@rubytech/create-maxy-code 0.1.279 → 0.1.280

package/payload/server/server.js

@@ -1201,8 +1201,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync24, existsSync as existsSync24, watchFile } from "fs";
-import { resolve as resolve27, join as join19, basename as basename7 } from "path";
+import { readFileSync as readFileSync23, existsSync as existsSync23, watchFile } from "fs";
+import { resolve as resolve26, join as join18, basename as basename7 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1763,7 +1763,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve28) => setTimeout(() => resolve28("timeout"), timeoutMs)
+    (resolve27) => setTimeout(() => resolve27("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1891,11 +1891,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve28, reject) => {
+  return new Promise((resolve27, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve28();
+        resolve27();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2009,14 +2009,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve28, reject) => {
+  return new Promise((resolve27, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve28(value);
+        resolve27(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2601,8 +2601,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve28) => {
-    release = resolve28;
+  const mine = new Promise((resolve27) => {
+    release = resolve27;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3069,6 +3069,14 @@ function createInboundDebouncer(opts) {
   return { enqueue, flush, destroy, registerPending };
 }
 
+// app/lib/whatsapp/inbound/combine-batch.ts
+function combineInboundBatch(entries) {
+  const last = entries[entries.length - 1];
+  const combinedText = entries.map((e) => e.text).filter(Boolean).join("\n");
+  const media = entries.flatMap((e) => e.media);
+  return { ...last, text: combinedText, media };
+}
+
 // app/lib/whatsapp/opening-hours.ts
 var TAG10 = "[whatsapp:hours]";
 async function isBusinessOpen(accountId) {
@@ -3638,11 +3646,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve28) => {
-        const timer2 = setTimeout(resolve28, delay);
+      await new Promise((resolve27) => {
+        const timer2 = setTimeout(resolve27, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve28();
+          resolve27();
         }, { once: true });
       });
     }
@@ -3650,16 +3658,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve28) => {
+  return new Promise((resolve27) => {
     if (!conn.sock) {
-      resolve28();
+      resolve27();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve28();
+        resolve27();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3723,21 +3731,10 @@ function monitorInbound(conn) {
     },
     onFlush: (entries) => {
       if (!onInboundMessage) return;
-      if (entries.length === 1) {
-        onInboundMessage(entries[0]);
-        return;
+      if (entries.length > 1) {
+        console.error(`${TAG12} debounce: combining ${entries.length} messages account=${conn.accountId} from=${entries[0].senderPhone}`);
       }
-      console.error(`${TAG12} debounce: combining ${entries.length} messages account=${conn.accountId} from=${entries[0].senderPhone}`);
-      const last = entries[entries.length - 1];
-      const mediaEntry = entries.find((e) => e.mediaPath);
-      const combinedText = entries.map((e) => e.text).filter(Boolean).join("\n");
-      onInboundMessage({
-        ...last,
-        text: combinedText,
-        mediaPath: mediaEntry?.mediaPath ?? last.mediaPath,
-        mediaMimetype: mediaEntry?.mediaMimetype ?? last.mediaMimetype,
-        mediaType: mediaEntry?.mediaType ?? last.mediaType
-      });
+      onInboundMessage(combineInboundBatch(entries));
     },
     onError: (err) => {
       console.error(`${TAG12} debounce flush error account=${conn.accountId}: ${String(err)}`);
@@ -3899,6 +3896,7 @@ async function handleInboundMessage(conn, msg) {
         groupJid: isGroup2 ? remoteJid : void 0,
         isOwnerMirror: true
       }),
+      media: [],
       isOwnerMirror: true
     });
     return;
@@ -3928,8 +3926,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve28) => {
-      resolvePending = resolve28;
+    const sttPending = new Promise((resolve27) => {
+      resolvePending = resolve27;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -4010,9 +4008,7 @@ async function handleInboundMessage(conn, msg) {
     reply,
     composing,
     cacheKey,
-    mediaPath: mediaResult?.path,
-    mediaMimetype: mediaResult?.mimetype,
-    mediaType: extracted.mediaType,
+    media: mediaResult?.path ? [{ path: mediaResult.path, type: extracted.mediaType, mimetype: mediaResult.mimetype }] : [],
     replyContext: extracted.quotedMessage
   };
   if (accessResult.agentType === "public") {
@@ -4338,20 +4334,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve28) => {
+  return new Promise((resolve27) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve28(true);
+      resolve27(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve28(false);
+      resolve27(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve28(false);
+      resolve27(false);
     });
   });
 }
@@ -5426,12 +5422,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve28;
+  let resolve27;
   const turnPromise = new Promise((r) => {
-    resolve28 = r;
+    resolve27 = r;
   });
   const listener = (text) => {
-    resolve28(text);
+    resolve27(text);
   };
   entry.subscribers.add(listener);
   const writeAtMs = Date.now();
@@ -6269,8 +6265,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve28, reject) => {
-    resolveCode = resolve28;
+  const codePromise = new Promise((resolve27, reject) => {
+    resolveCode = resolve27;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -6994,7 +6990,6 @@ import { basename as basename2, dirname, join as join8, resolve as resolve9, sep
 import { readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
 import { join as join7, resolve as resolve8 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
-var PID_FILE_RE = /^([0-9]+)\.json$/;
 var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
 var PUBLIC_ROLE = "public";
 var WEBCHAT_CHANNEL = "webchat";
@@ -7044,36 +7039,25 @@ function enumerateJsonls(projectsRoot) {
   }
   return out;
 }
-function sessionIdToPidMap(configDir2) {
+async function fetchLiveSessions() {
   const out = /* @__PURE__ */ new Map();
-  const sessionsDir = join7(configDir2, "sessions");
-  let entries;
+  let port2;
   try {
-    entries = readdirSync4(sessionsDir, { withFileTypes: true });
+    port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "sidebar-sessions:live" });
   } catch {
+    console.error("[admin-sessions-list] CLAUDE_SESSION_MANAGER_PORT unset; liveness unknown");
     return out;
   }
-  for (const entry of entries) {
-    if (!entry.isFile()) continue;
-    const m = entry.name.match(PID_FILE_RE);
-    if (!m) continue;
-    const pid = Number(m[1]);
-    if (!Number.isFinite(pid) || pid <= 0) continue;
-    let body;
-    try {
-      body = readFileSync8(join7(sessionsDir, entry.name), "utf8");
-    } catch {
-      continue;
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(body);
-    } catch {
-      continue;
+  try {
+    const res = await fetch(`http://127.0.0.1:${port2}/live-sessions`);
+    if (!res.ok) {
+      console.error(`[admin-sessions-list] live-sessions status=${res.status}; liveness unknown`);
+      return out;
     }
-    if (!parsed || typeof parsed !== "object") continue;
-    const sid = parsed.sessionId;
-    if (typeof sid === "string" && sid.length > 0) out.set(sid, pid);
+    const body = await res.json();
+    for (const s of body.sessions) out.set(s.sessionId, s.pid);
+  } catch (err) {
+    console.error(`[admin-sessions-list] live-sessions fetch failed: ${err instanceof Error ? err.message : String(err)}; liveness unknown`);
   }
   return out;
 }
@@ -7179,7 +7163,7 @@ app4.get("/", requireAdminSession, async (c) => {
   }
   const projectsRoot = join7(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
-  const pidsBySession = sessionIdToPidMap(configDir2);
+  const liveSessions = await fetchLiveSessions();
   const accountDir = accountId ? resolve8(ACCOUNTS_DIR, accountId) : null;
   const userTitles = loadUserTitles(accountDir);
   const rows = [];
@@ -7206,8 +7190,8 @@ app4.get("/", requireAdminSession, async (c) => {
     } catch {
       continue;
     }
-    const pid = pidsBySession.get(sessionId) ?? null;
-    const live = pid !== null;
+    const live = liveSessions.has(sessionId);
+    const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
     const metaPath = join7(projectDir, `${sessionId}.meta.json`);
@@ -8892,11 +8876,11 @@ app13.delete("/:id", requireAdminSession, async (c) => {
   const owned = await verifyConversationOwnership(sessionId, accountId);
   if (!owned) return c.json({ error: "Conversation not found" }, 404);
   const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-conversation-delete" });
-  const managerBase5 = `http://127.0.0.1:${managerPort}`;
+  const managerBase7 = `http://127.0.0.1:${managerPort}`;
   const outcome = await cascadeAdminConversationDelete({
     sessionId,
     accountId,
-    managerBase: managerBase5
+    managerBase: managerBase7
   });
   if (outcome.ok) return c.json({ ok: true, claudeSessionIds: outcome.claudeSessionIds });
   if (outcome.reason === "pty-still-alive") {
@@ -12564,7 +12548,7 @@ app20.post("/", requireAdminSession, async (c) => {
         return c.json({ error: "AdminConversation node is missing sessionId" }, 500);
       }
       const managerPort = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "graph-page-cascade" });
-      const managerBase5 = `http://127.0.0.1:${managerPort}`;
+      const managerBase7 = `http://127.0.0.1:${managerPort}`;
       try {
         await session.close();
       } catch {
@@ -12572,7 +12556,7 @@ app20.post("/", requireAdminSession, async (c) => {
       const outcome = await cascadeAdminConversationDelete({
         sessionId,
         accountId,
-        managerBase: managerBase5
+        managerBase: managerBase7
       });
       const elapsed2 = Date.now() - started;
       const labelSummary2 = preflightLabels.join(",");
@@ -13126,106 +13110,60 @@ function isWithin(target, root) {
 var sidebar_artefacts_default = app24;
 
 // server/routes/admin/session-delete.ts
-import { existsSync as existsSync18, readdirSync as readdirSync10, readFileSync as readFileSync17, unlinkSync as unlinkSync2 } from "fs";
-import { join as join16, resolve as resolve19 } from "path";
 var app25 = new Hono();
 var SESSION_ID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var PID_FILE_RE2 = /^([0-9]+)\.json$/;
-var SIGTERM_WAIT_MS = 2e3;
-var SIGKILL_WAIT_MS = 1e3;
-var POLL_INTERVAL_MS = 50;
-function findPidForSession(configDir2, sessionId) {
-  const sessionsDir = join16(configDir2, "sessions");
-  let entries;
+function managerBase4() {
+  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "session-delete:wrapper" });
+  return `http://127.0.0.1:${port2}`;
+}
+app25.post("/", requireAdminSession, async (c) => {
+  let body;
   try {
-    entries = readdirSync10(sessionsDir, { withFileTypes: true });
+    body = await c.req.json();
   } catch {
-    return null;
+    return c.json({ error: "invalid JSON body" }, 400);
   }
-  for (const entry of entries) {
-    if (!entry.isFile()) continue;
-    const m = entry.name.match(PID_FILE_RE2);
-    if (!m) continue;
-    const pid = Number(m[1]);
-    if (!Number.isFinite(pid) || pid <= 0) continue;
-    let body;
-    try {
-      body = readFileSync17(join16(sessionsDir, entry.name), "utf8");
-    } catch {
-      continue;
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(body);
-    } catch {
-      continue;
-    }
-    if (!parsed || typeof parsed !== "object") continue;
-    if (parsed.sessionId === sessionId) return pid;
+  const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+  if (!SESSION_ID_RE3.test(sessionId)) {
+    return c.json({ error: "sessionId must be a v4 UUID" }, 400);
   }
-  return null;
-}
-function isPidAlive(pid) {
+  const base = managerBase4();
   try {
-    process.kill(pid, 0);
-    return true;
+    const stop = await fetch(`${base}/${sessionId}/stop`, { method: "POST" });
+    if (stop.status !== 204 && stop.status !== 200 && stop.status !== 404) {
+      console.error(`[session-delete] sessionId=${sessionId} stop-status=${stop.status}`);
+      return c.json({ error: `stop-failed-${stop.status}` }, 502);
+    }
   } catch (err) {
-    const code = err.code;
-    if (code === "ESRCH") return false;
-    return true;
+    console.error(`[session-delete] sessionId=${sessionId} stop-unreachable err=${err instanceof Error ? err.message : String(err)}`);
+    return c.json({ error: "manager-unreachable" }, 502);
   }
-}
-function sleep2(ms) {
-  return new Promise((resolve28) => setTimeout(resolve28, ms));
-}
-function sendSignal(pid, signal) {
+  let del;
   try {
-    process.kill(pid, signal);
-    return true;
+    del = await fetch(`${base}/${sessionId}`, { method: "DELETE" });
   } catch (err) {
-    const code = err.code;
-    if (code === "ESRCH") return true;
-    return false;
+    console.error(`[session-delete] sessionId=${sessionId} delete-unreachable err=${err instanceof Error ? err.message : String(err)}`);
+    return c.json({ error: "manager-unreachable" }, 502);
   }
-}
-async function killAndWait(pid) {
-  const startedAt = Date.now();
-  let escalated = false;
-  const termSent = sendSignal(pid, "SIGTERM");
-  const termDeadline = Date.now() + SIGTERM_WAIT_MS;
-  while (Date.now() < termDeadline) {
-    if (!isPidAlive(pid)) {
-      return {
-        pidKilled: termSent ? "true" : "false",
-        waitForExitMs: Date.now() - startedAt,
-        escalatedToSIGKILL: false,
-        exited: true
-      };
-    }
-    await sleep2(POLL_INTERVAL_MS);
-  }
-  escalated = true;
-  sendSignal(pid, "SIGKILL");
-  const killDeadline = Date.now() + SIGKILL_WAIT_MS;
-  while (Date.now() < killDeadline) {
-    if (!isPidAlive(pid)) {
-      return {
-        pidKilled: "true",
-        waitForExitMs: Date.now() - startedAt,
-        escalatedToSIGKILL: true,
-        exited: true
-      };
-    }
-    await sleep2(POLL_INTERVAL_MS);
+  if (del.status === 204) {
+    console.log(`[session-delete] sessionId=${sessionId} deleted`);
+    return c.json({ deleted: true });
   }
-  return {
-    pidKilled: "false",
-    waitForExitMs: Date.now() - startedAt,
-    escalatedToSIGKILL: escalated,
-    exited: false
-  };
+  if (del.status === 404) return c.json({ deleted: false, error: "no-transcript" }, 404);
+  if (del.status === 409) return c.json({ deleted: false, error: "pty-still-alive" }, 409);
+  console.error(`[session-delete] sessionId=${sessionId} delete-status=${del.status}`);
+  return c.json({ error: `manager-status-${del.status}` }, 502);
+});
+var session_delete_default = app25;
+
+// server/routes/admin/session-stop.ts
+var app26 = new Hono();
+var SESSION_ID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function managerBase5() {
+  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "session-stop:wrapper" });
+  return `http://127.0.0.1:${port2}`;
 }
-app25.post("/", requireAdminSession, async (c) => {
+app26.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13233,91 +13171,33 @@ app25.post("/", requireAdminSession, async (c) => {
     return c.json({ error: "invalid JSON body" }, 400);
   }
   const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
-  const projectDir = typeof body.projectDir === "string" ? body.projectDir : "";
-  if (!SESSION_ID_RE3.test(sessionId)) {
+  if (!SESSION_ID_RE4.test(sessionId)) {
     return c.json({ error: "sessionId must be a v4 UUID" }, 400);
   }
-  if (!projectDir) {
-    return c.json({ error: "projectDir is required" }, 400);
-  }
-  const configDir2 = process.env.CLAUDE_CONFIG_DIR;
-  if (!configDir2) {
-    return c.json({ error: "CLAUDE_CONFIG_DIR not set" }, 500);
-  }
-  const projectsRoot = resolve19(join16(configDir2, "projects")) + "/";
-  const resolvedProject = resolve19(projectDir) + "/";
-  if (!resolvedProject.startsWith(projectsRoot)) {
-    console.error(`[sessions-delete] reject reason=projectDir-outside-tree projectDir=${projectDir}`);
-    return c.json({ error: "projectDir is not under CLAUDE_CONFIG_DIR/projects/" }, 400);
-  }
-  const jsonlPath = join16(projectDir, `${sessionId}.jsonl`);
-  const sidecarPath = join16(projectDir, `${sessionId}.meta.json`);
-  const pid = findPidForSession(configDir2, sessionId);
-  let pidKilled = "absent";
-  let waitForExitMs = 0;
-  let escalatedToSIGKILL = false;
-  if (pid !== null) {
-    const r = await killAndWait(pid);
-    pidKilled = r.pidKilled;
-    waitForExitMs = r.waitForExitMs;
-    escalatedToSIGKILL = r.escalatedToSIGKILL;
-    if (!r.exited) {
-      console.error(
-        `[sessions-delete] kill-failed sessionId=${sessionId} pid=${pid} waitForExit=${waitForExitMs} escalatedToSIGKILL=${escalatedToSIGKILL}`
-      );
-      return c.json(
-        { error: "kill-failed", pid, waitForExitMs, escalatedToSIGKILL },
-        500
-      );
-    }
-  }
-  let deleted = false;
+  let res;
   try {
-    if (existsSync18(jsonlPath)) {
-      unlinkSync2(jsonlPath);
-      deleted = true;
-    }
+    res = await fetch(`${managerBase5()}/${sessionId}/stop`, { method: "POST" });
   } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`[sessions-delete] unlink-failed path=${jsonlPath} err=${msg}`);
-    console.log(
-      `[sessions-delete] sessionId=${sessionId} pidKilled=${pidKilled} jsonlPath=${jsonlPath} deleted=false waitForExit=${waitForExitMs} escalatedToSIGKILL=${escalatedToSIGKILL}`
-    );
-    return c.json({ error: `unlink failed: ${msg}` }, 500);
-  }
-  try {
-    if (existsSync18(sidecarPath)) unlinkSync2(sidecarPath);
-  } catch {
-  }
-  if (pid !== null) {
-    try {
-      const pidFile = join16(configDir2, "sessions", `${pid}.json`);
-      if (existsSync18(pidFile)) unlinkSync2(pidFile);
-    } catch {
-    }
+    console.error(`[session-stop] sessionId=${sessionId} manager-unreachable err=${err instanceof Error ? err.message : String(err)}`);
+    return c.json({ error: "manager-unreachable" }, 502);
   }
-  if (existsSync18(jsonlPath)) {
-    console.error(`[sessions-delete] resurrection jsonlPath=${jsonlPath} sessionId=${sessionId}`);
-    return c.json(
-      { error: "jsonl-resurrected", jsonlPath, pidKilled, waitForExitMs, escalatedToSIGKILL },
-      500
-    );
+  if (res.status === 204 || res.status === 200 || res.status === 404) {
+    console.log(`[session-stop] sessionId=${sessionId} stopped manager-status=${res.status}`);
+    return c.json({ stopped: true });
   }
-  console.log(
-    `[sessions-delete] sessionId=${sessionId} pidKilled=${pidKilled} jsonlPath=${jsonlPath} deleted=${deleted} waitForExit=${waitForExitMs} escalatedToSIGKILL=${escalatedToSIGKILL}`
-  );
-  return c.json({ deleted, pidKilled, jsonlPath, waitForExitMs, escalatedToSIGKILL });
+  console.error(`[session-stop] sessionId=${sessionId} manager-status=${res.status}`);
+  return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_delete_default = app25;
+var session_stop_default = app26;
 
 // server/routes/admin/session-rc-spawn.ts
-var app26 = new Hono();
-function managerBase4() {
+var app27 = new Hono();
+function managerBase6() {
   const port2 = process.env.CLAUDE_SESSION_MANAGER_PORT;
   if (!port2) throw new Error("CLAUDE_SESSION_MANAGER_PORT is not set");
   return `http://127.0.0.1:${port2}`;
 }
-app26.post("/", requireAdminSession, async (c) => {
+app27.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13329,7 +13209,7 @@ app26.post("/", requireAdminSession, async (c) => {
   if (typeof body.name === "string" && body.name.length > 0) payload.name = body.name;
   let res;
   try {
-    res = await fetch(`${managerBase4()}/rc-spawn`, {
+    res = await fetch(`${managerBase6()}/rc-spawn`, {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify(payload)
@@ -13351,7 +13231,7 @@ app26.post("/", requireAdminSession, async (c) => {
   }
   return c.json(parsed ?? {});
 });
-var session_rc_spawn_default = app26;
+var session_rc_spawn_default = app27;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile5 } from "fs/promises";
@@ -13448,8 +13328,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app27 = new Hono();
-app27.get("/", async (c) => {
+var app28 = new Hono();
+app28.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -13472,27 +13352,27 @@ app27.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app27;
+var system_stats_default = app28;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
-import { resolve as resolve20, join as join17 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
+import { existsSync as existsSync18, readFileSync as readFileSync17 } from "fs";
+import { resolve as resolve19, join as join16 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join17(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync19(brandJsonPath)) {
+var brandJsonPath = join16(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync18(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync18(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync17(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve20(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve19(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync19(VERSION_FILE)) return "unknown";
-  return readFileSync18(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync18(VERSION_FILE)) return "unknown";
+  return readFileSync17(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -13517,8 +13397,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app28 = new Hono();
-app28.get("/", async (c) => {
+var app29 = new Hono();
+app29.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -13540,7 +13420,7 @@ app28.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app28;
+var health_default2 = app29;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID9 } from "crypto";
@@ -13642,8 +13522,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app29 = new Hono();
-app29.post("/", requireAdminSession, async (c) => {
+var app30 = new Hono();
+app30.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13688,7 +13568,7 @@ app29.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
-var linkedin_ingest_default = app29;
+var linkedin_ingest_default = app30;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j2 from "neo4j-driver";
@@ -13730,8 +13610,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app30 = new Hono();
-app30.get("/", async (c) => {
+var app31 = new Hono();
+app31.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
     console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -13791,7 +13671,7 @@ app30.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app30;
+var post_turn_context_default = app31;
 
 // server/routes/admin/public-session-context.ts
 import neo4j3 from "neo4j-driver";
@@ -13833,8 +13713,8 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app31 = new Hono();
-app31.get("/", async (c) => {
+var app32 = new Hono();
+app32.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -13893,15 +13773,15 @@ app31.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app31;
+var public_session_context_default = app32;
 
 // server/routes/admin/public-session-exit.ts
 var TAG26 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app32 = new Hono();
-app32.post("/", async (c) => {
+var app33 = new Hono();
+app33.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -13928,15 +13808,15 @@ app32.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app32;
+var public_session_exit_default = app33;
 
 // server/routes/admin/access-session-evict.ts
 var TAG27 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app33 = new Hono();
-app33.post("/", async (c) => {
+var app34 = new Hono();
+app34.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -13964,11 +13844,11 @@ app33.post("/", async (c) => {
   console.log(`${TAG27} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app33;
+var access_session_evict_default = app34;
 
 // server/routes/admin/browser.ts
-var app34 = new Hono();
-app34.post("/launch", requireAdminSession, async (c) => {
+var app35 = new Hono();
+app35.post("/launch", requireAdminSession, async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     console.error(`[admin/browser/launch] op=request transport=${transport}`);
@@ -13996,52 +13876,53 @@ app34.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app34;
+var browser_default = app35;
 
 // server/routes/admin/index.ts
-var app35 = new Hono();
-app35.route("/session", session_default);
-app35.route("/logs", logs_default);
-app35.route("/claude-info", claude_info_default);
-app35.route("/attachment", attachment_default);
-app35.route("/agents", agents_default);
-app35.route("/sessions", sessions_default);
-app35.route("/claude-sessions", claude_sessions_default);
-app35.route("/log-ingest", log_ingest_default);
-app35.route("/events", events_default);
-app35.route("/files", files_default);
-app35.route("/graph-search", graph_search_default);
-app35.route("/graph-subgraph", graph_subgraph_default);
-app35.route("/graph-delete", graph_delete_default);
-app35.route("/graph-restore", graph_restore_default);
-app35.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app35.route("/graph-default-view", graph_default_view_default);
-app35.route("/sidebar-artefacts", sidebar_artefacts_default);
-app35.route("/sidebar-sessions", sidebar_sessions_default);
-app35.route("/session-delete", session_delete_default);
-app35.route("/browser", browser_default);
-app35.route("/session-rc-spawn", session_rc_spawn_default);
-app35.route("/system-stats", system_stats_default);
-app35.route("/health-brand", health_default2);
-app35.route("/linkedin-ingest", linkedin_ingest_default);
-app35.route("/post-turn-context", post_turn_context_default);
-app35.route("/public-session-context", public_session_context_default);
-app35.route("/public-session-exit", public_session_exit_default);
-app35.route("/access-session-evict", access_session_evict_default);
-var admin_default = app35;
+var app36 = new Hono();
+app36.route("/session", session_default);
+app36.route("/logs", logs_default);
+app36.route("/claude-info", claude_info_default);
+app36.route("/attachment", attachment_default);
+app36.route("/agents", agents_default);
+app36.route("/sessions", sessions_default);
+app36.route("/claude-sessions", claude_sessions_default);
+app36.route("/log-ingest", log_ingest_default);
+app36.route("/events", events_default);
+app36.route("/files", files_default);
+app36.route("/graph-search", graph_search_default);
+app36.route("/graph-subgraph", graph_subgraph_default);
+app36.route("/graph-delete", graph_delete_default);
+app36.route("/graph-restore", graph_restore_default);
+app36.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app36.route("/graph-default-view", graph_default_view_default);
+app36.route("/sidebar-artefacts", sidebar_artefacts_default);
+app36.route("/sidebar-sessions", sidebar_sessions_default);
+app36.route("/session-delete", session_delete_default);
+app36.route("/session-stop", session_stop_default);
+app36.route("/browser", browser_default);
+app36.route("/session-rc-spawn", session_rc_spawn_default);
+app36.route("/system-stats", system_stats_default);
+app36.route("/health-brand", health_default2);
+app36.route("/linkedin-ingest", linkedin_ingest_default);
+app36.route("/post-turn-context", post_turn_context_default);
+app36.route("/public-session-context", public_session_context_default);
+app36.route("/public-session-exit", public_session_exit_default);
+app36.route("/access-session-evict", access_session_evict_default);
+var admin_default = app36;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
-import { readFileSync as readFileSync19 } from "fs";
-import { resolve as resolve21 } from "path";
+import { readFileSync as readFileSync18 } from "fs";
+import { resolve as resolve20 } from "path";
 import { randomUUID as randomUUID10 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve21(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve20(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
-    return readFileSync19(passwordFile, "utf-8").trim();
+    return readFileSync18(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -14242,8 +14123,8 @@ async function generateNewMagicToken(grantId) {
 var TAG28 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app36 = new Hono();
-app36.post("/", async (c) => {
+var app37 = new Hono();
+app37.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -14325,13 +14206,13 @@ app36.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app36;
+var verify_token_default = app37;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve22 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
-var SEND_SCRIPT = resolve22(
+import { resolve as resolve21 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
+var SEND_SCRIPT = resolve21(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -14388,9 +14269,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG29 = "[access-request-link]";
-var app37 = new Hono();
+var app38 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app37.post("/", async (c) => {
+app38.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14464,17 +14345,17 @@ app37.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app37;
+var request_magic_link_default = app38;
 
 // server/routes/access/index.ts
-var app38 = new Hono();
-app38.route("/verify-token", verify_token_default);
-app38.route("/request-magic-link", request_magic_link_default);
-var access_default = app38;
+var app39 = new Hono();
+app39.route("/verify-token", verify_token_default);
+app39.route("/request-magic-link", request_magic_link_default);
+var access_default = app39;
 
 // server/routes/sites.ts
-import { existsSync as existsSync20, readFileSync as readFileSync20, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
-import { resolve as resolve23 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync19, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
+import { resolve as resolve22 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -14505,8 +14386,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app39 = new Hono();
-app39.get("/:rel{.*}", (c) => {
+var app40 = new Hono();
+app40.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -14531,15 +14412,15 @@ app39.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve23(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve23(rootDir, ...segments);
+  const rootDir = resolve22(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve22(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat7;
   try {
-    stat7 = existsSync20(filePath) ? statSync9(filePath) : null;
+    stat7 = existsSync19(filePath) ? statSync9(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -14552,13 +14433,13 @@ app39.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve23(filePath, "index.html");
+    filePath = resolve22(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync20(filePath)) {
+  if (!existsSync19(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -14577,7 +14458,7 @@ app39.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync20(realPath);
+    body = readFileSync19(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -14609,11 +14490,11 @@ app39.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app39;
+var sites_default = app40;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync21, writeFileSync as writeFileSync7 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync20, writeFileSync as writeFileSync7 } from "fs";
 import { dirname as dirname5 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -14622,7 +14503,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync21(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync20(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -14636,7 +14517,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync21(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync20(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -14689,8 +14570,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync21 } from "fs";
+import { join as join17 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -14698,10 +14579,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
-  const brandPath = join18(platformRoot2, "config", "brand.json");
-  if (!existsSync21(brandPath)) return null;
+  const brandPath = join17(platformRoot2, "config", "brand.json");
+  if (!existsSync20(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync22(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync21(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -14709,7 +14590,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app40 = new Hono();
+var app41 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -14754,17 +14635,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app40.options("/consent", (c) => {
+app41.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app40.options("/brand-config", (c) => {
+app41.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app40.post("/consent", async (c) => {
+app41.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -14804,7 +14685,7 @@ app40.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app40.get("/brand-config", (c) => {
+app41.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -14814,7 +14695,7 @@ app40.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app40;
+var visitor_consent_default = app41;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -14841,8 +14722,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app41 = new Hono();
-app41.get("/:slug/click", async (c) => {
+var app42 = new Hono();
+app42.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -14906,10 +14787,10 @@ app41.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app41;
+var listings_default = app42;
 
 // server/routes/visitor-event.ts
-var app42 = new Hono();
+var app43 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -14976,12 +14857,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app42.options("/event", (c) => {
+app43.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app42.post("/event", async (c) => {
+app43.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -15186,17 +15067,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app42;
+var visitor_event_default = app43;
 
 // server/routes/session.ts
-import { resolve as resolve24 } from "path";
-import { existsSync as existsSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync5 } from "fs";
+import { resolve as resolve23 } from "path";
+import { existsSync as existsSync21, writeFileSync as writeFileSync8, mkdirSync as mkdirSync5 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve24(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve23(MAXY_DIR, "branding-cache", accountId);
     mkdirSync5(cacheDir, { recursive: true });
-    writeFileSync8(resolve24(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync8(resolve23(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -15232,8 +15113,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app43 = new Hono();
-app43.post("/", async (c) => {
+var app44 = new Hono();
+app44.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15284,8 +15165,8 @@ app43.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve24(account.accountDir, "agents", agentSlug);
-    if (!existsSync22(agentDir) || !existsSync22(resolve24(agentDir, "config.json"))) {
+    const agentDir = resolve23(account.accountDir, "agents", agentSlug);
+    if (!existsSync21(agentDir) || !existsSync21(resolve23(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -15444,7 +15325,7 @@ app43.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app43;
+var session_default2 = app44;
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist3(), 1);
@@ -15565,7 +15446,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve25, sep as sep7 } from "path";
+import { resolve as resolve24, sep as sep7 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["uploads", "accounts"];
@@ -15584,7 +15465,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve25(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve24(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -15605,7 +15486,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve25(dataRoot, relativePath);
+    const absolute = resolve24(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -15629,7 +15510,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve25(dataRoot, rootName);
+    const absRoot = resolve24(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -15939,8 +15820,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app45 = new Hono();
-  app45.get("/wa-channel/inbound", (c) => {
+  const app46 = new Hono();
+  app46.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -15958,7 +15839,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app45.post("/wa-channel/reply", async (c) => {
+  app46.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -15977,7 +15858,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app45.post("/wa-channel/ready", async (c) => {
+  app46.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -15986,7 +15867,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app45.post("/wa-channel/received", async (c) => {
+  app46.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -15996,7 +15877,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  return app45;
+  return app46;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -16057,17 +15938,15 @@ var WaGateway = class {
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.senderId);
     const willDeliverNow = this.hub.isReady(input.senderId);
-    const hasFileMedia = !!input.mediaPath && input.mediaType !== "audio";
-    const mediaField = hasFileMedia ? `media=${input.mediaType} mediaPath=${input.mediaPath}` : input.mediaType === "audio" ? "media=audio mediaPath=transcribed" : "media=none";
+    const openable = input.media.filter((m) => m.type !== "audio");
+    const mediaField = openable.length > 0 ? `media=${openable.map((m) => m.type).join(",")} mediaPaths=${openable.map((m) => m.path).join(",")}` : input.media.some((m) => m.type === "audio") ? "media=audio mediaPath=transcribed" : "media=none";
     this.replies.set(input.senderId, input.reply);
     this.hub.deliver(
       {
         senderId: input.senderId,
         text: input.text,
         waMessageId: `wa-${++this.seq}`,
-        mediaPath: input.mediaPath,
-        mediaType: input.mediaType,
-        mediaMimetype: input.mediaMimetype
+        media: input.media
       },
       Date.now()
     );
@@ -16191,8 +16070,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync23, readFileSync as readFileSync23, statSync as statSync10 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync22, statSync as statSync10 } from "fs";
+import { resolve as resolve25 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -16227,7 +16106,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve26(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve25(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -16239,8 +16118,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve26(brand.configDir, "entitlement.json");
-  if (!existsSync23(entitlementPath)) {
+  const entitlementPath = resolve25(brand.configDir, "entitlement.json");
+  if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync10(entitlementPath);
@@ -16255,7 +16134,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync23(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync22(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -16269,7 +16148,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync23(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync22(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -16430,14 +16309,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join19(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join18(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync24(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync23(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -16456,11 +16335,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join19(homedir2(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join18(homedir2(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync24(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync24(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync23(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -16484,10 +16363,10 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app44 = new Hono();
+var app45 = new Hono();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve27(process.env.MAXY_PLATFORM_ROOT ?? join19(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve26(process.env.MAXY_PLATFORM_ROOT ?? join18(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   ensureChannelSession: async ({ accountId, senderId, gatewayUrl, serverPath }) => {
     const userId = resolveAdminUserId({ accountId, senderPhone: senderId }) ?? void 0;
     console.error(`[whatsapp-native] op=admin-identity senderId=${senderId} userId=${userId ?? "owner-fallback"}`);
@@ -16502,10 +16381,10 @@ var waGateway = new WaGateway({
     }
   }
 });
-app44.route("/", waGateway.routes());
+app45.route("/", waGateway.routes());
 waGateway.startSweeper();
-app44.use("*", clientIpMiddleware);
-app44.use("*", async (c, next) => {
+app45.use("*", clientIpMiddleware);
+app45.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -16515,7 +16394,7 @@ app44.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app44.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -16533,7 +16412,7 @@ app44.use("*", async (c, next) => {
     });
   }
 });
-app44.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -16564,7 +16443,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app44.post("/__remote-auth/login", async (c) => {
+app45.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -16609,7 +16488,7 @@ app44.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app44.get("/__remote-auth/logout", (c) => {
+app45.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -16622,7 +16501,7 @@ app44.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app44.post("/__remote-auth/change-password", async (c) => {
+app45.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -16673,13 +16552,13 @@ app44.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app44.get("/__remote-auth/setup", (c) => {
+app45.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app44.post("/__remote-auth/set-initial-password", async (c) => {
+app45.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -16717,10 +16596,10 @@ app44.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app44.get("/api/remote-auth/status", (c) => {
+app45.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app44.post("/api/remote-auth/set-password", async (c) => {
+app45.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -16751,9 +16630,9 @@ app44.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app44.route("/api/_client-error", client_error_default);
+app45.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app44.use("*", async (c, next) => {
+app45.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -16786,14 +16665,14 @@ app44.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app44.route("/api/health", health_default);
-app44.route("/api/chat", chat_default);
-app44.route("/api/whatsapp", whatsapp_default);
-app44.route("/api/whatsapp-reader", whatsapp_reader_default);
-app44.route("/api/onboarding", onboarding_default);
-app44.route("/api/admin", admin_default);
-app44.route("/api/access", access_default);
-app44.route("/api/session", session_default2);
+app45.route("/api/health", health_default);
+app45.route("/api/chat", chat_default);
+app45.route("/api/whatsapp", whatsapp_default);
+app45.route("/api/whatsapp-reader", whatsapp_reader_default);
+app45.route("/api/onboarding", onboarding_default);
+app45.route("/api/admin", admin_default);
+app45.route("/api/access", access_default);
+app45.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -16805,7 +16684,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app44.get("/agent-assets/:slug/:filename", (c) => {
+app45.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -16821,26 +16700,26 @@ app44.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve27(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve27(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve26(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve26(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync24(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync24(filePath);
+  const body = readFileSync23(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app44.get("/generated/:filename", (c) => {
+app45.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -16851,35 +16730,35 @@ app44.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve27(account.accountDir, "generated", filename);
-  const expectedDir = resolve27(account.accountDir, "generated");
+  const filePath = resolve26(account.accountDir, "generated", filename);
+  const expectedDir = resolve26(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync24(filePath)) {
+  if (!existsSync23(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync24(filePath);
+  const body = readFileSync23(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app44.route("/sites", sites_default);
-app44.route("/listings", listings_default);
-app44.route("/v", visitor_event_default);
-app44.route("/v", visitor_consent_default);
+app45.route("/sites", sites_default);
+app45.route("/listings", listings_default);
+app45.route("/v", visitor_event_default);
+app45.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync24(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync23(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -16896,9 +16775,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join19(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync24(versionFile)) return "unknown";
-    const content = readFileSync24(versionFile, "utf-8").trim();
+    const versionFile = join18(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync23(versionFile)) return "unknown";
+    const content = readFileSync23(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -16939,7 +16818,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync24(resolve27(process.cwd(), "public", file), "utf-8");
+    html = readFileSync23(resolve26(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -16955,13 +16834,13 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join19(homedir2(), BRAND.configDir);
+  const configDir2 = join18(homedir2(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join19(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync24(cachePath)) return null;
-    return JSON.parse(readFileSync24(cachePath, "utf-8"));
+    const cachePath = join18(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync23(cachePath)) return null;
+    return JSON.parse(readFileSync23(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -17004,7 +16883,7 @@ function escapeHtml(s) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app44.get("/", (c) => {
+app45.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -17020,12 +16899,12 @@ app44.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app44.get("/public", (c) => {
+app45.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app44.get("/chat", (c) => {
+app45.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -17044,12 +16923,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app44.use("/vnc-viewer.html", logViewerFetch);
-app44.use("/vnc-popout.html", logViewerFetch);
-app44.get("/vnc-popout.html", (c) => {
+app45.use("/vnc-viewer.html", logViewerFetch);
+app45.use("/vnc-popout.html", logViewerFetch);
+app45.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync24(resolve27(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync23(resolve26(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -17059,7 +16938,7 @@ app44.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app44.post("/api/vnc/client-event", async (c) => {
+app45.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17080,30 +16959,30 @@ app44.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app44.get("/g/:slug", (c) => {
+app45.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app44.get("/graph", (c) => {
+app45.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app44.get("/sessions", (c) => {
+app45.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app44.get("/data", (c) => {
+app45.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app44.get("/browser", (c) => {
+app45.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app44.get("/:slug", async (c, next) => {
+app45.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -17118,13 +16997,13 @@ app44.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app44.get("/favicon.ico", (c) => {
+  app45.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app44.use("/*", serveStatic({ root: "./public" }));
-app44.all("*", (c) => {
+app45.use("/*", serveStatic({ root: "./public" }));
+app45.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -17138,7 +17017,7 @@ app44.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app44.fetch, port, hostname });
+var httpServer = serve({ fetch: app45.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startAuthHealthHeartbeat();
 {
@@ -17176,7 +17055,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app44.routes ?? []) {
+  for (const r of app45.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -17204,11 +17083,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync24(USERS_FILE)) {
+    if (!existsSync23(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync24(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync23(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -17315,7 +17194,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join19(__dirname, "..")),
+  platformRoot: resolve26(process.env.MAXY_PLATFORM_ROOT ?? join18(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {
@@ -17326,9 +17205,9 @@ init({
       console.error(`[whatsapp:route] dropped reason=non-admin-sender senderId=${msg.senderPhone} agentType=${msg.agentType}`);
       return;
     }
-    const hasFileMedia = !!msg.mediaPath && msg.mediaType !== "audio";
+    const hasFileMedia = msg.media.some((m) => m.type !== "audio");
     if (!msg.text && !hasFileMedia) {
-      console.error(`[whatsapp:route] dropped reason=no-text-no-media senderId=${msg.senderPhone} media=${msg.mediaType ?? "none"}`);
+      console.error(`[whatsapp:route] dropped reason=no-text-no-media senderId=${msg.senderPhone} mediaCount=${msg.media.length}`);
       return;
     }
     try {
@@ -17339,9 +17218,7 @@ init({
         senderId: msg.senderPhone,
         text: msg.text,
         reply: msg.reply,
-        mediaPath: msg.mediaPath,
-        mediaType: msg.mediaType,
-        mediaMimetype: msg.mediaMimetype
+        media: msg.media
       });
     } catch (err) {
       console.error(