@rubytech/create-maxy-code 0.1.182 → 0.1.184

package/payload/server/server.js

@@ -816,8 +816,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync20, existsSync as existsSync24, watchFile } from "fs";
-import { resolve as resolve20, join as join15, basename as basename5 } from "path";
+import { readFileSync as readFileSync21, existsSync as existsSync24, watchFile } from "fs";
+import { resolve as resolve22, join as join15, basename as basename5 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1275,7 +1275,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve21) => setTimeout(() => resolve21("timeout"), timeoutMs)
+    (resolve23) => setTimeout(() => resolve23("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1403,11 +1403,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve23, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve21();
+        resolve23();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -1521,14 +1521,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve21, reject) => {
+  return new Promise((resolve23, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve21(value);
+        resolve23(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2063,8 +2063,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve21) => {
-    release = resolve21;
+  const mine = new Promise((resolve23) => {
+    release = resolve23;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3100,11 +3100,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve21) => {
-        const timer2 = setTimeout(resolve21, delay);
+      await new Promise((resolve23) => {
+        const timer2 = setTimeout(resolve23, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve21();
+          resolve23();
         }, { once: true });
       });
     }
@@ -3112,16 +3112,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     if (!conn.sock) {
-      resolve21();
+      resolve23();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve21();
+        resolve23();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3383,8 +3383,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve21) => {
-      resolvePending = resolve21;
+    const sttPending = new Promise((resolve23) => {
+      resolvePending = resolve23;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3788,20 +3788,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve21(true);
+      resolve23(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve21(false);
+      resolve23(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve21(false);
+      resolve23(false);
     });
   });
 }
@@ -4114,7 +4114,9 @@ async function managerSpawn(opts) {
       aboutOwner: opts.aboutOwner,
       dormantPlugins: opts.dormantPlugins,
       activePlugins: opts.activePlugins,
-      specialistDomains: opts.specialistDomains
+      specialistDomains: opts.specialistDomains,
+      sliceToken: opts.sliceToken,
+      personId: opts.personId
     })
   }).catch((err) => ({ __throw: err instanceof Error ? err.message : String(err) }));
   if ("__throw" in res) {
@@ -4145,6 +4147,169 @@ function managerLogFollowUrl(sessionId) {
   return `${managerBase()}/${sessionId}/log?follow=1`;
 }
 
+// app/lib/channel-pty-bridge/public-session-end-review.ts
+var TAG14 = "[public-session-review]";
+var CONSUMED_CAP = 500;
+var consumed = /* @__PURE__ */ new Set();
+function consumeOnce(sessionId) {
+  if (consumed.has(sessionId)) return false;
+  consumed.add(sessionId);
+  if (consumed.size > CONSUMED_CAP) {
+    const oldest = consumed.values().next().value;
+    if (oldest !== void 0) consumed.delete(oldest);
+  }
+  return true;
+}
+function managerBase2() {
+  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "public-session-end-review:manager" });
+  return `http://127.0.0.1:${port2}`;
+}
+function uiBase() {
+  const port2 = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "public-session-end-review:ui" });
+  return `http://127.0.0.1:${port2}`;
+}
+async function fetchJsonl(sessionId) {
+  try {
+    const res = await fetch(`${managerBase2()}/${sessionId}/log?download=1`);
+    if (!res.ok) return null;
+    return await res.text();
+  } catch (err) {
+    console.error(
+      `${TAG14} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return null;
+  }
+}
+function countOperatorTurns(jsonl) {
+  let count = 0;
+  for (const raw of jsonl.split("\n")) {
+    const line = raw.trim();
+    if (!line) continue;
+    try {
+      const obj = JSON.parse(line);
+      if (obj.type === "user") count += 1;
+    } catch {
+    }
+  }
+  return count;
+}
+async function fetchPriorWrites(sliceToken, accountId) {
+  const url = `${uiBase()}/api/admin/public-session-context?sliceToken=${encodeURIComponent(sliceToken)}&accountId=${encodeURIComponent(accountId)}`;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      console.error(
+        `${TAG14} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+      );
+      return [];
+    }
+    const body = await res.json();
+    return Array.isArray(body.writes) ? body.writes : [];
+  } catch (err) {
+    console.error(
+      `${TAG14} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return [];
+  }
+}
+function composeInitialMessage(input) {
+  const priorJson = JSON.stringify(input.priorWrites, null, 2);
+  return [
+    `The gated public-agent session for agent "${input.agentSlug}" has just been reaped. Review the transcript and decide what is worth saving to the visitor's per-visitor memory slice. Dispatch \`database-operator\` for each individual write via the Task tool. Do not call memory-write or memory-update directly.`,
+    "",
+    "<slice-token>",
+    input.sliceToken,
+    "</slice-token>",
+    "",
+    "<person-id>",
+    input.personId ?? "(unknown)",
+    "</person-id>",
+    "",
+    "<prior-writes>",
+    priorJson,
+    "</prior-writes>",
+    "",
+    "<transcript>",
+    input.jsonl,
+    "</transcript>"
+  ].join("\n");
+}
+async function dispatchReviewer(input, initialMessage) {
+  try {
+    const res = await fetch(`${managerBase2()}/spawn`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        senderId: `public-session-reviewer-${input.sessionId}`,
+        role: "admin",
+        channel: "webchat",
+        accountId: input.accountId,
+        specialist: "public-session-reviewer",
+        hidden: true,
+        initialMessage,
+        sliceToken: input.sliceToken,
+        personId: input.personId ?? void 0
+      })
+    });
+    if (!res.ok) {
+      return { ok: false, reason: `spawn-status-${res.status}` };
+    }
+    const body = await res.json();
+    return { ok: true, managerSessionId: body.sessionId ?? "unknown" };
+  } catch (err) {
+    return { ok: false, reason: `spawn-threw-${err instanceof Error ? err.message : String(err)}` };
+  }
+}
+async function firePublicSessionEndReview(input) {
+  const sliceShort = input.sliceToken.slice(0, 8);
+  const personField = input.personId ?? "none";
+  const dispatchedAt = Date.now();
+  if (consumed.has(input.sessionId)) {
+    console.log(
+      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+    );
+    return;
+  }
+  const jsonl = await fetchJsonl(input.sessionId);
+  if (!jsonl) {
+    console.log(
+      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+    );
+    return;
+  }
+  const operatorTurns = countOperatorTurns(jsonl);
+  if (operatorTurns === 0) {
+    console.log(
+      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+    );
+    return;
+  }
+  const priorWrites = await fetchPriorWrites(input.sliceToken, input.accountId);
+  const initialMessage = composeInitialMessage({
+    agentSlug: input.agentSlug,
+    sliceToken: input.sliceToken,
+    personId: input.personId,
+    jsonl,
+    priorWrites
+  });
+  if (!consumeOnce(input.sessionId)) {
+    console.log(
+      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+    );
+    return;
+  }
+  const dispatched = await dispatchReviewer(input, initialMessage);
+  if (!dispatched.ok) {
+    console.error(
+      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+    );
+    return;
+  }
+  console.log(
+    `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+  );
+}
+
 // app/lib/channel-pty-bridge/follower.ts
 function startFollower(opts) {
   const abort = new AbortController();
@@ -4235,12 +4400,15 @@ function publicIdleMs() {
   return Number(process.env.CHANNEL_PTY_IDLE_MS ?? String(30 * 6e4));
 }
 var index = /* @__PURE__ */ new Map();
-function indexKey(accountId, agentSlug, senderId, liveMemory) {
-  return `${accountId}:${agentSlug}:${liveMemory ? "lm1" : "lm0"}:${senderId}`;
+function indexKey(accountId, agentSlug, senderId, liveMemory, sliceToken = "") {
+  const slice = sliceToken && sliceToken.length > 0 ? sliceToken : "open";
+  return `${accountId}:${agentSlug}:${liveMemory ? "lm1" : "lm0"}:${slice}:${senderId}`;
 }
 async function ensureEntry(input) {
   startReaper();
-  const key = indexKey(input.accountId, input.agentSlug, input.senderId, input.liveMemory);
+  const sliceTokenValue = input.sliceToken ?? "";
+  const personIdValue = input.personId ?? null;
+  const key = indexKey(input.accountId, input.agentSlug, input.senderId, input.liveMemory, sliceTokenValue);
   const existing = index.get(key);
   const tag = tagFor(input.channel);
   if (existing) {
@@ -4264,7 +4432,9 @@ async function ensureEntry(input) {
     accountId: input.accountId,
     agentSlug: input.agentSlug,
     liveMemory: input.liveMemory,
-    attachmentDir
+    attachmentDir,
+    sliceToken: sliceTokenValue.length > 0 ? sliceTokenValue : void 0,
+    personId: personIdValue ?? void 0
   });
   if ("error" in spawned) {
     if (spawned.error !== "claude-auth-dead") {
@@ -4287,7 +4457,9 @@ async function ensureEntry(input) {
     pendingTurnText: "",
     followerAbort: null,
     followerRunning: false,
-    liveMemory: input.liveMemory
+    liveMemory: input.liveMemory,
+    sliceToken: sliceTokenValue,
+    personId: personIdValue
   };
   entry.followerAbort = startFollower({
     entry,
@@ -4314,14 +4486,26 @@ async function writeInput(entry, text) {
           `${tag} session-resolved senderId=${entry.senderId} action=respawn reason=session-gone-${result.status} sessionId=${entry.sessionId.slice(0, 8)}`
         );
         if (entry.followerAbort) entry.followerAbort.abort();
-        index.delete(indexKey(entry.accountId, entry.agentSlug, entry.senderId, entry.liveMemory));
+        if (entry.role === "public" && entry.sliceToken.length > 0) {
+          void firePublicSessionEndReview({
+            sessionId: entry.sessionId,
+            sliceToken: entry.sliceToken,
+            personId: entry.personId,
+            accountId: entry.accountId,
+            agentSlug: entry.agentSlug,
+            dispatchFor: "exit"
+          });
+        }
+        index.delete(indexKey(entry.accountId, entry.agentSlug, entry.senderId, entry.liveMemory, entry.sliceToken));
         const respawned = await ensureEntry({
           accountId: entry.accountId,
           senderId: entry.senderId,
           role: entry.role,
           channel: entry.channel,
           agentSlug: entry.agentSlug,
-          liveMemory: entry.liveMemory
+          liveMemory: entry.liveMemory,
+          sliceToken: entry.sliceToken.length > 0 ? entry.sliceToken : void 0,
+          personId: entry.personId
         });
         if (!respawned) return false;
         for (const cb of entry.subscribers) respawned.subscribers.add(cb);
@@ -4359,16 +4543,18 @@ async function dispatchOnce(input) {
     role: input.role,
     channel: input.channel,
     agentSlug: input.agentSlug,
-    liveMemory: input.liveMemory
+    liveMemory: input.liveMemory,
+    sliceToken: input.sliceToken,
+    personId: input.personId
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve21;
+  let resolve23;
   const turnPromise = new Promise((r) => {
-    resolve21 = r;
+    resolve23 = r;
   });
   const listener = (text) => {
-    resolve21(text);
+    resolve23(text);
   };
   entry.subscribers.add(listener);
   const writeOk = await writeInput(entry, input.text);
@@ -4418,11 +4604,75 @@ function startReaper() {
       );
       if (entry.followerAbort) entry.followerAbort.abort();
       index.delete(key);
+      if (entry.role === "public" && entry.sliceToken.length > 0) {
+        void firePublicSessionEndReview({
+          sessionId: entry.sessionId,
+          sliceToken: entry.sliceToken,
+          personId: entry.personId,
+          accountId: entry.accountId,
+          agentSlug: entry.agentSlug,
+          dispatchFor: "eviction"
+        });
+      }
       void managerDelete(entry.sessionId);
     }
   }, 6e4);
   if (reaperHandle.unref) reaperHandle.unref();
 }
+function handlePublicSessionExit(sessionId) {
+  let found = null;
+  for (const [key2, entry2] of index) {
+    if (entry2.sessionId === sessionId) {
+      found = { key: key2, entry: entry2 };
+      break;
+    }
+  }
+  if (!found) {
+    console.error(`[public-session-exit] sessionId=${sessionId} result=no-entry`);
+    return;
+  }
+  const { key, entry } = found;
+  if (entry.role !== "public" || entry.sliceToken.length === 0) {
+    return;
+  }
+  if (entry.followerAbort) entry.followerAbort.abort();
+  index.delete(key);
+  void firePublicSessionEndReview({
+    sessionId: entry.sessionId,
+    sliceToken: entry.sliceToken,
+    personId: entry.personId,
+    accountId: entry.accountId,
+    agentSlug: entry.agentSlug,
+    dispatchFor: "exit"
+  });
+}
+
+// app/lib/access-session-store.ts
+import { randomUUID as randomUUID4 } from "crypto";
+var sessions = /* @__PURE__ */ new Map();
+function createAccessSession(input) {
+  const sessionId = randomUUID4();
+  const session = {
+    ...input,
+    sessionId,
+    createdAt: Date.now()
+  };
+  sessions.set(sessionId, session);
+  return session;
+}
+function getAccessSession(sessionId) {
+  return sessions.get(sessionId) ?? null;
+}
+function evictAccessSessionsByGrant(grantId) {
+  let dropped = 0;
+  for (const [sessionId, session] of sessions) {
+    if (session.grantId === grantId) {
+      sessions.delete(sessionId);
+      dropped += 1;
+    }
+  }
+  return dropped;
+}
 
 // server/routes/chat.ts
 var WEBCHAT_TAG = "[webchat-adaptor]";
@@ -4545,13 +4795,37 @@ ${lines}]`;
     return c.json({ error: "No default agent configured" }, 500);
   }
   let liveMemory = false;
+  let accessMode = "open";
   try {
-    liveMemory = resolveAgentConfig(account.accountDir, agentSlug).liveMemory;
+    const config = resolveAgentConfig(account.accountDir, agentSlug);
+    liveMemory = config.liveMemory;
+    accessMode = config.accessMode;
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
     console.error(`${WEBCHAT_TAG} reject reason=agent-config-failed agentSlug=${agentSlug} message=${m}`);
     return c.json({ error: "Agent config invalid" }, 500);
   }
+  let sliceToken;
+  let personId = null;
+  if (accessMode === "gated" || accessMode === "paid") {
+    const cookieHeader = c.req.header("cookie") ?? "";
+    const accessSessionId = cookieHeader.split(";").map((p) => p.trim()).find((p) => p.startsWith("__access_session="))?.slice("__access_session=".length);
+    const session = accessSessionId ? getAccessSession(accessSessionId) : null;
+    if (!session) {
+      console.error(
+        `${WEBCHAT_TAG} reject reason=gate-required agentSlug=${agentSlug} senderId=${session_key.slice(0, 8)} cookie=${accessSessionId ? "unknown-id" : "absent"}`
+      );
+      return c.json({ error: "gate-required", agentSlug }, 401);
+    }
+    if (session.agentSlug !== agentSlug) {
+      console.error(
+        `${WEBCHAT_TAG} reject reason=gate-agent-mismatch agentSlug=${agentSlug} cookieAgent=${session.agentSlug}`
+      );
+      return c.json({ error: "gate-required", agentSlug }, 401);
+    }
+    sliceToken = session.sliceToken;
+    personId = session.personId;
+  }
   const sk = session_key.slice(0, 8);
   console.error(
     `${WEBCHAT_TAG} inbound from=${sk} bytes=${Buffer.byteLength(fullMessage, "utf8")} attachments=${attachmentCount} accountId=${account.accountId}`
@@ -4566,6 +4840,8 @@ ${lines}]`;
           channel: "webchat",
           agentSlug,
           liveMemory,
+          sliceToken,
+          personId,
           text: fullMessage,
           timeoutMs: webchatTurnTimeoutMs()
         });
@@ -4617,15 +4893,15 @@ import { readFile as readFile2, stat as stat3 } from "fs/promises";
 import { realpathSync as realpathSync2, readdirSync as readdirSync2, readFileSync as readFileSync6, existsSync as existsSync4 } from "fs";
 
 // app/lib/whatsapp/login.ts
-import { randomUUID as randomUUID4 } from "crypto";
-var TAG14 = "[whatsapp:login]";
+import { randomUUID as randomUUID5 } from "crypto";
+var TAG15 = "[whatsapp:login]";
 var ACTIVE_LOGIN_TTL_MS = 3 * 6e4;
 var activeLogins = /* @__PURE__ */ new Map();
 function closeSocket(sock) {
   try {
     sock.ws?.close?.();
   } catch (err) {
-    console.warn(`${TAG14} socket close error during cleanup: ${String(err)}`);
+    console.warn(`${TAG15} socket close error during cleanup: ${String(err)}`);
   }
 }
 function resetActiveLogin(accountId) {
@@ -4648,7 +4924,7 @@ async function loginConnectionLoop(accountId, login) {
       const current = activeLogins.get(accountId);
       if (current?.id === login.id) {
         current.connected = true;
-        console.error(`${TAG14} loginConnectionLoop: connected account=${accountId} attempt=${attempt}`);
+        console.error(`${TAG15} loginConnectionLoop: connected account=${accountId} attempt=${attempt}`);
       }
       return;
     } catch (err) {
@@ -4658,7 +4934,7 @@ async function loginConnectionLoop(accountId, login) {
       if (!classification.shouldRetry || attempt >= LOGIN_MAX_RECONNECTS) {
         if (attempt >= LOGIN_MAX_RECONNECTS) {
           console.error(
-            `${TAG14} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
+            `${TAG15} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
           );
           current.error = `Login failed after ${attempt} reconnect attempts: ${formatError(err)}`;
         } else {
@@ -4670,7 +4946,7 @@ async function loginConnectionLoop(accountId, login) {
       attempt++;
       const delay = LOGIN_RECONNECT_DELAYS[attempt - 1] ?? 8e3;
       console.error(
-        `${TAG14} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
+        `${TAG15} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
       );
       closeSocket(current.sock);
       await new Promise((r) => setTimeout(r, delay));
@@ -4681,7 +4957,7 @@ async function loginConnectionLoop(accountId, login) {
         current.sock = newSock;
       } catch (sockErr) {
         console.error(
-          `${TAG14} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
+          `${TAG15} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
         );
         current.error = `Reconnection failed: ${String(sockErr)}`;
         return;
@@ -4695,7 +4971,7 @@ async function startLogin(opts) {
   const hasAuth = await authExists(authDir);
   const selfId = readSelfId(authDir);
   console.error(
-    `${TAG14} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasQr=${!!existing0.qr}}` : " activeLogin=none")
+    `${TAG15} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasQr=${!!existing0.qr}}` : " activeLogin=none")
   );
   if (hasAuth && !force) {
     const who = selfId.e164 ?? selfId.jid ?? "unknown";
@@ -4707,7 +4983,7 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   const existing = activeLogins.get(accountId);
   if (existing && isLoginFresh(existing) && existing.qrDataUrl && !force) {
-    console.error(`${TAG14} startLogin account=${accountId} guard: returning existing QR (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
+    console.error(`${TAG15} startLogin account=${accountId} guard: returning existing QR (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
     return {
       qrDataUrl: existing.qrDataUrl,
       qrRaw: existing.qr,
@@ -4715,13 +4991,13 @@ async function startLogin(opts) {
     };
   }
   if (existing) {
-    console.error(`${TAG14} startLogin account=${accountId} ${force ? "force override" : "stale/no-QR"}, resetting active login`);
+    console.error(`${TAG15} startLogin account=${accountId} ${force ? "force override" : "stale/no-QR"}, resetting active login`);
   }
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve21, reject) => {
-    resolveQr = resolve21;
+  const qrPromise = new Promise((resolve23, reject) => {
+    resolveQr = resolve23;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -4737,14 +5013,14 @@ async function startLogin(opts) {
       onQr: (qr2) => {
         loginQrCount++;
         if (pendingQr) {
-          console.error(`${TAG14} QR rotation #${loginQrCount} received for account=${accountId} \u2014 not forwarded (initial QR already captured)`);
+          console.error(`${TAG15} QR rotation #${loginQrCount} received for account=${accountId} \u2014 not forwarded (initial QR already captured)`);
           return;
         }
         pendingQr = qr2;
         const current = activeLogins.get(accountId);
         if (current && !current.qr) current.qr = qr2;
         clearTimeout(qrTimer);
-        console.error(`${TAG14} QR #${loginQrCount} received for account=${accountId} \u2014 forwarding to caller`);
+        console.error(`${TAG15} QR #${loginQrCount} received for account=${accountId} \u2014 forwarding to caller`);
         resolveQr?.(qr2);
       }
     });
@@ -4756,7 +5032,7 @@ async function startLogin(opts) {
   const login = {
     accountId,
     authDir,
-    id: randomUUID4(),
+    id: randomUUID5(),
     sock,
     startedAt: Date.now(),
     connected: false
@@ -4764,7 +5040,7 @@ async function startLogin(opts) {
   activeLogins.set(accountId, login);
   if (pendingQr && !login.qr) login.qr = pendingQr;
   loginConnectionLoop(accountId, login).catch((err) => {
-    console.error(`${TAG14} loginConnectionLoop unexpected error: ${String(err)}`);
+    console.error(`${TAG15} loginConnectionLoop unexpected error: ${String(err)}`);
     const current = activeLogins.get(accountId);
     if (current?.id === login.id) {
       current.error = `Unexpected login error: ${String(err)}`;
@@ -4789,7 +5065,7 @@ async function waitForLogin(opts) {
   const { accountId, timeoutMs = 6e4 } = opts;
   const login = activeLogins.get(accountId);
   console.error(
-    `${TAG14} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasQr=${!!login.qr}}` : " login=none")
+    `${TAG15} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasQr=${!!login.qr}}` : " login=none")
   );
   if (!login) {
     return { connected: false, message: "No active WhatsApp login in progress." };
@@ -4802,7 +5078,7 @@ async function waitForLogin(opts) {
   while (Date.now() < deadline) {
     if (login.connected) {
       const selfId = readSelfId(login.authDir);
-      console.error(`${TAG14} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
+      console.error(`${TAG15} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
       const sock = login.sock;
       const authDir = login.authDir;
       activeLogins.delete(accountId);
@@ -4822,7 +5098,7 @@ async function waitForLogin(opts) {
     await new Promise((r) => setTimeout(r, 1e3));
   }
   const elapsed = Math.round((Date.now() - (deadline - timeoutMs)) / 1e3);
-  console.error(`${TAG14} waitForLogin timeout account=${accountId} elapsed=${elapsed}s \u2014 cleaning up active login`);
+  console.error(`${TAG15} waitForLogin timeout account=${accountId} elapsed=${elapsed}s \u2014 cleaning up active login`);
   resetActiveLogin(accountId);
   return { connected: false, message: "Login timed out. Try generating a new QR." };
 }
@@ -4830,7 +5106,7 @@ async function waitForLogin(opts) {
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync3 } from "fs";
 import { resolve as resolve5, join as join4 } from "path";
-var TAG15 = "[whatsapp:config]";
+var TAG16 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve5(accountDir, "account.json");
 }
@@ -4847,9 +5123,9 @@ function reloadManagerConfig(accountDir) {
   try {
     const config = readConfig(accountDir);
     reloadConfig(config);
-    console.error(`${TAG15} reloaded manager config`);
+    console.error(`${TAG16} reloaded manager config`);
   } catch (err) {
-    console.error(`${TAG15} manager config reload failed: ${String(err)}`);
+    console.error(`${TAG16} manager config reload failed: ${String(err)}`);
   }
 }
 var E164_PATTERN = /^\+\d{7,15}$/;
@@ -4875,25 +5151,25 @@ function persistAfterPairing(accountDir, accountId, selfPhone) {
       const adminPhones = wa.adminPhones;
       if (!adminPhones.includes(normalized)) {
         adminPhones.push(normalized);
-        console.error(`${TAG15} added selfPhone=${normalized} to adminPhones`);
+        console.error(`${TAG16} added selfPhone=${normalized} to adminPhones`);
       }
     } else {
-      console.error(`${TAG15} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
+      console.error(`${TAG16} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
     }
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG15} validation failed after pairing: ${msg}`);
+      console.error(`${TAG16} validation failed after pairing: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
+    console.error(`${TAG16} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
     reloadManagerConfig(accountDir);
     return { ok: true };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} persist failed account=${accountId}: ${msg}`);
+    console.error(`${TAG16} persist failed account=${accountId}: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -4923,12 +5199,12 @@ function addAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} added admin phone=${normalized}`);
+    console.error(`${TAG16} added admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Added ${normalized} as admin phone. Messages from this number will route to the admin agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} addAdminPhone failed: ${msg}`);
+    console.error(`${TAG16} addAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -4956,12 +5232,12 @@ function removeAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} removed admin phone=${normalized}`);
+    console.error(`${TAG16} removed admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Removed ${normalized} from admin phones. Messages from this number will now route to the public agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} removeAdminPhone failed: ${msg}`);
+    console.error(`${TAG16} removeAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -4999,12 +5275,12 @@ function setPublicAgent(accountDir, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} publicAgent set to ${trimmed}`);
+    console.error(`${TAG16} publicAgent set to ${trimmed}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Public agent set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} setPublicAgent failed: ${msg}`);
+    console.error(`${TAG16} setPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5068,12 +5344,12 @@ function setGroupPublicAgent(accountDir, accountId, groupJid, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} setGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup} slug=${trimmedSlug}`);
+    console.error(`${TAG16} setGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup} slug=${trimmedSlug}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Per-group public agent set to "${trimmedSlug}" for group ${trimmedGroup}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} setGroupPublicAgent failed: ${msg}`);
+    console.error(`${TAG16} setGroupPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5100,12 +5376,12 @@ function unsetGroupPublicAgent(accountDir, accountId, groupJid) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} unsetGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup}`);
+    console.error(`${TAG16} unsetGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Per-group public agent override removed for group ${trimmedGroup}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} unsetGroupPublicAgent failed: ${msg}`);
+    console.error(`${TAG16} unsetGroupPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5126,17 +5402,17 @@ function updateConfig(accountDir, fields) {
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG15} update validation failed: ${msg}`);
+      console.error(`${TAG16} update validation failed: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} updated fields=[${fieldNames.join(",")}]`);
+    console.error(`${TAG16} updated fields=[${fieldNames.join(",")}]`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Updated WhatsApp config: ${fieldNames.join(", ")}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} updateConfig failed: ${msg}`);
+    console.error(`${TAG16} updateConfig failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5262,17 +5538,17 @@ function serializeWhatsAppSchema() {
 }
 
 // server/routes/whatsapp.ts
-var TAG16 = "[whatsapp:api]";
+var TAG17 = "[whatsapp:api]";
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT || "";
 var app3 = new Hono();
 app3.get("/status", (c) => {
   try {
     const status = getStatus();
     const summary = status.map((a) => `${a.accountId}:${a.connected ? "up" : "down"}`).join(", ");
-    console.error(`${TAG16} status accounts=${status.length} [${summary}]`);
+    console.error(`${TAG17} status accounts=${status.length} [${summary}]`);
     return c.json({ accounts: status });
   } catch (err) {
-    console.error(`${TAG16} status error: ${String(err)}`);
+    console.error(`${TAG17} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5283,10 +5559,10 @@ app3.post("/login/start", async (c) => {
     const force = body.force ?? false;
     const authDir = join5(MAXY_DIR, "credentials", "whatsapp", accountId);
     const result = await startLogin({ accountId, authDir, force });
-    console.error(`${TAG16} login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
+    console.error(`${TAG17} login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG16} login/start error: ${String(err)}`);
+    console.error(`${TAG17} login/start error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5301,7 +5577,7 @@ app3.post("/login/wait", async (c) => {
       try {
         await registerLoginSocket(accountId, result.sock, result.authDir);
       } catch (regErr) {
-        console.error(`${TAG16} registerLoginSocket failed account=${accountId}: ${String(regErr)}`);
+        console.error(`${TAG17} registerLoginSocket failed account=${accountId}: ${String(regErr)}`);
       }
       try {
         const account = resolveAccount();
@@ -5309,16 +5585,16 @@ app3.post("/login/wait", async (c) => {
           const persistResult = persistAfterPairing(account.accountDir, accountId, result.selfPhone ?? null);
           configPersisted = persistResult.ok;
           if (!persistResult.ok) {
-            console.error(`${TAG16} config persist failed account=${accountId}: ${persistResult.error}`);
+            console.error(`${TAG17} config persist failed account=${accountId}: ${persistResult.error}`);
           }
         } else {
-          console.error(`${TAG16} config persist skipped \u2014 no account resolved`);
+          console.error(`${TAG17} config persist skipped \u2014 no account resolved`);
         }
       } catch (persistErr) {
-        console.error(`${TAG16} config persist error account=${accountId}: ${String(persistErr)}`);
+        console.error(`${TAG17} config persist error account=${accountId}: ${String(persistErr)}`);
       }
     }
-    console.error(`${TAG16} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${configPersisted}`);
+    console.error(`${TAG17} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${configPersisted}`);
     return c.json({
       connected: result.connected,
       message: result.message,
@@ -5326,7 +5602,7 @@ app3.post("/login/wait", async (c) => {
       configPersisted
     });
   } catch (err) {
-    console.error(`${TAG16} login/wait error: ${String(err)}`);
+    console.error(`${TAG17} login/wait error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5337,7 +5613,7 @@ app3.post("/disconnect", async (c) => {
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
   } catch (err) {
-    console.error(`${TAG16} disconnect error: ${String(err)}`);
+    console.error(`${TAG17} disconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5348,7 +5624,7 @@ app3.post("/reconnect", async (c) => {
     await startConnection(accountId);
     return c.json({ reconnecting: true, accountId });
   } catch (err) {
-    console.error(`${TAG16} reconnect error: ${String(err)}`);
+    console.error(`${TAG17} reconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5367,7 +5643,7 @@ app3.post("/send", async (c) => {
     const result = await sendTextMessage(sock, to, text, { accountId });
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG16} send error: ${String(err)}`);
+    console.error(`${TAG17} send error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5388,7 +5664,7 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG16} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG17} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -5396,12 +5672,12 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone".' }, 400);
         }
         const result = removeAdminPhone(account.accountDir, phone);
-        console.error(`${TAG16} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG17} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-admin-phones": {
         const phones = readAdminPhones(account.accountDir);
-        console.error(`${TAG16} config action=list-admin-phones count=${phones.length}`);
+        console.error(`${TAG17} config action=list-admin-phones count=${phones.length}`);
         return c.json({ ok: true, phones });
       }
       case "set-public-agent": {
@@ -5409,14 +5685,14 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
         }
         const result = setPublicAgent(account.accountDir, slug);
-        console.error(`${TAG16} config action=set-public-agent slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG17} config action=set-public-agent slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-public-agent": {
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const targetGroup = typeof groupJid === "string" && groupJid.trim() ? groupJid.trim() : void 0;
         const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount, groupJid: targetGroup });
-        console.error(`${TAG16} config action=get-public-agent accountId=${targetAccount} groupJid=${targetGroup ?? "none"} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
+        console.error(`${TAG17} config action=get-public-agent accountId=${targetAccount} groupJid=${targetGroup ?? "none"} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "set-group-public-agent": {
@@ -5428,7 +5704,7 @@ app3.post("/config", async (c) => {
         }
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const result = setGroupPublicAgent(account.accountDir, targetAccount, groupJid, slug);
-        console.error(`${TAG16} config action=set-group-public-agent accountId=${targetAccount} groupJid=${groupJid} slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG17} config action=set-group-public-agent accountId=${targetAccount} groupJid=${groupJid} slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "unset-group-public-agent": {
@@ -5437,7 +5713,7 @@ app3.post("/config", async (c) => {
         }
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const result = unsetGroupPublicAgent(account.accountDir, targetAccount, groupJid);
-        console.error(`${TAG16} config action=unset-group-public-agent accountId=${targetAccount} groupJid=${groupJid} ok=${result.ok}`);
+        console.error(`${TAG17} config action=unset-group-public-agent accountId=${targetAccount} groupJid=${groupJid} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-public-agents": {
@@ -5454,26 +5730,26 @@ app3.post("/config", async (c) => {
                 const config = JSON.parse(readFileSync6(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
-                console.error(`${TAG16} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+                console.error(`${TAG17} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
               }
             }
           } catch (err) {
-            console.error(`${TAG16} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
+            console.error(`${TAG17} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
           }
         }
-        console.error(`${TAG16} config action=list-public-agents count=${agents.length}`);
+        console.error(`${TAG17} config action=list-public-agents count=${agents.length}`);
         return c.json({ ok: true, agents });
       }
       case "schema": {
         const text = serializeWhatsAppSchema();
-        console.error(`${TAG16} config action=schema`);
+        console.error(`${TAG17} config action=schema`);
         return c.json({ ok: true, text });
       }
       case "list-groups": {
         const groupAccountId = accountId ?? "default";
         const sock = getSocket(groupAccountId);
         if (!sock) {
-          console.error(`${TAG16} config action=list-groups error="not connected" accountId=${groupAccountId}`);
+          console.error(`${TAG17} config action=list-groups error="not connected" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `WhatsApp account "${groupAccountId}" is not connected. Connect first, then retry.` });
         }
         try {
@@ -5483,10 +5759,10 @@ app3.post("/config", async (c) => {
             name: g.subject ?? g.id,
             participantCount: Array.isArray(g.participants) ? g.participants.length : 0
           }));
-          console.error(`${TAG16} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
+          console.error(`${TAG17} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
           return c.json({ ok: true, groups });
         } catch (err) {
-          console.error(`${TAG16} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
+          console.error(`${TAG17} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `Failed to fetch groups: ${String(err)}` });
         }
       }
@@ -5496,12 +5772,12 @@ app3.post("/config", async (c) => {
         }
         const result = updateConfig(account.accountDir, fields);
         const fieldNames = Object.keys(fields);
-        console.error(`${TAG16} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
+        console.error(`${TAG17} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-config": {
         const waConfig = getConfig(account.accountDir);
-        console.error(`${TAG16} config action=get-config`);
+        console.error(`${TAG17} config action=get-config`);
         return c.json({ ok: true, config: waConfig });
       }
       default:
@@ -5511,7 +5787,7 @@ app3.post("/config", async (c) => {
         );
     }
   } catch (err) {
-    console.error(`${TAG16} config error: ${String(err)}`);
+    console.error(`${TAG17} config error: ${String(err)}`);
     return c.json({ ok: false, error: String(err) }, 500);
   }
 });
@@ -5533,16 +5809,16 @@ app3.post("/send-document", async (c) => {
       const accountResolved = realpathSync2(accountDir);
       if (!resolvedPath.startsWith(accountResolved + "/")) {
         const sanitised = filePath.replace(accountDir, "<account>/");
-        console.error(`${TAG16} send-document REJECTED path=${sanitised} reason=outside_account_directory`);
+        console.error(`${TAG17} send-document REJECTED path=${sanitised} reason=outside_account_directory`);
         return c.json({ error: "Access denied: file is outside the account directory" }, 403);
       }
     } catch (err) {
       const code = err.code;
       if (code === "ENOENT") {
-        console.error(`${TAG16} send-document ENOENT path=${filePath}`);
+        console.error(`${TAG17} send-document ENOENT path=${filePath}`);
         return c.json({ error: `File not found: ${filePath}` }, 404);
       }
-      console.error(`${TAG16} send-document path error: ${String(err)}`);
+      console.error(`${TAG17} send-document path error: ${String(err)}`);
       return c.json({ error: String(err) }, 500);
     }
     const fileStat = await stat3(resolvedPath);
@@ -5564,11 +5840,11 @@ app3.post("/send-document", async (c) => {
       caption
     }, { accountId });
     console.error(
-      `${TAG16} send-document to=${to} size=${fileStat.size} mime=${mimetype} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
+      `${TAG17} send-document to=${to} size=${fileStat.size} mime=${mimetype} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
     );
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG16} send-document error: ${String(err)}`);
+    console.error(`${TAG17} send-document error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5578,11 +5854,11 @@ app3.get("/activity", (c) => {
     const result = getChannelActivity(accountId);
     const total = result.accounts.reduce((sum, a) => sum + a.total, 0);
     console.error(
-      `${TAG16} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
+      `${TAG17} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
     );
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG16} activity error: ${String(err)}`);
+    console.error(`${TAG17} activity error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5601,10 +5877,10 @@ app3.get("/conversations", (c) => {
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG16} conversations account=${accountId} count=${conversations.length}`);
+    console.error(`${TAG17} conversations account=${accountId} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
-    console.error(`${TAG16} conversations error: ${String(err)}`);
+    console.error(`${TAG17} conversations error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5619,10 +5895,10 @@ app3.get("/messages", (c) => {
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
     const messages = getMessages(accountId, jid, effectiveLimit);
-    console.error(`${TAG16} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    console.error(`${TAG17} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
     return c.json({ messages });
   } catch (err) {
-    console.error(`${TAG16} messages error: ${String(err)}`);
+    console.error(`${TAG17} messages error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5703,7 +5979,7 @@ app3.get("/conversation-graph-state", async (c) => {
       }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      console.error(`${TAG16} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
+      console.error(`${TAG17} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
       return c.json({ error: `Graph query failed: ${msg}`, cacheKey, cypher: cypher.trim() }, 500);
     }
     const ms = Date.now() - t0;
@@ -5716,7 +5992,7 @@ app3.get("/conversation-graph-state", async (c) => {
       ms
     });
   } catch (err) {
-    console.error(`${TAG16} conversation-graph-state error: ${String(err)}`);
+    console.error(`${TAG17} conversation-graph-state error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -5728,12 +6004,12 @@ app3.get("/group-info", async (c) => {
       return c.json({ error: "Missing required parameter: jid" }, 400);
     }
     if (!isGroupJid(jid)) {
-      console.error(`${TAG16} group-info error="not a group JID" jid=${jid} account=${accountId}`);
+      console.error(`${TAG17} group-info error="not a group JID" jid=${jid} account=${accountId}`);
       return c.json({ error: `"${jid}" is not a group JID. Group JIDs end with @g.us.` }, 400);
     }
     const sock = getSocket(accountId);
     if (!sock) {
-      console.error(`${TAG16} group-info error="not connected" account=${accountId}`);
+      console.error(`${TAG17} group-info error="not connected" account=${accountId}`);
       return c.json({ error: `WhatsApp account "${accountId}" is not connected. Connect first, then retry.` }, 400);
     }
     const meta = await sock.groupMetadata(jid);
@@ -5746,10 +6022,10 @@ app3.get("/group-info", async (c) => {
       participantCount: meta.participants.length,
       participants: meta.participants.map((p) => ({ jid: p.id, admin: p.admin ?? null }))
     };
-    console.error(`${TAG16} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
+    console.error(`${TAG17} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG16} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
+    console.error(`${TAG17} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
     return c.json({ error: `Failed to fetch group info: ${String(err)}` }, 500);
   }
 });
@@ -5758,7 +6034,7 @@ var whatsapp_default = app3;
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
 import { openSync, closeSync, writeFileSync as writeFileSync5, writeSync, existsSync as existsSync6, readFileSync as readFileSync8, unlinkSync } from "fs";
-import { createHash, randomUUID as randomUUID5 } from "crypto";
+import { createHash, randomUUID as randomUUID6 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4, renameSync, mkdirSync as mkdirSync2, readdirSync as readdirSync3, statSync as statSync2 } from "fs";
@@ -6034,7 +6310,7 @@ app4.post("/set-pin", async (c) => {
   const hash = hashPin(body.pin);
   const account = resolveAccount();
   const existingOwnerUserId = account?.config.admins?.find((a) => a.role === "owner")?.userId;
-  const userId = existingOwnerUserId ?? randomUUID5();
+  const userId = existingOwnerUserId ?? randomUUID6();
   if (existingOwnerUserId) {
     console.log(`[set-pin] reusing existing owner userId=${userId.slice(0, 8)}\u2026 (change-PIN preserves identity)`);
   } else {
@@ -6295,7 +6571,7 @@ var client_error_default = app5;
 import { readFileSync as readFileSync9, readdirSync as readdirSync4, statSync as statSync4, existsSync as existsSync8 } from "fs";
 import { join as join8 } from "path";
 import { createHash as createHash2 } from "crypto";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 function hashPin2(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
@@ -6352,7 +6628,7 @@ async function resolveUserIdentity(accountId, userId) {
 async function createAdminSession(accountId, thinkingView, userId, userName, role, avatar) {
   const account = resolveAccount();
   const effectiveThinkingView = thinkingView ?? account?.config.thinkingView ?? "default";
-  const signedSessionToken = randomUUID6();
+  const signedSessionToken = randomUUID7();
   const cacheKey = fingerprintSessionKey(signedSessionToken);
   registerSession(cacheKey, "admin", accountId, void 0, userId, userName, role);
   if (userId) setWantsPriorConversation(cacheKey);
@@ -7223,7 +7499,7 @@ app14.get("/", requireAdminSession, async (c) => {
   if (!userId) return c.json({ error: "User identity required \u2014 authenticate with users.json PIN" }, 401);
   try {
     const flushed = await listAdminSessions(accountId, userId, 20);
-    const sessions = flushed.map((r) => ({
+    const sessions2 = flushed.map((r) => ({
       sessionId: r.sessionId,
       cacheKey: null,
       name: r.name,
@@ -7231,15 +7507,15 @@ app14.get("/", requireAdminSession, async (c) => {
       phase: "flushed",
       channel: r.channel
     })).sort((a, b) => a.updatedAt < b.updatedAt ? 1 : a.updatedAt > b.updatedAt ? -1 : 0).slice(0, 20);
-    const channelCounts = sessions.reduce((acc, s) => {
+    const channelCounts = sessions2.reduce((acc, s) => {
       const k = s.channel ?? "unknown";
       acc[k] = (acc[k] ?? 0) + 1;
       return acc;
     }, {});
     console.error(
-      `[conversations-list] render rows=${sessions.length} channels=${JSON.stringify(channelCounts)}`
+      `[conversations-list] render rows=${sessions2.length} channels=${JSON.stringify(channelCounts)}`
     );
-    return c.json({ sessions });
+    return c.json({ sessions: sessions2 });
   } catch (err) {
     console.error(`[sessions-list] Failed: ${err instanceof Error ? err.message : String(err)}`);
     return c.json({ error: "Failed to fetch sessions" }, 500);
@@ -7298,11 +7574,11 @@ app14.delete("/:id", requireAdminSession, async (c) => {
   const owned = await verifyConversationOwnership(sessionId, accountId);
   if (!owned) return c.json({ error: "Conversation not found" }, 404);
   const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-conversation-delete" });
-  const managerBase3 = `http://127.0.0.1:${managerPort}`;
+  const managerBase4 = `http://127.0.0.1:${managerPort}`;
   const outcome = await cascadeAdminConversationDelete({
     sessionId,
     accountId,
-    managerBase: managerBase3
+    managerBase: managerBase4
   });
   if (outcome.ok) return c.json({ ok: true, claudeSessionIds: outcome.claudeSessionIds });
   if (outcome.reason === "pty-still-alive") {
@@ -7948,7 +8224,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG17 = "[claude-session-manager:wrapper]";
+var TAG18 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -7960,7 +8236,7 @@ async function refuseIfClaudeAuthDead(c, route, sessionId) {
     503
   );
 }
-function managerBase2() {
+function managerBase3() {
   const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "claude-session-manager:wrapper" });
   return `http://127.0.0.1:${port2}`;
 }
@@ -7971,12 +8247,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG17} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG18} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG17} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG18} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -8003,24 +8279,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG17} forward-spawn-start managerBase=${managerBase2()} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG18} forward-spawn-start managerBase=${managerBase3()} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
-  const upstream = await fetch(`${managerBase2()}/spawn`, {
+  const upstream = await fetch(`${managerBase3()}/spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG18} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG17} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG18} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG17} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG18} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -8069,7 +8345,7 @@ app15.post("/", async (c) => {
     authSurface = "cookie";
     senderId = getAccountIdForSession(cacheKey) ?? "";
     if (!senderId) {
-      console.error(`${TAG17} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+      console.error(`${TAG18} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
       return c.json({ error: "admin-account-not-resolved" }, 500);
     }
     userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -8080,9 +8356,9 @@ app15.post("/", async (c) => {
     }
     const lookupSessionId = body.adminSessionId;
     const operatorMeta = await fetch(
-      `${managerBase2()}/${encodeURIComponent(lookupSessionId)}/meta`
+      `${managerBase3()}/${encodeURIComponent(lookupSessionId)}/meta`
     ).then((r) => r.ok ? r.json() : null).catch((err) => {
-      console.error(`${TAG17} fetch-failed op=operator-meta-lookup message=${err instanceof Error ? err.message : String(err)}`);
+      console.error(`${TAG18} fetch-failed op=operator-meta-lookup message=${err instanceof Error ? err.message : String(err)}`);
       return null;
     });
     const operatorSenderId = operatorMeta && typeof operatorMeta.senderId === "string" && operatorMeta.senderId.length > 0 ? operatorMeta.senderId : null;
@@ -8097,7 +8373,7 @@ app15.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG17} spawn-request-in surface=${authSurface} accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG18} spawn-request-in surface=${authSurface} accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -8116,14 +8392,14 @@ app15.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG17} route-done surface=${authSurface} status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG18} route-done surface=${authSurface} status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 app15.get("/events", async (c) => {
-  const upstream = await fetch(`${managerBase2()}/events`, {
+  const upstream = await fetch(`${managerBase3()}/events`, {
     headers: { accept: "text/event-stream" }
   }).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=events message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=events message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream || !upstream.body) return c.json({ error: "manager-unreachable" }, 503);
@@ -8142,9 +8418,9 @@ app15.get("/", async (c) => {
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) return c.json({ error: "admin-account-not-resolved" }, 500);
   const upstream = await fetch(
-    `${managerBase2()}/list?senderId=${encodeURIComponent(senderId)}`
+    `${managerBase3()}/list?senderId=${encodeURIComponent(senderId)}`
   ).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=list message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=list message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8173,7 +8449,7 @@ app15.post("/resume", async (c) => {
   const activePlugins = computeActivePlugins(senderId);
   const specialistDomains = computeSpecialistDomains(senderId);
   const tunnelUrl = resolveTunnelUrl();
-  const upstream = await fetch(`${managerBase2()}/resume`, {
+  const upstream = await fetch(`${managerBase3()}/resume`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
@@ -8198,7 +8474,7 @@ app15.post("/resume", async (c) => {
       conversationNodeId: getSessionIdForSession(cacheKey)
     })
   }).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=resume message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=resume message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8223,10 +8499,10 @@ app15.post("/resume", async (c) => {
 app15.post("/:sessionId/stop", async (c) => {
   const sessionId = c.req.param("sessionId");
   const upstream = await fetch(
-    `${managerBase2()}/${encodeURIComponent(sessionId)}/stop`,
+    `${managerBase3()}/${encodeURIComponent(sessionId)}/stop`,
     { method: "POST" }
   ).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=stop message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=stop message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8236,14 +8512,14 @@ app15.post("/:sessionId/rename", async (c) => {
   const sessionId = c.req.param("sessionId");
   const body = await c.req.text();
   const upstream = await fetch(
-    `${managerBase2()}/${encodeURIComponent(sessionId)}/rename`,
+    `${managerBase3()}/${encodeURIComponent(sessionId)}/rename`,
     {
       method: "POST",
       headers: { "content-type": "application/json" },
       body
     }
   ).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=rename message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=rename message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8258,10 +8534,10 @@ app15.delete("/:sessionId", async (c) => {
   if (!sessionId) {
     console.log(`[admin-conversation-delete] reason=no-conversation-mapping claudeSessionId=${claudeSessionId.slice(0, 8)}`);
     const upstream = await fetch(
-      `${managerBase2()}/${encodeURIComponent(claudeSessionId)}`,
+      `${managerBase3()}/${encodeURIComponent(claudeSessionId)}`,
       { method: "DELETE" }
     ).catch((err) => {
-      console.error(`${TAG17} fetch-failed op=delete message=${err instanceof Error ? err.message : String(err)}`);
+      console.error(`${TAG18} fetch-failed op=delete message=${err instanceof Error ? err.message : String(err)}`);
       return null;
     });
     if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8277,7 +8553,7 @@ app15.delete("/:sessionId", async (c) => {
   const outcome = await cascadeAdminConversationDelete({
     sessionId,
     accountId,
-    managerBase: managerBase2(),
+    managerBase: managerBase3(),
     claudeSessionIds: all
   });
   if (outcome.ok) return c.json({ ok: true, claudeSessionIds: outcome.claudeSessionIds });
@@ -8316,14 +8592,14 @@ app15.post("/:sessionId/archive", async (c) => {
   const sessionId = c.req.param("sessionId");
   const body = await c.req.text();
   const upstream = await fetch(
-    `${managerBase2()}/${encodeURIComponent(sessionId)}/archive`,
+    `${managerBase3()}/${encodeURIComponent(sessionId)}/archive`,
     {
       method: "POST",
       headers: { "content-type": "application/json" },
       body
     }
   ).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=archive message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=archive message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8332,9 +8608,9 @@ app15.post("/:sessionId/archive", async (c) => {
 app15.get("/:sessionId/meta", async (c) => {
   const sessionId = c.req.param("sessionId");
   const upstream = await fetch(
-    `${managerBase2()}/${encodeURIComponent(sessionId)}/meta`
+    `${managerBase3()}/${encodeURIComponent(sessionId)}/meta`
   ).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=meta message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=meta message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8344,14 +8620,14 @@ app15.post("/:sessionId/input", async (c) => {
   const sessionId = c.req.param("sessionId");
   const rawBody = await c.req.text();
   const upstream = await fetch(
-    `${managerBase2()}/${encodeURIComponent(sessionId)}/input`,
+    `${managerBase3()}/${encodeURIComponent(sessionId)}/input`,
     {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: rawBody
     }
   ).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=input message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=input message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8364,9 +8640,9 @@ app15.get("/:sessionId/log", async (c) => {
   if (c.req.query("download") === "1") search.set("download", "1");
   const qs = search.toString() ? `?${search.toString()}` : "";
   const upstream = await fetch(
-    `${managerBase2()}/${encodeURIComponent(sessionId)}/log${qs}`
+    `${managerBase3()}/${encodeURIComponent(sessionId)}/log${qs}`
   ).catch((err) => {
-    console.error(`${TAG17} fetch-failed op=log message=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`${TAG18} fetch-failed op=log message=${err instanceof Error ? err.message : String(err)}`);
     return null;
   });
   if (!upstream) return c.json({ error: "manager-unreachable" }, 503);
@@ -8375,7 +8651,7 @@ app15.get("/:sessionId/log", async (c) => {
 var claude_sessions_default = app15;
 
 // server/routes/admin/log-ingest.ts
-var TAG18 = "[log-ingest]";
+var TAG19 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
@@ -8386,7 +8662,7 @@ function isLoopbackAddr(addr) {
 app16.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG18} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG19} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -8395,7 +8671,7 @@ app16.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG18} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG19} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -8437,18 +8713,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app17 = new Hono();
 app17.post("/", async (c) => {
-  const TAG22 = "[admin:events]";
+  const TAG28 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG22} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG28} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG22} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG28} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -9326,6 +9602,27 @@ function pickFulltextIndex(allowedScopes) {
 function isPublicOnlyScope(allowedScopes) {
   return Array.isArray(allowedScopes) && allowedScopes.length === 1 && allowedScopes[0] === "public";
 }
+function buildScopeAndSliceClause(allowedScopes, sliceToken, alias = "node") {
+  const hasSlice = typeof sliceToken === "string" && sliceToken.length > 0;
+  const hasScopes = Array.isArray(allowedScopes) && allowedScopes.length > 0;
+  if (!hasSlice && !hasScopes) return { clause: "", params: {} };
+  if (hasSlice && hasScopes) {
+    return {
+      clause: `AND (${alias}.sliceToken = $sliceToken OR ${alias}.scope IS NULL OR ${alias}.scope IN $allowedScopes)`,
+      params: { sliceToken, allowedScopes }
+    };
+  }
+  if (hasSlice) {
+    return {
+      clause: `AND (${alias}.sliceToken = $sliceToken OR ${alias}.scope IS NULL)`,
+      params: { sliceToken }
+    };
+  }
+  return {
+    clause: `AND (${alias}.scope IS NULL OR ${alias}.scope IN $allowedScopes)`,
+    params: { allowedScopes }
+  };
+}
 function escapeLucene(query) {
   return query.replace(/[+\-&|!(){}[\]^"~*?:\\/]/g, "\\$&");
 }
@@ -9361,8 +9658,9 @@ function buildKeywordFilter(keywords, keywordMatch = "any") {
   };
 }
 async function bm25Only(session, params) {
-  const { query, accountId, limit, allowedScopes, agentSlug, keywords, keywordMatch, labels } = params;
-  const scopeClause = allowedScopes ? "AND (node.scope IS NULL OR node.scope IN $allowedScopes)" : "";
+  const { query, accountId, limit, allowedScopes, agentSlug, keywords, keywordMatch, labels, sliceToken } = params;
+  const scope = buildScopeAndSliceClause(allowedScopes, sliceToken);
+  const scopeClause = scope.clause;
   const agentClause = agentSlug ? "AND node.agents IS NOT NULL AND $agentSlug IN node.agents" : "";
   const labelClause = labels && labels.length > 0 ? "AND any(l IN labels(node) WHERE l IN $labels)" : "";
   const keywordFilter = buildKeywordFilter(keywords, keywordMatch);
@@ -9386,7 +9684,7 @@ async function bm25Only(session, params) {
         query: escaped,
         accountId,
         limit: int(limit),
-        ...allowedScopes ? { allowedScopes } : {},
+        ...scope.params,
         ...agentSlug ? { agentSlug } : {},
         ...labels && labels.length > 0 ? { labels } : {},
         ...keywordFilter?.params ?? {}
@@ -9418,6 +9716,7 @@ async function hybrid(session, embed2, params) {
     accountId,
     limit,
     allowedScopes,
+    sliceToken,
     keywords,
     keywordMatch = "any",
     agentSlug,
@@ -9496,22 +9795,18 @@ async function hybrid(session, embed2, params) {
   if (effectiveLabels && effectiveLabels.length > 0) {
     indexesToQuery = effectiveLabels.map((l) => labelToIndex.get(l)).filter((idx) => idx !== void 0);
     if (indexesToQuery.length === 0) {
-      return {
-        mode: useRrf ? "rrf" : "hybrid",
-        results: [],
-        expandMs: 0,
-        rawMerged: 0,
-        suppressed: 0,
-        bm25Bypass: 0,
-        threshold: params.vectorThreshold ?? null,
-        stageCounts: emptyStageCounts
-      };
+      const missing = effectiveLabels.filter((l) => !labelToIndex.has(l));
+      process.stderr.write(
+        `[graph-search] labels-without-vector-index=${missing.join(",")} accountId=${(accountId ?? "").slice(0, 8)} \u2014 falling through to BM25-only for these labels
+`
+      );
     }
   } else {
     indexesToQuery = [...new Set(labelToIndex.values())];
   }
-  const scopeClause = allowedScopes ? "AND (node.scope IS NULL OR node.scope IN $allowedScopes)" : "";
-  const scopeParams = allowedScopes ? { allowedScopes } : {};
+  const hybridScope = buildScopeAndSliceClause(allowedScopes, sliceToken);
+  const scopeClause = hybridScope.clause;
+  const scopeParams = hybridScope.params;
   const agentClause = agentSlug ? "AND node.agents IS NOT NULL AND $agentSlug IN node.agents" : "";
   const agentParams = agentSlug ? { agentSlug } : {};
   const keywordFilter = buildKeywordFilter(keywords, keywordMatch);
@@ -9626,7 +9921,8 @@ async function hybrid(session, embed2, params) {
         query: kw,
         accountId,
         limit,
-        allowedScopes
+        allowedScopes,
+        sliceToken
       });
       if (kwHits.length === 0) continue;
       const rawScores = kwHits.map((h) => h.score);
@@ -9635,21 +9931,21 @@ async function hybrid(session, embed2, params) {
         mergeBm25Hit(scoreMap, kwHits[i], normalised[i]);
       }
     }
-    const propScopeClause = allowedScopes ? "AND (node.scope IS NULL OR node.scope IN $allowedScopes)" : "";
+    const propScope = buildScopeAndSliceClause(allowedScopes, sliceToken);
     const propResult = await session.run(
       `MATCH (node)
        WHERE node.accountId = $accountId
        AND ${(0, import_dist.notTrashed)("node")}
        AND node.keywords IS NOT NULL
        AND ANY(kw IN $kwSubs WHERE ANY(nk IN node.keywords WHERE toLower(nk) = kw))
-       ${propScopeClause}
+       ${propScope.clause}
        RETURN node, labels(node) AS nodeLabels, elementId(node) AS nodeId
        LIMIT $limit`,
       {
         accountId,
         kwSubs: keywordSubscriptions,
         limit: int(limit),
-        ...allowedScopes ? { allowedScopes } : {}
+        ...propScope.params
       }
     );
     for (const record of propResult.records) {
@@ -9677,7 +9973,8 @@ async function hybrid(session, embed2, params) {
         query: kw,
         accountId,
         limit,
-        allowedScopes
+        allowedScopes,
+        sliceToken
       });
       if (kwHits.length === 0) continue;
       const rawScores = kwHits.map((h) => h.score);
@@ -9686,21 +9983,21 @@ async function hybrid(session, embed2, params) {
         mergeBm25Hit(scoreMap, kwHits[i], normalised[i]);
       }
     }
-    const propScopeClause = allowedScopes ? "AND (node.scope IS NULL OR node.scope IN $allowedScopes)" : "";
+    const propScope = buildScopeAndSliceClause(allowedScopes, sliceToken);
     const propResult = await session.run(
       `MATCH (node)
        WHERE node.accountId = $accountId
        AND ${(0, import_dist.notTrashed)("node")}
        AND node.keywords IS NOT NULL
        AND ANY(kw IN $kwSubs WHERE ANY(nk IN node.keywords WHERE toLower(nk) = kw))
-       ${propScopeClause}
+       ${propScope.clause}
        RETURN node, labels(node) AS nodeLabels, elementId(node) AS nodeId
        LIMIT $limit`,
       {
         accountId,
         kwSubs: keywordSubscriptions,
         limit: int(limit),
-        ...allowedScopes ? { allowedScopes } : {}
+        ...propScope.params
       }
     );
     for (const record of propResult.records) {
@@ -10731,7 +11028,7 @@ app21.post("/", requireAdminSession, async (c) => {
         return c.json({ error: "AdminConversation node is missing sessionId" }, 500);
       }
       const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "graph-page-cascade" });
-      const managerBase3 = `http://127.0.0.1:${managerPort}`;
+      const managerBase4 = `http://127.0.0.1:${managerPort}`;
       try {
         await session.close();
       } catch {
@@ -10739,7 +11036,7 @@ app21.post("/", requireAdminSession, async (c) => {
       const outcome = await cascadeAdminConversationDelete({
         sessionId,
         accountId,
-        managerBase: managerBase3
+        managerBase: managerBase4
       });
       const elapsed2 = Date.now() - started;
       const labelSummary2 = preflightLabels.join(",");
@@ -11848,7 +12145,7 @@ app31.get("/", async (c) => {
 var health_default2 = app31;
 
 // server/routes/admin/linkedin-ingest.ts
-var TAG19 = "[linkedin-ingest-route]";
+var TAG20 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -11947,25 +12244,25 @@ app32.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG19 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG20 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG19 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG20 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG19 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG20 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG19 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG20 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
@@ -11987,12 +12284,12 @@ app32.post("/", requireAdminSession, async (c) => {
   if (!response.ok) {
     const detail = await response.text().catch(() => "");
     console.error(
-      TAG19 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + response.status + " ms=" + (Date.now() - spawnStart) + " detail=" + detail.slice(0, 200)
+      TAG20 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + response.status + " ms=" + (Date.now() - spawnStart) + " detail=" + detail.slice(0, 200)
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: response.status, detail: detail.slice(0, 500) }, 502);
   }
   console.log(
-    TAG19 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + (claudeSessionId ?? "unknown") + " ms=" + (Date.now() - spawnStart)
+    TAG20 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + (claudeSessionId ?? "unknown") + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: claudeSessionId }, 202);
 });
@@ -12000,7 +12297,7 @@ var linkedin_ingest_default = app32;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG20 = "[post-turn-context]";
+var TAG21 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -12042,7 +12339,7 @@ var app33 = new Hono();
 app33.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG20} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -12051,7 +12348,7 @@ app33.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG20} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG21} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -12083,7 +12380,7 @@ app33.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG20} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG21} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -12092,7 +12389,7 @@ app33.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG20} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG21} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -12101,41 +12398,659 @@ app33.get("/", async (c) => {
 });
 var post_turn_context_default = app33;
 
-// server/routes/admin/index.ts
+// server/routes/admin/public-session-context.ts
+import neo4j4 from "neo4j-driver";
+var TAG22 = "[public-session-context]";
+var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
+  "embedding",
+  "passwordHash",
+  "magicToken",
+  "otpCode",
+  "cacheKey"
+]);
+function isLoopbackAddr3(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+function convertValue2(value) {
+  if (neo4j4.isDateTime(value) || neo4j4.isDate(value) || neo4j4.isLocalDateTime(value) || neo4j4.isLocalTime(value) || neo4j4.isTime(value) || neo4j4.isDuration(value)) {
+    return value.toString();
+  }
+  if (neo4j4.isInt(value)) {
+    return value.inSafeRange() ? value.toNumber() : value.toString();
+  }
+  if (Array.isArray(value)) {
+    return value.map((v) => convertValue2(v));
+  }
+  if (value !== null && typeof value === "object" && value.constructor === Object) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = convertValue2(v);
+    }
+    return out;
+  }
+  return value;
+}
+function pruneProperties2(raw) {
+  const out = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (STRIPPED_PROPERTIES3.has(k)) continue;
+    out[k] = convertValue2(v);
+  }
+  return out;
+}
 var app34 = new Hono();
-app34.route("/session", session_default);
-app34.route("/new-session-failure", new_session_failure_default);
-app34.route("/new-session-submit", new_session_submit_default);
-app34.route("/logs", logs_default);
-app34.route("/claude-info", claude_info_default);
-app34.route("/claude-capabilities", claude_capabilities_default);
-app34.route("/attachment", attachment_default);
-app34.route("/agents", agents_default);
-app34.route("/sessions", sessions_default);
-app34.route("/claude-sessions", claude_sessions_default);
-app34.route("/log-ingest", log_ingest_default);
-app34.route("/events", events_default);
-app34.route("/files", files_default);
-app34.route("/graph-search", graph_search_default);
-app34.route("/graph-subgraph", graph_subgraph_default);
-app34.route("/graph-delete", graph_delete_default);
-app34.route("/graph-restore", graph_restore_default);
-app34.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app34.route("/graph-default-view", graph_default_view_default);
-app34.route("/session-defaults", session_defaults_default);
-app34.route("/file-attach", file_attach_default);
-app34.route("/sidebar-artefacts", sidebar_artefacts_default);
-app34.route("/sidebar-artefact-save", sidebar_artefact_save_default);
-app34.route("/sidebar-artefact-content", sidebar_artefact_content_default);
-app34.route("/system-stats", system_stats_default);
-app34.route("/health-brand", health_default2);
-app34.route("/linkedin-ingest", linkedin_ingest_default);
-app34.route("/post-turn-context", post_turn_context_default);
-var admin_default = app34;
+app34.get("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr3(remoteAddr)) {
+    console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "public-session-context-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr3(t));
+    if (offender !== void 0) {
+      console.error(`${TAG22} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "public-session-context-loopback-only" }, 403);
+    }
+  }
+  const sliceToken = (c.req.query("sliceToken") ?? "").trim();
+  const accountId = (c.req.query("accountId") ?? "").trim();
+  if (!sliceToken) return c.json({ error: "sliceToken required" }, 400);
+  if (!accountId) return c.json({ error: "accountId required" }, 400);
+  const session = getSession();
+  const started = Date.now();
+  try {
+    const cypher = `
+      MATCH (n)
+      WHERE n.sliceToken = $sliceToken AND n.accountId = $accountId
+      RETURN elementId(n) AS elementId,
+             labels(n) AS labels,
+             properties(n) AS properties,
+             coalesce(n.createdAt, n.observedAt, '') AS sortKey
+    `;
+    const res = await session.executeRead(
+      (tx) => tx.run(cypher, { sliceToken, accountId })
+    );
+    const writes = res.records.map((r) => ({
+      elementId: r.get("elementId"),
+      labels: r.get("labels"),
+      properties: pruneProperties2(r.get("properties")),
+      sortKey: String(r.get("sortKey") ?? "")
+    }));
+    writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
+    const total = Date.now() - started;
+    console.log(
+      `${TAG22} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+    );
+    return c.json({
+      writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
+    });
+  } catch (err) {
+    const elapsed = Date.now() - started;
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(
+      `${TAG22} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+    );
+    return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
+  } finally {
+    await session.close();
+  }
+});
+var public_session_context_default = app34;
 
-// server/routes/sites.ts
-import { existsSync as existsSync21, readFileSync as readFileSync16, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+// server/routes/admin/public-session-exit.ts
+var TAG23 = "[public-session-exit-route]";
+function isLoopbackAddr4(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+var app35 = new Hono();
+app35.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr4(remoteAddr)) {
+    console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "public-session-exit-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr4(t));
+    if (offender !== void 0) {
+      console.error(`${TAG23} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "public-session-exit-loopback-only" }, 403);
+    }
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
+  if (!sessionId) return c.json({ error: "sessionId required" }, 400);
+  handlePublicSessionExit(sessionId);
+  return c.json({ ok: true });
+});
+var public_session_exit_default = app35;
+
+// server/routes/admin/access-session-evict.ts
+var TAG24 = "[access-session-evict]";
+function isLoopbackAddr5(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+var app36 = new Hono();
+app36.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr5(remoteAddr)) {
+    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "access-session-evict-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr5(t));
+    if (offender !== void 0) {
+      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "access-session-evict-loopback-only" }, 403);
+    }
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
+  if (!grantId) return c.json({ error: "grantId required" }, 400);
+  const dropped = evictAccessSessionsByGrant(grantId);
+  console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
+  return c.json({ ok: true, dropped });
+});
+var access_session_evict_default = app36;
+
+// server/routes/admin/index.ts
+var app37 = new Hono();
+app37.route("/session", session_default);
+app37.route("/new-session-failure", new_session_failure_default);
+app37.route("/new-session-submit", new_session_submit_default);
+app37.route("/logs", logs_default);
+app37.route("/claude-info", claude_info_default);
+app37.route("/claude-capabilities", claude_capabilities_default);
+app37.route("/attachment", attachment_default);
+app37.route("/agents", agents_default);
+app37.route("/sessions", sessions_default);
+app37.route("/claude-sessions", claude_sessions_default);
+app37.route("/log-ingest", log_ingest_default);
+app37.route("/events", events_default);
+app37.route("/files", files_default);
+app37.route("/graph-search", graph_search_default);
+app37.route("/graph-subgraph", graph_subgraph_default);
+app37.route("/graph-delete", graph_delete_default);
+app37.route("/graph-restore", graph_restore_default);
+app37.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app37.route("/graph-default-view", graph_default_view_default);
+app37.route("/session-defaults", session_defaults_default);
+app37.route("/file-attach", file_attach_default);
+app37.route("/sidebar-artefacts", sidebar_artefacts_default);
+app37.route("/sidebar-artefact-save", sidebar_artefact_save_default);
+app37.route("/sidebar-artefact-content", sidebar_artefact_content_default);
+app37.route("/system-stats", system_stats_default);
+app37.route("/health-brand", health_default2);
+app37.route("/linkedin-ingest", linkedin_ingest_default);
+app37.route("/post-turn-context", post_turn_context_default);
+app37.route("/public-session-context", public_session_context_default);
+app37.route("/public-session-exit", public_session_exit_default);
+app37.route("/access-session-evict", access_session_evict_default);
+var admin_default = app37;
+
+// app/lib/access-gate.ts
+import neo4j5 from "neo4j-driver";
+import { readFileSync as readFileSync16 } from "fs";
 import { resolve as resolve18 } from "path";
+import { randomUUID as randomUUID8 } from "crypto";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+var driver = null;
+function readPassword() {
+  if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
+  const passwordFile = resolve18(PLATFORM_ROOT7, "config/.neo4j-password");
+  try {
+    return readFileSync16(passwordFile, "utf-8").trim();
+  } catch {
+    throw new Error(
+      `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
+    );
+  }
+}
+function getDriver() {
+  if (!driver) {
+    const uri = process.env.NEO4J_URI;
+    if (!uri) {
+      throw new Error(
+        "[ui/access-gate] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687"
+      );
+    }
+    const user = process.env.NEO4J_USER ?? "neo4j";
+    const password = readPassword();
+    console.error(`[ui/access-gate] resolved neo4j_uri=${uri}`);
+    driver = neo4j5.driver(uri, neo4j5.auth.basic(user, password), {
+      maxConnectionPoolSize: 5
+    });
+  }
+  return driver;
+}
+function getSession3() {
+  return getDriver().session();
+}
+process.on("SIGINT", async () => {
+  if (driver) {
+    await driver.close();
+    driver = null;
+  }
+});
+var rateLimitMap = /* @__PURE__ */ new Map();
+var ACCESS_MAX_ATTEMPTS = 5;
+var ACCESS_LOCKOUT_MS = 15 * 60 * 1e3;
+var ACCESS_WINDOW_MS = 15 * 60 * 1e3;
+function checkAccessRateLimit(ip, agentSlug) {
+  const key = `${ip}:${agentSlug}`;
+  const entry = rateLimitMap.get(key);
+  if (!entry) return null;
+  const now = Date.now();
+  if (entry.lockedUntil && now < entry.lockedUntil) {
+    const remainingMs = entry.lockedUntil - now;
+    const remainingS = Math.ceil(remainingMs / 1e3);
+    return `Too many attempts. Try again in ${remainingS}s`;
+  }
+  if (now - entry.firstAttempt > ACCESS_WINDOW_MS) {
+    rateLimitMap.delete(key);
+    return null;
+  }
+  return null;
+}
+function recordAccessFailedAttempt(ip, agentSlug) {
+  const key = `${ip}:${agentSlug}`;
+  const now = Date.now();
+  const entry = rateLimitMap.get(key);
+  if (!entry || now - entry.firstAttempt > ACCESS_WINDOW_MS) {
+    rateLimitMap.set(key, { attempts: 1, firstAttempt: now });
+    return;
+  }
+  entry.attempts++;
+  if (entry.attempts >= ACCESS_MAX_ATTEMPTS) {
+    entry.lockedUntil = now + ACCESS_LOCKOUT_MS;
+  }
+}
+function clearAccessRateLimit(ip, agentSlug) {
+  rateLimitMap.delete(`${ip}:${agentSlug}`);
+}
+var contactRateMap = /* @__PURE__ */ new Map();
+var REQUEST_LINK_MAX = 3;
+var REQUEST_LINK_WINDOW_MS = 60 * 60 * 1e3;
+function checkRequestLinkRateLimit(contactValue) {
+  const entry = contactRateMap.get(contactValue);
+  if (!entry) return null;
+  const now = Date.now();
+  if (now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
+    contactRateMap.delete(contactValue);
+    return null;
+  }
+  if (entry.count >= REQUEST_LINK_MAX) {
+    const remainingMs = REQUEST_LINK_WINDOW_MS - (now - entry.windowStart);
+    const remainingM = Math.ceil(remainingMs / 6e4);
+    return `Too many requests. Try again in ${remainingM} minute(s)`;
+  }
+  return null;
+}
+function recordRequestLinkAttempt(contactValue) {
+  const now = Date.now();
+  const entry = contactRateMap.get(contactValue);
+  if (!entry || now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
+    contactRateMap.set(contactValue, { count: 1, windowStart: now });
+    return;
+  }
+  entry.count++;
+}
+function maskContact(value) {
+  if (value.includes("@")) {
+    const [local, domain] = value.split("@");
+    return `${local[0]}***@${domain}`;
+  }
+  return "****";
+}
+function readGrant(record) {
+  const g = record.get("g").properties;
+  const personId = record.get("personId");
+  return {
+    grantId: record.get("grantId"),
+    agentSlug: String(g.agentSlug),
+    accountId: String(g.accountId),
+    contactValue: String(g.contactValue),
+    displayName: record.get("givenName") ?? null,
+    personId,
+    expiresAt: g.expiresAt ? new Date(String(g.expiresAt)).getTime() : null,
+    status: String(g.status),
+    sliceToken: String(g.sliceToken ?? "")
+  };
+}
+async function findGrantByMagicToken(token) {
+  const session = getSession3();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {magicToken: $token})
+       RETURN g, p.givenName AS givenName,
+              elementId(g) AS grantId,
+              elementId(p) AS personId`,
+      { token }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
+  const session = getSession3();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {
+        contactValue: $contactValue,
+        agentSlug: $agentSlug,
+        accountId: $accountId
+      })
+      WHERE g.status IN ['invited', 'active']
+      RETURN g, p.givenName AS givenName,
+             elementId(g) AS grantId,
+             elementId(p) AS personId`,
+      { contactValue, agentSlug, accountId }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function consumeMagicTokenAndActivate(grantId) {
+  const session = getSession3();
+  try {
+    const result = await session.run(
+      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
+       SET g.magicToken = null,
+           g.magicTokenExpiresAt = null,
+           g.status = "active"
+       RETURN count(g) AS affected`,
+      { grantId }
+    );
+    const affected = result.records[0]?.get("affected");
+    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
+    if (count === 0) {
+      throw new Error(`[access-gate] consumeMagicTokenAndActivate: no grant matched grantId=${grantId}`);
+    }
+  } finally {
+    await session.close();
+  }
+}
+async function generateNewMagicToken(grantId) {
+  const token = randomUUID8();
+  const session = getSession3();
+  try {
+    const result = await session.run(
+      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
+       SET g.magicToken = $token,
+           g.magicTokenExpiresAt = datetime() + duration('PT15M')
+       RETURN count(g) AS affected`,
+      { grantId, token }
+    );
+    const affected = result.records[0]?.get("affected");
+    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
+    if (count === 0) {
+      throw new Error(`[access-gate] generateNewMagicToken: no grant matched grantId=${grantId}`);
+    }
+  } finally {
+    await session.close();
+  }
+  return token;
+}
+
+// server/routes/access/verify-token.ts
+var TAG25 = "[access-verify]";
+var MINT_TAG = "[access-session-mint]";
+var COOKIE_NAME = "__access_session";
+var app38 = new Hono();
+app38.post("/", async (c) => {
+  const ip = c.var.clientIp || "unknown";
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const token = typeof body.token === "string" ? body.token.trim() : "";
+  const agentSlug = typeof body.agentSlug === "string" ? body.agentSlug.trim() : "";
+  if (!token || !agentSlug) {
+    return c.json({ error: "token and agentSlug required" }, 400);
+  }
+  const rateMsg = checkAccessRateLimit(ip, agentSlug);
+  if (rateMsg) {
+    console.error(`${TAG25} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    return c.json({ error: rateMsg }, 429);
+  }
+  const grant = await findGrantByMagicToken(token);
+  if (!grant) {
+    recordAccessFailedAttempt(ip, agentSlug);
+    console.error(`${TAG25} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    return c.json({ error: "invalid-or-expired-link" }, 401);
+  }
+  if (grant.agentSlug !== agentSlug) {
+    recordAccessFailedAttempt(ip, agentSlug);
+    console.error(
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+    );
+    return c.json({ error: "invalid-or-expired-link" }, 401);
+  }
+  if (grant.status === "expired" || grant.status === "revoked") {
+    recordAccessFailedAttempt(ip, agentSlug);
+    console.error(
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+    );
+    return c.json({ error: "access-no-longer-valid" }, 401);
+  }
+  if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
+    recordAccessFailedAttempt(ip, agentSlug);
+    console.error(
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+    );
+    return c.json({ error: "access-no-longer-valid" }, 401);
+  }
+  if (!grant.sliceToken) {
+    console.error(
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+    );
+    return c.json({ error: "grant-misconfigured" }, 500);
+  }
+  const session = createAccessSession({
+    grantId: grant.grantId,
+    sliceToken: grant.sliceToken,
+    agentSlug: grant.agentSlug,
+    accountId: grant.accountId,
+    personId: grant.personId,
+    contactValue: grant.contactValue
+  });
+  try {
+    await consumeMagicTokenAndActivate(grant.grantId);
+  } catch (err) {
+    console.error(
+      `${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return c.json({ error: "verification-failed" }, 500);
+  }
+  clearAccessRateLimit(ip, agentSlug);
+  console.log(`${TAG25} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(
+    `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
+  );
+  c.header(
+    "Set-Cookie",
+    `${COOKIE_NAME}=${session.sessionId}; HttpOnly; Secure; SameSite=Lax; Path=/`
+  );
+  return c.json({
+    ok: true,
+    agentSlug,
+    displayName: grant.displayName
+  });
+});
+var verify_token_default = app38;
+
+// app/lib/access-email.ts
+import { spawn as spawn2 } from "child_process";
+import { resolve as resolve19 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
+var SEND_SCRIPT = resolve19(
+  PLATFORM_ROOT8,
+  "plugins",
+  "email",
+  "mcp",
+  "dist",
+  "scripts",
+  "send-transactional.js"
+);
+async function sendMagicLinkEmail(payload) {
+  return new Promise((resolveResult) => {
+    const child = spawn2("node", [SEND_SCRIPT], {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: process.env
+    });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const timeout = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+      resolveResult({ ok: false, error: "send-transactional timeout (30s)" });
+    }, 3e4);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      resolveResult({ ok: false, error: `spawn-failed: ${err.message}` });
+    });
+    child.on("exit", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      if (code === 0) {
+        const match = stdout.match(/^ok messageId=(.+)$/m);
+        resolveResult({ ok: true, messageId: match?.[1]?.trim() ?? "unknown" });
+      } else {
+        resolveResult({ ok: false, error: stderr.trim() || `exit-${code}` });
+      }
+    });
+    child.stdin.write(JSON.stringify(payload));
+    child.stdin.end();
+  });
+}
+
+// server/routes/access/request-magic-link.ts
+var TAG26 = "[access-request-link]";
+var app39 = new Hono();
+var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
+app39.post("/", async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const contactValue = typeof body.contactValue === "string" ? body.contactValue.trim().toLowerCase() : "";
+  const agentSlug = typeof body.agentSlug === "string" ? body.agentSlug.trim() : "";
+  if (!contactValue || !agentSlug) {
+    return c.json({ error: "contactValue and agentSlug required" }, 400);
+  }
+  const rateMsg = checkRequestLinkRateLimit(contactValue);
+  if (rateMsg) {
+    console.error(`${TAG26} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    return c.json({ error: rateMsg }, 429);
+  }
+  recordRequestLinkAttempt(contactValue);
+  const accountId = process.env.ACCOUNT_ID ?? "";
+  if (!accountId) {
+    console.error(`${TAG26} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    return c.json({ message: VISITOR_MESSAGE }, 200);
+  }
+  const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
+  if (!grant) {
+    console.log(`${TAG26} contactValue=${maskContact(contactValue)} result=notfound`);
+    return c.json({ message: VISITOR_MESSAGE }, 200);
+  }
+  let token;
+  try {
+    token = await generateNewMagicToken(grant.grantId);
+  } catch (err) {
+    console.error(
+      `${TAG26} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return c.json({ message: VISITOR_MESSAGE }, 200);
+  }
+  const host = c.req.header("host") ?? "";
+  const proto = (c.req.header("x-forwarded-proto") ?? "https").toLowerCase();
+  const magicUrl = `${proto}://${host}/${agentSlug}?token=${token}`;
+  const subject = `Your link to ${grant.agentSlug}`;
+  const bodyText = [
+    grant.displayName ? `Hi ${grant.displayName},` : "Hello,",
+    "",
+    `Here's a fresh link to access ${grant.agentSlug}:`,
+    "",
+    magicUrl,
+    "",
+    "This link expires in 15 minutes."
+  ].join("\n");
+  const htmlBody = `
+    <p>${grant.displayName ? `Hi ${grant.displayName},` : "Hello,"}</p>
+    <p>Here's a fresh link to access <strong>${grant.agentSlug}</strong>:</p>
+    <p><a href="${magicUrl}" style="display:inline-block;padding:12px 24px;background:#000;color:#fff;text-decoration:none;border-radius:6px;">Open ${grant.agentSlug}</a></p>
+    <p style="color:#888;font-size:14px;">This link expires in 15 minutes.</p>
+  `;
+  const sendResult = await sendMagicLinkEmail({
+    accountId,
+    to: grant.contactValue,
+    subject,
+    body: bodyText,
+    html: htmlBody
+  });
+  if (!sendResult.ok) {
+    console.error(
+      `${TAG26} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+    );
+    return c.json({ message: VISITOR_MESSAGE }, 200);
+  }
+  console.log(
+    `${TAG26} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+  );
+  return c.json({ message: VISITOR_MESSAGE }, 200);
+});
+var request_magic_link_default = app39;
+
+// server/routes/access/index.ts
+var app40 = new Hono();
+app40.route("/verify-token", verify_token_default);
+app40.route("/request-magic-link", request_magic_link_default);
+var access_default = app40;
+
+// server/routes/sites.ts
+import { existsSync as existsSync21, readFileSync as readFileSync17, realpathSync as realpathSync5, statSync as statSync7 } from "fs";
+import { resolve as resolve20 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -12166,8 +13081,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app35 = new Hono();
-app35.get("/:rel{.*}", (c) => {
+var app41 = new Hono();
+app41.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -12192,8 +13107,8 @@ app35.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve18(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve18(rootDir, ...segments);
+  const rootDir = resolve20(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve20(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -12213,7 +13128,7 @@ app35.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve18(filePath, "index.html");
+    filePath = resolve20(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -12238,7 +13153,7 @@ app35.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync16(realPath);
+    body = readFileSync17(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -12270,11 +13185,11 @@ app35.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app35;
+var sites_default = app41;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync17, writeFileSync as writeFileSync6 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname5 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -12283,7 +13198,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync17(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -12297,7 +13212,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync17(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync18(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -12350,7 +13265,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync22, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync19 } from "fs";
 import { join as join14 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -12362,7 +13277,7 @@ function readBrandConfig() {
   const brandPath = join14(platformRoot, "config", "brand.json");
   if (!existsSync22(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync18(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync19(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -12370,7 +13285,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app36 = new Hono();
+var app42 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -12415,17 +13330,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app36.options("/consent", (c) => {
+app42.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app36.options("/brand-config", (c) => {
+app42.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app36.post("/consent", async (c) => {
+app42.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -12465,7 +13380,7 @@ app36.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app36.get("/brand-config", (c) => {
+app42.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -12475,7 +13390,7 @@ app36.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app36;
+var visitor_consent_default = app42;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -12502,8 +13417,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app37 = new Hono();
-app37.get("/:slug/click", async (c) => {
+var app43 = new Hono();
+app43.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -12567,10 +13482,10 @@ app37.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app37;
+var listings_default = app43;
 
 // server/routes/visitor-event.ts
-var app38 = new Hono();
+var app44 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -12637,12 +13552,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app38.options("/event", (c) => {
+app44.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app38.post("/event", async (c) => {
+app44.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -12847,7 +13762,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app38;
+var visitor_event_default = app44;
 
 // app/lib/graph-health.ts
 var HOUR_MS = 60 * 60 * 1e3;
@@ -12931,7 +13846,7 @@ function startGraphHealthTimer() {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG21 = "[whatsapp-adaptor]";
+var TAG27 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -12954,7 +13869,7 @@ async function dispatchToClaude(input) {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG21} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG27} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -12991,8 +13906,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash4, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync23, readFileSync as readFileSync19, statSync as statSync8 } from "fs";
-import { resolve as resolve19 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync20, statSync as statSync8 } from "fs";
+import { resolve as resolve21 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -13027,7 +13942,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve19(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve21(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -13039,7 +13954,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve19(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve21(brand.configDir, "entitlement.json");
   if (!existsSync23(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -13055,7 +13970,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync19(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync20(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -13069,7 +13984,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync19(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync20(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -13229,15 +14144,15 @@ function clientFrom(c) {
     c.req.header("x-forwarded-for")
   );
 }
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT7 ? join15(PLATFORM_ROOT7, "config", "brand.json") : "";
+var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join15(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -13260,7 +14175,7 @@ var ALIAS_DOMAINS_PATH = join15(homedir3(), BRAND.configDir, "alias-domains.json
 function loadAliasDomains() {
   try {
     if (!existsSync24(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync20(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync21(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -13284,9 +14199,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app39 = new Hono();
-app39.use("*", clientIpMiddleware);
-app39.use("*", async (c, next) => {
+var app45 = new Hono();
+app45.use("*", clientIpMiddleware);
+app45.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -13296,7 +14211,7 @@ app39.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app39.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -13329,7 +14244,7 @@ var PUBLIC_ALLOWED_PREFIXES = [
   "/sites/"
 ];
 var PUBLIC_ALLOWED_EXACT = ["/favicon.ico"];
-app39.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -13369,7 +14284,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app39.post("/__remote-auth/login", async (c) => {
+app45.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -13414,7 +14329,7 @@ app39.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app39.get("/__remote-auth/logout", (c) => {
+app45.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -13427,7 +14342,7 @@ app39.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app39.post("/__remote-auth/change-password", async (c) => {
+app45.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -13478,13 +14393,13 @@ app39.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app39.get("/__remote-auth/setup", (c) => {
+app45.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app39.post("/__remote-auth/set-initial-password", async (c) => {
+app45.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -13522,10 +14437,10 @@ app39.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app39.get("/api/remote-auth/status", (c) => {
+app45.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app39.post("/api/remote-auth/set-password", async (c) => {
+app45.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13556,9 +14471,9 @@ app39.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app39.route("/api/_client-error", client_error_default);
+app45.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app39.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -13591,11 +14506,12 @@ app39.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app39.route("/api/health", health_default);
-app39.route("/api/chat", chat_default);
-app39.route("/api/whatsapp", whatsapp_default);
-app39.route("/api/onboarding", onboarding_default);
-app39.route("/api/admin", admin_default);
+app45.route("/api/health", health_default);
+app45.route("/api/chat", chat_default);
+app45.route("/api/whatsapp", whatsapp_default);
+app45.route("/api/onboarding", onboarding_default);
+app45.route("/api/admin", admin_default);
+app45.route("/api/access", access_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -13607,7 +14523,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app39.get("/agent-assets/:slug/:filename", (c) => {
+app45.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -13623,8 +14539,8 @@ app39.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve20(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve20(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve22(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve22(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -13636,13 +14552,13 @@ app39.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync20(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app39.get("/generated/:filename", (c) => {
+app45.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -13653,8 +14569,8 @@ app39.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve20(account.accountDir, "generated", filename);
-  const expectedDir = resolve20(account.accountDir, "generated");
+  const filePath = resolve22(account.accountDir, "generated", filename);
+  const expectedDir = resolve22(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -13666,22 +14582,22 @@ app39.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync20(filePath);
+  const body = readFileSync21(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app39.route("/sites", sites_default);
-app39.route("/listings", listings_default);
-app39.route("/v", visitor_event_default);
-app39.route("/v", visitor_consent_default);
+app45.route("/sites", sites_default);
+app45.route("/listings", listings_default);
+app45.route("/v", visitor_event_default);
+app45.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync20(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync21(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -13697,10 +14613,10 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 })}</script>`;
 function readInstalledVersion() {
   try {
-    if (!PLATFORM_ROOT7) return "unknown";
-    const versionFile = join15(PLATFORM_ROOT7, "config", `.${BRAND.hostname}-version`);
+    if (!PLATFORM_ROOT9) return "unknown";
+    const versionFile = join15(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
     if (!existsSync24(versionFile)) return "unknown";
-    const content = readFileSync20(versionFile, "utf-8").trim();
+    const content = readFileSync21(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -13741,7 +14657,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync20(resolve20(process.cwd(), "public", file), "utf-8");
+    html = readFileSync21(resolve22(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -13761,12 +14677,12 @@ function loadBrandingCache(agentSlug) {
   try {
     const accountJsonPath = join15(configDir2, "account.json");
     if (!existsSync24(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     const accountId = account.accountId;
     if (!accountId) return null;
     const cachePath = join15(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync24(cachePath)) return null;
-    return JSON.parse(readFileSync20(cachePath, "utf-8"));
+    return JSON.parse(readFileSync21(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -13776,7 +14692,7 @@ function resolveDefaultSlug() {
     const configDir2 = join15(homedir3(), BRAND.configDir);
     const accountJsonPath = join15(configDir2, "account.json");
     if (!existsSync24(accountJsonPath)) return null;
-    const account = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+    const account = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     return account.defaultAgent || null;
   } catch {
     return null;
@@ -13812,7 +14728,7 @@ function brandedPublicHtml(agentSlug) {
 function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-app39.get("/", (c) => {
+app45.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -13820,12 +14736,12 @@ app39.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app39.get("/public", (c) => {
+app45.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app39.get("/chat", (c) => {
+app45.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -13844,12 +14760,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app39.use("/vnc-viewer.html", logViewerFetch);
-app39.use("/vnc-popout.html", logViewerFetch);
-app39.get("/vnc-popout.html", (c) => {
+app45.use("/vnc-viewer.html", logViewerFetch);
+app45.use("/vnc-popout.html", logViewerFetch);
+app45.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync20(resolve20(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync21(resolve22(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -13859,7 +14775,7 @@ app39.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app39.post("/api/vnc/client-event", async (c) => {
+app45.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13880,25 +14796,25 @@ app39.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app39.get("/g/:slug", (c) => {
+app45.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app39.get("/graph", (c) => {
+app45.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app39.get("/sessions", (c) => {
+app45.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app39.get("/data", (c) => {
+app45.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app39.get("/:slug", async (c, next) => {
+app45.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const branding = loadBrandingCache(slug);
@@ -13908,15 +14824,15 @@ app39.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app39.get("/favicon.ico", (c) => {
+  app45.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app39.use("/*", serveStatic({ root: "./public" }));
+app45.use("/*", serveStatic({ root: "./public" }));
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app39.fetch, port, hostname });
+var httpServer = serve({ fetch: app45.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -13940,6 +14856,7 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/whatsapp", file: "server/routes/whatsapp.ts", subapp: whatsapp_default },
   { prefix: "/api/onboarding", file: "server/routes/onboarding.ts", subapp: onboarding_default },
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
+  { prefix: "/api/access", file: "server/routes/access/index.ts", subapp: access_default },
   { prefix: "/api/_client-error", file: "server/routes/client-error.ts", subapp: client_error_default },
   { prefix: "/listings", file: "server/routes/listings.ts", subapp: listings_default },
   { prefix: "/v", file: "server/routes/visitor-event.ts", subapp: visitor_event_default },
@@ -13951,7 +14868,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app39.routes ?? []) {
+  for (const r of app45.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -13974,7 +14891,7 @@ try {
 (async () => {
   try {
     if (!existsSync24(USERS_FILE)) return;
-    const usersRaw = readFileSync20(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync21(USERS_FILE, "utf-8").trim();
     if (!usersRaw) return;
     const users = JSON.parse(usersRaw);
     const userId = users[0]?.userId;
@@ -14066,7 +14983,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve20(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
+  platformRoot: resolve22(process.env.MAXY_PLATFORM_ROOT ?? join15(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (process.env.WHATSAPP_PTY_BRIDGE_ENABLED === "true" && msg.text && !msg.isOwnerMirror) {