { port: 3829, host: "127.0.0.1" },
       dataDir
     };
-    (0, import_node_fs7.writeFileSync)(configPath, JSON.stringify(config, null, 2));
-    (0, import_node_fs7.chmodSync)(configPath, 384);
+    (0, import_node_fs9.writeFileSync)(configPath, JSON.stringify(config, null, 2));
+    (0, import_node_fs9.chmodSync)(configPath, 384);
     const envContent = `# Auto-generated by agenticmail setup
 STALWART_ADMIN_USER=admin
 STALWART_ADMIN_PASSWORD=${stalwartPassword}
@@ -8158,8 +8319,8 @@ SMTP_PORT=587
 IMAP_HOST=localhost
 IMAP_PORT=143
 `;
-    (0, import_node_fs7.writeFileSync)(envPath, envContent);
-    (0, import_node_fs7.chmodSync)(envPath, 384);
+    (0, import_node_fs9.writeFileSync)(envPath, envContent);
+    (0, import_node_fs9.chmodSync)(envPath, 384);
     this.generateDockerFiles(config);
     return { configPath, envPath, config, isNew: true };
   }
@@ -8168,13 +8329,13 @@ IMAP_PORT=143
    * with the correct admin password from config.
    */
   generateDockerFiles(config) {
-    const dataDir = config.dataDir || (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail");
-    if (!(0, import_node_fs7.existsSync)(dataDir)) {
-      (0, import_node_fs7.mkdirSync)(dataDir, { recursive: true });
+    const dataDir = config.dataDir || (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".agenticmail");
+    if (!(0, import_node_fs9.existsSync)(dataDir)) {
+      (0, import_node_fs9.mkdirSync)(dataDir, { recursive: true });
     }
     const password = config.stalwart?.adminPassword || "changeme";
-    const composePath = (0, import_node_path9.join)(dataDir, "docker-compose.yml");
-    (0, import_node_fs7.writeFileSync)(composePath, `services:
+    const composePath = (0, import_node_path11.join)(dataDir, "docker-compose.yml");
+    (0, import_node_fs9.writeFileSync)(composePath, `services:
   stalwart:
     # Pinned to v0.15.5 \u2014 Stalwart 0.16+ moved its config to JSON
     # at /etc/stalwart/config.json (hardcoded into the container
@@ -8203,9 +8364,9 @@ IMAP_PORT=143
 volumes:
   stalwart-data:
 `);
-    (0, import_node_fs7.chmodSync)(composePath, 384);
-    const tomlPath = (0, import_node_path9.join)(dataDir, "stalwart.toml");
-    (0, import_node_fs7.writeFileSync)(tomlPath, `# Stalwart Mail Server \u2014 AgenticMail Configuration
+    (0, import_node_fs9.chmodSync)(composePath, 384);
+    const tomlPath = (0, import_node_path11.join)(dataDir, "stalwart.toml");
+    (0, import_node_fs9.writeFileSync)(tomlPath, `# Stalwart Mail Server \u2014 AgenticMail Configuration
 
 [server]
 hostname = "localhost"
@@ -8255,14 +8416,14 @@ enable = true
 user = "admin"
 secret = "${password}"
 `);
-    (0, import_node_fs7.chmodSync)(tomlPath, 384);
+    (0, import_node_fs9.chmodSync)(tomlPath, 384);
   }
   /**
    * Check if config has already been initialized.
    */
   isInitialized() {
-    const configPath = (0, import_node_path9.join)((0, import_node_os7.homedir)(), ".agenticmail", "config.json");
-    return (0, import_node_fs7.existsSync)(configPath);
+    const configPath = (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".agenticmail", "config.json");
+    return (0, import_node_fs9.existsSync)(configPath);
   }
 };
 
@@ -8300,10 +8461,10 @@ function threadIdFor(input) {
 }
 
 // src/threading/thread-cache.ts
-var import_node_fs8 = require("fs");
-var import_node_os8 = require("os");
-var import_node_path10 = require("path");
-var CACHE_DIR_DEFAULT = (0, import_node_path10.join)((0, import_node_os8.homedir)(), ".agenticmail", "thread-cache");
+var import_node_fs10 = require("fs");
+var import_node_os10 = require("os");
+var import_node_path12 = require("path");
+var CACHE_DIR_DEFAULT = (0, import_node_path12.join)((0, import_node_os10.homedir)(), ".agenticmail", "thread-cache");
 var DEFAULT_K_MESSAGES = 10;
 var DEFAULT_LRU_CAP = 5e3;
 var PREVIEW_MAX_CHARS = 240;
@@ -8316,22 +8477,22 @@ var ThreadCache = class {
     this.k = opts.k ?? DEFAULT_K_MESSAGES;
     this.lruCap = opts.lruCap ?? DEFAULT_LRU_CAP;
     try {
-      (0, import_node_fs8.mkdirSync)(this.dir, { recursive: true });
+      (0, import_node_fs10.mkdirSync)(this.dir, { recursive: true });
     } catch {
     }
   }
   pathFor(threadId) {
-    return (0, import_node_path10.join)(this.dir, `${threadId}.json`);
+    return (0, import_node_path12.join)(this.dir, `${threadId}.json`);
   }
   read(threadId) {
     const p = this.pathFor(threadId);
-    if (!(0, import_node_fs8.existsSync)(p)) return null;
+    if (!(0, import_node_fs10.existsSync)(p)) return null;
     try {
-      const raw = (0, import_node_fs8.readFileSync)(p, "utf-8");
+      const raw = (0, import_node_fs10.readFileSync)(p, "utf-8");
       return JSON.parse(raw);
     } catch {
       try {
-        (0, import_node_fs8.rmSync)(p, { force: true });
+        (0, import_node_fs10.rmSync)(p, { force: true });
       } catch {
       }
       return null;
@@ -8372,7 +8533,7 @@ var ThreadCache = class {
   /** Permanently remove a thread's cache (called on [FINAL] / [DONE] / [CLOSED] / [WRAP]). */
   delete(threadId) {
     try {
-      (0, import_node_fs8.rmSync)(this.pathFor(threadId), { force: true });
+      (0, import_node_fs10.rmSync)(this.pathFor(threadId), { force: true });
     } catch {
     }
   }
@@ -8392,8 +8553,8 @@ var ThreadCache = class {
   writeAtomic(threadId, entry) {
     const p = this.pathFor(threadId);
     const tmp = `${p}.tmp`;
-    (0, import_node_fs8.writeFileSync)(tmp, JSON.stringify(entry), "utf-8");
-    (0, import_node_fs8.renameSync)(tmp, p);
+    (0, import_node_fs10.writeFileSync)(tmp, JSON.stringify(entry), "utf-8");
+    (0, import_node_fs10.renameSync)(tmp, p);
   }
   /**
    * Best-effort LRU eviction. Runs at most every 256 writes (we
@@ -8405,15 +8566,15 @@ var ThreadCache = class {
     if (Math.random() > 1 / 256) return;
     let files;
     try {
-      files = (0, import_node_fs8.readdirSync)(this.dir).filter((f) => f.endsWith(".json"));
+      files = (0, import_node_fs10.readdirSync)(this.dir).filter((f) => f.endsWith(".json"));
     } catch {
       return;
     }
     if (files.length <= this.lruCap) return;
     const stats = files.map((f) => {
-      const p = (0, import_node_path10.join)(this.dir, f);
+      const p = (0, import_node_path12.join)(this.dir, f);
       try {
-        return { p, mtime: (0, import_node_fs8.statSync)(p).mtimeMs };
+        return { p, mtime: (0, import_node_fs10.statSync)(p).mtimeMs };
       } catch {
         return { p, mtime: 0 };
       }
@@ -8422,7 +8583,7 @@ var ThreadCache = class {
     const dropCount = Math.max(1, Math.floor(this.lruCap * 0.1));
     for (let i = 0; i < dropCount; i++) {
       try {
-        (0, import_node_fs8.rmSync)(stats[i].p, { force: true });
+        (0, import_node_fs10.rmSync)(stats[i].p, { force: true });
       } catch {
       }
     }
@@ -8441,30 +8602,30 @@ function dedupAndCap(messages, k) {
 }
 
 // src/threading/agent-memory.ts
-var import_node_fs9 = require("fs");
-var import_node_os9 = require("os");
-var import_node_path11 = require("path");
-var MEMORY_DIR_DEFAULT = (0, import_node_path11.join)((0, import_node_os9.homedir)(), ".agenticmail", "agent-memory");
+var import_node_fs11 = require("fs");
+var import_node_os11 = require("os");
+var import_node_path13 = require("path");
+var MEMORY_DIR_DEFAULT = (0, import_node_path13.join)((0, import_node_os11.homedir)(), ".agenticmail", "agent-memory");
 var AgentMemoryStore = class {
   dir;
   constructor(opts = {}) {
     this.dir = opts.memoryDir ?? MEMORY_DIR_DEFAULT;
     try {
-      (0, import_node_fs9.mkdirSync)(this.dir, { recursive: true });
+      (0, import_node_fs11.mkdirSync)(this.dir, { recursive: true });
     } catch {
     }
   }
   dirFor(agentId) {
-    return (0, import_node_path11.join)(this.dir, sanitizeId(agentId));
+    return (0, import_node_path13.join)(this.dir, sanitizeId(agentId));
   }
   pathFor(agentId, threadId) {
-    return (0, import_node_path11.join)(this.dirFor(agentId), `${sanitizeId(threadId)}.md`);
+    return (0, import_node_path13.join)(this.dirFor(agentId), `${sanitizeId(threadId)}.md`);
   }
   read(agentId, threadId) {
     const p = this.pathFor(agentId, threadId);
-    if (!(0, import_node_fs9.existsSync)(p)) return null;
+    if (!(0, import_node_fs11.existsSync)(p)) return null;
     try {
-      const raw = (0, import_node_fs9.readFileSync)(p, "utf-8");
+      const raw = (0, import_node_fs11.readFileSync)(p, "utf-8");
       const parsed = parse(raw);
       return { ...parsed, raw };
     } catch {
@@ -8474,18 +8635,18 @@ var AgentMemoryStore = class {
   write(agentId, threadId, fields) {
     const agentDir = this.dirFor(agentId);
     try {
-      (0, import_node_fs9.mkdirSync)(agentDir, { recursive: true });
+      (0, import_node_fs11.mkdirSync)(agentDir, { recursive: true });
     } catch {
     }
     const body = render({ ...fields, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
     const p = this.pathFor(agentId, threadId);
     const tmp = `${p}.tmp`;
-    (0, import_node_fs9.writeFileSync)(tmp, body, "utf-8");
-    (0, import_node_fs9.renameSync)(tmp, p);
+    (0, import_node_fs11.writeFileSync)(tmp, body, "utf-8");
+    (0, import_node_fs11.renameSync)(tmp, p);
   }
   delete(agentId, threadId) {
     try {
-      (0, import_node_fs9.rmSync)(this.pathFor(agentId, threadId), { force: true });
+      (0, import_node_fs11.rmSync)(this.pathFor(agentId, threadId), { force: true });
     } catch {
     }
   }
@@ -8550,6 +8711,7 @@ function parse(raw) {
   CloudflareClient,
   DEFAULT_AGENT_NAME,
   DEFAULT_AGENT_ROLE,
+  DEFAULT_SESSION_MAX_AGE_MS,
   DNSConfigurator,
   DependencyChecker,
   DependencyInstaller,
@@ -8586,12 +8748,18 @@ function parse(raw) {
   ensureDataDir,
   extractVerificationCode,
   flushTelemetry,
+  forgetHostSession,
   getDatabase,
+  getOperatorEmail,
+  hostSessionStoragePath,
   isInternalEmail,
+  isSessionFresh,
   isValidPhoneNumber,
+  loadHostSession,
   normalizeAddress,
   normalizePhoneNumber,
   normalizeSubject,
+  operatorPrefsStoragePath,
   parseEmail,
   parseGoogleVoiceSms,
   recordToolCall,
@@ -8601,8 +8769,10 @@ function parse(raw) {
   safeJoin,
   sanitizeEmail,
   saveConfig,
+  saveHostSession,
   scanOutboundEmail,
   scoreEmail,
+  setOperatorEmail,
   setTelemetryVersion,
   startRelayBridge,
   threadIdFor,