@rubytech/create-maxy-code 0.1.275 → 0.1.277

package/payload/server/server.js

@@ -11,6 +11,7 @@ import {
   Hono,
   HtmlEscapedCallbackPhase,
   INSTALL_OWNER_FILE,
+  LID_MAP_FILE,
   LOG_DIR,
   MAXY_DIR,
   PLATFORM_ROOT,
@@ -95,7 +96,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-W4EM7RK4.js";
+} from "./chunk-QHD5TKLQ.js";
 import {
   __commonJS,
   __toESM
@@ -604,46 +605,6 @@ var require_dist2 = __commonJS({
   }
 });
 
-// ../lib/require-port-env/dist/index.js
-var require_dist3 = __commonJS({
-  "../lib/require-port-env/dist/index.js"(exports) {
-    "use strict";
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.MissingPortEnvError = void 0;
-    exports.requirePortEnv = requirePortEnv3;
-    var MissingPortEnvError = class extends Error {
-      envName;
-      tag;
-      failLine;
-      constructor(envName, tag, failLine, message) {
-        super(message);
-        this.name = "MissingPortEnvError";
-        this.envName = envName;
-        this.tag = tag;
-        this.failLine = failLine;
-      }
-    };
-    exports.MissingPortEnvError = MissingPortEnvError;
-    var VALID_PORT_MIN = 1;
-    var VALID_PORT_MAX = 65535;
-    function requirePortEnv3(envName, options = {}) {
-      const tag = options.tag ?? "port-env";
-      const failLine = options.failLine ?? "missing-port-env";
-      const raw = process.env[envName];
-      if (raw === void 0 || raw === "") {
-        const msg = `[${tag}] ${failLine} reason=missing-env env=${envName}`;
-        throw new MissingPortEnvError(envName, tag, failLine, msg);
-      }
-      const parsed = Number.parseInt(raw, 10);
-      if (!Number.isInteger(parsed) || parsed < VALID_PORT_MIN || parsed > VALID_PORT_MAX || String(parsed) !== raw.trim()) {
-        const msg = `[${tag}] ${failLine} reason=invalid-port-env env=${envName} value=${JSON.stringify(raw)}`;
-        throw new MissingPortEnvError(envName, tag, failLine, msg);
-      }
-      return parsed;
-    }
-  }
-});
-
 // ../lib/graph-write/dist/audit.js
 var require_audit = __commonJS({
   "../lib/graph-write/dist/audit.js"(exports) {
@@ -725,7 +686,7 @@ var require_conversation_provenance = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.injectConversationProvenance = injectConversationProvenance;
-    var index_js_1 = require_dist4();
+    var index_js_1 = require_dist3();
     async function injectConversationProvenance(params) {
       const { session, relationships, accountId, writeLabels, conversationNodeId, logNamespace, tool } = params;
       const original = [...relationships];
@@ -775,7 +736,7 @@ var require_conversation_provenance = __commonJS({
 });
 
 // ../lib/graph-write/dist/index.js
-var require_dist4 = __commonJS({
+var require_dist3 = __commonJS({
   "../lib/graph-write/dist/index.js"(exports) {
     "use strict";
     var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -1240,7 +1201,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync22, existsSync as existsSync23, watchFile } from "fs";
+import { readFileSync as readFileSync23, existsSync as existsSync24, watchFile } from "fs";
 import { resolve as resolve26, join as join18, basename as basename6 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
@@ -1528,7 +1489,7 @@ async function ensureAuth() {
 }
 
 // server/routes/health.ts
-import { existsSync as existsSync2, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -2229,6 +2190,49 @@ async function resolveJidToE164(jid, lidMapping) {
   return null;
 }
 
+// app/lib/whatsapp/inbound/lid-map.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+function resolveViaLidMap(map, senderPhone) {
+  const key = normalizeE164(senderPhone);
+  if (!key) return null;
+  const mapped = map[key];
+  return mapped && mapped.length > 0 ? mapped : null;
+}
+function lidCaptureFor(senderJid, senderPhone) {
+  if (!isLidJid(senderJid)) return null;
+  const numericLid = jidToE164(senderJid);
+  if (!numericLid) return null;
+  const e164 = normalizeE164(senderPhone);
+  if (!e164 || e164 === numericLid) return null;
+  return { numericLid, e164 };
+}
+function readLidMap() {
+  try {
+    if (!existsSync2(LID_MAP_FILE)) return null;
+    const raw = readFileSync2(LID_MAP_FILE, "utf-8").trim();
+    if (!raw) return null;
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function recordLidMapping(numericLid, e164) {
+  try {
+    const key = normalizeE164(numericLid);
+    const val = normalizeE164(e164);
+    if (!key || !val) return;
+    const map = readLidMap() ?? {};
+    if (map[key] === val) return;
+    map[key] = val;
+    writeFileSync2(LID_MAP_FILE, JSON.stringify(map, null, 2));
+    console.error(`[lid-map] recorded lid=${key} userId-phone=present`);
+  } catch (err) {
+    console.error(`[lid-map] record-failed lid=${numericLid}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+
 // app/lib/whatsapp/inbound/extract.ts
 import {
   extractMessageContent,
@@ -2783,7 +2787,7 @@ async function ensureWhatsAppConversation(input) {
 }
 
 // ../lib/account-enumeration/src/index.ts
-import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { readdirSync, readFileSync as readFileSync3 } from "fs";
 import { resolve } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
@@ -2805,7 +2809,7 @@ function enumerateValidAccountIds(accountsDir) {
     if (!UUID_RE.test(name)) continue;
     const configPath2 = resolve(accountsDir, name, "account.json");
     try {
-      JSON.parse(readFileSync2(configPath2, "utf-8"));
+      JSON.parse(readFileSync3(configPath2, "utf-8"));
       valid.push(name);
     } catch (err) {
       const code = err.code;
@@ -3917,6 +3921,8 @@ async function handleInboundMessage(conn, msg) {
   const isGroup = isGroupJid(remoteJid);
   const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
   const senderPhone = await resolveJidToE164(senderJid, conn.lidMapping) ?? senderJid;
+  const lidCapture = lidCaptureFor(senderJid, senderPhone);
+  if (lidCapture) recordLidMapping(lidCapture.numericLid, lidCapture.e164);
   const selfPhone = conn.selfPhone ?? "";
   if (extracted.mediaType === "audio" && mediaResult?.path) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
@@ -4037,7 +4043,7 @@ async function handleInboundMessage(conn, msg) {
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
-import { mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve2 } from "path";
 var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
 var VNC_SCRIPT = resolve2(PLATFORM_ROOT2, "scripts/vnc.sh");
@@ -4095,7 +4101,7 @@ function discoverNativeDisplay() {
       const leaderPid = leaderResult.stdout?.trim();
       if (leaderPid) {
         try {
-          const environ = readFileSync3(`/proc/${leaderPid}/environ`, "utf8");
+          const environ = readFileSync4(`/proc/${leaderPid}/environ`, "utf8");
           const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
           if (match) waylandDisplay = match.split("=")[1];
         } catch {
@@ -4233,7 +4239,7 @@ function killChromium() {
 function writeChromiumWrapper() {
   mkdirSync(BIN_DIR, { recursive: true });
   const wrapperPath = resolve2(BIN_DIR, "chromium");
-  writeFileSync2(wrapperPath, `#!/bin/bash
+  writeFileSync3(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
 echo "  DISPLAY=$DISPLAY WAYLAND=$WAYLAND_DISPLAY XDG_SESSION_TYPE=$XDG_SESSION_TYPE" >> "$LOG"
@@ -4354,8 +4360,8 @@ app.get("/", async (c) => {
   const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
   let pinConfigured = false;
   try {
-    if (existsSync2(USERS_FILE)) {
-      const raw = readFileSync4(USERS_FILE, "utf-8").trim();
+    if (existsSync3(USERS_FILE)) {
+      const raw = readFileSync5(USERS_FILE, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -4674,6 +4680,7 @@ async function managerRcSpawn(opts) {
       closeAfterTurn: opts.closeAfterTurn,
       sliceToken: opts.sliceToken,
       personId: opts.personId,
+      userId: opts.userId,
       waChannel: opts.waChannel
     })
   }).catch((err) => ({ __throw: err instanceof Error ? err.message : String(err) }));
@@ -5793,13 +5800,13 @@ var chat_default = app2;
 
 // server/routes/whatsapp.ts
 import { join as join6, resolve as resolve7 } from "path";
-import { readdirSync as readdirSync3, readFileSync as readFileSync6, existsSync as existsSync4 } from "fs";
+import { readdirSync as readdirSync3, readFileSync as readFileSync7, existsSync as existsSync5 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync3 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
 import { resolve as resolve6, join as join4 } from "path";
 var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
@@ -5807,12 +5814,12 @@ function configPath(accountDir) {
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
-  if (!existsSync3(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync5(path2, "utf-8"));
+  if (!existsSync4(path2)) throw new Error(`account.json not found at ${path2}`);
+  return JSON.parse(readFileSync6(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
   const path2 = configPath(accountDir);
-  writeFileSync3(path2, JSON.stringify(config, null, 2) + "\n", "utf-8");
+  writeFileSync4(path2, JSON.stringify(config, null, 2) + "\n", "utf-8");
 }
 function reloadManagerConfig(accountDir) {
   try {
@@ -5953,7 +5960,7 @@ function setPublicAgent(accountDir, slug) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
   const agentConfigPath = join4(accountDir, "agents", trimmed, "config.json");
-  if (!existsSync3(agentConfigPath)) {
+  if (!existsSync4(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
   try {
@@ -6017,7 +6024,7 @@ function setGroupPublicAgent(accountDir, accountId, groupJid, slug) {
   if (!trimmedGroup) return { ok: false, error: "Group JID cannot be empty." };
   if (!trimmedAccount) return { ok: false, error: "Account ID cannot be empty." };
   const agentConfigPath = join4(accountDir, "agents", trimmedSlug, "config.json");
-  if (!existsSync3(agentConfigPath)) {
+  if (!existsSync4(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmedSlug}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
   try {
@@ -6703,15 +6710,15 @@ app3.post("/config", async (c) => {
       case "list-public-agents": {
         const agentsDir = resolve7(account.accountDir, "agents");
         const agents = [];
-        if (existsSync4(agentsDir)) {
+        if (existsSync5(agentsDir)) {
           try {
             const entries = readdirSync3(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
               const configPath2 = resolve7(agentsDir, entry.name, "config.json");
-              if (!existsSync4(configPath2)) continue;
+              if (!existsSync5(configPath2)) continue;
               try {
-                const config = JSON.parse(readFileSync6(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync7(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
                 console.error(`${TAG20} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -6981,11 +6988,11 @@ var whatsapp_default = app3;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync, closeSync, writeFileSync as writeFileSync5, writeSync, existsSync as existsSync6, readFileSync as readFileSync8, unlinkSync } from "fs";
+import { openSync, closeSync, writeFileSync as writeFileSync6, writeSync, existsSync as existsSync7, readFileSync as readFileSync9, unlinkSync } from "fs";
 import { createHash as createHash2, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync5, readFileSync as readFileSync7, writeFileSync as writeFileSync4, renameSync, mkdirSync as mkdirSync2, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync5, renameSync, mkdirSync as mkdirSync2, readdirSync as readdirSync4, statSync as statSync2 } from "fs";
 import { dirname, join as join7 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
@@ -6996,15 +7003,15 @@ function logLine(input, result) {
 function writeFileAtomic(filePath, contents, mode) {
   mkdirSync2(dirname(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync4(tempPath, contents, mode !== void 0 ? { mode } : void 0);
+  writeFileSync5(tempPath, contents, mode !== void 0 ? { mode } : void 0);
   renameSync(tempPath, filePath);
 }
 function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync5(input.usersFile)) {
-      const raw = readFileSync7(input.usersFile, "utf-8").trim();
+    if (existsSync6(input.usersFile)) {
+      const raw = readFileSync8(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -7029,10 +7036,10 @@ function writeAdminEntry(input) {
   }
   try {
     const accountJsonPath = join7(input.accountDir, "account.json");
-    if (!existsSync5(accountJsonPath)) {
+    if (!existsSync6(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync7(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync8(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -7056,9 +7063,9 @@ function checkAdminAuthInvariant(input) {
     usersWithoutAccount: []
   };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync5(input.usersFile)) {
+  if (existsSync6(input.usersFile)) {
     try {
-      const raw = readFileSync7(input.usersFile, "utf-8").trim();
+      const raw = readFileSync8(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -7071,7 +7078,7 @@ function checkAdminAuthInvariant(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync5(input.accountsDir)) {
+  if (existsSync6(input.accountsDir)) {
     let entries;
     try {
       entries = readdirSync4(input.accountsDir);
@@ -7090,10 +7097,10 @@ function checkAdminAuthInvariant(input) {
         continue;
       }
       const accountJsonPath = join7(accountDir, "account.json");
-      if (!existsSync5(accountJsonPath)) continue;
+      if (!existsSync6(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync7(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync8(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -7133,8 +7140,8 @@ function hashPin(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile() {
-  if (!existsSync6(USERS_FILE)) return null;
-  const raw = readFileSync8(USERS_FILE, "utf-8").trim();
+  if (!existsSync7(USERS_FILE)) return null;
+  const raw = readFileSync9(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -7199,7 +7206,7 @@ app4.post("/claude-auth", async (c) => {
     return c.json({ launched: cdpReady });
   }
   ensureLogDir();
-  writeFileSync5(logPath("claude-auth"), "");
+  writeFileSync6(logPath("claude-auth"), "");
   const claudeAuthLogFd = openSync(logPath("claude-auth"), "a");
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   if (process.platform === "darwin") {
@@ -7288,9 +7295,9 @@ app4.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync6(INSTALL_OWNER_FILE)) {
+    if (existsSync7(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync8(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync9(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -7363,7 +7370,7 @@ app4.delete("/set-pin", async (c) => {
     unlinkSync(USERS_FILE);
     console.log(`[set-pin] cleared users.json (last entry removed): userId=${matchedUser.userId.slice(0, 8)}\u2026`);
   } else {
-    writeFileSync5(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
+    writeFileSync6(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
     console.log(`[set-pin] removed entry from users.json: userId=${matchedUser.userId.slice(0, 8)}\u2026 remaining=${remaining.length}`);
   }
   return c.json({ ok: true });
@@ -7371,7 +7378,7 @@ app4.delete("/set-pin", async (c) => {
 var onboarding_default = app4;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync7, renameSync as renameSync2, statSync as statSync3 } from "fs";
+import { appendFileSync, existsSync as existsSync8, renameSync as renameSync2, statSync as statSync3 } from "fs";
 import { join as join8 } from "path";
 var CLIENT_ERRORS_LOG = join8(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -7416,7 +7423,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync7(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync8(CLIENT_ERRORS_LOG)) return;
     const stats = statSync3(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync2(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -7534,14 +7541,14 @@ import { randomUUID as randomUUID8 } from "crypto";
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
 import { join as join9 } from "path";
 function hashPin2(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile2(usersFilePath) {
-  if (!existsSync8(usersFilePath)) return null;
-  const raw = readFileSync9(usersFilePath, "utf-8").trim();
+  if (!existsSync9(usersFilePath)) return null;
+  const raw = readFileSync10(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -7560,7 +7567,7 @@ function validatePin(pin, usersFilePath) {
 function scanForOrphanedAccountAdmins(users, accountsDir) {
   const known = new Set(users.map((u) => u.userId));
   const orphans = [];
-  if (!existsSync8(accountsDir)) return orphans;
+  if (!existsSync9(accountsDir)) return orphans;
   let entries;
   try {
     entries = readdirSync5(accountsDir);
@@ -7576,9 +7583,9 @@ function scanForOrphanedAccountAdmins(users, accountsDir) {
       continue;
     }
     const accountJsonPath = join9(accountDir, "account.json");
-    if (!existsSync8(accountJsonPath)) continue;
+    if (!existsSync9(accountJsonPath)) continue;
     try {
-      const config = JSON.parse(readFileSync9(accountJsonPath, "utf-8"));
+      const config = JSON.parse(readFileSync10(accountJsonPath, "utf-8"));
       const admins = config.admins ?? [];
       for (const a of admins) {
         if (typeof a.userId === "string" && !known.has(a.userId)) orphans.push(a.userId);
@@ -7758,18 +7765,18 @@ app6.post("/", async (c) => {
 var session_default = app6;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync10, readdirSync as readdirSync6, readFileSync as readFileSync10, statSync as statSync5 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync5 } from "fs";
 import { resolve as resolve8, basename as basename2 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { join as join10 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
     const fullPath = join10(dir, filename);
-    if (existsSync9(fullPath)) {
+    if (existsSync10(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -7797,7 +7804,7 @@ app7.get("/", async (c) => {
       const filePath = resolve8(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync10(filePath);
+        const buffer = readFileSync11(filePath);
         const onDiskBytes = statSync5(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -7862,7 +7869,7 @@ app7.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename2(hit.path);
-        const buffer = readFileSync10(hit.path);
+        const buffer = readFileSync11(hit.path);
         const onDiskBytes = statSync5(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -7897,7 +7904,7 @@ app7.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync10(dir)) continue;
+    if (!existsSync11(dir)) continue;
     let files;
     try {
       files = readdirSync6(dir).filter((f) => f.endsWith(".log"));
@@ -7909,7 +7916,7 @@ app7.get("/", async (c) => {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync5(resolve8(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync10(resolve8(dir, name));
+        const content = readFileSync11(resolve8(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -7948,7 +7955,7 @@ var claude_info_default = app8;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { resolve as resolve9 } from "path";
 var app9 = new Hono();
 app9.get("/:attachmentId", requireAdminSession, async (c) => {
@@ -7962,11 +7969,11 @@ app9.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const dir = resolve9(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync11(dir)) {
+  if (!existsSync12(dir)) {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve9(dir, `${attachmentId}.meta.json`);
-  if (!existsSync11(metaPath)) {
+  if (!existsSync12(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -7994,13 +8001,13 @@ var attachment_default = app9;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve10 } from "path";
-import { readdirSync as readdirSync7, readFileSync as readFileSync11, existsSync as existsSync12, rmSync } from "fs";
+import { readdirSync as readdirSync7, readFileSync as readFileSync12, existsSync as existsSync13, rmSync } from "fs";
 var app10 = new Hono();
 app10.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve10(account.accountDir, "agents");
-  if (!existsSync12(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync13(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync7(agentsDir, { withFileTypes: true });
@@ -8008,9 +8015,9 @@ app10.get("/", (c) => {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve10(agentsDir, entry.name, "config.json");
-      if (!existsSync12(configPath2)) continue;
+      if (!existsSync13(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -8037,7 +8044,7 @@ app10.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve10(account.accountDir, "agents", slug);
-  if (!existsSync12(agentDir)) {
+  if (!existsSync13(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -8067,7 +8074,7 @@ app10.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve10(account.accountDir, "agents", slug);
-  if (!existsSync12(agentDir)) {
+  if (!existsSync13(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -8083,7 +8090,7 @@ var agents_default = app10;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync13, mkdirSync as mkdirSync3, createWriteStream } from "fs";
+import { existsSync as existsSync14, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -8243,7 +8250,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync13(a.storagePath)) reason = "missing-file";
+    else if (!existsSync14(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -8434,11 +8441,11 @@ app11.delete("/:id", requireAdminSession, async (c) => {
   const owned = await verifyConversationOwnership(sessionId, accountId);
   if (!owned) return c.json({ error: "Conversation not found" }, 404);
   const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-conversation-delete" });
-  const managerBase6 = `http://127.0.0.1:${managerPort}`;
+  const managerBase5 = `http://127.0.0.1:${managerPort}`;
   const outcome = await cascadeAdminConversationDelete({
     sessionId,
     accountId,
-    managerBase: managerBase6
+    managerBase: managerBase5
   });
   if (outcome.ok) return c.json({ ok: true, claudeSessionIds: outcome.claudeSessionIds });
   if (outcome.reason === "pty-still-alive") {
@@ -8770,7 +8777,7 @@ app11.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app11;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync14, readFileSync as readFileSync12, readdirSync as readdirSync8, statSync as statSync6 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync13, readdirSync as readdirSync8, statSync as statSync6 } from "fs";
 import { dirname as dirname2, resolve as resolve11, join as join11 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -8805,9 +8812,9 @@ function extractPluginToolDescriptions(pluginDir) {
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync14(path2)) continue;
+    if (!existsSync15(path2)) continue;
     try {
-      raw = readFileSync12(path2, "utf-8");
+      raw = readFileSync13(path2, "utf-8");
       break;
     } catch {
     }
@@ -8857,7 +8864,7 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve11(PLATFORM_ROOT, "plugins");
-  if (existsSync14(platformPlugins)) {
+  if (existsSync15(platformPlugins)) {
     for (const name of readdirSync8(platformPlugins)) {
       const dir = join11(platformPlugins, name);
       try {
@@ -8867,10 +8874,10 @@ function listPluginDirs() {
     }
   }
   const premiumRoot = resolve11(dirname2(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync14(premiumRoot)) {
+  if (existsSync15(premiumRoot)) {
     for (const bundle of readdirSync8(premiumRoot)) {
       const bundlePlugins = join11(premiumRoot, bundle, "plugins");
-      if (!existsSync14(bundlePlugins)) continue;
+      if (!existsSync15(bundlePlugins)) continue;
       try {
         for (const name of readdirSync8(bundlePlugins)) {
           const dir = join11(bundlePlugins, name);
@@ -8887,9 +8894,9 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync14(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync15(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync12(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync13(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -8898,10 +8905,10 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync14(path2)) return null;
+  if (!existsSync15(path2)) return null;
   let raw;
   try {
-    raw = readFileSync12(path2, "utf-8");
+    raw = readFileSync13(path2, "utf-8");
   } catch {
     return null;
   }
@@ -8933,7 +8940,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync14(join11(dir, "mcp/dist/index.js")) || existsSync14(join11(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync15(join11(dir, "mcp/dist/index.js")) || existsSync15(join11(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -8960,7 +8967,7 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync14(specialistsDir)) return [];
+  if (!existsSync15(specialistsDir)) return [];
   let entries;
   try {
     entries = readdirSync8(specialistsDir);
@@ -9006,10 +9013,10 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync14(accountFile)) return [];
+  if (!existsSync15(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync12(accountFile, "utf-8");
+    const raw = readFileSync13(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -9021,7 +9028,7 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve11(PLATFORM_ROOT, "plugins");
-  if (!existsSync14(pluginsDir)) return [];
+  if (!existsSync15(pluginsDir)) return [];
   let entries;
   try {
     entries = readdirSync8(pluginsDir);
@@ -9032,10 +9039,10 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve11(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync14(manifestPath)) continue;
+    if (!existsSync15(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync12(manifestPath, "utf-8");
+      manifest = readFileSync13(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -9049,13 +9056,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync14 } from "fs";
 import { resolve as resolve12 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync15(statePath)) return null;
+  if (!existsSync16(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync13(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync14(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -9069,7 +9076,7 @@ function resolveTunnelUrl() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync13(resolve12(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync14(resolve12(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -9282,18 +9289,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app14 = new Hono();
 app14.post("/", async (c) => {
-  const TAG31 = "[admin:events]";
+  const TAG30 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG31} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG30} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG31} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG30} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -12106,7 +12113,7 @@ app18.post("/", requireAdminSession, async (c) => {
         return c.json({ error: "AdminConversation node is missing sessionId" }, 500);
       }
       const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "graph-page-cascade" });
-      const managerBase6 = `http://127.0.0.1:${managerPort}`;
+      const managerBase5 = `http://127.0.0.1:${managerPort}`;
       try {
         await session.close();
       } catch {
@@ -12114,7 +12121,7 @@ app18.post("/", requireAdminSession, async (c) => {
       const outcome = await cascadeAdminConversationDelete({
         sessionId,
         accountId,
-        managerBase: managerBase6
+        managerBase: managerBase5
       });
       const elapsed2 = Date.now() - started;
       const labelSummary2 = preflightLabels.join(",");
@@ -12494,7 +12501,7 @@ var graph_default_view_default = app21;
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
 import { resolve as resolve16, relative as relative3, isAbsolute, sep as sep5, basename as basename5 } from "path";
-import { existsSync as existsSync16 } from "fs";
+import { existsSync as existsSync17 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -12509,27 +12516,27 @@ app22.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Account not found for session" }, 401);
   }
   const start = Date.now();
-  const outputs = await fetchOutputArtefacts(accountId);
-  if (outputs === null) {
+  const accountFiles = await fetchAccountFileArtefacts(accountId);
+  if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
   const accountDir = resolve16(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
-  const artefacts = [...outputs, ...agents].sort(
+  const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
   ).slice(0, LIMIT);
   const ms = Date.now() - start;
   console.log(
-    `[admin/sidebar-artefacts] account=${accountId} count=${artefacts.length} outputs=${outputs.length} agents=${agents.length} ms=${ms}`
+    `[admin/sidebar-artefacts] account=${accountId} count=${artefacts.length} accountFiles=${accountFiles.length} agents=${agents.length} ms=${ms}`
   );
   return c.json({ artefacts });
 });
-async function fetchOutputArtefacts(accountId) {
+async function fetchAccountFileArtefacts(accountId) {
   const session = getSession();
   try {
     const result = await session.run(
       `MATCH (f:FileArtifact { accountId: $accountId })
-       WHERE f.relativePath CONTAINS '/output/'
+       WHERE f.relativePath STARTS WITH 'accounts/'
        RETURN f.relativePath AS relativePath,
               f.displayName  AS displayName,
               f.mimeType     AS mimeType,
@@ -12544,9 +12551,9 @@ async function fetchOutputArtefacts(accountId) {
       const mimeType = r.get("mimeType") ?? "";
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
-        id: `output-file:${relativePath}`,
+        id: `account-file:${relativePath}`,
         name: displayName ?? basename5(relativePath),
-        kind: "output-file",
+        kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
         downloadPath: relativePath,
@@ -12600,7 +12607,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync16(dir)) continue;
+    if (!existsSync17(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -12615,7 +12622,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync16(inp.overridePath)) {
+  if (existsSync17(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -12626,7 +12633,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync16(inp.bundledPath)) {
+  } else if (existsSync17(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -12668,7 +12675,7 @@ function isWithin(target, root) {
 var sidebar_artefacts_default = app22;
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync9, readFileSync as readFileSync14, statSync as statSync7 } from "fs";
+import { readdirSync as readdirSync9, readFileSync as readFileSync15, statSync as statSync7 } from "fs";
 import { join as join14, resolve as resolve17 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 var PID_FILE_RE = /^([0-9]+)\.json$/;
@@ -12738,7 +12745,7 @@ function sessionIdToPidMap(configDir2) {
     if (!Number.isFinite(pid) || pid <= 0) continue;
     let body;
     try {
-      body = readFileSync14(join14(sessionsDir, entry.name), "utf8");
+      body = readFileSync15(join14(sessionsDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -12760,7 +12767,7 @@ function loadUserTitles(accountDir) {
   const path2 = join14(accountDir, "session-titles.json");
   let raw;
   try {
-    raw = readFileSync14(path2, "utf8");
+    raw = readFileSync15(path2, "utf8");
   } catch {
     return out;
   }
@@ -12785,7 +12792,7 @@ function loadUserTitles(accountDir) {
 function readSidecarMeta(metaPath) {
   let raw;
   try {
-    raw = readFileSync14(metaPath, "utf8");
+    raw = readFileSync15(metaPath, "utf8");
   } catch {
     return { bridgeIds: [], role: null, channel: null };
   }
@@ -12875,7 +12882,7 @@ app23.get("/", requireAdminSession, async (c) => {
     let body;
     let mtimeMs;
     try {
-      body = readFileSync14(path2, "utf8");
+      body = readFileSync15(path2, "utf8");
       mtimeMs = statSync7(path2).mtimeMs;
     } catch {
       continue;
@@ -12912,7 +12919,7 @@ app23.get("/", requireAdminSession, async (c) => {
 var sidebar_sessions_default = app23;
 
 // server/routes/admin/session-delete.ts
-import { existsSync as existsSync17, readdirSync as readdirSync10, readFileSync as readFileSync15, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync18, readdirSync as readdirSync10, readFileSync as readFileSync16, unlinkSync as unlinkSync2 } from "fs";
 import { join as join15, resolve as resolve18 } from "path";
 var app24 = new Hono();
 var SESSION_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -12936,7 +12943,7 @@ function findPidForSession(configDir2, sessionId) {
     if (!Number.isFinite(pid) || pid <= 0) continue;
     let body;
     try {
-      body = readFileSync15(join15(sessionsDir, entry.name), "utf8");
+      body = readFileSync16(join15(sessionsDir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -13059,7 +13066,7 @@ app24.post("/", requireAdminSession, async (c) => {
   }
   let deleted = false;
   try {
-    if (existsSync17(jsonlPath)) {
+    if (existsSync18(jsonlPath)) {
       unlinkSync2(jsonlPath);
       deleted = true;
     }
@@ -13072,17 +13079,17 @@ app24.post("/", requireAdminSession, async (c) => {
     return c.json({ error: `unlink failed: ${msg}` }, 500);
   }
   try {
-    if (existsSync17(sidecarPath)) unlinkSync2(sidecarPath);
+    if (existsSync18(sidecarPath)) unlinkSync2(sidecarPath);
   } catch {
   }
   if (pid !== null) {
     try {
       const pidFile = join15(configDir2, "sessions", `${pid}.json`);
-      if (existsSync17(pidFile)) unlinkSync2(pidFile);
+      if (existsSync18(pidFile)) unlinkSync2(pidFile);
     } catch {
     }
   }
-  if (existsSync17(jsonlPath)) {
+  if (existsSync18(jsonlPath)) {
     console.error(`[sessions-delete] resurrection jsonlPath=${jsonlPath} sessionId=${sessionId}`);
     return c.json(
       { error: "jsonl-resurrected", jsonlPath, pidKilled, waitForExitMs, escalatedToSIGKILL },
@@ -13261,14 +13268,14 @@ app26.get("/", async (c) => {
 var system_stats_default = app26;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync17 } from "fs";
 import { resolve as resolve19, join as join16 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join16(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync18(brandJsonPath)) {
+if (existsSync19(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync16(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync17(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -13277,8 +13284,8 @@ var VERSION_FILE = resolve19(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync18(VERSION_FILE)) return "unknown";
-  return readFileSync16(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync19(VERSION_FILE)) return "unknown";
+  return readFileSync17(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -13752,61 +13759,9 @@ app32.post("/", async (c) => {
 });
 var access_session_evict_default = app32;
 
-// server/routes/admin/identity.ts
-var import_dist4 = __toESM(require_dist3(), 1);
-var app33 = new Hono();
-var TAG28 = "[admin-identity]";
-function managerBase5() {
-  const port2 = (0, import_dist4.requirePortEnv)("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-identity" });
-  return `http://127.0.0.1:${port2}`;
-}
-app33.post("/validate", async (c) => {
-  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  const isLoopback = remoteAddr === "127.0.0.1" || remoteAddr === "::1" || remoteAddr === "::ffff:127.0.0.1";
-  if (!isLoopback || c.req.header("x-forwarded-for")) {
-    return c.json({ error: "forbidden" }, 403);
-  }
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "bad-request" }, 400);
-  }
-  const pin = typeof body.pin === "string" ? body.pin : "";
-  const sessionId = typeof body.sessionId === "string" ? body.sessionId : void 0;
-  if (!pin) return c.json({ error: "bad-request" }, 400);
-  const fireStop = () => {
-    if (sessionId) {
-      void fetch(`${managerBase5()}/${encodeURIComponent(sessionId)}/stop`, { method: "POST" }).catch(
-        () => {
-        }
-      );
-    }
-  };
-  const verdict = validatePin(pin, USERS_FILE);
-  if (verdict.kind !== "match") {
-    if (verdict.kind === "miss") fireStop();
-    console.log(`${TAG28} op=endpoint-validate result=${verdict.kind}${sessionId ? ` sessionId=${sessionId.slice(0, 8)}` : ""}`);
-    return c.json({ kind: verdict.kind });
-  }
-  const { userId } = verdict;
-  const accounts = resolveUserAccounts(userId);
-  if (accounts.length === 0) {
-    fireStop();
-    console.log(`${TAG28} op=endpoint-validate result=no-account userId=${userId.slice(0, 8)}`);
-    return c.json({ kind: "miss" });
-  }
-  const accountId = accounts[0].accountId;
-  const { userName } = await resolveUserIdentity(accountId, userId);
-  const aboutOwner = await resolveOwnerProfileBlock(accountId, userId);
-  console.log(`${TAG28} op=endpoint-validate result=match userId=${userId.slice(0, 8)} aboutOwner=${aboutOwner.ok ? "ok" : `unresolved:${aboutOwner.reason}`}`);
-  return c.json({ kind: "match", userId, userName, aboutOwner });
-});
-var identity_default = app33;
-
 // server/routes/admin/browser.ts
-var app34 = new Hono();
-app34.post("/launch", requireAdminSession, async (c) => {
+var app33 = new Hono();
+app33.post("/launch", requireAdminSession, async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     console.error(`[admin/browser/launch] op=request transport=${transport}`);
@@ -13834,44 +13789,43 @@ app34.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app34;
+var browser_default = app33;
 
 // server/routes/admin/index.ts
-var app35 = new Hono();
-app35.route("/session", session_default);
-app35.route("/identity", identity_default);
-app35.route("/logs", logs_default);
-app35.route("/claude-info", claude_info_default);
-app35.route("/attachment", attachment_default);
-app35.route("/agents", agents_default);
-app35.route("/sessions", sessions_default);
-app35.route("/claude-sessions", claude_sessions_default);
-app35.route("/log-ingest", log_ingest_default);
-app35.route("/events", events_default);
-app35.route("/files", files_default);
-app35.route("/graph-search", graph_search_default);
-app35.route("/graph-subgraph", graph_subgraph_default);
-app35.route("/graph-delete", graph_delete_default);
-app35.route("/graph-restore", graph_restore_default);
-app35.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app35.route("/graph-default-view", graph_default_view_default);
-app35.route("/sidebar-artefacts", sidebar_artefacts_default);
-app35.route("/sidebar-sessions", sidebar_sessions_default);
-app35.route("/session-delete", session_delete_default);
-app35.route("/browser", browser_default);
-app35.route("/session-rc-spawn", session_rc_spawn_default);
-app35.route("/system-stats", system_stats_default);
-app35.route("/health-brand", health_default2);
-app35.route("/linkedin-ingest", linkedin_ingest_default);
-app35.route("/post-turn-context", post_turn_context_default);
-app35.route("/public-session-context", public_session_context_default);
-app35.route("/public-session-exit", public_session_exit_default);
-app35.route("/access-session-evict", access_session_evict_default);
-var admin_default = app35;
+var app34 = new Hono();
+app34.route("/session", session_default);
+app34.route("/logs", logs_default);
+app34.route("/claude-info", claude_info_default);
+app34.route("/attachment", attachment_default);
+app34.route("/agents", agents_default);
+app34.route("/sessions", sessions_default);
+app34.route("/claude-sessions", claude_sessions_default);
+app34.route("/log-ingest", log_ingest_default);
+app34.route("/events", events_default);
+app34.route("/files", files_default);
+app34.route("/graph-search", graph_search_default);
+app34.route("/graph-subgraph", graph_subgraph_default);
+app34.route("/graph-delete", graph_delete_default);
+app34.route("/graph-restore", graph_restore_default);
+app34.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app34.route("/graph-default-view", graph_default_view_default);
+app34.route("/sidebar-artefacts", sidebar_artefacts_default);
+app34.route("/sidebar-sessions", sidebar_sessions_default);
+app34.route("/session-delete", session_delete_default);
+app34.route("/browser", browser_default);
+app34.route("/session-rc-spawn", session_rc_spawn_default);
+app34.route("/system-stats", system_stats_default);
+app34.route("/health-brand", health_default2);
+app34.route("/linkedin-ingest", linkedin_ingest_default);
+app34.route("/post-turn-context", post_turn_context_default);
+app34.route("/public-session-context", public_session_context_default);
+app34.route("/public-session-exit", public_session_exit_default);
+app34.route("/access-session-evict", access_session_evict_default);
+var admin_default = app34;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 import { resolve as resolve20 } from "path";
 import { randomUUID as randomUUID10 } from "crypto";
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
@@ -13880,7 +13834,7 @@ function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
   const passwordFile = resolve20(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
-    return readFileSync17(passwordFile, "utf-8").trim();
+    return readFileSync18(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -14078,11 +14032,11 @@ async function generateNewMagicToken(grantId) {
 }
 
 // server/routes/access/verify-token.ts
-var TAG29 = "[access-verify]";
+var TAG28 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app36 = new Hono();
-app36.post("/", async (c) => {
+var app35 = new Hono();
+app35.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -14097,39 +14051,39 @@ app36.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -14145,12 +14099,12 @@ app36.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -14164,7 +14118,7 @@ app36.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app36;
+var verify_token_default = app35;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -14226,10 +14180,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG30 = "[access-request-link]";
-var app37 = new Hono();
+var TAG29 = "[access-request-link]";
+var app36 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app37.post("/", async (c) => {
+app36.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14243,18 +14197,18 @@ app37.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG30} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG29} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -14262,7 +14216,7 @@ app37.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG30} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG29} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -14294,25 +14248,25 @@ app37.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG30} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG29} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG30} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG29} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app37;
+var request_magic_link_default = app36;
 
 // server/routes/access/index.ts
-var app38 = new Hono();
-app38.route("/verify-token", verify_token_default);
-app38.route("/request-magic-link", request_magic_link_default);
-var access_default = app38;
+var app37 = new Hono();
+app37.route("/verify-token", verify_token_default);
+app37.route("/request-magic-link", request_magic_link_default);
+var access_default = app37;
 
 // server/routes/sites.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync19, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
 import { resolve as resolve22 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -14344,8 +14298,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app39 = new Hono();
-app39.get("/:rel{.*}", (c) => {
+var app38 = new Hono();
+app38.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -14378,7 +14332,7 @@ app39.get("/:rel{.*}", (c) => {
   }
   let stat7;
   try {
-    stat7 = existsSync19(filePath) ? statSync8(filePath) : null;
+    stat7 = existsSync20(filePath) ? statSync8(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -14397,7 +14351,7 @@ app39.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync19(filePath)) {
+  if (!existsSync20(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -14416,7 +14370,7 @@ app39.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync18(realPath);
+    body = readFileSync19(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -14448,11 +14402,11 @@ app39.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app39;
+var sites_default = app38;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync19, writeFileSync as writeFileSync6 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync20, writeFileSync as writeFileSync7 } from "fs";
 import { dirname as dirname4 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -14461,7 +14415,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync19(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync20(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -14471,11 +14425,11 @@ function getSecret() {
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
     mkdirSync4(dirname4(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync6(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    writeFileSync7(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync19(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync20(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -14528,7 +14482,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
 import { join as join17 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
@@ -14538,9 +14492,9 @@ function readBrandConfig() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
   const brandPath = join17(platformRoot2, "config", "brand.json");
-  if (!existsSync20(brandPath)) return null;
+  if (!existsSync21(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync20(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync21(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -14548,7 +14502,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app40 = new Hono();
+var app39 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -14593,17 +14547,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app40.options("/consent", (c) => {
+app39.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app40.options("/brand-config", (c) => {
+app39.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app40.post("/consent", async (c) => {
+app39.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -14643,7 +14597,7 @@ app40.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app40.get("/brand-config", (c) => {
+app39.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -14653,7 +14607,7 @@ app40.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app40;
+var visitor_consent_default = app39;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -14680,8 +14634,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app41 = new Hono();
-app41.get("/:slug/click", async (c) => {
+var app40 = new Hono();
+app40.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -14745,10 +14699,10 @@ app41.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app41;
+var listings_default = app40;
 
 // server/routes/visitor-event.ts
-var app42 = new Hono();
+var app41 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -14815,12 +14769,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app42.options("/event", (c) => {
+app41.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app42.post("/event", async (c) => {
+app41.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -15025,17 +14979,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app42;
+var visitor_event_default = app41;
 
 // server/routes/session.ts
 import { resolve as resolve23 } from "path";
-import { existsSync as existsSync21, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "fs";
+import { existsSync as existsSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync5 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve23(MAXY_DIR, "branding-cache", accountId);
     mkdirSync5(cacheDir, { recursive: true });
-    writeFileSync7(resolve23(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync8(resolve23(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -15071,8 +15025,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app43 = new Hono();
-app43.post("/", async (c) => {
+var app42 = new Hono();
+app42.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15124,7 +15078,7 @@ app43.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve23(account.accountDir, "agents", agentSlug);
-    if (!existsSync21(agentDir) || !existsSync21(resolve23(agentDir, "config.json"))) {
+    if (!existsSync22(agentDir) || !existsSync22(resolve23(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -15283,10 +15237,10 @@ app43.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app43;
+var session_default2 = app42;
 
 // app/lib/graph-health.ts
-var import_dist5 = __toESM(require_dist4(), 1);
+var import_dist4 = __toESM(require_dist3(), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 function renderLabelTop(rows) {
   return rows.map((b) => {
@@ -15331,7 +15285,7 @@ async function runGraphHealthTick() {
     console.error(
       `[graph-health] userprofile-multi accounts=${upAccounts} top=${upTop.length > 0 ? upTop.join(",") : "none"}`
     );
-    const indexed = [...import_dist5.VECTOR_INDEXED_LABELS];
+    const indexed = [...import_dist4.VECTOR_INDEXED_LABELS];
     const embCount = await session.run(
       `MATCH (n) WHERE n.embedding IS NULL AND any(l IN labels(n) WHERE l IN $indexed)
        RETURN count(n) AS total`,
@@ -15516,44 +15470,115 @@ var InboundHub = class {
   state(senderId) {
     let s = this.senders.get(senderId);
     if (!s) {
-      s = { subscriber: null, queue: [] };
+      s = { subscriber: null, ready: false, inFlight: [] };
       this.senders.set(senderId, s);
     }
     return s;
   }
-  /** Route an inbound message to its sender. Delivers immediately if that
-   *  sender's channel server is attached; otherwise queues it (cold start). */
-  deliver(payload) {
+  /** Route an inbound message. Delivers immediately only if the sender's channel
+   *  server is attached AND has signalled readiness; otherwise queues it (cold
+   *  start, or the attach->ready window) so it is never written before the
+   *  channel server can consume it. Every accepted message is tracked in-flight
+   *  until it reaches a terminal state. */
+  deliver(payload, now) {
     const s = this.state(payload.senderId);
-    if (s.subscriber) {
+    if (s.subscriber && s.ready) {
       s.subscriber(payload);
+      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now });
     } else {
-      s.queue.push(payload);
+      s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null });
     }
   }
-  /** A sender's channel server connected. Drain any queued messages to it in
-   *  arrival order, then route live. Replaces any prior subscriber. */
+  /** A sender's channel server connected. Register the subscriber but do NOT
+   *  drain yet — the drain waits for markReady so nothing is written before the
+   *  channel server is consuming. Replaces any prior subscriber. */
   attach(senderId, subscriber) {
     const s = this.state(senderId);
     s.subscriber = subscriber;
-    if (s.queue.length > 0) {
-      const pending = s.queue;
-      s.queue = [];
-      for (const payload of pending) subscriber(payload);
+    s.ready = false;
+  }
+  /** The sender's channel server reported it is connected and consuming. Drain
+   *  every queued message to it in arrival order, marking each drained-awaiting-
+   *  ack, then route live. Returns the number drained. */
+  markReady(senderId, now) {
+    const s = this.state(senderId);
+    s.ready = true;
+    if (!s.subscriber) return 0;
+    let count = 0;
+    for (const e of s.inFlight) {
+      if (e.state === "queued") {
+        s.subscriber(e.payload);
+        e.state = "drained";
+        e.drainedAt = now;
+        count++;
+      }
     }
+    return count;
+  }
+  /** The channel server confirmed it received (emitted) a drained message. The
+   *  message has reached the agent; drop it from in-flight. Returns whether a
+   *  matching in-flight message was found. */
+  ack(senderId, waMessageId) {
+    const s = this.senders.get(senderId);
+    if (!s) return false;
+    const i = s.inFlight.findIndex((e) => e.payload.waMessageId === waMessageId);
+    if (i < 0) return false;
+    s.inFlight.splice(i, 1);
+    return true;
   }
   /** A sender's channel server disconnected (session ended/restarting).
-   *  Subsequent messages queue again until re-attach, so nothing is lost
-   *  across a restart. */
+   *  Subsequent messages queue again until re-attach + ready, so nothing is lost
+   *  across a restart. In-flight drained messages stay tracked for ack/sweep. */
   detach(senderId) {
     const s = this.senders.get(senderId);
-    if (s) s.subscriber = null;
+    if (s) {
+      s.subscriber = null;
+      s.ready = false;
+    }
+  }
+  /** Reconciliation from queue state alone — does not wait for a future inbound
+   *  to expose a loss. Returns (and removes) a terminal event for every message
+   *  that never reached the agent:
+   *   - a still-queued message older than queuedThresholdMs WHILE a subscriber
+   *     is attached -> inbound-undelivered (the readiness handoff broke);
+   *   - a still-queued message older than queuedThresholdMs with NO subscriber
+   *     attached -> spawn-undelivered (the channel server never attached: spawn
+   *     failed, or the session ended and never resumed);
+   *   - a drained message unacked past ackThresholdMs -> drain-undelivered (the
+   *     channel server never confirmed receipt — the silent cold-start drop).
+   *  Each message is emitted at most once (removed when emitted). */
+  sweep(now, t) {
+    const events = [];
+    for (const [senderId, s] of this.senders) {
+      s.inFlight = s.inFlight.filter((e) => {
+        if (e.state === "queued" && s.subscriber && now - e.enqueuedAt > t.queuedThresholdMs) {
+          events.push({ kind: "inbound-undelivered", senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.enqueuedAt });
+          return false;
+        }
+        if (e.state === "queued" && !s.subscriber && now - e.enqueuedAt > t.queuedThresholdMs) {
+          events.push({ kind: "spawn-undelivered", senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.enqueuedAt });
+          return false;
+        }
+        if (e.state === "drained" && e.drainedAt != null && now - e.drainedAt > t.ackThresholdMs) {
+          events.push({ kind: "drain-undelivered", senderId, waMessageId: e.payload.waMessageId, ageMs: now - e.drainedAt });
+          return false;
+        }
+        return true;
+      });
+    }
+    return events;
   }
-  /** Whether a sender currently has a live channel server. The gateway uses
-   *  this to decide whether an inbound needs a cold-start spawn/resume. */
+  /** Whether a sender currently has a live channel server attached. The gateway
+   *  uses this to decide whether an inbound needs a cold-start spawn/resume. */
   hasSubscriber(senderId) {
     return this.senders.get(senderId)?.subscriber != null;
   }
+  /** Whether a sender's channel server is attached AND has signalled readiness.
+   *  Used only to log delivery=immediate vs queued accurately. */
+  isReady(senderId) {
+    const s = this.senders.get(senderId);
+    return s?.subscriber != null && s.ready;
+  }
 };
 
 // node_modules/hono/dist/utils/stream.js
@@ -15707,8 +15732,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app45 = new Hono();
-  app45.get("/wa-channel/inbound", (c) => {
+  const app44 = new Hono();
+  app44.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -15726,7 +15751,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app45.post("/wa-channel/reply", async (c) => {
+  app44.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -15745,7 +15770,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app45.post("/wa-channel/ready", async (c) => {
+  app44.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -15754,10 +15779,23 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  return app45;
+  app44.post("/wa-channel/received", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    const senderId = body?.senderId;
+    const waMessageId = body?.waMessageId;
+    if (typeof senderId !== "string" || typeof waMessageId !== "string") {
+      return c.json({ error: "senderId and waMessageId required" }, 400);
+    }
+    deps.onReceived?.(senderId, waMessageId);
+    return c.json({ ok: true });
+  });
+  return app44;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
+var QUEUED_THRESHOLD_MS = 3e4;
+var ACK_THRESHOLD_MS = 3e4;
+var SWEEP_INTERVAL_MS = 15e3;
 var WaGateway = class {
   constructor(deps) {
     this.deps = deps;
@@ -15770,17 +15808,55 @@ var WaGateway = class {
   routes() {
     return createWaChannelRoutes({
       hub: this.hub,
-      sendOutbound: (senderId, text) => this.sendOutbound(senderId, text)
+      sendOutbound: (senderId, text) => this.sendOutbound(senderId, text),
+      onReady: (senderId) => {
+        const count = this.hub.markReady(senderId, Date.now());
+        if (count > 0) console.error(`[whatsapp-native] op=drained senderId=${senderId} count=${count}`);
+      },
+      onReceived: (senderId, waMessageId) => {
+        const found = this.hub.ack(senderId, waMessageId);
+        console.error(
+          `[whatsapp-native] op=channel-received senderId=${senderId} waMessageId=${waMessageId}${found ? "" : " note=unknown"}`
+        );
+      }
     });
   }
+  /** Run one reconciliation pass: log every terminal delivery event the sweep
+   *  surfaces — a queued message that never drained while a subscriber was
+   *  attached (inbound-undelivered), a queued message whose channel server never
+   *  attached (spawn-undelivered), or a drained message the channel server never
+   *  confirmed (drain-undelivered). Returns the events (for tests). Driven by
+   *  startSweeper() in production; called directly with an injected clock in
+   *  tests. */
+  reconcile(now) {
+    const events = this.hub.sweep(now, {
+      queuedThresholdMs: QUEUED_THRESHOLD_MS,
+      ackThresholdMs: ACK_THRESHOLD_MS
+    });
+    for (const e of events) {
+      console.error(
+        `[whatsapp-native] op=${e.kind} senderId=${e.senderId} waMessageId=${e.waMessageId} ageMs=${e.ageMs}`
+      );
+    }
+    return events;
+  }
+  /** Start the periodic reconciliation sweep in the long-lived UI process.
+   *  Returns the interval handle. */
+  startSweeper(intervalMs = SWEEP_INTERVAL_MS) {
+    return setInterval(() => this.reconcile(Date.now()), intervalMs);
+  }
   /** Handle one inbound admin WhatsApp message. */
   async handleInbound(input) {
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.senderId);
+    const willDeliverNow = this.hub.isReady(input.senderId);
     this.replies.set(input.senderId, input.reply);
-    this.hub.deliver({ senderId: input.senderId, text: input.text, waMessageId: `wa-${++this.seq}` });
+    this.hub.deliver(
+      { senderId: input.senderId, text: input.text, waMessageId: `wa-${++this.seq}` },
+      Date.now()
+    );
     console.error(
-      `[whatsapp-native] op=inbound senderId=${input.senderId} accountId=${input.accountId} bytes=${bytes} delivery=${hadSubscriber ? "immediate" : "queued"}`
+      `[whatsapp-native] op=inbound senderId=${input.senderId} accountId=${input.accountId} bytes=${bytes} delivery=${willDeliverNow ? "immediate" : "queued"}`
     );
     if (!hadSubscriber && !this.spawning.has(input.senderId)) {
       this.spawning.add(input.senderId);
@@ -15804,6 +15880,71 @@ var WaGateway = class {
   }
 };
 
+// app/lib/whatsapp/inbound/resolve-admin-userid.ts
+function classifyAdminUserId(users, admins, senderPhone) {
+  const matched = users.find((u) => typeof u.phone === "string" && phonesMatch(u.phone, senderPhone));
+  if (!matched) return { kind: "no-users-binding" };
+  return admins.some((a) => a.userId === matched.userId) ? { kind: "resolved", userId: matched.userId } : { kind: "userid-not-admin", userId: matched.userId };
+}
+function pickAdminUserId(users, admins, senderPhone) {
+  const r = classifyAdminUserId(users, admins, senderPhone);
+  return r.kind === "resolved" ? r.userId : null;
+}
+function resolveAdminUserId(params) {
+  try {
+    const users = readUsersFile2(USERS_FILE);
+    if (!users) return null;
+    const account = listValidAccounts().find((a) => a.accountId === params.accountId);
+    const admins = account?.config.admins ?? [];
+    const direct = pickAdminUserId(users, admins, params.senderPhone);
+    if (direct) return direct;
+    const mapped = resolveViaLidMap(readLidMap() ?? {}, params.senderPhone);
+    if (!mapped) return null;
+    const viaLid = pickAdminUserId(users, admins, mapped);
+    if (viaLid) {
+      console.error(`[lid-map] resolved-via-cache lid=${params.senderPhone} userId=${viaLid.slice(0, 8)}`);
+    }
+    return viaLid;
+  } catch {
+    return null;
+  }
+}
+
+// app/lib/whatsapp/inbound/channel-admin-binding-drift.ts
+function findChannelAdminBindingDrift(adminPhones, admins, users) {
+  const drift = [];
+  for (const phone of adminPhones) {
+    const r = classifyAdminUserId(users, admins, phone);
+    if (r.kind === "no-users-binding") drift.push({ phone, reason: "no-users-binding" });
+    else if (r.kind === "userid-not-admin") drift.push({ phone, reason: "userid-not-admin", userId: r.userId });
+  }
+  return drift;
+}
+function warnOnChannelAdminBindingDrift() {
+  let users;
+  try {
+    users = readUsersFile2(USERS_FILE) ?? [];
+  } catch {
+    return;
+  }
+  let accounts;
+  try {
+    accounts = listValidAccounts();
+  } catch {
+    return;
+  }
+  for (const acct of accounts) {
+    const adminPhones = readAdminPhones(acct.accountDir);
+    const drift = findChannelAdminBindingDrift(adminPhones, acct.config.admins ?? [], users);
+    for (const d of drift) {
+      const tail = d.reason === "userid-not-admin" ? ` userId=${d.userId}` : "";
+      console.error(
+        `[admin-identity] binding-drift accountId=${acct.accountId} phone=${d.phone} reason=${d.reason}${tail}`
+      );
+    }
+  }
+}
+
 // app/lib/admin-sse-registry.ts
 var activeAdminSSEControllers = /* @__PURE__ */ new Set();
 function broadcastAdminShutdown(reason) {
@@ -15834,7 +15975,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync21, statSync as statSync9 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync22, statSync as statSync9 } from "fs";
 import { resolve as resolve25 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -15883,7 +16024,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve25(brand.configDir, "entitlement.json");
-  if (!existsSync22(entitlementPath)) {
+  if (!existsSync23(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync9(entitlementPath);
@@ -15898,7 +16039,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync21(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync22(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -15912,7 +16053,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync21(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync22(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -16075,12 +16216,12 @@ function clientFrom(c) {
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join18(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync22(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync23(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -16102,8 +16243,8 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join18(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync22(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync24(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync23(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -16127,13 +16268,16 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app44 = new Hono();
+var app43 = new Hono();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
   serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve26(process.env.MAXY_PLATFORM_ROOT ?? join18(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   ensureChannelSession: async ({ accountId, senderId, gatewayUrl, serverPath }) => {
+    const userId = resolveAdminUserId({ accountId, senderPhone: senderId }) ?? void 0;
+    console.error(`[whatsapp-native] op=admin-identity senderId=${senderId} userId=${userId ?? "owner-fallback"}`);
     const result = await managerRcSpawn({
       sessionId: adminSessionIdFor(accountId, senderId),
+      userId,
       waChannel: { senderId, gatewayUrl, serverPath },
       logContext: `channel=whatsapp-native senderId=${senderId}`
     });
@@ -16142,9 +16286,10 @@ var waGateway = new WaGateway({
     }
   }
 });
-app44.route("/", waGateway.routes());
-app44.use("*", clientIpMiddleware);
-app44.use("*", async (c, next) => {
+app43.route("/", waGateway.routes());
+waGateway.startSweeper();
+app43.use("*", clientIpMiddleware);
+app43.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -16154,7 +16299,7 @@ app44.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app44.use("*", async (c, next) => {
+app43.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -16172,7 +16317,7 @@ app44.use("*", async (c, next) => {
     });
   }
 });
-app44.use("*", async (c, next) => {
+app43.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -16203,7 +16348,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app44.post("/__remote-auth/login", async (c) => {
+app43.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -16248,7 +16393,7 @@ app44.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app44.get("/__remote-auth/logout", (c) => {
+app43.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -16261,7 +16406,7 @@ app44.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app44.post("/__remote-auth/change-password", async (c) => {
+app43.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -16312,13 +16457,13 @@ app44.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app44.get("/__remote-auth/setup", (c) => {
+app43.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app44.post("/__remote-auth/set-initial-password", async (c) => {
+app43.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -16356,10 +16501,10 @@ app44.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app44.get("/api/remote-auth/status", (c) => {
+app43.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app44.post("/api/remote-auth/set-password", async (c) => {
+app43.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -16390,9 +16535,9 @@ app44.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app44.route("/api/_client-error", client_error_default);
+app43.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app44.use("*", async (c, next) => {
+app43.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -16425,13 +16570,13 @@ app44.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app44.route("/api/health", health_default);
-app44.route("/api/chat", chat_default);
-app44.route("/api/whatsapp", whatsapp_default);
-app44.route("/api/onboarding", onboarding_default);
-app44.route("/api/admin", admin_default);
-app44.route("/api/access", access_default);
-app44.route("/api/session", session_default2);
+app43.route("/api/health", health_default);
+app43.route("/api/chat", chat_default);
+app43.route("/api/whatsapp", whatsapp_default);
+app43.route("/api/onboarding", onboarding_default);
+app43.route("/api/admin", admin_default);
+app43.route("/api/access", access_default);
+app43.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -16443,7 +16588,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app44.get("/agent-assets/:slug/:filename", (c) => {
+app43.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -16465,20 +16610,20 @@ app44.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync22(filePath);
+  const body = readFileSync23(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app44.get("/generated/:filename", (c) => {
+app43.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -16495,29 +16640,29 @@ app44.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync22(filePath);
+  const body = readFileSync23(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app44.route("/sites", sites_default);
-app44.route("/listings", listings_default);
-app44.route("/v", visitor_event_default);
-app44.route("/v", visitor_consent_default);
+app43.route("/sites", sites_default);
+app43.route("/listings", listings_default);
+app43.route("/v", visitor_event_default);
+app43.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync22(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync23(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -16535,8 +16680,8 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
     const versionFile = join18(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync23(versionFile)) return "unknown";
-    const content = readFileSync22(versionFile, "utf-8").trim();
+    if (!existsSync24(versionFile)) return "unknown";
+    const content = readFileSync23(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -16577,7 +16722,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync22(resolve26(process.cwd(), "public", file), "utf-8");
+    html = readFileSync23(resolve26(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -16598,8 +16743,8 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join18(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync23(cachePath)) return null;
-    return JSON.parse(readFileSync22(cachePath, "utf-8"));
+    if (!existsSync24(cachePath)) return null;
+    return JSON.parse(readFileSync23(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -16642,7 +16787,7 @@ function escapeHtml(s) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app44.get("/", (c) => {
+app43.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -16658,12 +16803,12 @@ app44.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app44.get("/public", (c) => {
+app43.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app44.get("/chat", (c) => {
+app43.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -16682,12 +16827,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app44.use("/vnc-viewer.html", logViewerFetch);
-app44.use("/vnc-popout.html", logViewerFetch);
-app44.get("/vnc-popout.html", (c) => {
+app43.use("/vnc-viewer.html", logViewerFetch);
+app43.use("/vnc-popout.html", logViewerFetch);
+app43.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync22(resolve26(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync23(resolve26(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -16697,7 +16842,7 @@ app44.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app44.post("/api/vnc/client-event", async (c) => {
+app43.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -16718,30 +16863,30 @@ app44.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app44.get("/g/:slug", (c) => {
+app43.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app44.get("/graph", (c) => {
+app43.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app44.get("/sessions", (c) => {
+app43.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app44.get("/data", (c) => {
+app43.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app44.get("/browser", (c) => {
+app43.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app44.get("/:slug", async (c, next) => {
+app43.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -16756,13 +16901,13 @@ app44.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app44.get("/favicon.ico", (c) => {
+  app43.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app44.use("/*", serveStatic({ root: "./public" }));
-app44.all("*", (c) => {
+app43.use("/*", serveStatic({ root: "./public" }));
+app43.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -16776,7 +16921,7 @@ app44.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app44.fetch, port, hostname });
+var httpServer = serve({ fetch: app43.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startAuthHealthHeartbeat();
 {
@@ -16813,7 +16958,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app44.routes ?? []) {
+  for (const r of app43.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -16841,11 +16986,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync23(USERS_FILE)) {
+    if (!existsSync24(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync22(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync23(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -16910,6 +17055,7 @@ reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config, bootAccoun
 for (const acct of listValidAccounts()) {
   cleanupLeakedPremiumSubs(acct.accountDir, acct.config, acct.accountId);
 }
+warnOnChannelAdminBindingDrift();
 var bootEnabled = Array.isArray(bootAccountConfig?.enabledPlugins) ? bootAccountConfig.enabledPlugins : [];
 var bootDelivered = [];
 var bootDistMissing = [];