@rubytech/create-maxy-code 0.1.281 → 0.1.283

package/payload/server/server.js

@@ -1201,9 +1201,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync23, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve26, join as join18, basename as basename7 } from "path";
-import { homedir as homedir2 } from "os";
+import { readFileSync as readFileSync24, existsSync as existsSync24, watchFile } from "fs";
+import { resolve as resolve27, join as join19, basename as basename7 } from "path";
+import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
 // app/lib/agent-slug-pattern.ts
@@ -1513,24 +1513,14 @@ function getLanIp() {
 // app/lib/whatsapp/schema.ts
 import { z } from "zod";
 var DmPolicySchema = z.enum(["open", "allowlist", "disabled"]);
-var GroupPolicySchema = z.enum(["open", "allowlist", "disabled"]);
 var WhatsAppAccountSchema = z.object({
   name: z.string().optional().describe("Display name for this WhatsApp account (e.g. 'Main', 'Sales')."),
   enabled: z.boolean().optional().describe("If disabled, this account won't connect on startup."),
   dmPolicy: DmPolicySchema.optional().describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
-  groupPolicy: GroupPolicySchema.optional().describe("Whether your agent responds in WhatsApp group chats. 'Open' enables group responses (subject to per-group activation). 'Allowlist' restricts to approved senders. 'Disabled' ignores all group messages."),
   selfChatMode: z.boolean().optional().describe("Enable if the bot uses the owner's personal WhatsApp number (same phone for admin and bot). Changes how self-messages are routed."),
   adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone."),
   allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
-  groupAllowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to trigger the agent in groups when group policy is 'allowlist'."),
   sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
-  groups: z.record(
-    z.string(),
-    z.object({
-      activation: z.enum(["always", "mention", "off"]).optional(),
-      publicAgent: z.string().optional().describe("Per-group public-agent slug override. When set, inbound messages in this group route to this agent instead of the per-account or top-level publicAgent.")
-    }).strict().optional()
-  ).optional().describe("Per-group settings: 'activation' controls when the agent responds ('always', 'mention', 'off'); 'publicAgent' optionally overrides the public-agent slug for this group (precedence: group \u2192 account \u2192 top-level)."),
   ackReaction: z.object({
     emoji: z.string().optional(),
     direct: z.boolean().optional().default(true),
@@ -1552,10 +1542,8 @@ var WhatsAppAccountSchema = z.object({
 var WhatsAppConfigSchema = z.object({
   accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional().describe("Per-account config keyed by account ID."),
   dmPolicy: DmPolicySchema.optional().default("disabled").describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
-  groupPolicy: GroupPolicySchema.optional().default("disabled").describe("Whether your agent responds in WhatsApp group chats. 'Open' enables group responses (subject to per-group activation). 'Allowlist' restricts to approved senders. 'Disabled' ignores all group messages."),
   adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone."),
   allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
-  groupAllowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to trigger the agent in groups when group policy is 'allowlist'."),
   sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
   mediaMaxMb: z.number().int().positive().optional().default(50).describe("Maximum file size in MB for media the agent will download and process."),
   textChunkLimit: z.number().int().positive().optional().default(4e3).describe("Maximum characters per outbound message. Longer replies are split into multiple messages."),
@@ -1572,6 +1560,36 @@ var WhatsAppConfigSchema = z.object({
     message: 'dmPolicy="open" requires allowFrom to include "*"'
   });
 });
+function parseWhatsAppConfigTolerant(raw) {
+  const first = WhatsAppConfigSchema.safeParse(raw);
+  if (first.success) {
+    return { ok: true, data: first.data, droppedKeys: [] };
+  }
+  const issues = first.error.issues;
+  const onlyUnknownKeys = issues.length > 0 && issues.every((i) => i.code === "unrecognized_keys");
+  if (!onlyUnknownKeys) {
+    return { ok: false, error: first.error };
+  }
+  const clone = JSON.parse(JSON.stringify(raw));
+  const droppedKeys = [];
+  for (const issue of issues) {
+    if (issue.code !== "unrecognized_keys") continue;
+    const container = issue.path.reduce(
+      (acc, seg) => acc && typeof acc === "object" ? acc[seg] : void 0,
+      clone
+    );
+    if (!container || typeof container !== "object") continue;
+    for (const key of issue.keys) {
+      delete container[key];
+      droppedKeys.push([...issue.path, key].join("."));
+    }
+  }
+  const second = WhatsAppConfigSchema.safeParse(clone);
+  if (second.success) {
+    return { ok: true, data: second.data, droppedKeys };
+  }
+  return { ok: false, error: second.error };
+}
 
 // app/lib/whatsapp/auth-store.ts
 import fsSync from "fs";
@@ -1763,7 +1781,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve27) => setTimeout(() => resolve27("timeout"), timeoutMs)
+    (resolve28) => setTimeout(() => resolve28("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1891,11 +1909,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve27();
+        resolve28();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2009,14 +2027,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve27, reject) => {
+  return new Promise((resolve28, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve27(value);
+        resolve28(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2321,10 +2339,8 @@ function extractMessage(msg) {
 function resolveAccountConfig(config, accountConfig) {
   return {
     dmPolicy: accountConfig?.dmPolicy ?? config.dmPolicy ?? "disabled",
-    groupPolicy: accountConfig?.groupPolicy ?? config.groupPolicy ?? "disabled",
     adminPhones: accountConfig?.adminPhones ?? config.adminPhones ?? [],
     allowFrom: accountConfig?.allowFrom ?? config.allowFrom ?? [],
-    groupAllowFrom: accountConfig?.groupAllowFrom ?? config.groupAllowFrom ?? [],
     selfChatMode: accountConfig?.selfChatMode ?? false
   };
 }
@@ -2361,36 +2377,8 @@ function checkDmAccess(params) {
       return { allowed: false, reason: "unknown-dm-policy", agentType: "public" };
   }
 }
-function checkGroupAccess(params) {
-  const { senderPhone, selfPhone, groupJid, isMentioned } = params;
-  const cfg = resolveAccountConfig(params.config, params.accountConfig);
-  if (phonesMatch(senderPhone, selfPhone)) {
-    return { allowed: true, reason: "self-phone-group", agentType: "admin" };
-  }
-  switch (cfg.groupPolicy) {
-    case "open": {
-      const groupConfig = params.accountConfig?.groups?.[groupJid];
-      const activation = groupConfig?.activation ?? "mention";
-      if (activation === "off") {
-        return { allowed: false, reason: "group-activation-off", agentType: "public" };
-      }
-      if (activation === "mention" && !isMentioned) {
-        return { allowed: false, reason: "mention-gating", agentType: "public" };
-      }
-      return { allowed: true, reason: "group-policy-open", agentType: "public" };
-    }
-    case "allowlist": {
-      const inList = cfg.groupAllowFrom.some((entry) => phonesMatch(entry, senderPhone)) || cfg.adminPhones.some((entry) => phonesMatch(entry, senderPhone));
-      if (!inList) {
-        return { allowed: false, reason: "not-in-group-allowlist", agentType: "public" };
-      }
-      return { allowed: true, reason: "group-allowlist-match", agentType: "public" };
-    }
-    case "disabled":
-      return { allowed: false, reason: "group-policy-disabled", agentType: "public" };
-    default:
-      return { allowed: false, reason: "unknown-group-policy", agentType: "public" };
-  }
+function checkGroupAccess(_params) {
+  return { allowed: false, reason: "group-observe-only", agentType: "public" };
 }
 
 // app/lib/whatsapp/inbound/dedupe.ts
@@ -2601,8 +2589,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve27) => {
-    release = resolve27;
+  const mine = new Promise((resolve28) => {
+    release = resolve28;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3275,11 +3263,20 @@ async function transcribe(audioPath, mimetype) {
   }
 }
 
+// app/lib/whatsapp/reply-error.ts
+var WaReplyError = class extends Error {
+  terminal;
+  constructor(message, terminal) {
+    super(message);
+    this.name = "WaReplyError";
+    this.terminal = terminal;
+  }
+};
+
 // app/lib/whatsapp/manager.ts
 var TAG12 = "[whatsapp:manager]";
 var MAX_RECONNECT_ATTEMPTS = 10;
 var MESSAGE_STORE_MAX = 500;
-var GROUP_META_TTL = 5 * 60 * 1e3;
 var connections = /* @__PURE__ */ new Map();
 var configDir = null;
 var whatsAppConfig = {};
@@ -3375,8 +3372,7 @@ async function startConnection(accountId) {
     reconnectAttempts: 0,
     abortController: new AbortController(),
     debouncer: null,
-    lidMapping: null,
-    groupMetaCache: /* @__PURE__ */ new Map()
+    lidMapping: null
   };
   connections.set(accountId, conn);
   await connectWithReconnect(conn);
@@ -3412,7 +3408,8 @@ function getStatus() {
     reconnectAttempts: conn.reconnectAttempts,
     lastConnectedAt: conn.lastConnectedAt,
     lastError: conn.lastError,
-    sessionStuckReason: conn.sessionStuckReason
+    sessionStuckReason: conn.sessionStuckReason,
+    terminalReason: conn.terminalReason
   }));
 }
 function getSocket(accountId) {
@@ -3456,8 +3453,7 @@ async function registerLoginSocket(accountId, sock, authDir) {
     lastConnectedAt: Date.now(),
     abortController: new AbortController(),
     debouncer: null,
-    lidMapping,
-    groupMetaCache: /* @__PURE__ */ new Map()
+    lidMapping
   };
   connections.set(accountId, conn);
   try {
@@ -3534,13 +3530,20 @@ function loadConfig(accountConfig) {
     const raw = accountConfig?.whatsapp;
     if (raw && typeof raw === "object") {
       const wa = raw;
-      const parsed = WhatsAppConfigSchema.safeParse(wa);
-      if (parsed.success) {
-        whatsAppConfig = parsed.data;
+      const result = parseWhatsAppConfigTolerant(wa);
+      if (result.ok) {
+        whatsAppConfig = result.data;
+        if (result.droppedKeys.length > 0) {
+          console.error(`${TAG12} config: dropped unknown keys=[${result.droppedKeys.join(",")}] preserved known config`);
+        }
       } else {
-        console.error(`${TAG12} config validation failed: ${parsed.error.message}`);
+        console.error(`${TAG12} config validation failed: ${result.error.message}`);
         whatsAppConfig = {};
       }
+      const diskAdmin = Array.isArray(wa.adminPhones) ? wa.adminPhones : [];
+      if (diskAdmin.length > 0 && (whatsAppConfig.adminPhones?.length ?? 0) === 0) {
+        console.error(`${TAG12} WARN adminPhones present on disk but empty after load`);
+      }
     }
   } catch (err) {
     console.error(`${TAG12} config load error: ${String(err)}`);
@@ -3570,6 +3573,7 @@ async function connectWithReconnect(conn) {
       conn.selfLid = selfId.lid;
       conn.lastConnectedAt = connectedAt;
       conn.lastError = void 0;
+      conn.terminalReason = void 0;
       const rawLidMapping = sock.signalRepository?.lidMapping ?? null;
       conn.lidMapping = withSelfLidShortcut(rawLidMapping, selfId.lid, selfId.jid);
       if (selfId.lid) {
@@ -3612,6 +3616,7 @@ async function connectWithReconnect(conn) {
       conn.lastError = classification.message;
       console.error(`${TAG12} disconnect account=${conn.accountId}: ${classification.kind} \u2014 ${classification.message}`);
       if (!classification.shouldRetry) {
+        conn.terminalReason = classification.message;
         console.error(`${TAG12} terminal disconnect for account=${conn.accountId}, stopping reconnection`);
         return;
       }
@@ -3646,11 +3651,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve27) => {
-        const timer2 = setTimeout(resolve27, delay);
+      await new Promise((resolve28) => {
+        const timer2 = setTimeout(resolve28, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve27();
+          resolve28();
         }, { once: true });
       });
     }
@@ -3658,16 +3663,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve27) => {
+  return new Promise((resolve28) => {
     if (!conn.sock) {
-      resolve27();
+      resolve28();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve27();
+        resolve28();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -3687,37 +3692,6 @@ function watchForDisconnect(conn) {
     }
   });
 }
-async function getGroupMeta(conn, jid) {
-  const cached3 = conn.groupMetaCache.get(jid);
-  if (cached3 && cached3.expires > Date.now()) return cached3;
-  if (!conn.sock) return null;
-  console.error(`${TAG12} group metadata cache miss for ${jid}, fetching from Baileys account=${conn.accountId}`);
-  try {
-    const meta = await conn.sock.groupMetadata(jid);
-    const participants = await Promise.all(
-      (meta.participants ?? []).map(async (p) => {
-        return await resolveJidToE164(p.id, conn.lidMapping) ?? p.id;
-      })
-    );
-    const entry = {
-      subject: meta.subject,
-      participants,
-      expires: Date.now() + GROUP_META_TTL
-    };
-    conn.groupMetaCache.set(jid, entry);
-    console.error(
-      `${TAG12} group metadata cached for ${jid}: "${meta.subject}", ${participants.length} participants, expires in ${GROUP_META_TTL}ms account=${conn.accountId}`
-    );
-    return entry;
-  } catch (err) {
-    console.error(
-      `${TAG12} group metadata fetch failed for ${jid}: ${err instanceof Error ? err.message : String(err)}, caching empty entry for ${GROUP_META_TTL}ms account=${conn.accountId}`
-    );
-    const emptyEntry = { expires: Date.now() + GROUP_META_TTL };
-    conn.groupMetaCache.set(jid, emptyEntry);
-    return null;
-  }
-}
 function monitorInbound(conn) {
   if (!conn.sock || !onInboundMessage) return;
   const sock = conn.sock;
@@ -3926,8 +3900,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve27) => {
-      resolvePending = resolve27;
+    const sttPending = new Promise((resolve28) => {
+      resolvePending = resolve28;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -3941,24 +3915,7 @@ async function handleInboundMessage(conn, msg) {
   }
   let accessResult;
   if (isGroup) {
-    accessResult = checkGroupAccess({
-      senderPhone,
-      selfPhone,
-      groupJid: remoteJid,
-      // Three-way mention recognition (Sub-fix 4): legacy phone-JID equality,
-      // legacy E.164-via-jidToE164 equality, plus the new self-LID equality so
-      // mentions in LID-addressed groups (deliver as `<self-lid>@lid`) match.
-      // Pre-LID groups continue matching the first two — additive, never blocks.
-      // Each clause guards against null on its right operand; a creds-parse
-      // failure leaves all three of selfJid/selfLid/selfPhone null and
-      // jidToE164 of a malformed mention also returns null — without the
-      // guards, `null === null` would spuriously match every nullified field.
-      isMentioned: extracted.mentionedJids.some(
-        (jid) => conn.selfJid !== null && jid === conn.selfJid || conn.selfLid !== null && jid === conn.selfLid || conn.selfPhone !== null && jidToE164(jid) === conn.selfPhone
-      ),
-      config: whatsAppConfig,
-      accountConfig: whatsAppConfig.accounts?.[conn.accountId]
-    });
+    accessResult = checkGroupAccess({ groupJid: remoteJid });
   } else {
     accessResult = checkDmAccess({
       senderPhone,
@@ -3971,18 +3928,20 @@ async function handleInboundMessage(conn, msg) {
     `${TAG12} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
   );
   if (!accessResult.allowed) return;
-  let groupSubject;
-  if (isGroup) {
-    const groupMeta = await getGroupMeta(conn, remoteJid);
-    groupSubject = groupMeta?.subject;
-  }
   const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
   if (sendReceipts && msg.key.id) {
     sendReadReceipt(conn.sock, remoteJid, [msg.key.id], isGroup ? senderJid : void 0);
   }
   const reply = async (text) => {
+    if (isGroupJid(remoteJid)) {
+      console.error(`${TAG12} op=group-reply-blocked jid=${remoteJid}`);
+      throw new WaReplyError("group reply blocked \u2014 observe-only", false);
+    }
     const currentSock = conn.sock;
-    if (!currentSock) throw new Error("WhatsApp disconnected \u2014 cannot reply");
+    if (!currentSock) {
+      const reason = conn.terminalReason;
+      throw new WaReplyError(reason ?? "WhatsApp disconnected \u2014 cannot reply", Boolean(reason));
+    }
     await sendTextMessage(currentSock, remoteJid, text, { accountId: conn.accountId });
   };
   const composing = async () => {
@@ -4004,7 +3963,6 @@ async function handleInboundMessage(conn, msg) {
     text: extracted.text,
     isGroup,
     groupJid: isGroup ? remoteJid : void 0,
-    groupSubject,
     reply,
     composing,
     cacheKey,
@@ -4334,20 +4292,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve27) => {
+  return new Promise((resolve28) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve27(true);
+      resolve28(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve27(false);
+      resolve28(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve27(false);
+      resolve28(false);
     });
   });
 }
@@ -4383,13 +4341,15 @@ app.get("/", async (c) => {
       selfPhone: a.selfPhone ?? null,
       reconnectAttempts: a.reconnectAttempts,
       lastError: a.lastError ?? null,
-      sessionStuckReason: a.sessionStuckReason ?? null
+      sessionStuckReason: a.sessionStuckReason ?? null,
+      terminalReason: a.terminalReason ?? null
     }));
   } catch (err) {
     console.error(`[health] failed to read WhatsApp status: ${err instanceof Error ? err.message : String(err)}`);
   }
   const whatsappAnyConnected = whatsappAccounts.some((a) => a.connected);
   const whatsappAnyStuck = whatsappAccounts.some((a) => Boolean(a.sessionStuckReason));
+  const whatsappAnyTerminal = whatsappAccounts.some((a) => Boolean(a.terminalReason));
   const account = resolveAccount();
   const missingPlugins = findMissingPlugins(account?.config.enabledPlugins);
   return c.json({
@@ -4404,6 +4364,7 @@ app.get("/", async (c) => {
     whatsapp: {
       any_connected: whatsappAnyConnected,
       any_stuck: whatsappAnyStuck,
+      any_terminal: whatsappAnyTerminal,
       accounts: whatsappAccounts
     }
   });
@@ -4677,7 +4638,10 @@ async function managerRcSpawn(opts) {
       sliceToken: opts.sliceToken,
       personId: opts.personId,
       userId: opts.userId,
-      waChannel: opts.waChannel
+      waChannel: opts.waChannel,
+      role: opts.role,
+      channel: opts.channel,
+      senderId: opts.senderId
     })
   }).catch((err) => ({ __throw: err instanceof Error ? err.message : String(err) }));
   if ("__throw" in res) {
@@ -5286,6 +5250,13 @@ async function ensureEntry(input) {
     spawned = await managerRcSpawn({
       sessionId: adminSessionId,
       name: nameValue ?? void 0,
+      // Task 724 — pass the real channel + role + senderId so the manager writes
+      // the classification sidecar for this admin channel (webchat, email, …),
+      // not just WhatsApp. Without these the live session was left sidecar-less
+      // and the sidebar channel badge / archive classification mis-read it.
+      role: "admin",
+      channel: input.channel,
+      senderId: input.senderId,
       logContext: `channel=${input.channel} senderId=${input.senderId}`
     });
   } else {
@@ -5422,12 +5393,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve27;
+  let resolve28;
   const turnPromise = new Promise((r) => {
-    resolve27 = r;
+    resolve28 = r;
   });
   const listener = (text) => {
-    resolve27(text);
+    resolve28(text);
   };
   entry.subscribers.add(listener);
   const writeAtMs = Date.now();
@@ -5987,16 +5958,6 @@ function resolvePublicAgent(accountDir, opts) {
     const config = readConfig(accountDir);
     const wa = config.whatsapp;
     if (!wa) return null;
-    if (opts.groupJid) {
-      const accounts2 = wa.accounts;
-      const account2 = accounts2?.[opts.accountId];
-      const groups = account2?.groups;
-      const group = groups?.[opts.groupJid];
-      const groupSlug = group?.publicAgent;
-      if (typeof groupSlug === "string" && groupSlug.trim()) {
-        return { slug: groupSlug.trim(), source: "group" };
-      }
-    }
     const accounts = wa.accounts;
     const account = accounts?.[opts.accountId];
     const accountSlug = account?.publicAgent;
@@ -6012,77 +5973,6 @@ function resolvePublicAgent(accountDir, opts) {
     return null;
   }
 }
-function setGroupPublicAgent(accountDir, accountId, groupJid, slug) {
-  const trimmedSlug = slug.trim();
-  const trimmedGroup = groupJid.trim();
-  const trimmedAccount = accountId.trim();
-  if (!trimmedSlug) return { ok: false, error: "Agent slug cannot be empty." };
-  if (!trimmedGroup) return { ok: false, error: "Group JID cannot be empty." };
-  if (!trimmedAccount) return { ok: false, error: "Account ID cannot be empty." };
-  const agentConfigPath = join4(accountDir, "agents", trimmedSlug, "config.json");
-  if (!existsSync4(agentConfigPath)) {
-    return { ok: false, error: `Agent "${trimmedSlug}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
-  }
-  try {
-    const config = readConfig(accountDir);
-    if (!config.whatsapp || typeof config.whatsapp !== "object") config.whatsapp = {};
-    const wa = config.whatsapp;
-    if (!wa.accounts || typeof wa.accounts !== "object") wa.accounts = {};
-    const accounts = wa.accounts;
-    if (!accounts[trimmedAccount] || typeof accounts[trimmedAccount] !== "object") accounts[trimmedAccount] = {};
-    const account = accounts[trimmedAccount];
-    if (!account.groups || typeof account.groups !== "object") account.groups = {};
-    const groups = account.groups;
-    const existing = groups[trimmedGroup] && typeof groups[trimmedGroup] === "object" ? groups[trimmedGroup] : {};
-    groups[trimmedGroup] = { ...existing, publicAgent: trimmedSlug };
-    const parsed = WhatsAppConfigSchema.safeParse(wa);
-    if (!parsed.success) {
-      const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      return { ok: false, error: `Validation failed: ${msg}` };
-    }
-    config.whatsapp = parsed.data;
-    writeConfig(accountDir, config);
-    console.error(`${TAG17} setGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup} slug=${trimmedSlug}`);
-    reloadManagerConfig(accountDir);
-    return { ok: true, message: `Per-group public agent set to "${trimmedSlug}" for group ${trimmedGroup}.` };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG17} setGroupPublicAgent failed: ${msg}`);
-    return { ok: false, error: msg };
-  }
-}
-function unsetGroupPublicAgent(accountDir, accountId, groupJid) {
-  const trimmedGroup = groupJid.trim();
-  const trimmedAccount = accountId.trim();
-  if (!trimmedGroup) return { ok: false, error: "Group JID cannot be empty." };
-  if (!trimmedAccount) return { ok: false, error: "Account ID cannot be empty." };
-  try {
-    const config = readConfig(accountDir);
-    const wa = config.whatsapp ?? {};
-    const accounts = wa.accounts;
-    const account = accounts?.[trimmedAccount];
-    const groups = account?.groups;
-    const group = groups?.[trimmedGroup];
-    if (!group || typeof group.publicAgent !== "string") {
-      return { ok: true, message: `No per-group publicAgent override for group ${trimmedGroup}; nothing to remove.` };
-    }
-    delete group.publicAgent;
-    const parsed = WhatsAppConfigSchema.safeParse(wa);
-    if (!parsed.success) {
-      const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      return { ok: false, error: `Validation failed: ${msg}` };
-    }
-    config.whatsapp = parsed.data;
-    writeConfig(accountDir, config);
-    console.error(`${TAG17} unsetGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup}`);
-    reloadManagerConfig(accountDir);
-    return { ok: true, message: `Per-group public agent override removed for group ${trimmedGroup}.` };
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG17} unsetGroupPublicAgent failed: ${msg}`);
-    return { ok: false, error: msg };
-  }
-}
 function updateConfig(accountDir, fields) {
   const fieldNames = Object.keys(fields);
   if (fieldNames.length === 0) {
@@ -6126,6 +6016,35 @@ function getConfig(accountDir) {
     return null;
   }
 }
+function migrateRemovedConfigKeys(accountDir) {
+  try {
+    const config = readConfig(accountDir);
+    const wa = config.whatsapp;
+    if (!wa || typeof wa !== "object") return { dropped: [] };
+    const result = parseWhatsAppConfigTolerant(wa);
+    if (!result.ok || result.droppedKeys.length === 0) return { dropped: [] };
+    const block = wa;
+    for (const dotted of result.droppedKeys) {
+      const segs = dotted.split(".");
+      const key = segs.pop();
+      const container = segs.reduce(
+        (acc, seg) => acc && typeof acc === "object" ? acc[seg] : void 0,
+        block
+      );
+      if (container && typeof container === "object") {
+        delete container[key];
+      }
+    }
+    writeConfig(accountDir, config);
+    console.error(
+      `${TAG17} migration: stripped unknown keys=[${result.droppedKeys.join(",")}] from account.json`
+    );
+    return { dropped: result.droppedKeys };
+  } catch (err) {
+    console.error(`${TAG17} migration failed: ${String(err)}`);
+    return { dropped: [] };
+  }
+}
 
 // app/lib/whatsapp/login.ts
 var TAG18 = "[whatsapp:login]";
@@ -6265,8 +6184,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve27, reject) => {
-    resolveCode = resolve27;
+  const codePromise = new Promise((resolve28, reject) => {
+    resolveCode = resolve28;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -6615,29 +6534,10 @@ app3.post("/reconnect", async (c) => {
     return c.json({ error: String(err) }, 500);
   }
 });
-app3.post("/send", async (c) => {
-  try {
-    const body = await c.req.json();
-    const { to, text } = body;
-    const accountId = validateAccountId(body.accountId);
-    if (!to || !text) {
-      return c.json({ error: "Missing required fields: to, text" }, 400);
-    }
-    const sock = getSocket(accountId);
-    if (!sock) {
-      return c.json({ error: `WhatsApp account "${accountId}" is not connected` }, 503);
-    }
-    const result = await sendTextMessage(sock, to, text, { accountId });
-    return c.json(result);
-  } catch (err) {
-    console.error(`${TAG20} send error: ${String(err)}`);
-    return c.json({ error: String(err) }, 500);
-  }
-});
 app3.post("/config", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const { action, phone, slug, groupJid, fields, accountId } = body;
+    const { action, phone, slug, fields, accountId } = body;
     if (!action || typeof action !== "string") {
       return c.json({ ok: false, error: 'Missing required field "action".' }, 400);
     }
@@ -6677,32 +6577,10 @@ app3.post("/config", async (c) => {
       }
       case "get-public-agent": {
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
-        const targetGroup = typeof groupJid === "string" && groupJid.trim() ? groupJid.trim() : void 0;
-        const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount, groupJid: targetGroup });
-        console.error(`${TAG20} config action=get-public-agent accountId=${targetAccount} groupJid=${targetGroup ?? "none"} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
+        const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount });
+        console.error(`${TAG20} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
-      case "set-group-public-agent": {
-        if (!slug || typeof slug !== "string") {
-          return c.json({ ok: false, error: 'Missing required field "slug" (the public-agent directory name, e.g. "my-agent").' }, 400);
-        }
-        if (!groupJid || typeof groupJid !== "string") {
-          return c.json({ ok: false, error: 'Missing required field "groupJid" (group JID ending in @g.us).' }, 400);
-        }
-        const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
-        const result = setGroupPublicAgent(account.accountDir, targetAccount, groupJid, slug);
-        console.error(`${TAG20} config action=set-group-public-agent accountId=${targetAccount} groupJid=${groupJid} slug=${slug} ok=${result.ok}`);
-        return c.json(result, result.ok ? 200 : 400);
-      }
-      case "unset-group-public-agent": {
-        if (!groupJid || typeof groupJid !== "string") {
-          return c.json({ ok: false, error: 'Missing required field "groupJid" (group JID ending in @g.us).' }, 400);
-        }
-        const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
-        const result = unsetGroupPublicAgent(account.accountDir, targetAccount, groupJid);
-        console.error(`${TAG20} config action=unset-group-public-agent accountId=${targetAccount} groupJid=${groupJid} ok=${result.ok}`);
-        return c.json(result, result.ok ? 200 : 400);
-      }
       case "list-public-agents": {
         const agentsDir = resolve7(account.accountDir, "agents");
         const agents = [];
@@ -6769,7 +6647,7 @@ app3.post("/config", async (c) => {
       }
       default:
         return c.json(
-          { ok: false, error: `Unknown action "${action}". Valid actions: add-admin-phone, remove-admin-phone, list-admin-phones, set-public-agent, get-public-agent, set-group-public-agent, unset-group-public-agent, list-public-agents, update-config, get-config, schema, list-groups.` },
+          { ok: false, error: `Unknown action "${action}". Valid actions: add-admin-phone, remove-admin-phone, list-admin-phones, set-public-agent, get-public-agent, list-public-agents, update-config, get-config, schema, list-groups.` },
           400
         );
     }
@@ -7018,7 +6896,7 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join7(slugDir, entry.name), isSubagent: false });
+        out.push({ path: join7(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
         const subDir = join7(slugDir, entry.name);
         let subEntries;
@@ -7031,7 +6909,22 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join7(subDir, sub.name), isSubagent: true });
+            out.push({ path: join7(subDir, sub.name), isSubagent: true, archived: false });
+          }
+        }
+      } else if (entry.isDirectory() && entry.name === "archive") {
+        const archiveDir = join7(slugDir, entry.name);
+        let archiveEntries;
+        try {
+          archiveEntries = readdirSync4(archiveDir, { withFileTypes: true });
+        } catch (err) {
+          const code = err.code ?? "unknown";
+          console.error(`[admin-sessions-list] archive-skipped slug=${slug} code=${code}`);
+          continue;
+        }
+        for (const arc of archiveEntries) {
+          if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
+            out.push({ path: join7(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -7171,8 +7064,9 @@ app4.get("/", requireAdminSession, async (c) => {
   let liveCount = 0;
   let subagentCount = 0;
   let nonResumableCount = 0;
+  let archivedCount = 0;
   const titleSourceCounts = { user: 0, ai: 0, "first-message": 0, prefix: 0 };
-  for (const { path: path2, isSubagent } of jsonls) {
+  for (const { path: path2, isSubagent, archived } of jsonls) {
     const lastSlash = path2.lastIndexOf("/");
     const base = path2.slice(lastSlash + 1);
     const projectDir = path2.slice(0, lastSlash);
@@ -7207,15 +7101,17 @@ app4.get("/", requireAdminSession, async (c) => {
       pid,
       projectDir,
       bridgeIds,
-      resumable
+      resumable,
+      archived
     });
     if (live) liveCount += 1;
     if (isSubagent) subagentCount += 1;
     if (!resumable) nonResumableCount += 1;
+    if (archived) archivedCount += 1;
   }
   rows.sort((a, b) => a.startedAt < b.startedAt ? 1 : -1);
   console.log(
-    `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} nonResumable=${nonResumableCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} accountId=${accountId ? accountId.slice(0, 8) : "unset"}`
+    `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} archived=${archivedCount} nonResumable=${nonResumableCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} accountId=${accountId ? accountId.slice(0, 8) : "unset"}`
   );
   return c.json({ sessions: rows, accountId });
 });
@@ -7427,14 +7323,168 @@ app5.get("/stream", requireAdminSession, (c) => {
 });
 var whatsapp_reader_default = app5;
 
+// server/routes/telegram.ts
+import { homedir } from "os";
+import { resolve as resolve10, join as join9 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync10 } from "fs";
+
+// app/lib/telegram/access-control.ts
+function checkTelegramAccess(params) {
+  const { senderId, botType, config } = params;
+  if (botType === "admin") {
+    const adminUsers = config.adminUsers ?? [];
+    if (adminUsers.includes(senderId)) {
+      return { allowed: true, reason: "admin-binding", agentType: "admin" };
+    }
+    return { allowed: false, reason: "not-admin-user", agentType: "admin" };
+  }
+  const policy = config.dmPolicy ?? "disabled";
+  switch (policy) {
+    case "open":
+      return { allowed: true, reason: "dm-policy-open", agentType: "public" };
+    case "allowlist": {
+      const allowFrom = config.allowFrom ?? [];
+      if (allowFrom.includes(senderId)) {
+        return { allowed: true, reason: "allowlist-match", agentType: "public" };
+      }
+      return { allowed: false, reason: "not-in-allowlist", agentType: "public" };
+    }
+    case "disabled":
+      return { allowed: false, reason: "dm-policy-disabled", agentType: "public" };
+    default:
+      return { allowed: false, reason: "unknown-dm-policy", agentType: "public" };
+  }
+}
+
+// app/lib/telegram/route-inbound.ts
+function routeTelegramUpdate(input) {
+  const m = input.update.message;
+  if (!m || typeof m.from?.id !== "number" || typeof m.chat?.id !== "number") {
+    return { kind: "ignore", reason: "no-message" };
+  }
+  if (typeof m.text !== "string" || m.text.length === 0) {
+    return { kind: "ignore", reason: "no-text" };
+  }
+  const access = checkTelegramAccess({ senderId: m.from.id, botType: input.botType, config: input.config });
+  if (!access.allowed) {
+    return { kind: "denied", reason: access.reason, agentType: access.agentType };
+  }
+  return { kind: "dispatch", senderId: String(m.from.id), chatId: m.chat.id, text: m.text, agentType: access.agentType };
+}
+
+// server/routes/telegram.ts
+var TAG21 = "[telegram-inbound]";
+var DISPATCH_TIMEOUT_MS = 12e4;
+function configDirName() {
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve10(process.cwd(), "..");
+  const brandPath = join9(platformRoot2, "config", "brand.json");
+  if (existsSync6(brandPath)) {
+    try {
+      return JSON.parse(readFileSync10(brandPath, "utf-8")).configDir ?? ".maxy";
+    } catch {
+    }
+  }
+  return ".maxy";
+}
+function secretPath(botType) {
+  const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
+  return resolve10(homedir(), configDirName(), filename);
+}
+async function sendTelegram(botToken, chatId, text) {
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ chat_id: chatId, text })
+    });
+    const data = await res.json();
+    return data.ok ? { ok: true } : { ok: false, error: data.description ?? "send failed" };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+var app6 = new Hono();
+app6.post("/", async (c) => {
+  const botParam = c.req.query("bot");
+  const botType = botParam === "admin" ? "admin" : botParam === "public" ? "public" : null;
+  if (!botType) {
+    console.error(`${TAG21} op=reject reason=missing-bot-param`);
+    return c.json({ ok: false }, 400);
+  }
+  const sp = secretPath(botType);
+  if (!existsSync6(sp)) {
+    console.error(`${TAG21} op=reject reason=no-secret-file botType=${botType}`);
+    return c.json({ ok: false }, 401);
+  }
+  const expected = readFileSync10(sp, "utf-8").trim();
+  const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
+  if (got !== expected) {
+    console.error(`${TAG21} op=reject reason=bad-secret botType=${botType}`);
+    return c.json({ ok: false }, 401);
+  }
+  let update;
+  try {
+    update = await c.req.json();
+  } catch {
+    return c.json({ ok: true }, 200);
+  }
+  const account = resolveAccount();
+  if (!account) {
+    console.error(`${TAG21} op=reject reason=no-account`);
+    return c.json({ ok: true }, 200);
+  }
+  const decision = routeTelegramUpdate({ update, botType, config: account.config.telegram ?? {} });
+  if (decision.kind === "ignore") {
+    console.error(`${TAG21} op=ignore reason=${decision.reason}`);
+    return c.json({ ok: true }, 200);
+  }
+  if (decision.kind === "denied") {
+    console.error(`${TAG21} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
+    return c.json({ ok: true }, 200);
+  }
+  const role = decision.agentType === "admin" ? "admin" : "public";
+  const agentSlug = role === "admin" ? "admin" : resolveDefaultAgentSlug(account.accountDir);
+  if (!agentSlug) {
+    console.error(`${TAG21} op=reject reason=no-default-agent`);
+    return c.json({ ok: true }, 200);
+  }
+  console.error(`${TAG21} op=update accountId=${account.accountId} from=${decision.senderId}`);
+  const botToken = botType === "admin" ? account.config.telegram?.adminBotToken : account.config.telegram?.publicBotToken;
+  const { senderId, chatId, text } = decision;
+  void (async () => {
+    const result = await dispatchOnce({
+      accountId: account.accountId,
+      senderId,
+      role,
+      channel: "telegram",
+      agentSlug,
+      text,
+      timeoutMs: DISPATCH_TIMEOUT_MS
+    });
+    if ("error" in result) {
+      console.error(`${TAG21} op=dispatch-failed from=${senderId} error=${result.error}`);
+      return;
+    }
+    if (!botToken) {
+      const reason = account.config.telegram ? "no-bot-token" : "no-telegram-config";
+      console.error(`${TAG21} op=reply-dropped reason=${reason} botType=${botType}`);
+      return;
+    }
+    const sent = await sendTelegram(botToken, chatId, result.turnText);
+    console.error(`${TAG21} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
+  })();
+  return c.json({ ok: true }, 200);
+});
+var telegram_default = app6;
+
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync6, writeSync, existsSync as existsSync7, readFileSync as readFileSync11, unlinkSync } from "fs";
+import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync6, writeSync, existsSync as existsSync8, readFileSync as readFileSync12, unlinkSync } from "fs";
 import { createHash as createHash2, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync6, readFileSync as readFileSync10, writeFileSync as writeFileSync5, renameSync, mkdirSync as mkdirSync2, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
-import { dirname as dirname2, join as join9 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync5, renameSync, mkdirSync as mkdirSync2, readdirSync as readdirSync5, statSync as statSync4 } from "fs";
+import { dirname as dirname2, join as join10 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -7451,8 +7501,8 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync6(input.usersFile)) {
-      const raw = readFileSync10(input.usersFile, "utf-8").trim();
+    if (existsSync7(input.usersFile)) {
+      const raw = readFileSync11(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -7476,11 +7526,11 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join9(input.accountDir, "account.json");
-    if (!existsSync6(accountJsonPath)) {
+    const accountJsonPath = join10(input.accountDir, "account.json");
+    if (!existsSync7(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync10(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync11(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -7504,9 +7554,9 @@ function checkAdminAuthInvariant(input) {
     usersWithoutAccount: []
   };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync6(input.usersFile)) {
+  if (existsSync7(input.usersFile)) {
     try {
-      const raw = readFileSync10(input.usersFile, "utf-8").trim();
+      const raw = readFileSync11(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -7519,7 +7569,7 @@ function checkAdminAuthInvariant(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync6(input.accountsDir)) {
+  if (existsSync7(input.accountsDir)) {
     let entries;
     try {
       entries = readdirSync5(input.accountsDir);
@@ -7531,17 +7581,17 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join9(input.accountsDir, entry);
+      const accountDir = join10(input.accountsDir, entry);
       try {
         if (!statSync4(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join9(accountDir, "account.json");
-      if (!existsSync6(accountJsonPath)) continue;
+      const accountJsonPath = join10(accountDir, "account.json");
+      if (!existsSync7(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync10(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync11(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -7581,8 +7631,8 @@ function hashPin(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile() {
-  if (!existsSync7(USERS_FILE)) return null;
-  const raw = readFileSync11(USERS_FILE, "utf-8").trim();
+  if (!existsSync8(USERS_FILE)) return null;
+  const raw = readFileSync12(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -7612,11 +7662,11 @@ async function waitForAuthPage(timeoutMs = 2e4) {
   }
   return false;
 }
-var app6 = new Hono();
-app6.get("/claude-auth", async (c) => {
+var app7 = new Hono();
+app7.get("/claude-auth", async (c) => {
   return c.json({ authenticated: await checkAuthStatus() });
 });
-app6.post("/claude-auth", async (c) => {
+app7.post("/claude-auth", async (c) => {
   let body = {};
   try {
     body = await c.req.json();
@@ -7680,7 +7730,7 @@ app6.post("/claude-auth", async (c) => {
   await waitForAuthPage(2e4);
   return c.json({ started: true, transport });
 });
-app6.post("/set-pin", async (c) => {
+app7.post("/set-pin", async (c) => {
   let existingUsers = null;
   try {
     existingUsers = readUsersFile();
@@ -7736,9 +7786,9 @@ app6.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync7(INSTALL_OWNER_FILE)) {
+    if (existsSync8(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync11(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync12(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -7782,7 +7832,7 @@ ${body.pin}
   }
   return c.json({ ok: true });
 });
-app6.delete("/set-pin", async (c) => {
+app7.delete("/set-pin", async (c) => {
   let users = null;
   try {
     users = readUsersFile();
@@ -7816,12 +7866,12 @@ app6.delete("/set-pin", async (c) => {
   }
   return c.json({ ok: true });
 });
-var onboarding_default = app6;
+var onboarding_default = app7;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync8, renameSync as renameSync2, statSync as statSync5 } from "fs";
-import { join as join10 } from "path";
-var CLIENT_ERRORS_LOG = join10(LOG_DIR, "client-errors.log");
+import { appendFileSync, existsSync as existsSync9, renameSync as renameSync2, statSync as statSync5 } from "fs";
+import { join as join11 } from "path";
+var CLIENT_ERRORS_LOG = join11(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -7864,7 +7914,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync8(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync9(CLIENT_ERRORS_LOG)) return;
     const stats = statSync5(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync2(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -7872,8 +7922,8 @@ function rotateIfNeeded() {
     console.error(`[client-error] log rotation failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-var app7 = new Hono();
-app7.post("/", async (c) => {
+var app8 = new Hono();
+app8.post("/", async (c) => {
   const client = resolveClientIp(
     c.env?.incoming?.socket?.remoteAddress,
     c.req.header("x-forwarded-for")
@@ -7975,21 +8025,21 @@ app7.post("/", async (c) => {
   }
   return c.json({ ok: true });
 });
-var client_error_default = app7;
+var client_error_default = app8;
 
 // server/routes/admin/session.ts
 import { randomUUID as randomUUID8 } from "crypto";
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync6 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync6 } from "fs";
+import { join as join12 } from "path";
 function hashPin2(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile2(usersFilePath) {
-  if (!existsSync9(usersFilePath)) return null;
-  const raw = readFileSync12(usersFilePath, "utf-8").trim();
+  if (!existsSync10(usersFilePath)) return null;
+  const raw = readFileSync13(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -8008,7 +8058,7 @@ function validatePin(pin, usersFilePath) {
 function scanForOrphanedAccountAdmins(users, accountsDir) {
   const known = new Set(users.map((u) => u.userId));
   const orphans = [];
-  if (!existsSync9(accountsDir)) return orphans;
+  if (!existsSync10(accountsDir)) return orphans;
   let entries;
   try {
     entries = readdirSync6(accountsDir);
@@ -8017,16 +8067,16 @@ function scanForOrphanedAccountAdmins(users, accountsDir) {
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const accountDir = join11(accountsDir, entry);
+    const accountDir = join12(accountsDir, entry);
     try {
       if (!statSync6(accountDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    const accountJsonPath = join11(accountDir, "account.json");
-    if (!existsSync9(accountJsonPath)) continue;
+    const accountJsonPath = join12(accountDir, "account.json");
+    if (!existsSync10(accountJsonPath)) continue;
     try {
-      const config = JSON.parse(readFileSync12(accountJsonPath, "utf-8"));
+      const config = JSON.parse(readFileSync13(accountJsonPath, "utf-8"));
       const admins = config.admins ?? [];
       for (const a of admins) {
         if (typeof a.userId === "string" && !known.has(a.userId)) orphans.push(a.userId);
@@ -8093,8 +8143,8 @@ async function createAdminSession(accountId, thinkingView, userId, userName, rol
     sessionId: initialSessionId
   };
 }
-var app8 = new Hono();
-app8.get("/", async (c) => {
+var app9 = new Hono();
+app9.get("/", async (c) => {
   const signedSessionToken = c.req.query("session_key");
   if (!signedSessionToken) {
     return c.json({ error: "Invalid or expired admin session" }, 401);
@@ -8140,7 +8190,7 @@ app8.get("/", async (c) => {
     sessionId: getSessionIdForSession(cacheKey) ?? null
   });
 });
-app8.post("/", async (c) => {
+app9.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -8203,21 +8253,21 @@ app8.post("/", async (c) => {
   const payload = await createAdminSession(selected.accountId, selected.config.thinkingView, userId, userName, selected.role, avatar);
   return c.json(payload);
 });
-var session_default = app8;
+var session_default = app9;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync11, readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync7 } from "fs";
-import { resolve as resolve10, basename as basename3 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync7 } from "fs";
+import { resolve as resolve11, basename as basename3 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync10 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync11 } from "fs";
+import { join as join13 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join12(dir, filename);
-    if (existsSync10(fullPath)) {
+    const fullPath = join13(dir, filename);
+    if (existsSync11(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -8226,15 +8276,15 @@ function resolveSessionLogPaths(filename, logDirs) {
 
 // server/routes/admin/logs.ts
 var TAIL_BYTES = 8192;
-var app9 = new Hono();
-app9.get("/", async (c) => {
+var app10 = new Hono();
+app10.get("/", async (c) => {
   const fileParam = c.req.query("file");
   const typeParam = c.req.query("type");
   const sessionIdParam = c.req.query("sessionId");
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve10(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve11(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -8242,10 +8292,10 @@ app9.get("/", async (c) => {
     const safe = basename3(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve10(dir, safe);
+      const filePath = resolve11(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync13(filePath);
+        const buffer = readFileSync14(filePath);
         const onDiskBytes = statSync7(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -8310,7 +8360,7 @@ app9.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename3(hit.path);
-        const buffer = readFileSync13(hit.path);
+        const buffer = readFileSync14(hit.path);
         const onDiskBytes = statSync7(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -8345,7 +8395,7 @@ app9.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync11(dir)) continue;
+    if (!existsSync12(dir)) continue;
     let files;
     try {
       files = readdirSync7(dir).filter((f) => f.endsWith(".log"));
@@ -8354,10 +8404,10 @@ app9.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve10(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve11(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync13(resolve10(dir, name));
+        const content = readFileSync14(resolve11(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -8369,12 +8419,12 @@ app9.get("/", async (c) => {
   }
   return c.json({ logs });
 });
-var logs_default = app9;
+var logs_default = app10;
 
 // server/routes/admin/claude-info.ts
 import { execFileSync as execFileSync3 } from "child_process";
-var app10 = new Hono();
-app10.get("/", (c) => {
+var app11 = new Hono();
+app11.get("/", (c) => {
   let version = "unknown";
   try {
     const raw = execFileSync3("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
@@ -8392,14 +8442,14 @@ app10.get("/", (c) => {
   const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
   return c.json({ version, account, model, thinkingView });
 });
-var claude_info_default = app10;
+var claude_info_default = app11;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
-import { resolve as resolve11 } from "path";
-var app11 = new Hono();
-app11.get("/:attachmentId", requireAdminSession, async (c) => {
+import { existsSync as existsSync13 } from "fs";
+import { resolve as resolve12 } from "path";
+var app12 = new Hono();
+app12.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -8409,12 +8459,12 @@ app11.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve11(ATTACHMENTS_ROOT, accountId, attachmentId);
-  if (!existsSync12(dir)) {
+  const dir = resolve12(ATTACHMENTS_ROOT, accountId, attachmentId);
+  if (!existsSync13(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve11(dir, `${attachmentId}.meta.json`);
-  if (!existsSync12(metaPath)) {
+  const metaPath = resolve12(dir, `${attachmentId}.meta.json`);
+  if (!existsSync13(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -8428,7 +8478,7 @@ app11.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve11(dir, dataFile);
+  const filePath = resolve12(dir, dataFile);
   const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -8438,27 +8488,27 @@ app11.get("/:attachmentId", requireAdminSession, async (c) => {
     }
   });
 });
-var attachment_default = app11;
+var attachment_default = app12;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve12 } from "path";
-import { readdirSync as readdirSync8, readFileSync as readFileSync14, existsSync as existsSync13, rmSync } from "fs";
-var app12 = new Hono();
-app12.get("/", (c) => {
+import { resolve as resolve13 } from "path";
+import { readdirSync as readdirSync8, readFileSync as readFileSync15, existsSync as existsSync14, rmSync } from "fs";
+var app13 = new Hono();
+app13.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve12(account.accountDir, "agents");
-  if (!existsSync13(agentsDir)) return c.json({ agents: [] });
+  const agentsDir = resolve13(account.accountDir, "agents");
+  if (!existsSync14(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync8(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve12(agentsDir, entry.name, "config.json");
-      if (!existsSync13(configPath2)) continue;
+      const configPath2 = resolve13(agentsDir, entry.name, "config.json");
+      if (!existsSync14(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync14(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync15(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -8474,7 +8524,7 @@ app12.get("/", (c) => {
   }
   return c.json({ agents });
 });
-app12.delete("/:slug", async (c) => {
+app13.delete("/:slug", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -8484,8 +8534,8 @@ app12.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve12(account.accountDir, "agents", slug);
-  if (!existsSync13(agentDir)) {
+  const agentDir = resolve13(account.accountDir, "agents", slug);
+  if (!existsSync14(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -8504,7 +8554,7 @@ app12.delete("/:slug", async (c) => {
     return c.json({ error: "Failed to delete agent" }, 500);
   }
 });
-app12.post("/:slug/project", async (c) => {
+app13.post("/:slug/project", async (c) => {
   const slug = c.req.param("slug");
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account resolved" }, 400);
@@ -8514,8 +8564,8 @@ app12.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve12(account.accountDir, "agents", slug);
-  if (!existsSync13(agentDir)) {
+  const agentDir = resolve13(account.accountDir, "agents", slug);
+  if (!existsSync14(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -8526,12 +8576,12 @@ app12.post("/:slug/project", async (c) => {
     return c.json({ error: `Projection failed: ${msg}` }, 500);
   }
 });
-var agents_default = app12;
+var agents_default = app13;
 
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync14, mkdirSync as mkdirSync3, createWriteStream } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync3, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -8669,7 +8719,7 @@ var replayJsonl = (..._args) => null;
 var resolveJsonlPath = (..._args) => null;
 
 // server/routes/admin/sessions.ts
-import { homedir } from "os";
+import { homedir as homedir2 } from "os";
 
 // app/lib/claude-agent/component-attachment.ts
 var pickComponentBytes = (..._args) => null;
@@ -8691,7 +8741,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync14(a.storagePath)) reason = "missing-file";
+    else if (!existsSync15(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -8798,8 +8848,8 @@ function formatAge(updatedAtStr) {
     return "unknown";
   }
 }
-var app13 = new Hono();
-app13.get("/", requireAdminSession, async (c) => {
+var app14 = new Hono();
+app14.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) return c.json({ error: "Account not found for session" }, 401);
@@ -8829,7 +8879,7 @@ app13.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to fetch sessions" }, 500);
   }
 });
-app13.post("/new", requireAdminSession, async (c) => {
+app14.post("/new", requireAdminSession, async (c) => {
   const oldCacheKey = c.var.cacheKey;
   console.log(`[admin-chat] new-conversation outcome=ingress cacheKey=${oldCacheKey.slice(0, 8)}`);
   const accountId = getAccountIdForSession(oldCacheKey);
@@ -8846,7 +8896,7 @@ app13.post("/new", requireAdminSession, async (c) => {
   console.log(`[admin-chat] new-conversation outcome=ok oldKey=${oldCacheKey.slice(0, 8)} newKey=${newCacheKey.slice(0, 8)}`);
   return c.json({ session_key: newSignedSessionToken, sessionId: null });
 });
-app13.post("/switch", requireAdminSession, async (c) => {
+app14.post("/switch", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -8874,7 +8924,7 @@ app13.post("/switch", requireAdminSession, async (c) => {
   console.log(`[session-switch] from=${cacheKey.slice(0, 8)} to=${targetCacheKey.slice(0, 8)} targetConvId=${targetSessionId?.slice(0, 8) ?? "none"} accountId=${accountId.slice(0, 8)}`);
   return c.json({ session_key: targetSignedSessionToken, sessionId: targetSessionId });
 });
-app13.delete("/:id", requireAdminSession, async (c) => {
+app14.delete("/:id", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
@@ -8919,7 +8969,7 @@ app13.delete("/:id", requireAdminSession, async (c) => {
     500
   );
 });
-app13.post("/:id/resume", async (c) => {
+app14.post("/:id/resume", async (c) => {
   const sessionId = c.req.param("id");
   const t0 = Date.now();
   const signedSessionToken = c.req.query("session_key") ?? "";
@@ -8984,7 +9034,7 @@ app13.post("/:id/resume", async (c) => {
     return c.json({ error: "Failed to load conversation messages" }, 500);
   }
   if (persistedAgentSessionId) {
-    const jsonlPath = resolveJsonlPath(homedir(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
+    const jsonlPath = resolveJsonlPath(homedir2(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
     const replay = replayJsonl(jsonlPath);
     jsonlMissing = replay.jsonlMissing;
     jsonlMalformedLines = replay.malformedLines;
@@ -9188,7 +9238,7 @@ app13.post("/:id/resume", async (c) => {
     }
   });
 });
-app13.put("/:id/label", requireAdminSession, async (c) => {
+app14.put("/:id/label", requireAdminSession, async (c) => {
   const sessionId = c.req.param("id");
   const cacheKey = c.var.cacheKey;
   let body;
@@ -9214,11 +9264,11 @@ app13.put("/:id/label", requireAdminSession, async (c) => {
     return c.json({ error: "Failed to rename session" }, 500);
   }
 });
-var sessions_default = app13;
+var sessions_default = app14;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync15, readFileSync as readFileSync15, readdirSync as readdirSync9, statSync as statSync8 } from "fs";
-import { dirname as dirname3, resolve as resolve13, join as join13 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync16, readdirSync as readdirSync9, statSync as statSync8 } from "fs";
+import { dirname as dirname3, resolve as resolve14, join as join14 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -9247,14 +9297,14 @@ function frontmatterField(manifest, field) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join13(pluginDir, "mcp/dist/index.js"),
-    join13(pluginDir, "mcp/src/index.ts")
+    join14(pluginDir, "mcp/dist/index.js"),
+    join14(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync15(path2)) continue;
+    if (!existsSync16(path2)) continue;
     try {
-      raw = readFileSync15(path2, "utf-8");
+      raw = readFileSync16(path2, "utf-8");
       break;
     } catch {
     }
@@ -9303,24 +9353,24 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve13(PLATFORM_ROOT, "plugins");
-  if (existsSync15(platformPlugins)) {
+  const platformPlugins = resolve14(PLATFORM_ROOT, "plugins");
+  if (existsSync16(platformPlugins)) {
     for (const name of readdirSync9(platformPlugins)) {
-      const dir = join13(platformPlugins, name);
+      const dir = join14(platformPlugins, name);
       try {
         if (statSync8(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve13(dirname3(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync15(premiumRoot)) {
+  const premiumRoot = resolve14(dirname3(PLATFORM_ROOT), "premium-plugins");
+  if (existsSync16(premiumRoot)) {
     for (const bundle of readdirSync9(premiumRoot)) {
-      const bundlePlugins = join13(premiumRoot, bundle, "plugins");
-      if (!existsSync15(bundlePlugins)) continue;
+      const bundlePlugins = join14(premiumRoot, bundle, "plugins");
+      if (!existsSync16(bundlePlugins)) continue;
       try {
         for (const name of readdirSync9(bundlePlugins)) {
-          const dir = join13(bundlePlugins, name);
+          const dir = join14(bundlePlugins, name);
           try {
             if (statSync8(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -9333,10 +9383,10 @@ function listPluginDirs() {
   return out;
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve13(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync15(accountFile)) return /* @__PURE__ */ new Set();
+  const accountFile = resolve14(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync16(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync15(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync16(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -9345,10 +9395,10 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync15(path2)) return null;
+  if (!existsSync16(path2)) return null;
   let raw;
   try {
-    raw = readFileSync15(path2, "utf-8");
+    raw = readFileSync16(path2, "utf-8");
   } catch {
     return null;
   }
@@ -9363,7 +9413,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join13(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join14(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -9380,7 +9430,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync15(join13(dir, "mcp/dist/index.js")) || existsSync15(join13(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync16(join14(dir, "mcp/dist/index.js")) || existsSync16(join14(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -9390,7 +9440,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join13(dir, relPath);
+      const skillPath = join14(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -9406,8 +9456,8 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve13(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync15(specialistsDir)) return [];
+  const specialistsDir = resolve14(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  if (!existsSync16(specialistsDir)) return [];
   let entries;
   try {
     entries = readdirSync9(specialistsDir);
@@ -9434,7 +9484,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join13(specialistsDir, file));
+    const fm = readFrontmatter(join14(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -9452,11 +9502,11 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve13(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync15(accountFile)) return [];
+  const accountFile = resolve14(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  if (!existsSync16(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync15(accountFile, "utf-8");
+    const raw = readFileSync16(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -9467,8 +9517,8 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve13(PLATFORM_ROOT, "plugins");
-  if (!existsSync15(pluginsDir)) return [];
+  const pluginsDir = resolve14(PLATFORM_ROOT, "plugins");
+  if (!existsSync16(pluginsDir)) return [];
   let entries;
   try {
     entries = readdirSync9(pluginsDir);
@@ -9478,11 +9528,11 @@ function computeDormantPlugins(accountId) {
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve13(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync15(manifestPath)) continue;
+    const manifestPath = resolve14(pluginsDir, name, "PLUGIN.md");
+    if (!existsSync16(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync15(manifestPath, "utf-8");
+      manifest = readFileSync16(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -9496,13 +9546,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync16, readFileSync as readFileSync16 } from "fs";
-import { resolve as resolve14 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync17 } from "fs";
+import { resolve as resolve15 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync16(statePath)) return null;
+  if (!existsSync17(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync16(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync17(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -9513,10 +9563,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync16(resolve14(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync17(resolve15(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -9527,7 +9577,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG21 = "[claude-session-manager:wrapper]";
+var TAG22 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -9539,18 +9589,18 @@ async function refuseIfClaudeAuthDead(c, route, sessionId) {
     503
   );
 }
-var app14 = new Hono();
+var app15 = new Hono();
 async function performSpawnWithInitialMessage(args) {
   const ownerStart = Date.now();
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG21} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG22} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG21} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG22} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -9577,24 +9627,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG21} forward-spawn-start managerBase=${managerBase3("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG22} forward-spawn-start managerBase=${managerBase3("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase3("claude-session-manager:wrapper")}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG21} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG22} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG21} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG22} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG21} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG22} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -9616,8 +9666,8 @@ function mintTranscriptEdge(sessionId, claudeSessionId, accountId) {
   if (!sessionId || !claudeSessionId) return;
   void linkConversationTranscript(sessionId, claudeSessionId, accountId);
 }
-app14.use("*", requireAdminSession);
-app14.post("/", async (c) => {
+app15.use("*", requireAdminSession);
+app15.post("/", async (c) => {
   const routeStart = Date.now();
   const cacheKey = c.get("cacheKey") ?? "";
   let body = {};
@@ -9629,7 +9679,7 @@ app14.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG21} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG22} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -9638,7 +9688,7 @@ app14.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG21} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG22} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -9657,24 +9707,24 @@ app14.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG21} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG22} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
-var claude_sessions_default = app14;
+var claude_sessions_default = app15;
 
 // server/routes/admin/log-ingest.ts
-var TAG22 = "[log-ingest]";
+var TAG23 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
-var app15 = new Hono();
+var app16 = new Hono();
 function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-app15.post("/", async (c) => {
+app16.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -9683,7 +9733,7 @@ app15.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG22} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG23} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -9714,7 +9764,7 @@ app15.post("/", async (c) => {
   else console.log(formatted);
   return c.json({ ok: true }, 200);
 });
-var log_ingest_default = app15;
+var log_ingest_default = app16;
 
 // server/routes/admin/events.ts
 var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
@@ -9723,20 +9773,20 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
   "device-url:vnc-surface-shown",
   "device-url:malformed"
 ]);
-var app16 = new Hono();
-app16.post("/", async (c) => {
-  const TAG30 = "[admin:events]";
+var app17 = new Hono();
+app17.post("/", async (c) => {
+  const TAG31 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG30} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG31} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG30} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG31} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -9755,21 +9805,21 @@ app16.post("/", async (c) => {
   console.error(`[${event}] ${formatted}`);
   return c.json({ ok: true });
 });
-var events_default = app16;
+var events_default = app17;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename5, dirname as dirname4, join as join15, resolve as resolve17, sep as sep5 } from "path";
+import { basename as basename5, dirname as dirname4, join as join16, resolve as resolve18, sep as sep5 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve15, normalize, sep as sep3, relative } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "../platform");
-var DATA_ROOT = resolve15(PLATFORM_ROOT5, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve15(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+import { resolve as resolve16, normalize, sep as sep3, relative } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve16(process.cwd(), "../platform");
+var DATA_ROOT = resolve16(PLATFORM_ROOT5, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve16(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath, accountId) {
@@ -9782,7 +9832,7 @@ function crossesForeignAccountPartition(relPath, accountId) {
 }
 function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve15(rootAbs, cleaned);
+  const absolute = resolve16(rootAbs, cleaned);
   let rootReal;
   try {
     rootReal = realpathSync3(rootAbs);
@@ -10141,7 +10191,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve16, relative as relative2, join as join14, basename as basename4, extname as extname2, sep as sep4 } from "path";
+import { resolve as resolve17, relative as relative2, join as join15, basename as basename4, extname as extname2, sep as sep4 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -10212,7 +10262,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join14(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join15(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -10274,7 +10324,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join14(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join15(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -10294,7 +10344,7 @@ async function walkSubtree(root, dataRoot, out) {
   let clean = true;
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
-    const abs = join14(root, entry.name);
+    const abs = join15(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -10449,8 +10499,8 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve16(dataRoot, "uploads", accountId),
-      resolve16(dataRoot, "accounts", accountId)
+      resolve17(dataRoot, "uploads", accountId),
+      resolve17(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -10531,7 +10581,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve16(dataRoot, relativePath);
+  const absolute = resolve17(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -10565,7 +10615,7 @@ async function dropFileIndex(accountId, relativePath, opts) {
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join15(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join16(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -10576,7 +10626,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve17(DATA_ROOT, "accounts");
+  const accountsDir = resolve18(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir3(accountsDir);
@@ -10585,7 +10635,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve17(accountsDir, name, "account.json");
+    const configPath2 = resolve18(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -10603,7 +10653,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join15(absolute, entry.name), entry.name);
+    const meta = await readMeta(join16(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -10663,8 +10713,8 @@ async function knowledgeDocOwnedByAccount(accountId, attachmentId) {
     await session.close();
   }
 }
-var app17 = new Hono();
-app17.get("/", requireAdminSession, async (c) => {
+var app18 = new Hono();
+app18.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10701,7 +10751,7 @@ app17.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join15(absolute, name);
+        const entryPath = join16(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -10730,7 +10780,7 @@ app17.get("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app17.get("/download", requireAdminSession, async (c) => {
+app18.get("/download", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10794,7 +10844,7 @@ app17.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-app17.post("/upload", requireAdminSession, async (c) => {
+app18.post("/upload", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10826,8 +10876,8 @@ app17.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename5(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve17(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve17(destDir, finalName);
+  const destDir = resolve18(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve18(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -10855,7 +10905,7 @@ app17.post("/upload", requireAdminSession, async (c) => {
     mimeType: file.type
   });
 });
-app17.delete("/", requireAdminSession, async (c) => {
+app18.delete("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -10892,7 +10942,7 @@ app17.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join15(dirname4(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join16(dirname4(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -10931,7 +10981,7 @@ app17.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: message }, 500);
   }
 });
-var files_default = app17;
+var files_default = app18;
 
 // ../lib/graph-search/src/index.ts
 var import_dist = __toESM(require_dist());
@@ -11696,8 +11746,8 @@ var DEFAULT_LIMIT = 20;
 var MAX_LIMIT = 2e3;
 var MESSAGE_FAMILY_LABELS = ["Message", "UserMessage", "AssistantMessage", "WhatsAppMessage"];
 var CONVERSATION_PARENT_LABELS = /* @__PURE__ */ new Set(["AdminConversation", "PublicConversation"]);
-var app18 = new Hono();
-app18.get("/", requireAdminSession, async (c) => {
+var app19 = new Hono();
+app19.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const q = (c.req.query("q") ?? "").trim();
   const rawLimit = c.req.query("limit");
@@ -11833,7 +11883,7 @@ app18.get("/", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-var graph_search_default = app18;
+var graph_search_default = app19;
 
 // server/routes/admin/graph-subgraph.ts
 import neo4j from "neo4j-driver";
@@ -11911,8 +11961,8 @@ var STRIPPED_PROPERTIES = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-var app19 = new Hono();
-app19.get("/", requireAdminSession, async (c) => {
+var app20 = new Hono();
+app20.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12495,12 +12545,12 @@ function pruneNode(node, warnedClasses, conversationWarnings) {
   }
   return trashed ? { id: node.id, labels, properties, trashed: true } : { id: node.id, labels, properties };
 }
-var graph_subgraph_default = app19;
+var graph_subgraph_default = app20;
 
 // server/routes/admin/graph-delete.ts
 var ALLOWED_BY = ["graph-page", "graph-drag-trash", "graph-side-panel-trash"];
-var app20 = new Hono();
-app20.post("/", requireAdminSession, async (c) => {
+var app21 = new Hono();
+app21.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12662,11 +12712,11 @@ app20.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_delete_default = app20;
+var graph_delete_default = app21;
 
 // server/routes/admin/graph-restore.ts
-var app21 = new Hono();
-app21.post("/", requireAdminSession, async (c) => {
+var app22 = new Hono();
+app22.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12730,11 +12780,11 @@ app21.post("/", requireAdminSession, async (c) => {
     }
   }
 });
-var graph_restore_default = app21;
+var graph_restore_default = app22;
 
 // server/routes/admin/graph-labels-in-graph.ts
-var app22 = new Hono();
-app22.get("/", requireAdminSession, async (c) => {
+var app23 = new Hono();
+app23.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12800,11 +12850,11 @@ var LABELS_IN_GRAPH_CYPHER = `
        sum(halfEdges) AS relDegree
   RETURN label, nodeCount, relDegree
 `;
-var graph_labels_in_graph_default = app22;
+var graph_labels_in_graph_default = app23;
 
 // server/routes/admin/graph-default-view.ts
-var app23 = new Hono();
-app23.get("/", requireAdminSession, async (c) => {
+var app24 = new Hono();
+app24.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12842,7 +12892,7 @@ app23.get("/", requireAdminSession, async (c) => {
     }
   }
 });
-app23.put("/", requireAdminSession, async (c) => {
+app24.put("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   const userId = getUserIdForSession(cacheKey);
@@ -12931,20 +12981,20 @@ var WRITE_CYPHER = `
       p.updatedAt = $updatedAt
   RETURN p.labels AS labels
 `;
-var graph_default_view_default = app23;
+var graph_default_view_default = app24;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve18, relative as relative3, isAbsolute, sep as sep6, basename as basename6 } from "path";
-import { existsSync as existsSync17 } from "fs";
+import { resolve as resolve19, relative as relative3, isAbsolute, sep as sep6, basename as basename6 } from "path";
+import { existsSync as existsSync18 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
   if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep6)) return null;
   return relative3(DATA_ROOT, absPath);
 }
-var app24 = new Hono();
-app24.get("/", requireAdminSession, async (c) => {
+var app25 = new Hono();
+app25.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -12955,7 +13005,7 @@ app24.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve18(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve19(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -13006,8 +13056,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve18(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve18(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve19(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve19(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -13020,12 +13070,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve18(accountDir, "specialists", "agents");
-  const bundledDir = resolve18(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve19(accountDir, "specialists", "agents");
+  const bundledDir = resolve19(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve18(overrideDir, filename);
-    const bundledPath = resolve18(bundledDir, filename);
+    const overridePath = resolve19(overrideDir, filename);
+    const bundledPath = resolve19(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -13042,7 +13092,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync17(dir)) continue;
+    if (!existsSync18(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -13057,7 +13107,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync17(inp.overridePath)) {
+  if (existsSync18(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -13068,7 +13118,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync17(inp.bundledPath)) {
+  } else if (existsSync18(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -13107,11 +13157,11 @@ function isWithin(target, root) {
   const rel = relative3(root, target);
   return !rel.startsWith("..") && !isAbsolute(rel);
 }
-var sidebar_artefacts_default = app24;
+var sidebar_artefacts_default = app25;
 
 // server/routes/admin/session-delete.ts
-var app25 = new Hono();
-app25.post("/", requireAdminSession, async (c) => {
+var app26 = new Hono();
+app26.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13149,11 +13199,11 @@ app25.post("/", requireAdminSession, async (c) => {
   console.error(`[session-delete] sessionId=${sessionId} delete-status=${del.status}`);
   return c.json({ error: `manager-status-${del.status}` }, 502);
 });
-var session_delete_default = app25;
+var session_delete_default = app26;
 
 // server/routes/admin/session-stop.ts
-var app26 = new Hono();
-app26.post("/", requireAdminSession, async (c) => {
+var app27 = new Hono();
+app27.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13178,11 +13228,63 @@ app26.post("/", requireAdminSession, async (c) => {
   console.error(`[session-stop] sessionId=${sessionId} manager-status=${res.status}`);
   return c.json({ error: `manager-status-${res.status}` }, 502);
 });
-var session_stop_default = app26;
+var session_stop_default = app27;
+
+// server/routes/admin/session-archive.ts
+var app28 = new Hono();
+app28.post("/", requireAdminSession, async (c) => {
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid JSON body" }, 400);
+  }
+  const sessionId = typeof body.sessionId === "string" ? body.sessionId : "";
+  if (!SESSION_ID_RE2.test(sessionId)) {
+    return c.json({ error: "sessionId must be a v4 UUID" }, 400);
+  }
+  const mode = body.mode;
+  if (mode !== "archive" && mode !== "unarchive") {
+    return c.json({ error: "mode must be 'archive' or 'unarchive'" }, 400);
+  }
+  let res;
+  try {
+    res = await fetch(`${managerBase3("session-archive:wrapper")}/${sessionId}/archive`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ mode })
+    });
+  } catch (err) {
+    console.error(`[session-archive] sessionId=${sessionId} manager-unreachable err=${err instanceof Error ? err.message : String(err)}`);
+    return c.json({ error: "manager-unreachable" }, 502);
+  }
+  if (res.status === 200) {
+    const dir = mode === "archive" ? "top\u2192archive" : "archive\u2192top";
+    console.log(`[session-archive] sessionId=${sessionId.slice(0, 8)} moved ${dir}`);
+    return c.json({ archived: mode === "archive" });
+  }
+  if (res.status === 409) {
+    console.error(`[session-archive] sessionId=${sessionId.slice(0, 8)} pty-still-alive`);
+    return c.json({ error: "pty-still-alive", detail: "end the session before archiving" }, 409);
+  }
+  if (res.status === 404) {
+    console.error(`[session-archive] sessionId=${sessionId.slice(0, 8)} session-not-found`);
+    return c.json({ error: "session-not-found" }, 404);
+  }
+  if (res.status === 500) {
+    const body2 = await res.json().catch(() => ({}));
+    const detail = typeof body2.detail === "string" ? body2.detail : body2.error ?? "archive-failed";
+    console.error(`[session-archive] sessionId=${sessionId.slice(0, 8)} archive-failed detail=${detail}`);
+    return c.json({ error: "archive-failed", detail }, 502);
+  }
+  console.error(`[session-archive] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
+  return c.json({ error: `manager-status-${res.status}` }, 502);
+});
+var session_archive_default = app28;
 
 // server/routes/admin/session-rc-spawn.ts
-var app27 = new Hono();
-app27.post("/", requireAdminSession, async (c) => {
+var app29 = new Hono();
+app29.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -13216,7 +13318,7 @@ app27.post("/", requireAdminSession, async (c) => {
   }
   return c.json(parsed ?? {});
 });
-var session_rc_spawn_default = app27;
+var session_rc_spawn_default = app29;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile5 } from "fs/promises";
@@ -13313,8 +13415,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app28 = new Hono();
-app28.get("/", async (c) => {
+var app30 = new Hono();
+app30.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -13337,27 +13439,27 @@ app28.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app28;
+var system_stats_default = app30;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync18, readFileSync as readFileSync17 } from "fs";
-import { resolve as resolve19, join as join16 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
+import { existsSync as existsSync19, readFileSync as readFileSync18 } from "fs";
+import { resolve as resolve20, join as join17 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join16(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync18(brandJsonPath)) {
+var brandJsonPath = join17(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync19(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync17(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync18(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve19(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve20(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync18(VERSION_FILE)) return "unknown";
-  return readFileSync17(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync19(VERSION_FILE)) return "unknown";
+  return readFileSync18(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -13382,8 +13484,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app29 = new Hono();
-app29.get("/", async (c) => {
+var app31 = new Hono();
+app31.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -13405,11 +13507,11 @@ app29.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app29;
+var health_default2 = app31;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID9 } from "crypto";
-var TAG23 = "[linkedin-ingest-route]";
+var TAG24 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -13507,35 +13609,35 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app30 = new Hono();
-app30.post("/", requireAdminSession, async (c) => {
+var app32 = new Hono();
+app32.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG23 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG24 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG23 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG24 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG23 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG24 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG23 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG24 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID9();
-  console.log(TAG23 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG24 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -13544,20 +13646,20 @@ app30.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG23 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG24 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG23 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG24 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
-var linkedin_ingest_default = app30;
+var linkedin_ingest_default = app32;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j2 from "neo4j-driver";
-var TAG24 = "[post-turn-context]";
+var TAG25 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -13595,11 +13697,11 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app31 = new Hono();
-app31.get("/", async (c) => {
+var app33 = new Hono();
+app33.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -13608,7 +13710,7 @@ app31.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -13640,7 +13742,7 @@ app31.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG24} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG25} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -13649,18 +13751,18 @@ app31.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG24} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG25} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
     await session.close();
   }
 });
-var post_turn_context_default = app31;
+var post_turn_context_default = app33;
 
 // server/routes/admin/public-session-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG25 = "[public-session-context]";
+var TAG26 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -13698,11 +13800,11 @@ function pruneProperties2(raw) {
   }
   return out;
 }
-var app32 = new Hono();
-app32.get("/", async (c) => {
+var app34 = new Hono();
+app34.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -13711,7 +13813,7 @@ app32.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -13742,7 +13844,7 @@ app32.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG25} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG26} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -13751,25 +13853,25 @@ app32.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG25} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG26} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
     await session.close();
   }
 });
-var public_session_context_default = app32;
+var public_session_context_default = app34;
 
 // server/routes/admin/public-session-exit.ts
-var TAG26 = "[public-session-exit-route]";
+var TAG27 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app33 = new Hono();
-app33.post("/", async (c) => {
+var app35 = new Hono();
+app35.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -13778,7 +13880,7 @@ app33.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -13793,18 +13895,18 @@ app33.post("/", async (c) => {
   handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app33;
+var public_session_exit_default = app35;
 
 // server/routes/admin/access-session-evict.ts
-var TAG27 = "[access-session-evict]";
+var TAG28 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app34 = new Hono();
-app34.post("/", async (c) => {
+var app36 = new Hono();
+app36.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -13813,7 +13915,7 @@ app34.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -13826,14 +13928,14 @@ app34.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG27} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG28} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app34;
+var access_session_evict_default = app36;
 
 // server/routes/admin/browser.ts
-var app35 = new Hono();
-app35.post("/launch", requireAdminSession, async (c) => {
+var app37 = new Hono();
+app37.post("/launch", requireAdminSession, async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     console.error(`[admin/browser/launch] op=request transport=${transport}`);
@@ -13861,53 +13963,54 @@ app35.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app35;
+var browser_default = app37;
 
 // server/routes/admin/index.ts
-var app36 = new Hono();
-app36.route("/session", session_default);
-app36.route("/logs", logs_default);
-app36.route("/claude-info", claude_info_default);
-app36.route("/attachment", attachment_default);
-app36.route("/agents", agents_default);
-app36.route("/sessions", sessions_default);
-app36.route("/claude-sessions", claude_sessions_default);
-app36.route("/log-ingest", log_ingest_default);
-app36.route("/events", events_default);
-app36.route("/files", files_default);
-app36.route("/graph-search", graph_search_default);
-app36.route("/graph-subgraph", graph_subgraph_default);
-app36.route("/graph-delete", graph_delete_default);
-app36.route("/graph-restore", graph_restore_default);
-app36.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app36.route("/graph-default-view", graph_default_view_default);
-app36.route("/sidebar-artefacts", sidebar_artefacts_default);
-app36.route("/sidebar-sessions", sidebar_sessions_default);
-app36.route("/session-delete", session_delete_default);
-app36.route("/session-stop", session_stop_default);
-app36.route("/browser", browser_default);
-app36.route("/session-rc-spawn", session_rc_spawn_default);
-app36.route("/system-stats", system_stats_default);
-app36.route("/health-brand", health_default2);
-app36.route("/linkedin-ingest", linkedin_ingest_default);
-app36.route("/post-turn-context", post_turn_context_default);
-app36.route("/public-session-context", public_session_context_default);
-app36.route("/public-session-exit", public_session_exit_default);
-app36.route("/access-session-evict", access_session_evict_default);
-var admin_default = app36;
+var app38 = new Hono();
+app38.route("/session", session_default);
+app38.route("/logs", logs_default);
+app38.route("/claude-info", claude_info_default);
+app38.route("/attachment", attachment_default);
+app38.route("/agents", agents_default);
+app38.route("/sessions", sessions_default);
+app38.route("/claude-sessions", claude_sessions_default);
+app38.route("/log-ingest", log_ingest_default);
+app38.route("/events", events_default);
+app38.route("/files", files_default);
+app38.route("/graph-search", graph_search_default);
+app38.route("/graph-subgraph", graph_subgraph_default);
+app38.route("/graph-delete", graph_delete_default);
+app38.route("/graph-restore", graph_restore_default);
+app38.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app38.route("/graph-default-view", graph_default_view_default);
+app38.route("/sidebar-artefacts", sidebar_artefacts_default);
+app38.route("/sidebar-sessions", sidebar_sessions_default);
+app38.route("/session-delete", session_delete_default);
+app38.route("/session-stop", session_stop_default);
+app38.route("/session-archive", session_archive_default);
+app38.route("/browser", browser_default);
+app38.route("/session-rc-spawn", session_rc_spawn_default);
+app38.route("/system-stats", system_stats_default);
+app38.route("/health-brand", health_default2);
+app38.route("/linkedin-ingest", linkedin_ingest_default);
+app38.route("/post-turn-context", post_turn_context_default);
+app38.route("/public-session-context", public_session_context_default);
+app38.route("/public-session-exit", public_session_exit_default);
+app38.route("/access-session-evict", access_session_evict_default);
+var admin_default = app38;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
-import { readFileSync as readFileSync18 } from "fs";
-import { resolve as resolve20 } from "path";
+import { readFileSync as readFileSync19 } from "fs";
+import { resolve as resolve21 } from "path";
 import { randomUUID as randomUUID10 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve20(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve21(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
-    return readFileSync18(passwordFile, "utf-8").trim();
+    return readFileSync19(passwordFile, "utf-8").trim();
   } catch {
     throw new Error(
       `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
@@ -14105,11 +14208,11 @@ async function generateNewMagicToken(grantId) {
 }
 
 // server/routes/access/verify-token.ts
-var TAG28 = "[access-verify]";
+var TAG29 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app37 = new Hono();
-app37.post("/", async (c) => {
+var app39 = new Hono();
+app39.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -14124,39 +14227,39 @@ app37.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -14172,12 +14275,12 @@ app37.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -14191,13 +14294,13 @@ app37.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app37;
+var verify_token_default = app39;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve21 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
-var SEND_SCRIPT = resolve21(
+import { resolve as resolve22 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
+var SEND_SCRIPT = resolve22(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -14253,10 +14356,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG29 = "[access-request-link]";
-var app38 = new Hono();
+var TAG30 = "[access-request-link]";
+var app40 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app38.post("/", async (c) => {
+app40.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -14270,18 +14373,18 @@ app38.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG29} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG30} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -14289,7 +14392,7 @@ app38.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG29} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG30} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -14321,26 +14424,26 @@ app38.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG29} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG30} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG29} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG30} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app38;
+var request_magic_link_default = app40;
 
 // server/routes/access/index.ts
-var app39 = new Hono();
-app39.route("/verify-token", verify_token_default);
-app39.route("/request-magic-link", request_magic_link_default);
-var access_default = app39;
+var app41 = new Hono();
+app41.route("/verify-token", verify_token_default);
+app41.route("/request-magic-link", request_magic_link_default);
+var access_default = app41;
 
 // server/routes/sites.ts
-import { existsSync as existsSync19, readFileSync as readFileSync19, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
-import { resolve as resolve22 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync20, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
+import { resolve as resolve23 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -14371,8 +14474,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app40 = new Hono();
-app40.get("/:rel{.*}", (c) => {
+var app42 = new Hono();
+app42.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -14397,15 +14500,15 @@ app40.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve22(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve22(rootDir, ...segments);
+  const rootDir = resolve23(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve23(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat7;
   try {
-    stat7 = existsSync19(filePath) ? statSync9(filePath) : null;
+    stat7 = existsSync20(filePath) ? statSync9(filePath) : null;
   } catch {
     stat7 = null;
   }
@@ -14418,13 +14521,13 @@ app40.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve22(filePath, "index.html");
+    filePath = resolve23(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync19(filePath)) {
+  if (!existsSync20(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -14443,7 +14546,7 @@ app40.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync19(realPath);
+    body = readFileSync20(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -14475,11 +14578,11 @@ app40.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app40;
+var sites_default = app42;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync20, writeFileSync as writeFileSync7 } from "fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync21, writeFileSync as writeFileSync7 } from "fs";
 import { dirname as dirname5 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -14488,7 +14591,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync20(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync21(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -14502,7 +14605,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync20(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync21(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -14555,8 +14658,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync22 } from "fs";
+import { join as join18 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -14564,10 +14667,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
-  const brandPath = join17(platformRoot2, "config", "brand.json");
-  if (!existsSync20(brandPath)) return null;
+  const brandPath = join18(platformRoot2, "config", "brand.json");
+  if (!existsSync21(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync21(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync22(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -14575,7 +14678,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app41 = new Hono();
+var app43 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -14620,17 +14723,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app41.options("/consent", (c) => {
+app43.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app41.options("/brand-config", (c) => {
+app43.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app41.post("/consent", async (c) => {
+app43.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -14670,7 +14773,7 @@ app41.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app41.get("/brand-config", (c) => {
+app43.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -14680,7 +14783,7 @@ app41.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app41;
+var visitor_consent_default = app43;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -14707,8 +14810,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app42 = new Hono();
-app42.get("/:slug/click", async (c) => {
+var app44 = new Hono();
+app44.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -14772,10 +14875,10 @@ app42.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app42;
+var listings_default = app44;
 
 // server/routes/visitor-event.ts
-var app43 = new Hono();
+var app45 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -14842,12 +14945,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app43.options("/event", (c) => {
+app45.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app43.post("/event", async (c) => {
+app45.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -15052,17 +15155,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app43;
+var visitor_event_default = app45;
 
 // server/routes/session.ts
-import { resolve as resolve23 } from "path";
-import { existsSync as existsSync21, writeFileSync as writeFileSync8, mkdirSync as mkdirSync5 } from "fs";
+import { resolve as resolve24 } from "path";
+import { existsSync as existsSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync5 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve23(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve24(MAXY_DIR, "branding-cache", accountId);
     mkdirSync5(cacheDir, { recursive: true });
-    writeFileSync8(resolve23(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync8(resolve24(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -15098,8 +15201,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app44 = new Hono();
-app44.post("/", async (c) => {
+var app46 = new Hono();
+app46.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15150,8 +15253,8 @@ app44.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve23(account.accountDir, "agents", agentSlug);
-    if (!existsSync21(agentDir) || !existsSync21(resolve23(agentDir, "config.json"))) {
+    const agentDir = resolve24(account.accountDir, "agents", agentSlug);
+    if (!existsSync22(agentDir) || !existsSync22(resolve24(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -15310,7 +15413,7 @@ app44.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app44;
+var session_default2 = app46;
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist3(), 1);
@@ -15431,7 +15534,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve24, sep as sep7 } from "path";
+import { resolve as resolve25, sep as sep7 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["uploads", "accounts"];
@@ -15450,7 +15553,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve24(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve25(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -15471,7 +15574,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve24(dataRoot, relativePath);
+    const absolute = resolve25(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -15495,7 +15598,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve24(dataRoot, rootName);
+    const absRoot = resolve25(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -15800,8 +15903,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app46 = new Hono();
-  app46.get("/wa-channel/inbound", (c) => {
+  const app48 = new Hono();
+  app48.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -15819,7 +15922,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app46.post("/wa-channel/reply", async (c) => {
+  app48.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -15830,15 +15933,17 @@ function createWaChannelRoutes(deps) {
     try {
       await deps.sendOutbound(senderId, text);
     } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const terminal = err instanceof WaReplyError ? err.terminal : false;
       console.error(
-        `[whatsapp-native] op=reply-failed senderId=${senderId} bytes=${bytes} error=${err instanceof Error ? err.message : String(err)}`
+        `[whatsapp-native] op=reply-failed senderId=${senderId} bytes=${bytes} terminal=${terminal} error=${message}`
       );
-      return c.json({ error: "send-failed" }, 500);
+      return c.json({ error: message, terminal }, 500);
     }
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app46.post("/wa-channel/ready", async (c) => {
+  app48.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -15847,7 +15952,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app46.post("/wa-channel/received", async (c) => {
+  app48.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -15857,7 +15962,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  return app46;
+  return app48;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -16050,8 +16155,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync22, readFileSync as readFileSync22, statSync as statSync10 } from "fs";
-import { resolve as resolve25 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync23, statSync as statSync10 } from "fs";
+import { resolve as resolve26 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -16086,7 +16191,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve25(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve26(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -16098,8 +16203,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve25(brand.configDir, "entitlement.json");
-  if (!existsSync22(entitlementPath)) {
+  const entitlementPath = resolve26(brand.configDir, "entitlement.json");
+  if (!existsSync23(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat7 = statSync10(entitlementPath);
@@ -16114,7 +16219,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync22(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync23(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -16128,7 +16233,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync22(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync23(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -16289,14 +16394,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join18(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join19(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync24(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync23(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync24(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -16315,11 +16420,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join18(homedir2(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join19(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync23(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync23(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync24(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync24(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -16343,16 +16448,21 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app45 = new Hono();
+var app47 = new Hono();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve26(process.env.MAXY_PLATFORM_ROOT ?? join18(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve27(process.env.MAXY_PLATFORM_ROOT ?? join19(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   ensureChannelSession: async ({ accountId, senderId, gatewayUrl, serverPath }) => {
     const userId = resolveAdminUserId({ accountId, senderPhone: senderId }) ?? void 0;
     console.error(`[whatsapp-native] op=admin-identity senderId=${senderId} userId=${userId ?? "owner-fallback"}`);
     const result = await managerRcSpawn({
       sessionId: adminSessionIdFor(accountId, senderId),
       userId,
+      // Task 724 — supply the channel so /rc-spawn writes the classification
+      // sidecar from the body, the same path every other admin channel uses.
+      // senderId for the sidecar continues to come from the waChannel binding.
+      role: "admin",
+      channel: "whatsapp",
       waChannel: { senderId, gatewayUrl, serverPath },
       logContext: `channel=whatsapp-native senderId=${senderId}`
     });
@@ -16361,10 +16471,10 @@ var waGateway = new WaGateway({
     }
   }
 });
-app45.route("/", waGateway.routes());
+app47.route("/", waGateway.routes());
 waGateway.startSweeper();
-app45.use("*", clientIpMiddleware);
-app45.use("*", async (c, next) => {
+app47.use("*", clientIpMiddleware);
+app47.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -16374,7 +16484,7 @@ app45.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app45.use("*", async (c, next) => {
+app47.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -16392,7 +16502,7 @@ app45.use("*", async (c, next) => {
     });
   }
 });
-app45.use("*", async (c, next) => {
+app47.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -16423,7 +16533,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app45.post("/__remote-auth/login", async (c) => {
+app47.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -16468,7 +16578,7 @@ app45.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app45.get("/__remote-auth/logout", (c) => {
+app47.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -16481,7 +16591,7 @@ app45.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app45.post("/__remote-auth/change-password", async (c) => {
+app47.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -16532,13 +16642,13 @@ app45.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app45.get("/__remote-auth/setup", (c) => {
+app47.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app45.post("/__remote-auth/set-initial-password", async (c) => {
+app47.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -16576,10 +16686,10 @@ app45.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app45.get("/api/remote-auth/status", (c) => {
+app47.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app45.post("/api/remote-auth/set-password", async (c) => {
+app47.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -16610,9 +16720,9 @@ app45.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app45.route("/api/_client-error", client_error_default);
+app47.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app45.use("*", async (c, next) => {
+app47.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -16645,14 +16755,15 @@ app45.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app45.route("/api/health", health_default);
-app45.route("/api/chat", chat_default);
-app45.route("/api/whatsapp", whatsapp_default);
-app45.route("/api/whatsapp-reader", whatsapp_reader_default);
-app45.route("/api/onboarding", onboarding_default);
-app45.route("/api/admin", admin_default);
-app45.route("/api/access", access_default);
-app45.route("/api/session", session_default2);
+app47.route("/api/health", health_default);
+app47.route("/api/chat", chat_default);
+app47.route("/api/whatsapp", whatsapp_default);
+app47.route("/api/whatsapp-reader", whatsapp_reader_default);
+app47.route("/api/telegram", telegram_default);
+app47.route("/api/onboarding", onboarding_default);
+app47.route("/api/admin", admin_default);
+app47.route("/api/access", access_default);
+app47.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -16664,7 +16775,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app45.get("/agent-assets/:slug/:filename", (c) => {
+app47.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -16680,26 +16791,26 @@ app45.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve26(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve26(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve27(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve27(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync23(filePath);
+  const body = readFileSync24(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app45.get("/generated/:filename", (c) => {
+app47.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -16710,35 +16821,35 @@ app45.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve26(account.accountDir, "generated", filename);
-  const expectedDir = resolve26(account.accountDir, "generated");
+  const filePath = resolve27(account.accountDir, "generated", filename);
+  const expectedDir = resolve27(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync23(filePath)) {
+  if (!existsSync24(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync23(filePath);
+  const body = readFileSync24(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app45.route("/sites", sites_default);
-app45.route("/listings", listings_default);
-app45.route("/v", visitor_event_default);
-app45.route("/v", visitor_consent_default);
+app47.route("/sites", sites_default);
+app47.route("/listings", listings_default);
+app47.route("/v", visitor_event_default);
+app47.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync23(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync24(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync23(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync24(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -16755,9 +16866,9 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join18(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync23(versionFile)) return "unknown";
-    const content = readFileSync23(versionFile, "utf-8").trim();
+    const versionFile = join19(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync24(versionFile)) return "unknown";
+    const content = readFileSync24(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -16798,7 +16909,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync23(resolve26(process.cwd(), "public", file), "utf-8");
+    html = readFileSync24(resolve27(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -16814,13 +16925,13 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join18(homedir2(), BRAND.configDir);
+  const configDir2 = join19(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join18(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync23(cachePath)) return null;
-    return JSON.parse(readFileSync23(cachePath, "utf-8"));
+    const cachePath = join19(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync24(cachePath)) return null;
+    return JSON.parse(readFileSync24(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -16863,7 +16974,7 @@ function escapeHtml(s) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app45.get("/", (c) => {
+app47.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -16879,12 +16990,12 @@ app45.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app45.get("/public", (c) => {
+app47.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app45.get("/chat", (c) => {
+app47.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -16903,12 +17014,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app45.use("/vnc-viewer.html", logViewerFetch);
-app45.use("/vnc-popout.html", logViewerFetch);
-app45.get("/vnc-popout.html", (c) => {
+app47.use("/vnc-viewer.html", logViewerFetch);
+app47.use("/vnc-popout.html", logViewerFetch);
+app47.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync23(resolve26(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync24(resolve27(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -16918,7 +17029,7 @@ app45.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app45.post("/api/vnc/client-event", async (c) => {
+app47.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -16939,30 +17050,30 @@ app45.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app45.get("/g/:slug", (c) => {
+app47.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app45.get("/graph", (c) => {
+app47.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app45.get("/sessions", (c) => {
+app47.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app45.get("/data", (c) => {
+app47.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app45.get("/browser", (c) => {
+app47.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app45.get("/:slug", async (c, next) => {
+app47.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -16977,13 +17088,13 @@ app45.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app45.get("/favicon.ico", (c) => {
+  app47.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app45.use("/*", serveStatic({ root: "./public" }));
-app45.all("*", (c) => {
+app47.use("/*", serveStatic({ root: "./public" }));
+app47.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -16997,7 +17108,7 @@ app45.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app45.fetch, port, hostname });
+var httpServer = serve({ fetch: app47.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startAuthHealthHeartbeat();
 {
@@ -17020,6 +17131,7 @@ var SUBAPP_MANIFEST = [
   { prefix: "/api/chat", file: "server/routes/chat.ts", subapp: chat_default },
   { prefix: "/api/whatsapp", file: "server/routes/whatsapp.ts", subapp: whatsapp_default },
   { prefix: "/api/whatsapp-reader", file: "server/routes/whatsapp-reader.ts", subapp: whatsapp_reader_default },
+  { prefix: "/api/telegram", file: "server/routes/telegram.ts", subapp: telegram_default },
   { prefix: "/api/onboarding", file: "server/routes/onboarding.ts", subapp: onboarding_default },
   { prefix: "/api/admin", file: "server/routes/admin/index.ts", subapp: admin_default },
   { prefix: "/api/access", file: "server/routes/access/index.ts", subapp: access_default },
@@ -17035,7 +17147,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app45.routes ?? []) {
+  for (const r of app47.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -17063,11 +17175,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync23(USERS_FILE)) {
+    if (!existsSync24(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync23(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync24(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -17117,6 +17229,9 @@ try {
 }
 var configDirForWhatsApp = basename7(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
+if (bootAccount) {
+  migrateRemovedConfigKeys(bootAccount.accountDir);
+}
 var bootAccountConfig = bootAccount?.config;
 var bootPublicAgent = bootAccount ? resolvePublicAgent(bootAccount.accountDir, { accountId: bootAccount.accountId })?.slug ?? null : null;
 var bootEntitlement = bootAccountConfig ? resolveEntitlement(
@@ -17174,7 +17289,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve26(process.env.MAXY_PLATFORM_ROOT ?? join18(__dirname, "..")),
+  platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join19(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {