@rubytech/create-maxy-code 0.1.290 → 0.1.292

package/payload/server/server.js

@@ -97,7 +97,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-EAJMRICW.js";
+} from "./chunk-QDCBAHPI.js";
 import {
   __commonJS,
   __toESM
@@ -411,6 +411,18 @@ var require_dist2 = __commonJS({
       Property: "#5C7A99",
       Viewing: "#D4A574",
       Offer: "#B08850",
+      // Construction ontology (Task 773; labels registered in schema.cypher by
+      // Task 650). Muted brick-red family — the construction register sits
+      // apart from people-terracotta, viewing-amber, and task-rose bands so
+      // siteoffice legends read as their own group. Top-level (operator-entry)
+      // labels only; child labels (LineItem, Milestone, Valuation,
+      // VariationNote, TimeLog) intentionally stay fallback-grey.
+      Job: "#8C3B2E",
+      QuoteDocument: "#A65A4A",
+      InboundInvoice: "#6B2A20",
+      SubContractor: "#BF7E6E",
+      SubInvoice: "#52201A",
+      WhatsAppGroup: "#D4A096",
       // External business entity — schema:Organization, written by memory-write
       // as the Supplier label. Warm tobacco — distinct hue from internal-business
       // slates so external entities are scannable at a glance.
@@ -1203,7 +1215,7 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync24, existsSync as existsSync25, watchFile } from "fs";
-import { resolve as resolve27, join as join19, basename as basename7 } from "path";
+import { resolve as resolve27, join as join20, basename as basename8 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -2432,8 +2444,45 @@ function isDuplicateInbound(key) {
   return true;
 }
 
+// app/lib/whatsapp/inbound/self-chat.ts
+var TAG4 = "[whatsapp:self-chat]";
+function normalizeJid(jid) {
+  const m = jid.match(/^(\d+)(?::\d+)?@(s\.whatsapp\.net|lid)$/i);
+  return m ? `${m[1]}@${m[2].toLowerCase()}` : jid;
+}
+function isSelfChatJid(remoteJid, self) {
+  const candidates = /* @__PURE__ */ new Set();
+  if (self.selfJid) candidates.add(normalizeJid(self.selfJid));
+  if (self.selfLid) candidates.add(normalizeJid(self.selfLid));
+  if (self.selfPhone) candidates.add(`${self.selfPhone}@s.whatsapp.net`);
+  if (candidates.size === 0) return false;
+  return candidates.has(normalizeJid(remoteJid));
+}
+function evaluateSelfChatCommand(input) {
+  if (!input.fromMe) return { kind: "not-self-chat" };
+  if (!isSelfChatJid(input.remoteJid, input)) return { kind: "not-self-chat" };
+  const tsMs = input.messageTimestampSec ? input.messageTimestampSec * 1e3 : 0;
+  const connAtMs = input.lastConnectedAtMs ?? 0;
+  const msgId = input.msgId ?? "?";
+  console.error(
+    `${TAG4} op=seen account=${input.accountId} msgId=${msgId} tsMs=${tsMs} connAtMs=${connAtMs} fromMe=true`
+  );
+  const skip = (reason) => {
+    console.error(`${TAG4} op=skip account=${input.accountId} msgId=${msgId} reason=${reason}`);
+    return { kind: "skip", reason };
+  };
+  if (input.msgId && isAgentSentMessage(input.msgId)) return skip("echo");
+  if (!(tsMs > connAtMs)) return skip("backfill");
+  if (isDuplicateInbound(`${input.accountId}:${input.remoteJid}:${input.msgId}`)) return skip("duplicate");
+  if (!input.text) return skip("no-text");
+  console.error(
+    `${TAG4} op=dispatch account=${input.accountId} msgId=${msgId} bytes=${Buffer.byteLength(input.text, "utf8")} agentType=admin`
+  );
+  return { kind: "dispatch", text: input.text };
+}
+
 // app/lib/whatsapp/activity.ts
-var TAG4 = "[whatsapp:activity]";
+var TAG5 = "[whatsapp:activity]";
 var RECENT_EVENTS_MAX = 200;
 var counters = /* @__PURE__ */ new Map();
 var recentEvents = [];
@@ -2461,10 +2510,10 @@ function recordActivity(event) {
       recentEvents.splice(0, recentEvents.length - RECENT_EVENTS_MAX);
     }
     console.error(
-      `${TAG4} channel-activity: direction=${direction} account=${accountId} jid=${jid}` + (messageType ? ` type=${messageType}` : "")
+      `${TAG5} channel-activity: direction=${direction} account=${accountId} jid=${jid}` + (messageType ? ` type=${messageType}` : "")
     );
   } catch (err) {
-    console.error(`${TAG4} recording failed: ${String(err)}`);
+    console.error(`${TAG5} recording failed: ${String(err)}`);
   }
 }
 function getChannelActivity(accountId) {
@@ -2485,7 +2534,7 @@ function getChannelActivity(accountId) {
 }
 
 // app/lib/whatsapp/outbound/send.ts
-var TAG5 = "[whatsapp:outbound]";
+var TAG6 = "[whatsapp:outbound]";
 async function sendTextMessage(sock, to, text, opts) {
   try {
     const jid = to.includes("@") ? to : toWhatsappJid(to);
@@ -2497,14 +2546,14 @@ async function sendTextMessage(sock, to, text, opts) {
     const messageId = result?.key?.id;
     if (messageId) {
       trackAgentSentMessage(messageId);
-      console.error(`${TAG5} sent text to=${jid} id=${messageId}`);
+      console.error(`${TAG6} sent text to=${jid} id=${messageId}`);
     }
     if (opts?.accountId) {
       recordActivity({ accountId: opts.accountId, direction: "outbound", jid, messageType: "text" });
     }
     return { success: true, messageId: messageId ?? void 0 };
   } catch (err) {
-    console.error(`${TAG5} send failed to=${to}: ${String(err)}`);
+    console.error(`${TAG6} send failed to=${to}: ${String(err)}`);
     return { success: false, error: String(err) };
   }
 }
@@ -2573,20 +2622,20 @@ async function sendMediaMessage(sock, to, media, opts) {
     const messageId = result?.key?.id;
     if (messageId) {
       trackAgentSentMessage(messageId);
-      console.error(`${TAG5} sent ${media.type} to=${jid} id=${messageId}`);
+      console.error(`${TAG6} sent ${media.type} to=${jid} id=${messageId}`);
     }
     if (opts?.accountId) {
       recordActivity({ accountId: opts.accountId, direction: "outbound", jid, messageType: media.type });
     }
     return { success: true, messageId: messageId ?? void 0 };
   } catch (err) {
-    console.error(`${TAG5} send media failed to=${to}: ${String(err)}`);
+    console.error(`${TAG6} send media failed to=${to}: ${String(err)}`);
     return { success: false, error: String(err) };
   }
 }
 
 // app/lib/whatsapp/persist-message.ts
-var TAG6 = "[whatsapp-persist]";
+var TAG7 = "[whatsapp-persist]";
 var sessionWriteLocks = /* @__PURE__ */ new Map();
 async function persistWhatsAppMessage(input) {
   if (!input.body || !input.msgKeyId) return null;
@@ -2691,7 +2740,7 @@ async function persistWhatsAppMessage(input) {
     const result = await session.run(cypher, params);
     const ms = Date.now() - t0;
     if (result.records.length === 0) {
-      console.error(`${TAG6} skip reason=conversation-not-found accountId=${input.platformAccountId} cacheKey=${input.cacheKey} messageId=${messageId}`);
+      console.error(`${TAG7} skip reason=conversation-not-found accountId=${input.platformAccountId} cacheKey=${input.cacheKey} messageId=${messageId}`);
       return null;
     }
     const rec = result.records[0];
@@ -2700,26 +2749,26 @@ async function persistWhatsAppMessage(input) {
     const senderElementId = rec.get("senderElementId");
     const senderReused = rec.get("senderReused") === true;
     if (existed) {
-      console.error(`${TAG6} noop reason=existing-message messageId=${messageId}`);
+      console.error(`${TAG7} noop reason=existing-message messageId=${messageId}`);
       return { messageId, created: false, senderElementId };
     }
     console.error(
-      `${TAG6} sender-resolved telephone=${senderTelephone} nodeKind=Person elementId=${senderElementId} reused=${senderReused}`
+      `${TAG7} sender-resolved telephone=${senderTelephone} nodeKind=Person elementId=${senderElementId} reused=${senderReused}`
     );
     if (prevMessageId) {
-      console.error(`${TAG6} next-merge prior=${prevMessageId} next=${messageId}`);
+      console.error(`${TAG7} next-merge prior=${prevMessageId} next=${messageId}`);
     } else {
-      console.error(`${TAG6} next-skip reason=no-prior msgId=${messageId}`);
+      console.error(`${TAG7} next-skip reason=no-prior msgId=${messageId}`);
     }
     console.error(
-      `${TAG6} write messageId=${messageId} accountId=${input.platformAccountId} cacheKey=${input.cacheKey} fromMe=${input.fromMe} dateSent=${dateSentIso} bodyBytes=${Buffer.byteLength(input.body, "utf8")} ms=${ms}`
+      `${TAG7} write messageId=${messageId} accountId=${input.platformAccountId} cacheKey=${input.cacheKey} fromMe=${input.fromMe} dateSent=${dateSentIso} bodyBytes=${Buffer.byteLength(input.body, "utf8")} ms=${ms}`
     );
     return { messageId, created: true, senderElementId };
   } catch (err) {
     const ms = Date.now() - t0;
     const reason = sanitizeReason(err);
     console.error(
-      `${TAG6} FAIL accountId=${input.platformAccountId} waname=${input.accountId} remoteJid=${input.remoteJid} msgKey=${input.msgKeyId} reason=${reason} ms=${ms}`
+      `${TAG7} FAIL accountId=${input.platformAccountId} waname=${input.accountId} remoteJid=${input.remoteJid} msgKey=${input.msgKeyId} reason=${reason} ms=${ms}`
     );
     return null;
   } finally {
@@ -2752,7 +2801,7 @@ function sanitizeReason(err) {
 }
 
 // app/lib/whatsapp/ensure-conversation.ts
-var TAG7 = "[whatsapp-persist]";
+var TAG8 = "[whatsapp-persist]";
 async function ensureWhatsAppConversation(input) {
   const t0 = Date.now();
   try {
@@ -2764,19 +2813,19 @@ async function ensureWhatsAppConversation(input) {
     const ms = Date.now() - t0;
     if (!result.sessionId) {
       console.error(
-        `${TAG7} conversation-merged FAIL cacheKey=${input.cacheKey} reason=null-sessionId ms=${ms}`
+        `${TAG8} conversation-merged FAIL cacheKey=${input.cacheKey} reason=null-sessionId ms=${ms}`
       );
       return null;
     }
     console.error(
-      `${TAG7} conversation-merged cacheKey=${input.cacheKey} agentType=${input.agentType} channel=whatsapp created=${result.created} ms=${ms}`
+      `${TAG8} conversation-merged cacheKey=${input.cacheKey} agentType=${input.agentType} channel=whatsapp created=${result.created} ms=${ms}`
     );
     return { sessionId: result.sessionId, created: result.created };
   } catch (err) {
     const ms = Date.now() - t0;
     const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
     console.error(
-      `${TAG7} conversation-merged FAIL cacheKey=${input.cacheKey} reason=${reason} ms=${ms}`
+      `${TAG8} conversation-merged FAIL cacheKey=${input.cacheKey} reason=${reason} ms=${ms}`
     );
     return null;
   }
@@ -2867,7 +2916,7 @@ import {
   downloadContentFromMessage,
   normalizeMessageContent as normalizeMessageContent2
 } from "@whiskeysockets/baileys";
-var TAG8 = "[whatsapp:media]";
+var TAG9 = "[whatsapp:media]";
 var MEDIA_DIR = "/tmp/maxy-media";
 function mimeToExt(mimetype) {
   const map = {
@@ -2923,25 +2972,25 @@ async function downloadInboundMedia(msg, sock, opts) {
       }
     );
     if (!buffer || buffer.length === 0) {
-      console.error(`${TAG8} primary download returned empty, trying direct fallback`);
+      console.error(`${TAG9} primary download returned empty, trying direct fallback`);
       const downloadable = getDownloadableContent(content);
       if (downloadable) {
         try {
           const stream2 = await downloadContentFromMessage(downloadable.downloadable, downloadable.mediaType);
           buffer = await streamToBuffer(stream2);
         } catch (fallbackErr) {
-          console.error(`${TAG8} direct download fallback failed: ${String(fallbackErr)}`);
+          console.error(`${TAG9} direct download fallback failed: ${String(fallbackErr)}`);
         }
       }
     }
     if (!buffer || buffer.length === 0) {
-      console.error(`${TAG8} download failed: empty buffer for ${mimetype ?? "unknown"}`);
+      console.error(`${TAG9} download failed: empty buffer for ${mimetype ?? "unknown"}`);
       return void 0;
     }
     if (buffer.length > maxBytes) {
       const sizeMB = (buffer.length / (1024 * 1024)).toFixed(1);
       const limitMB = (maxBytes / (1024 * 1024)).toFixed(0);
-      console.error(`${TAG8} media too large type=${mimetype ?? "unknown"} size=${sizeMB}MB limit=${limitMB}MB`);
+      console.error(`${TAG9} media too large type=${mimetype ?? "unknown"} size=${sizeMB}MB limit=${limitMB}MB`);
       return void 0;
     }
     await mkdir(MEDIA_DIR, { recursive: true });
@@ -2950,20 +2999,20 @@ async function downloadInboundMedia(msg, sock, opts) {
     const filePath = join2(MEDIA_DIR, filename);
     await writeFile(filePath, buffer);
     const sizeKB = (buffer.length / 1024).toFixed(0);
-    console.error(`${TAG8} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
+    console.error(`${TAG9} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
     return {
       path: filePath,
       mimetype: mimetype ?? "application/octet-stream",
       size: buffer.length
     };
   } catch (err) {
-    console.error(`${TAG8} media download failed type=${mimetype ?? "unknown"} error=${String(err)}`);
+    console.error(`${TAG9} media download failed type=${mimetype ?? "unknown"} error=${String(err)}`);
     return void 0;
   }
 }
 
 // app/lib/whatsapp/inbound/debounce.ts
-var TAG9 = "[whatsapp:debounce]";
+var TAG10 = "[whatsapp:debounce]";
 var STT_TAG = "[whatsapp:stt-await]";
 function createInboundDebouncer(opts) {
   const { debounceMs, buildKey, onFlush, onError } = opts;
@@ -2994,7 +3043,7 @@ function createInboundDebouncer(opts) {
     pending.delete(key);
     const batchSize = batch.entries.length;
     try {
-      console.error(`${TAG9} debounce flush key=${key} batchSize=${batchSize}`);
+      console.error(`${TAG10} debounce flush key=${key} batchSize=${batchSize}`);
       const result = onFlush(batch.entries);
       if (result && typeof result.catch === "function") {
         result.catch(onError);
@@ -3074,7 +3123,7 @@ function combineInboundBatch(entries) {
 }
 
 // app/lib/whatsapp/opening-hours.ts
-var TAG10 = "[whatsapp:hours]";
+var TAG11 = "[whatsapp:hours]";
 async function isBusinessOpen(accountId) {
   try {
     const timezone = await resolveTimezone(accountId);
@@ -3092,7 +3141,7 @@ async function isBusinessOpen(accountId) {
         { accountId, dayOfWeek, previousDayOfWeek }
       );
       if (result.records.length === 0) {
-        console.error(`${TAG10} [${accountId}] business hours check: no opening hours configured, treating as open`);
+        console.error(`${TAG11} [${accountId}] business hours check: no opening hours configured, treating as open`);
         return { open: true, reason: "no opening hours configured" };
       }
       const specs = result.records.filter((r) => r.get("opens") != null && r.get("closes") != null).map((r) => ({
@@ -3101,7 +3150,7 @@ async function isBusinessOpen(accountId) {
         closes: String(r.get("closes")).trim()
       }));
       if (specs.length === 0) {
-        console.error(`${TAG10} [${accountId}] business hours check: no opening hours configured, treating as open`);
+        console.error(`${TAG11} [${accountId}] business hours check: no opening hours configured, treating as open`);
         return { open: true, reason: "no opening hours configured" };
       }
       for (const spec of specs) {
@@ -3111,7 +3160,7 @@ async function isBusinessOpen(accountId) {
           if (spec.opens > spec.closes && currentTime < spec.closes) {
             const hoursStr = `${spec.opens}-${spec.closes} (${spec.day})`;
             console.error(
-              `${TAG10} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
+              `${TAG11} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
             );
             return {
               open: true,
@@ -3124,7 +3173,7 @@ async function isBusinessOpen(accountId) {
         } else if (isTimeInRange(currentTime, spec.opens, spec.closes)) {
           const hoursStr = `${spec.opens}-${spec.closes}`;
           console.error(
-            `${TAG10} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
+            `${TAG11} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
           );
           return {
             open: true,
@@ -3138,7 +3187,7 @@ async function isBusinessOpen(accountId) {
       const todaySpecs = specs.filter((s) => s.day === dayOfWeek);
       const allHours = todaySpecs.map((s) => `${s.opens}-${s.closes}`).join(", ") || "none today";
       console.error(
-        `${TAG10} [${accountId}] business hours check: closed (day=${dayOfWeek}, time=${currentTime}, hours=${allHours})`
+        `${TAG11} [${accountId}] business hours check: closed (day=${dayOfWeek}, time=${currentTime}, hours=${allHours})`
       );
       return {
         open: false,
@@ -3152,7 +3201,7 @@ async function isBusinessOpen(accountId) {
     }
   } catch (err) {
     console.error(
-      `${TAG10} [${accountId}] business hours check failed, treating as open: ${err instanceof Error ? err.message : String(err)}`
+      `${TAG11} [${accountId}] business hours check failed, treating as open: ${err instanceof Error ? err.message : String(err)}`
     );
     return { open: true, reason: "hours check failed (treating as open)" };
   }
@@ -3198,7 +3247,7 @@ import { execFile } from "child_process";
 import { unlink, stat } from "fs/promises";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
-var TAG11 = "[stt]";
+var TAG12 = "[stt]";
 var WHISPER_BINARY = process.env.WHISPER_BINARY ?? "/opt/whisper.cpp/build/bin/whisper-cli";
 var WHISPER_MODEL = process.env.WHISPER_MODEL ?? "/opt/whisper.cpp/models/ggml-base.bin";
 var WHISPER_TIMEOUT_MS = 20 * 60 * 1e3;
@@ -3209,11 +3258,11 @@ async function transcribe(audioPath, mimetype) {
     const s = await stat(audioPath);
     audioBytes = s.size;
   } catch {
-    console.error(`${TAG11} failed: file not readable path=${audioPath}`);
+    console.error(`${TAG12} failed: file not readable path=${audioPath}`);
     return void 0;
   }
   console.error(
-    `${TAG11} start provider=whisper-local audio_bytes=${audioBytes} mimetype=${mimetype} path=${audioPath}`
+    `${TAG12} start provider=whisper-local audio_bytes=${audioBytes} mimetype=${mimetype} path=${audioPath}`
   );
   const wavPath = audioPath.replace(/\.[^.]+$/, "") + ".wav";
   try {
@@ -3232,7 +3281,7 @@ async function transcribe(audioPath, mimetype) {
     ], { timeout: 3e4 });
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG11} failed: ffmpeg conversion error=${reason}`);
+    console.error(`${TAG12} failed: ffmpeg conversion error=${reason}`);
     return void 0;
   }
   try {
@@ -3250,20 +3299,20 @@ async function transcribe(audioPath, mimetype) {
     const text = stdout.trim();
     const durationMs = Date.now() - startMs;
     if (!text) {
-      console.error(`${TAG11} failed: whisper returned empty output duration_ms=${durationMs}`);
+      console.error(`${TAG12} failed: whisper returned empty output duration_ms=${durationMs}`);
       return void 0;
     }
     const langMatch = stderr.match(/auto-detected language:\s*(\w+)/);
     const language = langMatch?.[1] ?? "unknown";
     const words = text.split(/\s+/).filter(Boolean).length;
     console.error(
-      `${TAG11} done provider=whisper-local duration_ms=${durationMs} words=${words} lang=${language}`
+      `${TAG12} done provider=whisper-local duration_ms=${durationMs} words=${words} lang=${language}`
     );
     return { text, language, durationMs };
   } catch (err) {
     const durationMs = Date.now() - startMs;
     const reason = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG11} failed provider=whisper-local duration_ms=${durationMs} error=${reason}`);
+    console.error(`${TAG12} failed provider=whisper-local duration_ms=${durationMs} error=${reason}`);
     return void 0;
   } finally {
     unlink(wavPath).catch(() => {
@@ -3282,7 +3331,7 @@ var WaReplyError = class extends Error {
 };
 
 // app/lib/whatsapp/manager.ts
-var TAG12 = "[whatsapp:manager]";
+var TAG13 = "[whatsapp:manager]";
 var MAX_RECONNECT_ATTEMPTS = 10;
 var MESSAGE_STORE_MAX = 500;
 var connections = /* @__PURE__ */ new Map();
@@ -3301,7 +3350,7 @@ function storeMessage(storeKey, entry) {
   if (entries.length > MESSAGE_STORE_MAX) {
     const trimmed = entries.length - MESSAGE_STORE_MAX;
     entries.splice(0, trimmed);
-    console.error(`${TAG12} message store trimmed for ${storeKey}: ${trimmed} oldest messages removed`);
+    console.error(`${TAG13} message store trimmed for ${storeKey}: ${trimmed} oldest messages removed`);
   }
 }
 function deriveCacheKey(input) {
@@ -3318,9 +3367,28 @@ function deriveCacheKey(input) {
   }
   return `whatsapp:${input.accountId}:${input.senderPhone}`;
 }
+function buildSelfChatDispatch(input) {
+  const senderPhone = input.selfPhone ?? "owner";
+  return {
+    accountId: input.accountId,
+    agentType: "admin",
+    senderPhone,
+    text: input.text,
+    isGroup: false,
+    reply: input.reply,
+    composing: input.composing,
+    cacheKey: deriveCacheKey({
+      agentType: "admin",
+      accountId: input.accountId,
+      senderPhone,
+      isGroup: false
+    }),
+    media: []
+  };
+}
 async function init(opts) {
   if (initialized) {
-    console.error(`${TAG12} already initialized`);
+    console.error(`${TAG13} already initialized`);
     return;
   }
   configDir = opts.configDir;
@@ -3328,20 +3396,20 @@ async function init(opts) {
   loadConfig(opts.accountConfig);
   const accountIds = listCredentialAccountIds(configDir);
   if (accountIds.length === 0) {
-    console.error(`${TAG12} init: no stored WhatsApp credentials found`);
+    console.error(`${TAG13} init: no stored WhatsApp credentials found`);
     initialized = true;
     return;
   }
-  console.error(`${TAG12} init: found ${accountIds.length} credentialed account(s): ${accountIds.join(", ")}`);
+  console.error(`${TAG13} init: found ${accountIds.length} credentialed account(s): ${accountIds.join(", ")}`);
   initialized = true;
   for (const accountId of accountIds) {
     const accountCfg = whatsAppConfig.accounts?.[accountId];
     if (accountCfg?.enabled === false) {
-      console.error(`${TAG12} skipping disabled account=${accountId}`);
+      console.error(`${TAG13} skipping disabled account=${accountId}`);
       continue;
     }
     startConnection(accountId).catch((err) => {
-      console.error(`${TAG12} failed to auto-start account=${accountId}: ${formatError(err)}`);
+      console.error(`${TAG13} failed to auto-start account=${accountId}: ${formatError(err)}`);
     });
   }
 }
@@ -3350,7 +3418,7 @@ async function startConnection(accountId) {
   const authDir = resolveAuthDir(configDir, accountId);
   const hasAuth = await authExists(authDir);
   if (!hasAuth) {
-    console.error(`${TAG12} no credentials for account=${accountId}`);
+    console.error(`${TAG13} no credentials for account=${accountId}`);
     return;
   }
   let platformAccountId;
@@ -3400,11 +3468,11 @@ async function stopConnection(accountId) {
       conn.sock.ev.removeAllListeners("creds.update");
       conn.sock.ws?.close?.();
     } catch (err) {
-      console.warn(`${TAG12} socket cleanup error during stop account=${accountId}: ${String(err)}`);
+      console.warn(`${TAG13} socket cleanup error during stop account=${accountId}: ${String(err)}`);
     }
   }
   connections.delete(accountId);
-  console.error(`${TAG12} stopped account=${accountId}`);
+  console.error(`${TAG13} stopped account=${accountId}`);
 }
 function getStatus() {
   return Array.from(connections.values()).map((conn) => ({
@@ -3466,9 +3534,9 @@ async function registerLoginSocket(accountId, sock, authDir) {
   connections.set(accountId, conn);
   try {
     await sock.sendPresenceUpdate("available");
-    console.error(`${TAG12} presence set to available account=${accountId}`);
+    console.error(`${TAG13} presence set to available account=${accountId}`);
   } catch (err) {
-    console.error(`${TAG12} presence update failed account=${accountId}: ${String(err)}`);
+    console.error(`${TAG13} presence update failed account=${accountId}: ${String(err)}`);
   }
   await runInitQueries(sock, {
     accountId,
@@ -3480,7 +3548,7 @@ async function registerLoginSocket(accountId, sock, authDir) {
   monitorInbound(conn);
   watchForDisconnect(conn);
   attachSelfIdRefreshOnCredsUpdate(conn);
-  console.error(`${TAG12} registered login socket for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
+  console.error(`${TAG13} registered login socket for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
 }
 function attachSelfIdRefreshOnCredsUpdate(conn) {
   if (!conn.sock) return;
@@ -3531,7 +3599,7 @@ async function shutdown() {
   const ids = Array.from(connections.keys());
   await Promise.all(ids.map((id) => stopConnection(id)));
   initialized = false;
-  console.error(`${TAG12} shutdown complete`);
+  console.error(`${TAG13} shutdown complete`);
 }
 function loadConfig(accountConfig) {
   try {
@@ -3542,19 +3610,19 @@ function loadConfig(accountConfig) {
       if (result.ok) {
         whatsAppConfig = result.data;
         if (result.droppedKeys.length > 0) {
-          console.error(`${TAG12} config: dropped unknown keys=[${result.droppedKeys.join(",")}] preserved known config`);
+          console.error(`${TAG13} config: dropped unknown keys=[${result.droppedKeys.join(",")}] preserved known config`);
         }
       } else {
-        console.error(`${TAG12} config validation failed: ${result.error.message}`);
+        console.error(`${TAG13} config validation failed: ${result.error.message}`);
         whatsAppConfig = {};
       }
       const diskAdmin = Array.isArray(wa.adminPhones) ? wa.adminPhones : [];
       if (diskAdmin.length > 0 && (whatsAppConfig.adminPhones?.length ?? 0) === 0) {
-        console.error(`${TAG12} WARN adminPhones present on disk but empty after load`);
+        console.error(`${TAG13} WARN adminPhones present on disk but empty after load`);
       }
     }
   } catch (err) {
-    console.error(`${TAG12} config load error: ${String(err)}`);
+    console.error(`${TAG13} config load error: ${String(err)}`);
     whatsAppConfig = {};
   }
 }
@@ -3565,13 +3633,13 @@ async function connectWithReconnect(conn) {
     let cycleError = null;
     let connectedAt;
     try {
-      console.error(`${TAG12} connecting account=${conn.accountId} attempt=${conn.reconnectAttempts}`);
+      console.error(`${TAG13} connecting account=${conn.accountId} attempt=${conn.reconnectAttempts}`);
       const sock = await createWaSocket({
         authDir: conn.authDir,
         silent: true
       });
       conn.sock = sock;
-      console.error(`${TAG12} socket created account=${conn.accountId} \u2014 waiting for connection`);
+      console.error(`${TAG13} socket created account=${conn.accountId} \u2014 waiting for connection`);
       await waitForConnection(sock);
       const selfId = readSelfId(conn.authDir);
       connectedAt = Date.now();
@@ -3589,12 +3657,12 @@ async function connectWithReconnect(conn) {
       } else {
         console.error(`[whatsapp:lid] FAIL self-lid-resolution accountId=${conn.accountId} reason=creds-missing-lid`);
       }
-      console.error(`${TAG12} connected account=${conn.accountId} phone=${selfId.e164 ?? "unknown"}`);
+      console.error(`${TAG13} connected account=${conn.accountId} phone=${selfId.e164 ?? "unknown"}`);
       try {
         await sock.sendPresenceUpdate("available");
-        console.error(`${TAG12} presence set to available account=${conn.accountId}`);
+        console.error(`${TAG13} presence set to available account=${conn.accountId}`);
       } catch (err) {
-        console.error(`${TAG12} presence update failed account=${conn.accountId}: ${String(err)}`);
+        console.error(`${TAG13} presence update failed account=${conn.accountId}: ${String(err)}`);
       }
       await runInitQueries(sock, {
         accountId: conn.accountId,
@@ -3622,10 +3690,10 @@ async function connectWithReconnect(conn) {
       }
       const classification = classifyDisconnect(err);
       conn.lastError = classification.message;
-      console.error(`${TAG12} disconnect account=${conn.accountId}: ${classification.kind} \u2014 ${classification.message}`);
+      console.error(`${TAG13} disconnect account=${conn.accountId}: ${classification.kind} \u2014 ${classification.message}`);
       if (!classification.shouldRetry) {
         conn.terminalReason = classification.message;
-        console.error(`${TAG12} terminal disconnect for account=${conn.accountId}, stopping reconnection`);
+        console.error(`${TAG13} terminal disconnect for account=${conn.accountId}, stopping reconnection`);
         return;
       }
     }
@@ -3638,7 +3706,7 @@ async function connectWithReconnect(conn) {
     if (decision.action === "abort") {
       const stuckReason = `GIVING UP account=${conn.accountId} attempts=${decision.finalAttempts}/${maxAttempts} uptimeMsLast=${uptimeMs} stableThresholdMs=${STABLE_UPTIME_MS} lastError=${conn.lastError ?? "(none)"}`;
       console.error(
-        `${TAG12} ${stuckReason} \u2014 re-pair via QR or restart required; WhatsApp will not reconnect automatically`
+        `${TAG13} ${stuckReason} \u2014 re-pair via QR or restart required; WhatsApp will not reconnect automatically`
       );
       conn.sessionStuckReason = stuckReason;
       conn.lastError = stuckReason;
@@ -3647,17 +3715,17 @@ async function connectWithReconnect(conn) {
     conn.reconnectAttempts = decision.nextAttempts;
     if (decision.reason === "short-lived") {
       console.error(
-        `${TAG12} short-lived session account=${conn.accountId} uptimeMs=${uptimeMs} attempt=${decision.nextAttempts}/${maxAttempts} lastError=${conn.lastError ?? "(clean disconnect)"}`
+        `${TAG13} short-lived session account=${conn.accountId} uptimeMs=${uptimeMs} attempt=${decision.nextAttempts}/${maxAttempts} lastError=${conn.lastError ?? "(clean disconnect)"}`
       );
     } else {
       console.error(
-        `${TAG12} session stable account=${conn.accountId} uptimeMs=${uptimeMs} \u2014 reconnect counter reset`
+        `${TAG13} session stable account=${conn.accountId} uptimeMs=${uptimeMs} \u2014 reconnect counter reset`
       );
     }
     if (decision.reason === "short-lived" || cycleError) {
       const delay = computeBackoff(Math.max(1, decision.nextAttempts));
       console.error(
-        `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
+        `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
       await new Promise((resolve28) => {
         const timer2 = setTimeout(resolve28, delay);
@@ -3691,11 +3759,11 @@ function watchForDisconnect(conn) {
   conn.sock.ev.on("connection.update", (update) => {
     if (update.connection === "close") {
       if (connections.get(conn.accountId) !== conn) return;
-      console.error(`${TAG12} socket disconnected for account=${conn.accountId}`);
+      console.error(`${TAG13} socket disconnected for account=${conn.accountId}`);
       conn.connected = false;
       conn.sock = null;
       connectWithReconnect(conn).catch((err) => {
-        console.error(`${TAG12} reconnection failed for account=${conn.accountId}: ${formatError(err)}`);
+        console.error(`${TAG13} reconnection failed for account=${conn.accountId}: ${formatError(err)}`);
       });
     }
   });
@@ -3704,7 +3772,7 @@ function monitorInbound(conn) {
   if (!conn.sock || !onInboundMessage) return;
   const sock = conn.sock;
   const debounceMs = whatsAppConfig.accounts?.[conn.accountId]?.debounceMs ?? whatsAppConfig.debounceMs ?? 0;
-  console.error(`${TAG12} monitorInbound started account=${conn.accountId} debounceMs=${debounceMs}`);
+  console.error(`${TAG13} monitorInbound started account=${conn.accountId} debounceMs=${debounceMs}`);
   conn.debouncer = createInboundDebouncer({
     debounceMs,
     buildKey: (payload) => {
@@ -3714,12 +3782,12 @@ function monitorInbound(conn) {
     onFlush: (entries) => {
       if (!onInboundMessage) return;
       if (entries.length > 1) {
-        console.error(`${TAG12} debounce: combining ${entries.length} messages account=${conn.accountId} from=${entries[0].senderPhone}`);
+        console.error(`${TAG13} debounce: combining ${entries.length} messages account=${conn.accountId} from=${entries[0].senderPhone}`);
       }
       onInboundMessage(combineInboundBatch(entries));
     },
     onError: (err) => {
-      console.error(`${TAG12} debounce flush error account=${conn.accountId}: ${String(err)}`);
+      console.error(`${TAG13} debounce flush error account=${conn.accountId}: ${String(err)}`);
     }
   });
   sock.ev.on("messages.upsert", async (upsert) => {
@@ -3747,7 +3815,7 @@ function monitorInbound(conn) {
           });
           const entries = messageStore.get(storeKey);
           console.error(
-            `${TAG12} stored message ${msg.key.id ?? "?"} for ${remoteJid} (type: ${upsert.type}, store size: ${entries?.length ?? 0}/${MESSAGE_STORE_MAX}) account=${conn.accountId}`
+            `${TAG13} stored message ${msg.key.id ?? "?"} for ${remoteJid} (type: ${upsert.type}, store size: ${entries?.length ?? 0}/${MESSAGE_STORE_MAX}) account=${conn.accountId}`
           );
           recordActivity({
             accountId: conn.accountId,
@@ -3810,14 +3878,46 @@ function monitorInbound(conn) {
               isGroupJid(remoteJid) ? msg.key.participant ?? void 0 : void 0
             );
           }
+          const decision = evaluateSelfChatCommand({
+            accountId: conn.accountId,
+            remoteJid,
+            fromMe: Boolean(msg.key.fromMe),
+            msgId: msg.key.id ?? null,
+            messageTimestampSec: msg.messageTimestamp ? Number(msg.messageTimestamp) : null,
+            lastConnectedAtMs: conn.lastConnectedAt ?? null,
+            selfJid: conn.selfJid,
+            selfLid: conn.selfLid,
+            selfPhone: conn.selfPhone,
+            text: extracted.text || null
+          });
+          if (decision.kind === "dispatch" && onInboundMessage) {
+            const reply = async (text) => {
+              const currentSock = conn.sock;
+              if (!currentSock) throw new Error("WhatsApp disconnected \u2014 cannot reply");
+              await sendTextMessage(currentSock, remoteJid, text, { accountId: conn.accountId });
+            };
+            const composing = async () => {
+              const currentSock = conn.sock;
+              if (currentSock) await sendComposing(currentSock, remoteJid);
+            };
+            onInboundMessage(buildSelfChatDispatch({
+              accountId: conn.accountId,
+              selfPhone: conn.selfPhone,
+              remoteJid,
+              text: decision.text,
+              reply,
+              composing
+            }));
+            continue;
+          }
           console.error(
-            `${TAG12} append-type message ${msg.key.id ?? "?"} stored, dispatch skipped account=${conn.accountId}`
+            `${TAG13} append-type message ${msg.key.id ?? "?"} stored, dispatch skipped account=${conn.accountId}`
           );
           continue;
         }
         await handleInboundMessage(conn, msg);
       } catch (err) {
-        console.error(`${TAG12} inbound handler error account=${conn.accountId}: ${String(err)}`);
+        console.error(`${TAG13} inbound handler error account=${conn.accountId}: ${String(err)}`);
       }
     }
   });
@@ -3827,31 +3927,31 @@ async function handleInboundMessage(conn, msg) {
   const remoteJid = msg.key.remoteJid;
   if (!remoteJid) return;
   if (remoteJid === "status@broadcast") {
-    console.error(`${TAG12} drop: status broadcast account=${conn.accountId}`);
+    console.error(`${TAG13} drop: status broadcast account=${conn.accountId}`);
     return;
   }
   if (!msg.message) {
-    console.error(`${TAG12} drop: empty message account=${conn.accountId} from=${remoteJid}`);
+    console.error(`${TAG13} drop: empty message account=${conn.accountId} from=${remoteJid}`);
     return;
   }
   const dedupKey = `${conn.accountId}:${remoteJid}:${msg.key.id}`;
   if (isDuplicateInbound(dedupKey)) {
-    console.error(`${TAG12} drop: duplicate account=${conn.accountId} key=${dedupKey}`);
+    console.error(`${TAG13} drop: duplicate account=${conn.accountId} key=${dedupKey}`);
     return;
   }
   if (msg.key.fromMe) {
     if (msg.key.id && isAgentSentMessage(msg.key.id)) {
-      console.error(`${TAG12} drop: echo suppression account=${conn.accountId} msgId=${msg.key.id}`);
+      console.error(`${TAG13} drop: echo suppression account=${conn.accountId} msgId=${msg.key.id}`);
       return;
     }
     const extracted2 = extractMessage(msg);
     if (!extracted2.text) {
-      console.error(`${TAG12} owner reply skipped \u2014 no text content account=${conn.accountId}`);
+      console.error(`${TAG13} owner reply skipped \u2014 no text content account=${conn.accountId}`);
       return;
     }
     const isGroup2 = isGroupJid(remoteJid);
     const senderPhone2 = conn.selfPhone ?? "owner";
-    console.error(`${TAG12} owner reply mirrored to session from=${senderPhone2} account=${conn.accountId}`);
+    console.error(`${TAG13} owner reply mirrored to session from=${senderPhone2} account=${conn.accountId}`);
     const reply2 = async (text) => {
       const currentSock = conn.sock;
       if (!currentSock) throw new Error("WhatsApp disconnected \u2014 cannot reply");
@@ -3885,7 +3985,7 @@ async function handleInboundMessage(conn, msg) {
   }
   const extracted = extractMessage(msg);
   if (!extracted.text && !extracted.mediaType) {
-    console.error(`${TAG12} drop: no text or media account=${conn.accountId} from=${remoteJid}`);
+    console.error(`${TAG13} drop: no text or media account=${conn.accountId} from=${remoteJid}`);
     return;
   }
   let mediaResult;
@@ -3895,7 +3995,7 @@ async function handleInboundMessage(conn, msg) {
       maxBytes: maxMb * 1024 * 1024
     });
     if (!mediaResult) {
-      console.error(`${TAG12} media download returned undefined account=${conn.accountId} type=${extracted.mediaType} from=${remoteJid}`);
+      console.error(`${TAG13} media download returned undefined account=${conn.accountId} type=${extracted.mediaType} from=${remoteJid}`);
     }
   }
   const isGroup = isGroupJid(remoteJid);
@@ -3933,7 +4033,7 @@ async function handleInboundMessage(conn, msg) {
     });
   }
   console.error(
-    `${TAG12} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
+    `${TAG13} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
   );
   if (!accessResult.allowed) return;
   const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
@@ -3942,7 +4042,7 @@ async function handleInboundMessage(conn, msg) {
   }
   const reply = async (text) => {
     if (isGroupJid(remoteJid)) {
-      console.error(`${TAG12} op=group-reply-blocked jid=${remoteJid}`);
+      console.error(`${TAG13} op=group-reply-blocked jid=${remoteJid}`);
       throw new WaReplyError("group reply blocked \u2014 observe-only", false);
     }
     const currentSock = conn.sock;
@@ -3980,15 +4080,15 @@ async function handleInboundMessage(conn, msg) {
   if (accessResult.agentType === "public") {
     const hoursResult = await isBusinessOpen(conn.accountId);
     if (!hoursResult.open) {
-      console.error(`${TAG12} [${conn.accountId}] dispatch skipped: business closed`);
+      console.error(`${TAG13} [${conn.accountId}] dispatch skipped: business closed`);
       const afterHoursMessage = whatsAppConfig.accounts?.[conn.accountId]?.afterHoursMessage ?? whatsAppConfig.afterHoursMessage;
       if (afterHoursMessage) {
         try {
           await reply(afterHoursMessage);
-          console.error(`${TAG12} [${conn.accountId}] after-hours auto-reply sent to ${remoteJid}`);
+          console.error(`${TAG13} [${conn.accountId}] after-hours auto-reply sent to ${remoteJid}`);
         } catch (err) {
           console.error(
-            `${TAG12} [${conn.accountId}] after-hours auto-reply failed: ${err instanceof Error ? err.message : String(err)}`
+            `${TAG13} [${conn.accountId}] after-hours auto-reply failed: ${err instanceof Error ? err.message : String(err)}`
           );
         }
       }
@@ -4502,7 +4602,7 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join3 } from "path";
-var TAG13 = "[voice]";
+var TAG14 = "[voice]";
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
   "audio/opus",
@@ -4540,7 +4640,7 @@ async function transcribeVoiceNote(file, source) {
   const bytes = file.size;
   const mimeType = file.type;
   console.error(
-    `${TAG13} recording send source=${source} duration_ms=unknown bytes=${bytes} format=${mimeType}`
+    `${TAG14} recording send source=${source} duration_ms=unknown bytes=${bytes} format=${mimeType}`
   );
   let tempDir;
   let tempPath;
@@ -4552,7 +4652,7 @@ async function transcribeVoiceNote(file, source) {
     await writeFile3(tempPath, buffer);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG13} failed source=${source} error=temp-file-write: ${reason}`);
+    console.error(`${TAG14} failed source=${source} error=temp-file-write: ${reason}`);
     return { ok: false, error: "Could not process voice note" };
   }
   try {
@@ -4560,7 +4660,7 @@ async function transcribeVoiceNote(file, source) {
     if (!sttResult) {
       const elapsed2 = Date.now() - startMs;
       console.error(
-        `${TAG13} failed source=${source} error=transcription-failed duration_ms=${elapsed2}`
+        `${TAG14} failed source=${source} error=transcription-failed duration_ms=${elapsed2}`
       );
       return { ok: false, error: "Could not transcribe voice note. Please try again or type your message." };
     }
@@ -4568,7 +4668,7 @@ async function transcribeVoiceNote(file, source) {
     const elapsed = Date.now() - startMs;
     const words = rawText.split(/\s+/).filter(Boolean).length;
     console.error(
-      `${TAG13} transcribed source=${source} duration_ms=${elapsed} stt_ms=${sttResult.durationMs} words=${words}`
+      `${TAG14} transcribed source=${source} duration_ms=${elapsed} stt_ms=${sttResult.durationMs} words=${words}`
     );
     return {
       ok: true,
@@ -4578,7 +4678,7 @@ async function transcribeVoiceNote(file, source) {
     const elapsed = Date.now() - startMs;
     const reason = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG13} failed source=${source} error=${reason} duration_ms=${elapsed}`
+      `${TAG14} failed source=${source} error=${reason} duration_ms=${elapsed}`
     );
     return { ok: false, error: "Voice note transcription failed. Please try again or type your message." };
   } finally {
@@ -4647,6 +4747,7 @@ async function managerRcSpawn(opts) {
       personId: opts.personId,
       userId: opts.userId,
       waChannel: opts.waChannel,
+      webchatChannel: opts.webchatChannel,
       role: opts.role,
       channel: opts.channel,
       senderId: opts.senderId
@@ -4718,7 +4819,7 @@ function adminSessionIdFor(accountId, senderId) {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID4 } from "crypto";
-var TAG14 = "[public-session-review]";
+var TAG15 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -4745,7 +4846,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG14} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG15} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -4769,7 +4870,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG14} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG15} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -4777,7 +4878,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG14} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG15} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -4806,7 +4907,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID4();
-  console.log(`${TAG14} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG15} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -4826,21 +4927,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG15} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG15} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG15} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -4854,19 +4955,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG15} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG15} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG14} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG15} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -5040,21 +5141,21 @@ async function fanOut(subscribers, text, onError, tag) {
 import { realpathSync as realpathSync2 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
 import { resolve as resolve4, basename } from "path";
-var TAG15 = "[whatsapp:outbound]";
+var TAG16 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
 var lastRouteDocumentOutboundAt = /* @__PURE__ */ new Map();
-function normalizeJid(to) {
+function normalizeJid2(to) {
   return to.includes("@") ? to : toWhatsappJid(to);
 }
 function routeKey(to, filePath) {
-  return `${normalizeJid(to)}\0${filePath}`;
+  return `${normalizeJid2(to)}\0${filePath}`;
 }
 function documentOutboundAt(to) {
-  return lastDocumentOutboundAt.get(normalizeJid(to));
+  return lastDocumentOutboundAt.get(normalizeJid2(to));
 }
 function recordDocumentOutbound(to) {
-  lastDocumentOutboundAt.set(normalizeJid(to), Date.now());
+  lastDocumentOutboundAt.set(normalizeJid2(to), Date.now());
 }
 function recordRouteDocumentOutbound(to, filePath) {
   lastRouteDocumentOutboundAt.set(routeKey(to, filePath), Date.now());
@@ -5077,16 +5178,16 @@ async function sendWhatsAppDocument(input) {
     const accountResolved = realpathSync2(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
       const sanitised = filePath.replace(accountDir, "<account>/");
-      console.error(`${TAG15} document REJECTED path=${sanitised} reason=outside_account_directory`);
+      console.error(`${TAG16} document REJECTED path=${sanitised} reason=outside_account_directory`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG15} document ENOENT path=${filePath}`);
+      console.error(`${TAG16} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG15} document path error: ${String(err)}`);
+    console.error(`${TAG16} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat2(resolvedPath);
@@ -5098,10 +5199,10 @@ async function sendWhatsAppDocument(input) {
     };
   }
   const filename = basename(resolvedPath);
-  const jid = normalizeJid(to);
+  const jid = normalizeJid2(to);
   const sock = getSocket(accountId);
   if (!sock) {
-    console.error(`${TAG15} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=false reason=not-connected`);
+    console.error(`${TAG16} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=false reason=not-connected`);
     return { ok: false, status: 503, error: `WhatsApp account "${accountId}" is not connected` };
   }
   const buffer = Buffer.from(await readFile(resolvedPath));
@@ -5113,7 +5214,7 @@ async function sendWhatsAppDocument(input) {
     { accountId }
   );
   console.error(
-    `${TAG15} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
+    `${TAG16} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
   );
   if (result.success) {
     recordDocumentOutbound(to);
@@ -5123,7 +5224,7 @@ async function sendWhatsAppDocument(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG16 = "[whatsapp-adaptor]";
+var TAG17 = "[whatsapp-adaptor]";
 var SEND_USER_FILE = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
@@ -5158,7 +5259,7 @@ function makeWhatsAppFileDelivery(entry) {
         maxyAccountId = resolvePlatformAccountId();
       } catch (err) {
         console.error(
-          `${TAG16} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+          `${TAG17} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
         );
         return;
       }
@@ -5175,7 +5276,7 @@ function makeWhatsAppFileDelivery(entry) {
         if (!result.ok) {
           failedFiles.push(files[i]);
           console.error(
-            `${TAG16} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+            `${TAG17} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
           );
         }
       }
@@ -5192,7 +5293,7 @@ function makeWhatsAppFileDelivery(entry) {
       const sid = entry.sessionId.slice(0, 8);
       for (const file of failed) {
         console.error(
-          `${TAG16} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
+          `${TAG17} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
         );
       }
       const okAt = documentOutboundAt(entry.senderId);
@@ -5203,13 +5304,13 @@ function makeWhatsAppFileDelivery(entry) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG16} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG17} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
       if (firedTools.includes(SEND_USER_FILE) && attempts === 0 && !documentWentOut) {
         console.error(
-          `${TAG16} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
+          `${TAG17} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
         );
       }
     }
@@ -5791,7 +5892,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
 import { resolve as resolve6, join as join4 } from "path";
-var TAG17 = "[whatsapp:config]";
+var TAG18 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve6(accountDir, "account.json");
 }
@@ -5808,9 +5909,9 @@ function reloadManagerConfig(accountDir) {
   try {
     const config = readConfig(accountDir);
     reloadConfig(config);
-    console.error(`${TAG17} reloaded manager config`);
+    console.error(`${TAG18} reloaded manager config`);
   } catch (err) {
-    console.error(`${TAG17} manager config reload failed: ${String(err)}`);
+    console.error(`${TAG18} manager config reload failed: ${String(err)}`);
   }
 }
 var E164_PATTERN = /^\+\d{7,15}$/;
@@ -5836,25 +5937,25 @@ function persistAfterPairing(accountDir, accountId, selfPhone) {
       const adminPhones = wa.adminPhones;
       if (!adminPhones.includes(normalized)) {
         adminPhones.push(normalized);
-        console.error(`${TAG17} added selfPhone=${normalized} to adminPhones`);
+        console.error(`${TAG18} added selfPhone=${normalized} to adminPhones`);
       }
     } else {
-      console.error(`${TAG17} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
+      console.error(`${TAG18} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
     }
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG17} validation failed after pairing: ${msg}`);
+      console.error(`${TAG18} validation failed after pairing: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG17} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
+    console.error(`${TAG18} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
     reloadManagerConfig(accountDir);
     return { ok: true };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG17} persist failed account=${accountId}: ${msg}`);
+    console.error(`${TAG18} persist failed account=${accountId}: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5884,12 +5985,12 @@ function addAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG17} added admin phone=${normalized}`);
+    console.error(`${TAG18} added admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Added ${normalized} as admin phone. Messages from this number will route to the admin agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG17} addAdminPhone failed: ${msg}`);
+    console.error(`${TAG18} addAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5917,12 +6018,12 @@ function removeAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG17} removed admin phone=${normalized}`);
+    console.error(`${TAG18} removed admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Removed ${normalized} from admin phones. Messages from this number will now route to the public agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG17} removeAdminPhone failed: ${msg}`);
+    console.error(`${TAG18} removeAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5960,12 +6061,12 @@ function setPublicAgent(accountDir, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG17} publicAgent set to ${trimmed}`);
+    console.error(`${TAG18} publicAgent set to ${trimmed}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Public agent set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG17} setPublicAgent failed: ${msg}`);
+    console.error(`${TAG18} setPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -6006,17 +6107,17 @@ function updateConfig(accountDir, fields) {
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG17} update validation failed: ${msg}`);
+      console.error(`${TAG18} update validation failed: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG17} updated fields=[${fieldNames.join(",")}]`);
+    console.error(`${TAG18} updated fields=[${fieldNames.join(",")}]`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Updated WhatsApp config: ${fieldNames.join(", ")}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG17} updateConfig failed: ${msg}`);
+    console.error(`${TAG18} updateConfig failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -6053,17 +6154,17 @@ function migrateRemovedConfigKeys(accountDir) {
     }
     writeConfig(accountDir, config);
     console.error(
-      `${TAG17} migration: stripped unknown keys=[${result.droppedKeys.join(",")}] from account.json`
+      `${TAG18} migration: stripped unknown keys=[${result.droppedKeys.join(",")}] from account.json`
     );
     return { dropped: result.droppedKeys };
   } catch (err) {
-    console.error(`${TAG17} migration failed: ${String(err)}`);
+    console.error(`${TAG18} migration failed: ${String(err)}`);
     return { dropped: [] };
   }
 }
 
 // app/lib/whatsapp/login.ts
-var TAG18 = "[whatsapp:login]";
+var TAG19 = "[whatsapp:login]";
 function maskPhone(digits) {
   if (digits.length <= 4) return "*".repeat(digits.length);
   return digits.slice(0, 2) + "*".repeat(digits.length - 4) + digits.slice(-2);
@@ -6074,7 +6175,7 @@ function closeSocket(sock) {
   try {
     sock.ws?.close?.();
   } catch (err) {
-    console.warn(`${TAG18} socket close error during cleanup: ${String(err)}`);
+    console.warn(`${TAG19} socket close error during cleanup: ${String(err)}`);
   }
 }
 function resetActiveLogin(accountId) {
@@ -6101,18 +6202,18 @@ async function runPostPairing(login) {
         const masked = selfPhone ? `${selfPhone.slice(0, 4)}***` : "null";
         console.error(`[whatsapp-persist] wa-persist-on-connect account=${login.accountId} phone=${masked}`);
       } else {
-        console.error(`${TAG18} wa-persist-on-connect FAILED account=${login.accountId}: ${result.error}`);
+        console.error(`${TAG19} wa-persist-on-connect FAILED account=${login.accountId}: ${result.error}`);
       }
     } catch (err) {
-      console.error(`${TAG18} wa-persist-on-connect error account=${login.accountId}: ${String(err)}`);
+      console.error(`${TAG19} wa-persist-on-connect error account=${login.accountId}: ${String(err)}`);
     }
   } else {
-    console.error(`${TAG18} wa-persist-on-connect skipped \u2014 no accountDir account=${login.accountId}`);
+    console.error(`${TAG19} wa-persist-on-connect skipped \u2014 no accountDir account=${login.accountId}`);
   }
   try {
     await registerLoginSocket(login.accountId, login.sock, login.authDir);
   } catch (err) {
-    console.error(`${TAG18} registerLoginSocket failed account=${login.accountId}: ${String(err)}`);
+    console.error(`${TAG19} registerLoginSocket failed account=${login.accountId}: ${String(err)}`);
   }
 }
 async function loginConnectionLoop(accountId, login) {
@@ -6124,7 +6225,7 @@ async function loginConnectionLoop(accountId, login) {
       if (current?.id === login.id) {
         await runPostPairing(current);
         current.connected = true;
-        console.error(`${TAG18} loginConnectionLoop: connected account=${accountId} attempt=${attempt} configPersisted=${current.configPersisted}`);
+        console.error(`${TAG19} loginConnectionLoop: connected account=${accountId} attempt=${attempt} configPersisted=${current.configPersisted}`);
       }
       return;
     } catch (err) {
@@ -6134,7 +6235,7 @@ async function loginConnectionLoop(accountId, login) {
       if (!classification.shouldRetry || attempt >= LOGIN_MAX_RECONNECTS) {
         if (attempt >= LOGIN_MAX_RECONNECTS) {
           console.error(
-            `${TAG18} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
+            `${TAG19} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
           );
           current.error = `Login failed after ${attempt} reconnect attempts: ${formatError(err)}`;
         } else {
@@ -6146,7 +6247,7 @@ async function loginConnectionLoop(accountId, login) {
       attempt++;
       const delay = LOGIN_RECONNECT_DELAYS[attempt - 1] ?? 8e3;
       console.error(
-        `${TAG18} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
+        `${TAG19} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
       );
       closeSocket(current.sock);
       await new Promise((r) => setTimeout(r, delay));
@@ -6157,7 +6258,7 @@ async function loginConnectionLoop(accountId, login) {
         current.sock = newSock;
       } catch (sockErr) {
         console.error(
-          `${TAG18} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
+          `${TAG19} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
         );
         current.error = `Reconnection failed: ${String(sockErr)}`;
         return;
@@ -6171,7 +6272,7 @@ async function startLogin(opts) {
   const hasAuth = await authExists(authDir);
   const selfId = readSelfId(authDir);
   console.error(
-    `${TAG18} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasCode=${!!existing0.pairingCode}}` : " activeLogin=none")
+    `${TAG19} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasCode=${!!existing0.pairingCode}}` : " activeLogin=none")
   );
   if (hasAuth && !force) {
     const who = selfId.e164 ?? selfId.jid ?? "unknown";
@@ -6186,7 +6287,7 @@ async function startLogin(opts) {
   }
   const existing = activeLogins.get(accountId);
   if (existing && isLoginFresh(existing) && existing.pairingCode && !force) {
-    console.error(`${TAG18} startLogin account=${accountId} guard: returning existing pairing code (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
+    console.error(`${TAG19} startLogin account=${accountId} guard: returning existing pairing code (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
     return {
       pairingCode: existing.pairingCode,
       phone: existing.phone,
@@ -6194,7 +6295,7 @@ async function startLogin(opts) {
     };
   }
   if (existing) {
-    console.error(`${TAG18} startLogin account=${accountId} ${force ? "force override" : "stale/no-code"}, resetting active login`);
+    console.error(`${TAG19} startLogin account=${accountId} ${force ? "force override" : "stale/no-code"}, resetting active login`);
   }
   resetActiveLogin(accountId);
   await clearAuth(authDir);
@@ -6224,7 +6325,7 @@ async function startLogin(opts) {
           const current = activeLogins.get(accountId);
           if (current?.id !== login.id) return;
           if (!current.pairingCode) current.pairingCode = code;
-          console.error(`${TAG18} pairing-code-issued account=${accountId} phone=${maskPhone(digits)} codeLen=${code.length}`);
+          console.error(`${TAG19} pairing-code-issued account=${accountId} phone=${maskPhone(digits)} codeLen=${code.length}`);
           resolveCode?.(code);
         }).catch((err) => {
           clearTimeout(codeTimer);
@@ -6253,7 +6354,7 @@ async function startLogin(opts) {
   const ttlTimer = setTimeout(() => {
     const current = activeLogins.get(accountId);
     if (current?.id === login.id && !current.connected) {
-      console.error(`${TAG18} pairing-window-elapsed account=${accountId} (ttl sweep)`);
+      console.error(`${TAG19} pairing-window-elapsed account=${accountId} (ttl sweep)`);
       resetActiveLogin(accountId);
     }
   }, ACTIVE_LOGIN_TTL_MS);
@@ -6261,7 +6362,7 @@ async function startLogin(opts) {
     ttlTimer.unref();
   }
   loginConnectionLoop(accountId, login).catch((err) => {
-    console.error(`${TAG18} loginConnectionLoop unexpected error: ${String(err)}`);
+    console.error(`${TAG19} loginConnectionLoop unexpected error: ${String(err)}`);
     const current = activeLogins.get(accountId);
     if (current?.id === login.id) {
       current.error = `Unexpected login error: ${String(err)}`;
@@ -6286,13 +6387,13 @@ async function waitForLogin(opts) {
   const { accountId, timeoutMs = 6e4 } = opts;
   const login = activeLogins.get(accountId);
   console.error(
-    `${TAG18} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasCode=${!!login.pairingCode}}` : " login=none")
+    `${TAG19} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasCode=${!!login.pairingCode}}` : " login=none")
   );
   if (!login) {
     return { connected: false, message: "No active WhatsApp login in progress.", configPersisted: false };
   }
   if (!isLoginFresh(login)) {
-    console.error(`${TAG18} pairing-window-elapsed account=${accountId}`);
+    console.error(`${TAG19} pairing-window-elapsed account=${accountId}`);
     resetActiveLogin(accountId);
     return { connected: false, message: "The pairing window expired. Ask me to generate a new code.", configPersisted: false };
   }
@@ -6300,8 +6401,8 @@ async function waitForLogin(opts) {
   while (Date.now() < deadline) {
     if (login.connected) {
       const selfId = readSelfId(login.authDir);
-      console.error(`${TAG18} pairing-connected account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
-      console.error(`${TAG18} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"} configPersisted=${login.configPersisted}`);
+      console.error(`${TAG19} pairing-connected account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
+      console.error(`${TAG19} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"} configPersisted=${login.configPersisted}`);
       const configPersisted = login.configPersisted;
       activeLogins.delete(accountId);
       return {
@@ -6319,7 +6420,7 @@ async function waitForLogin(opts) {
     await new Promise((r) => setTimeout(r, 1e3));
   }
   const elapsed = Math.round((Date.now() - (deadline - timeoutMs)) / 1e3);
-  console.error(`${TAG18} waitForLogin poll timeout account=${accountId} elapsed=${elapsed}s \u2014 login kept alive (pairing code still valid)`);
+  console.error(`${TAG19} waitForLogin poll timeout account=${accountId} elapsed=${elapsed}s \u2014 login kept alive (pairing code still valid)`);
   return { connected: false, message: "Still waiting for you to enter the pairing code. The code is still valid \u2014 ask me to keep waiting, or request a new code.", configPersisted: false };
 }
 
@@ -6434,7 +6535,7 @@ function serializeWhatsAppSchema() {
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync2 } from "fs";
 import { join as join5 } from "path";
-var TAG19 = "[whatsapp:reconcile]";
+var TAG20 = "[whatsapp:reconcile]";
 function listCredsAccountIds(credsRoot) {
   try {
     return readdirSync2(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join5(credsRoot, e.name))).map((e) => e.name);
@@ -6456,14 +6557,14 @@ function reconcileCredsOnDisk(opts) {
     const selfPhone = readSelfId(authDir).e164 ?? void 0;
     const configured = accountDir ? isAccountConfigured(accountDir, accountId) : false;
     console.error(
-      `${TAG19} wa-link-unconfigured account=${accountId} creds=present config=${configured ? "present" : "absent"}`
+      `${TAG20} wa-link-unconfigured account=${accountId} creds=present config=${configured ? "present" : "absent"}`
     );
     if (!configured && accountDir) {
       const result = persistAfterPairing(accountDir, accountId, selfPhone ?? null);
       if (result.ok) {
-        console.error(`${TAG19} self-healed account=${accountId}`);
+        console.error(`${TAG20} self-healed account=${accountId}`);
       } else {
-        console.error(`${TAG19} self-heal FAILED account=${accountId}: ${result.error}`);
+        console.error(`${TAG20} self-heal FAILED account=${accountId}: ${result.error}`);
       }
     }
     entries.push({ accountId, selfPhone, connected: false, linkedUnconfigured: !configured });
@@ -6472,7 +6573,7 @@ function reconcileCredsOnDisk(opts) {
 }
 
 // server/routes/whatsapp.ts
-var TAG20 = "[whatsapp:api]";
+var TAG21 = "[whatsapp:api]";
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT || "";
 var app3 = new Hono();
 app3.get("/status", (c) => {
@@ -6484,10 +6585,10 @@ app3.get("/status", (c) => {
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds });
     const accounts = [...live, ...reconciled];
     const summary = accounts.map((a) => `${a.accountId}:${a.connected ? "up" : a.linkedUnconfigured ? "linked-unconfigured" : "down"}`).join(", ");
-    console.error(`${TAG20} status accounts=${accounts.length} [${summary}]`);
+    console.error(`${TAG21} status accounts=${accounts.length} [${summary}]`);
     return c.json({ accounts });
   } catch (err) {
-    console.error(`${TAG20} status error: ${String(err)}`);
+    console.error(`${TAG21} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6503,10 +6604,10 @@ app3.post("/login/start", async (c) => {
     const authDir = join6(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
-    console.error(`${TAG20} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
+    console.error(`${TAG21} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG20} login/start error: ${String(err)}`);
+    console.error(`${TAG21} login/start error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6516,7 +6617,7 @@ app3.post("/login/wait", async (c) => {
     const accountId = validateAccountId(body.accountId);
     const timeoutMs = body.timeoutMs ?? 6e4;
     const result = await waitForLogin({ accountId, timeoutMs });
-    console.error(`${TAG20} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${result.configPersisted}`);
+    console.error(`${TAG21} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${result.configPersisted}`);
     return c.json({
       connected: result.connected,
       message: result.message,
@@ -6524,7 +6625,7 @@ app3.post("/login/wait", async (c) => {
       configPersisted: result.configPersisted
     });
   } catch (err) {
-    console.error(`${TAG20} login/wait error: ${String(err)}`);
+    console.error(`${TAG21} login/wait error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6535,7 +6636,7 @@ app3.post("/disconnect", async (c) => {
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
   } catch (err) {
-    console.error(`${TAG20} disconnect error: ${String(err)}`);
+    console.error(`${TAG21} disconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6546,7 +6647,7 @@ app3.post("/reconnect", async (c) => {
     await startConnection(accountId);
     return c.json({ reconnecting: true, accountId });
   } catch (err) {
-    console.error(`${TAG20} reconnect error: ${String(err)}`);
+    console.error(`${TAG21} reconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6567,7 +6668,7 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG20} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG21} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -6575,12 +6676,12 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone".' }, 400);
         }
         const result = removeAdminPhone(account.accountDir, phone);
-        console.error(`${TAG20} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG21} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-admin-phones": {
         const phones = readAdminPhones(account.accountDir);
-        console.error(`${TAG20} config action=list-admin-phones count=${phones.length}`);
+        console.error(`${TAG21} config action=list-admin-phones count=${phones.length}`);
         return c.json({ ok: true, phones });
       }
       case "set-public-agent": {
@@ -6588,13 +6689,13 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
         }
         const result = setPublicAgent(account.accountDir, slug);
-        console.error(`${TAG20} config action=set-public-agent slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG21} config action=set-public-agent slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-public-agent": {
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount });
-        console.error(`${TAG20} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
+        console.error(`${TAG21} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
@@ -6611,26 +6712,26 @@ app3.post("/config", async (c) => {
                 const config = JSON.parse(readFileSync7(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
-                console.error(`${TAG20} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+                console.error(`${TAG21} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
               }
             }
           } catch (err) {
-            console.error(`${TAG20} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
+            console.error(`${TAG21} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
           }
         }
-        console.error(`${TAG20} config action=list-public-agents count=${agents.length}`);
+        console.error(`${TAG21} config action=list-public-agents count=${agents.length}`);
         return c.json({ ok: true, agents });
       }
       case "schema": {
         const text = serializeWhatsAppSchema();
-        console.error(`${TAG20} config action=schema`);
+        console.error(`${TAG21} config action=schema`);
         return c.json({ ok: true, text });
       }
       case "list-groups": {
         const groupAccountId = accountId ?? "default";
         const sock = getSocket(groupAccountId);
         if (!sock) {
-          console.error(`${TAG20} config action=list-groups error="not connected" accountId=${groupAccountId}`);
+          console.error(`${TAG21} config action=list-groups error="not connected" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `WhatsApp account "${groupAccountId}" is not connected. Connect first, then retry.` });
         }
         try {
@@ -6640,10 +6741,10 @@ app3.post("/config", async (c) => {
             name: g.subject ?? g.id,
             participantCount: Array.isArray(g.participants) ? g.participants.length : 0
           }));
-          console.error(`${TAG20} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
+          console.error(`${TAG21} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
           return c.json({ ok: true, groups });
         } catch (err) {
-          console.error(`${TAG20} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
+          console.error(`${TAG21} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `Failed to fetch groups: ${String(err)}` });
         }
       }
@@ -6653,12 +6754,12 @@ app3.post("/config", async (c) => {
         }
         const result = updateConfig(account.accountDir, fields);
         const fieldNames = Object.keys(fields);
-        console.error(`${TAG20} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
+        console.error(`${TAG21} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-config": {
         const waConfig = getConfig(account.accountDir);
-        console.error(`${TAG20} config action=get-config`);
+        console.error(`${TAG21} config action=get-config`);
         return c.json({ ok: true, config: waConfig });
       }
       default:
@@ -6668,7 +6769,7 @@ app3.post("/config", async (c) => {
         );
     }
   } catch (err) {
-    console.error(`${TAG20} config error: ${String(err)}`);
+    console.error(`${TAG21} config error: ${String(err)}`);
     return c.json({ ok: false, error: String(err) }, 500);
   }
 });
@@ -6689,7 +6790,7 @@ app3.post("/send-document", async (c) => {
     recordRouteDocumentOutbound(to, filePath);
     return c.json({ success: true, messageId: result.messageId });
   } catch (err) {
-    console.error(`${TAG20} send-document error: ${String(err)}`);
+    console.error(`${TAG21} send-document error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6699,11 +6800,11 @@ app3.get("/activity", (c) => {
     const result = getChannelActivity(accountId);
     const total = result.accounts.reduce((sum, a) => sum + a.total, 0);
     console.error(
-      `${TAG20} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
+      `${TAG21} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
     );
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG20} activity error: ${String(err)}`);
+    console.error(`${TAG21} activity error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6722,10 +6823,10 @@ app3.get("/conversations", (c) => {
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG20} conversations account=${accountId} count=${conversations.length}`);
+    console.error(`${TAG21} conversations account=${accountId} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
-    console.error(`${TAG20} conversations error: ${String(err)}`);
+    console.error(`${TAG21} conversations error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6740,10 +6841,10 @@ app3.get("/messages", (c) => {
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
     const messages = getMessages(accountId, jid, effectiveLimit);
-    console.error(`${TAG20} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    console.error(`${TAG21} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
     return c.json({ messages });
   } catch (err) {
-    console.error(`${TAG20} messages error: ${String(err)}`);
+    console.error(`${TAG21} messages error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6824,7 +6925,7 @@ app3.get("/conversation-graph-state", async (c) => {
       }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      console.error(`${TAG20} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
+      console.error(`${TAG21} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
       return c.json({ error: `Graph query failed: ${msg}`, cacheKey, cypher: cypher.trim() }, 500);
     }
     const ms = Date.now() - t0;
@@ -6837,7 +6938,7 @@ app3.get("/conversation-graph-state", async (c) => {
       ms
     });
   } catch (err) {
-    console.error(`${TAG20} conversation-graph-state error: ${String(err)}`);
+    console.error(`${TAG21} conversation-graph-state error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6849,12 +6950,12 @@ app3.get("/group-info", async (c) => {
       return c.json({ error: "Missing required parameter: jid" }, 400);
     }
     if (!isGroupJid(jid)) {
-      console.error(`${TAG20} group-info error="not a group JID" jid=${jid} account=${accountId}`);
+      console.error(`${TAG21} group-info error="not a group JID" jid=${jid} account=${accountId}`);
       return c.json({ error: `"${jid}" is not a group JID. Group JIDs end with @g.us.` }, 400);
     }
     const sock = getSocket(accountId);
     if (!sock) {
-      console.error(`${TAG20} group-info error="not connected" account=${accountId}`);
+      console.error(`${TAG21} group-info error="not connected" account=${accountId}`);
       return c.json({ error: `WhatsApp account "${accountId}" is not connected. Connect first, then retry.` }, 400);
     }
     const meta = await sock.groupMetadata(jid);
@@ -6867,10 +6968,10 @@ app3.get("/group-info", async (c) => {
       participantCount: meta.participants.length,
       participants: meta.participants.map((p) => ({ jid: p.id, admin: p.admin ?? null }))
     };
-    console.error(`${TAG20} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
+    console.error(`${TAG21} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG20} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
+    console.error(`${TAG21} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
     return c.json({ error: `Failed to fetch group info: ${String(err)}` }, 500);
   }
 });
@@ -7248,6 +7349,7 @@ function resolveOperatorDisplay(userIdRes, nameRes) {
 // app/lib/whatsapp-reader/parse-transcript.ts
 var WA_REPLY_TOOL = "mcp__whatsapp-channel__reply";
 var WA_REPLY_DOCUMENT_TOOL = "mcp__whatsapp-channel__reply-document";
+var WEBCHAT_REPLY_TOOL = "mcp__webchat-channel__reply";
 var CLI_MARKER_PREFIXES2 = ["<local-command-", "<command-name>", "<command-message>"];
 var CHANNEL_WRAPPER = /^<channel\b[^>]*>\n?([\s\S]*?)\n?<\/channel>$/;
 function asString(content) {
@@ -7264,7 +7366,7 @@ function assistantTurns(content, ts) {
     const b = block;
     if (b.type === "text" && typeof b.text === "string") {
       out.push({ kind: "agent-text", text: b.text, ts });
-    } else if (b.type === "tool_use" && b.name === WA_REPLY_TOOL) {
+    } else if (b.type === "tool_use" && (b.name === WA_REPLY_TOOL || b.name === WEBCHAT_REPLY_TOOL)) {
       const text = b.input?.text;
       out.push({ kind: "agent-reply", text: typeof text === "string" ? text : "", ts });
     } else if (b.type === "tool_use" && b.name === WA_REPLY_DOCUMENT_TOOL) {
@@ -7600,9 +7702,57 @@ app5.get("/directive", requireAdminSession, (c) => {
 });
 var whatsapp_reader_default = app5;
 
+// server/routes/webchat.ts
+import { basename as basename3, dirname as dirname2 } from "path";
+import { join as join10 } from "path";
+var WEBCHAT_ADMIN_KEY = "webchat-admin";
+function createWebchatRoutes(deps) {
+  const app48 = new Hono();
+  app48.post("/send", requireAdminSession, async (c) => {
+    const body = await c.req.json().catch(() => null);
+    const text = body?.text;
+    if (typeof text !== "string" || text.length === 0) {
+      return c.json({ error: "text required" }, 400);
+    }
+    let accountId;
+    try {
+      accountId = resolvePlatformAccountId();
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      console.error(`[webchat:inbound] op=send-refused reason=account-unresolved detail=${detail}`);
+      return c.json({ error: "account unresolved" }, 503);
+    }
+    await deps.handleInbound({ role: "admin", accountId, key: WEBCHAT_ADMIN_KEY, text });
+    return c.json({ ok: true });
+  });
+  app48.get("/session", requireAdminSession, (c) => {
+    let accountId;
+    try {
+      accountId = resolvePlatformAccountId();
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      console.error(`[webchat:inbound] op=session-refused reason=account-unresolved detail=${detail}`);
+      return c.json({ error: "account unresolved" }, 503);
+    }
+    const sessionId = adminSessionIdFor(accountId, WEBCHAT_ADMIN_KEY);
+    const cfg = claudeConfigDir();
+    let projectDir = null;
+    if (cfg) {
+      for (const { path: path2 } of enumerateJsonls(join10(cfg, "projects"))) {
+        if (basename3(path2) === `${sessionId}.jsonl`) {
+          projectDir = dirname2(path2);
+          break;
+        }
+      }
+    }
+    return c.json({ sessionId, projectDir });
+  });
+  return app48;
+}
+
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve10, join as join10 } from "path";
+import { resolve as resolve10, join as join11 } from "path";
 import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
 
 // app/lib/telegram/access-control.ts
@@ -7650,11 +7800,11 @@ function routeTelegramUpdate(input) {
 }
 
 // server/routes/telegram.ts
-var TAG21 = "[telegram-inbound]";
+var TAG22 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve10(process.cwd(), "..");
-  const brandPath = join10(platformRoot2, "config", "brand.json");
+  const brandPath = join11(platformRoot2, "config", "brand.json");
   if (existsSync8(brandPath)) {
     try {
       return JSON.parse(readFileSync11(brandPath, "utf-8")).configDir ?? ".maxy";
@@ -7685,18 +7835,18 @@ app6.post("/", async (c) => {
   const botParam = c.req.query("bot");
   const botType = botParam === "admin" ? "admin" : botParam === "public" ? "public" : null;
   if (!botType) {
-    console.error(`${TAG21} op=reject reason=missing-bot-param`);
+    console.error(`${TAG22} op=reject reason=missing-bot-param`);
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
   if (!existsSync8(sp)) {
-    console.error(`${TAG21} op=reject reason=no-secret-file botType=${botType}`);
+    console.error(`${TAG22} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
   const expected = readFileSync11(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
-    console.error(`${TAG21} op=reject reason=bad-secret botType=${botType}`);
+    console.error(`${TAG22} op=reject reason=bad-secret botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
   let update;
@@ -7707,25 +7857,25 @@ app6.post("/", async (c) => {
   }
   const account = resolveAccount();
   if (!account) {
-    console.error(`${TAG21} op=reject reason=no-account`);
+    console.error(`${TAG22} op=reject reason=no-account`);
     return c.json({ ok: true }, 200);
   }
   const decision = routeTelegramUpdate({ update, botType, config: account.config.telegram ?? {} });
   if (decision.kind === "ignore") {
-    console.error(`${TAG21} op=ignore reason=${decision.reason}`);
+    console.error(`${TAG22} op=ignore reason=${decision.reason}`);
     return c.json({ ok: true }, 200);
   }
   if (decision.kind === "denied") {
-    console.error(`${TAG21} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
+    console.error(`${TAG22} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
     return c.json({ ok: true }, 200);
   }
   const role = decision.agentType === "admin" ? "admin" : "public";
   const agentSlug = role === "admin" ? "admin" : resolveDefaultAgentSlug(account.accountDir);
   if (!agentSlug) {
-    console.error(`${TAG21} op=reject reason=no-default-agent`);
+    console.error(`${TAG22} op=reject reason=no-default-agent`);
     return c.json({ ok: true }, 200);
   }
-  console.error(`${TAG21} op=update accountId=${account.accountId} from=${decision.senderId}`);
+  console.error(`${TAG22} op=update accountId=${account.accountId} from=${decision.senderId}`);
   const botToken = botType === "admin" ? account.config.telegram?.adminBotToken : account.config.telegram?.publicBotToken;
   const { senderId, chatId, text } = decision;
   void (async () => {
@@ -7739,16 +7889,16 @@ app6.post("/", async (c) => {
       timeoutMs: DISPATCH_TIMEOUT_MS
     });
     if ("error" in result) {
-      console.error(`${TAG21} op=dispatch-failed from=${senderId} error=${result.error}`);
+      console.error(`${TAG22} op=dispatch-failed from=${senderId} error=${result.error}`);
       return;
     }
     if (!botToken) {
       const reason = account.config.telegram ? "no-bot-token" : "no-telegram-config";
-      console.error(`${TAG21} op=reply-dropped reason=${reason} botType=${botType}`);
+      console.error(`${TAG22} op=reply-dropped reason=${reason} botType=${botType}`);
       return;
     }
     const sent = await sendTelegram(botToken, chatId, result.turnText);
-    console.error(`${TAG21} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
+    console.error(`${TAG22} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
   })();
   return c.json({ ok: true }, 200);
 });
@@ -7761,7 +7911,7 @@ import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync5, renameSync, mkdirSync as mkdirSync2, readdirSync as readdirSync7, statSync as statSync5 } from "fs";
-import { dirname as dirname2, join as join11 } from "path";
+import { dirname as dirname3, join as join12 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -7769,7 +7919,7 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync2(dirname2(filePath), { recursive: true });
+  mkdirSync2(dirname3(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync5(tempPath, contents, mode !== void 0 ? { mode } : void 0);
   renameSync(tempPath, filePath);
@@ -7803,7 +7953,7 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join11(input.accountDir, "account.json");
+    const accountJsonPath = join12(input.accountDir, "account.json");
     if (!existsSync9(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
@@ -7858,13 +8008,13 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join11(input.accountsDir, entry);
+      const accountDir = join12(input.accountsDir, entry);
       try {
         if (!statSync5(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join11(accountDir, "account.json");
+      const accountJsonPath = join12(accountDir, "account.json");
       if (!existsSync9(accountJsonPath)) continue;
       let admins = [];
       try {
@@ -7955,11 +8105,17 @@ app7.post("/claude-auth", async (c) => {
     return c.json({ stopped: true });
   }
   if (body.action === "logout") {
+    const start = Date.now();
+    let logoutError = null;
     try {
       execFileSync2("claude", ["auth", "logout"], { encoding: "utf-8", timeout: 8e3 });
-    } catch {
+    } catch (err) {
+      logoutError = err instanceof Error ? err.message : String(err);
     }
-    return c.json({ logged_out: true });
+    const credentialsPresent = existsSync10(CLAUDE_CREDENTIALS_FILE);
+    const ranMs = Date.now() - start;
+    console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
+    return c.json({ logged_out: !credentialsPresent });
   }
   if (body.action === "wait") {
     const authenticated = await checkAuthStatus();
@@ -8147,8 +8303,8 @@ var onboarding_default = app7;
 
 // server/routes/client-error.ts
 import { appendFileSync, existsSync as existsSync11, renameSync as renameSync2, statSync as statSync6 } from "fs";
-import { join as join12 } from "path";
-var CLIENT_ERRORS_LOG = join12(LOG_DIR, "client-errors.log");
+import { join as join13 } from "path";
+var CLIENT_ERRORS_LOG = join13(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -8474,16 +8630,16 @@ var session_default = app9;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync13, readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync7 } from "fs";
-import { resolve as resolve11, basename as basename3 } from "path";
+import { resolve as resolve11, basename as basename4 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync12 } from "fs";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join13(dir, filename);
+    const fullPath = join14(dir, filename);
     if (existsSync12(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -8506,7 +8662,7 @@ app10.get("/", async (c) => {
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename3(fileParam);
+    const safe = basename4(fileParam);
     const searched = [];
     for (const dir of logDirs) {
       const filePath = resolve11(dir, safe);
@@ -8576,7 +8732,7 @@ app10.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename3(hit.path);
+        const filename = basename4(hit.path);
         const buffer = readFileSync14(hit.path);
         const onDiskBytes = statSync7(hit.path).size;
         const headers = {
@@ -9485,7 +9641,7 @@ var sessions_default = app14;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync17, readFileSync as readFileSync16, readdirSync as readdirSync10, statSync as statSync8 } from "fs";
-import { dirname as dirname3, resolve as resolve14, join as join14 } from "path";
+import { dirname as dirname4, resolve as resolve14, join as join15 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -9514,8 +9670,8 @@ function frontmatterField(manifest, field) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join14(pluginDir, "mcp/dist/index.js"),
-    join14(pluginDir, "mcp/src/index.ts")
+    join15(pluginDir, "mcp/dist/index.js"),
+    join15(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
@@ -9573,21 +9729,21 @@ function listPluginDirs() {
   const platformPlugins = resolve14(PLATFORM_ROOT, "plugins");
   if (existsSync17(platformPlugins)) {
     for (const name of readdirSync10(platformPlugins)) {
-      const dir = join14(platformPlugins, name);
+      const dir = join15(platformPlugins, name);
       try {
         if (statSync8(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve14(dirname3(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve14(dirname4(PLATFORM_ROOT), "premium-plugins");
   if (existsSync17(premiumRoot)) {
     for (const bundle of readdirSync10(premiumRoot)) {
-      const bundlePlugins = join14(premiumRoot, bundle, "plugins");
+      const bundlePlugins = join15(premiumRoot, bundle, "plugins");
       if (!existsSync17(bundlePlugins)) continue;
       try {
         for (const name of readdirSync10(bundlePlugins)) {
-          const dir = join14(bundlePlugins, name);
+          const dir = join15(bundlePlugins, name);
           try {
             if (statSync8(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -9630,7 +9786,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join14(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join15(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -9647,7 +9803,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync17(join14(dir, "mcp/dist/index.js")) || existsSync17(join14(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync17(join15(dir, "mcp/dist/index.js")) || existsSync17(join15(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -9657,7 +9813,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join14(dir, relPath);
+      const skillPath = join15(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -9701,7 +9857,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join14(specialistsDir, file));
+    const fm = readFrontmatter(join15(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -9794,7 +9950,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG22 = "[claude-session-manager:wrapper]";
+var TAG23 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -9812,12 +9968,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG22} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG23} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG22} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG23} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -9844,24 +10000,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG22} forward-spawn-start managerBase=${managerBase3("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG23} forward-spawn-start managerBase=${managerBase3("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase3("claude-session-manager:wrapper")}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG22} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG23} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG22} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG23} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG22} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG23} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -9896,7 +10052,7 @@ app15.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG22} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG23} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -9905,7 +10061,7 @@ app15.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG22} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG23} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -9924,13 +10080,13 @@ app15.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG22} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG23} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 var claude_sessions_default = app15;
 
 // server/routes/admin/log-ingest.ts
-var TAG23 = "[log-ingest]";
+var TAG24 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
@@ -9941,7 +10097,7 @@ function isLoopbackAddr(addr) {
 app16.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -9950,7 +10106,7 @@ app16.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG23} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -9992,18 +10148,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app17 = new Hono();
 app17.post("/", async (c) => {
-  const TAG31 = "[admin:events]";
+  const TAG32 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG31} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG32} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG31} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG32} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -10028,7 +10184,7 @@ var events_default = app17;
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename5, dirname as dirname4, join as join16, resolve as resolve18, sep as sep5 } from "path";
+import { basename as basename6, dirname as dirname5, join as join17, resolve as resolve18, sep as sep5 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
@@ -10408,7 +10564,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve17, relative as relative2, join as join15, basename as basename4, extname as extname2, sep as sep4 } from "path";
+import { resolve as resolve17, relative as relative2, join as join16, basename as basename5, extname as extname2, sep as sep4 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -10479,7 +10635,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join15(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join16(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -10535,13 +10691,13 @@ async function extractFileContent(absolute) {
   }
 }
 async function readDisplayName(absolute) {
-  const dir = absolute.slice(0, absolute.length - basename4(absolute).length);
-  const base = basename4(absolute);
+  const dir = absolute.slice(0, absolute.length - basename5(absolute).length);
+  const base = basename5(absolute);
   const dot = base.lastIndexOf(".");
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join15(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join16(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -10561,7 +10717,7 @@ async function walkSubtree(root, dataRoot, out) {
   let clean = true;
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
-    const abs = join15(root, entry.name);
+    const abs = join16(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -10673,7 +10829,7 @@ async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths
   return { kds, sections, chunks };
 }
 async function buildArtifact(accountId, wf, embed2) {
-  const name = basename4(wf.absolute);
+  const name = basename5(wf.absolute);
   const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
@@ -10832,7 +10988,7 @@ async function dropFileIndex(accountId, relativePath, opts) {
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join16(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join17(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -10870,7 +11026,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join16(absolute, entry.name), entry.name);
+    const meta = await readMeta(join17(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -10968,7 +11124,7 @@ app18.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join16(absolute, name);
+        const entryPath = join17(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -11034,7 +11190,7 @@ app18.get("/download", requireAdminSession, async (c) => {
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename5(absolute);
+    const filename = basename6(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -11091,7 +11247,7 @@ app18.post("/upload", requireAdminSession, async (c) => {
       error: `Unsupported file type: "${file.type}". Supported: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
     }, 422);
   }
-  const safeName = basename5(file.name).replace(/[\0/\\]/g, "_");
+  const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
   const destDir = resolve18(DATA_ROOT, "uploads", accountId);
   const destPath = resolve18(destDir, finalName);
@@ -11143,7 +11299,7 @@ app18.delete("/", requireAdminSession, async (c) => {
     console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
-  const base = basename5(absolute);
+  const base = basename6(absolute);
   const segments = relPath.split("/").filter(Boolean);
   if (base === "account.json" || segments.includes(".git")) {
     console.error(`[data] file-delete blocked path="${relPath}" reason="protected"`);
@@ -11159,7 +11315,7 @@ app18.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join16(dirname4(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join17(dirname5(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -12135,6 +12291,12 @@ var FILTER_TOP_LEVEL_LABELS = Object.freeze(
     "Property",
     "Viewing",
     "Offer",
+    "Job",
+    "QuoteDocument",
+    "InboundInvoice",
+    "SubContractor",
+    "SubInvoice",
+    "WhatsAppGroup",
     "AdminConversation",
     "PublicConversation",
     "Task",
@@ -13202,7 +13364,7 @@ var graph_default_view_default = app24;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve19, relative as relative3, isAbsolute, sep as sep6, basename as basename6 } from "path";
+import { resolve as resolve19, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
 import { existsSync as existsSync19 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -13254,7 +13416,7 @@ async function fetchAccountFileArtefacts(accountId) {
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
         id: `account-file:${relativePath}`,
-        name: displayName ?? basename6(relativePath),
+        name: displayName ?? basename7(relativePath),
         kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
@@ -13660,10 +13822,10 @@ var system_stats_default = app30;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync20, readFileSync as readFileSync18 } from "fs";
-import { resolve as resolve20, join as join17 } from "path";
+import { resolve as resolve20, join as join18 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join17(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join18(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync20(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync18(brandJsonPath, "utf-8"));
@@ -13728,7 +13890,7 @@ var health_default2 = app31;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID9 } from "crypto";
-var TAG24 = "[linkedin-ingest-route]";
+var TAG25 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -13832,29 +13994,29 @@ app32.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG24 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG25 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG24 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG25 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG24 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG25 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG24 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG25 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID9();
-  console.log(TAG24 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG25 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -13863,12 +14025,12 @@ app32.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG24 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG25 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG24 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG25 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
@@ -13876,7 +14038,7 @@ var linkedin_ingest_default = app32;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j2 from "neo4j-driver";
-var TAG25 = "[post-turn-context]";
+var TAG26 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -13918,7 +14080,7 @@ var app33 = new Hono();
 app33.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -13927,7 +14089,7 @@ app33.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -13959,7 +14121,7 @@ app33.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG25} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG26} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -13968,7 +14130,7 @@ app33.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG25} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG26} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -13979,7 +14141,7 @@ var post_turn_context_default = app33;
 
 // server/routes/admin/public-session-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG26 = "[public-session-context]";
+var TAG27 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -14021,7 +14183,7 @@ var app34 = new Hono();
 app34.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -14030,7 +14192,7 @@ app34.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -14061,7 +14223,7 @@ app34.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG26} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG27} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -14070,7 +14232,7 @@ app34.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG26} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG27} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
@@ -14080,7 +14242,7 @@ app34.get("/", async (c) => {
 var public_session_context_default = app34;
 
 // server/routes/admin/public-session-exit.ts
-var TAG27 = "[public-session-exit-route]";
+var TAG28 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -14088,7 +14250,7 @@ var app35 = new Hono();
 app35.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -14097,7 +14259,7 @@ app35.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -14115,7 +14277,7 @@ app35.post("/", async (c) => {
 var public_session_exit_default = app35;
 
 // server/routes/admin/access-session-evict.ts
-var TAG28 = "[access-session-evict]";
+var TAG29 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -14123,7 +14285,7 @@ var app36 = new Hono();
 app36.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -14132,7 +14294,7 @@ app36.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -14145,7 +14307,7 @@ app36.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG28} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG29} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
 var access_session_evict_default = app36;
@@ -14425,7 +14587,7 @@ async function generateNewMagicToken(grantId) {
 }
 
 // server/routes/access/verify-token.ts
-var TAG29 = "[access-verify]";
+var TAG30 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
 var app39 = new Hono();
@@ -14444,39 +14606,39 @@ app39.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG30} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG30} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -14492,12 +14654,12 @@ app39.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -14573,7 +14735,7 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG30 = "[access-request-link]";
+var TAG31 = "[access-request-link]";
 var app40 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
 app40.post("/", async (c) => {
@@ -14590,18 +14752,18 @@ app40.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG31} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG31} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG30} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG31} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -14609,7 +14771,7 @@ app40.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG30} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG31} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -14641,12 +14803,12 @@ app40.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG30} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG31} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG30} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG31} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
@@ -14800,7 +14962,7 @@ var sites_default = app42;
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync21, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -14817,7 +14979,7 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync4(dirname5(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    mkdirSync4(dirname6(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
     writeFileSync7(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
@@ -14876,7 +15038,7 @@ var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
 import { existsSync as existsSync22, readFileSync as readFileSync22 } from "fs";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -14884,7 +15046,7 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
-  const brandPath = join18(platformRoot2, "config", "brand.json");
+  const brandPath = join19(platformRoot2, "config", "brand.json");
   if (!existsSync22(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync22(brandPath, "utf-8"));
@@ -16330,6 +16492,262 @@ var WaGateway = class {
   }
 };
 
+// app/lib/webchat/gateway/inbound-hub.ts
+var InboundHub2 = class {
+  keys = /* @__PURE__ */ new Map();
+  state(key) {
+    let s = this.keys.get(key);
+    if (!s) {
+      s = { subscriber: null, ready: false, inFlight: [] };
+      this.keys.set(key, s);
+    }
+    return s;
+  }
+  /** Route an inbound message. Delivers immediately only if the key's channel
+   *  server is attached AND has signalled readiness; otherwise queues it (cold
+   *  start, or the attach->ready window) so it is never written before the
+   *  channel server can consume it. Every accepted message is tracked in-flight
+   *  until it reaches a terminal state. */
+  deliver(payload, now) {
+    const s = this.state(payload.key);
+    if (s.subscriber && s.ready) {
+      s.subscriber(payload);
+      s.inFlight.push({ payload, state: "drained", enqueuedAt: now, drainedAt: now });
+    } else {
+      s.inFlight.push({ payload, state: "queued", enqueuedAt: now, drainedAt: null });
+    }
+  }
+  /** A key's channel server connected. Register the subscriber but do NOT
+   *  drain yet — the drain waits for markReady so nothing is written before the
+   *  channel server is consuming. Replaces any prior subscriber. */
+  attach(key, subscriber) {
+    const s = this.state(key);
+    s.subscriber = subscriber;
+    s.ready = false;
+  }
+  /** The key's channel server reported it is connected and consuming. Drain
+   *  every queued message to it in arrival order, marking each drained-awaiting-
+   *  ack, then route live. Returns the number drained. */
+  markReady(key, now) {
+    const s = this.state(key);
+    s.ready = true;
+    if (!s.subscriber) return 0;
+    let count = 0;
+    for (const e of s.inFlight) {
+      if (e.state === "queued") {
+        s.subscriber(e.payload);
+        e.state = "drained";
+        e.drainedAt = now;
+        count++;
+      }
+    }
+    return count;
+  }
+  /** The channel server confirmed it received (emitted) a drained message. The
+   *  message has reached the agent; drop it from in-flight. Returns whether a
+   *  matching in-flight message was found. */
+  ack(key, messageId) {
+    const s = this.keys.get(key);
+    if (!s) return false;
+    const i = s.inFlight.findIndex((e) => e.payload.messageId === messageId);
+    if (i < 0) return false;
+    s.inFlight.splice(i, 1);
+    return true;
+  }
+  /** A key's channel server disconnected (session ended/restarting).
+   *  Subsequent messages queue again until re-attach + ready, so nothing is lost
+   *  across a restart. In-flight drained messages stay tracked for ack/sweep. */
+  detach(key) {
+    const s = this.keys.get(key);
+    if (s) {
+      s.subscriber = null;
+      s.ready = false;
+    }
+  }
+  /** Reconciliation from queue state alone — does not wait for a future inbound
+   *  to expose a loss. Returns (and removes) a terminal event for every message
+   *  that never reached the agent:
+   *   - a still-queued message older than queuedThresholdMs WHILE a subscriber
+   *     is attached -> inbound-undelivered (the readiness handoff broke);
+   *   - a still-queued message older than queuedThresholdMs with NO subscriber
+   *     attached -> spawn-undelivered (the channel server never attached: spawn
+   *     failed, or the session ended and never resumed);
+   *   - a drained message unacked past ackThresholdMs -> drain-undelivered (the
+   *     channel server never confirmed receipt — the silent cold-start drop).
+   *  Each message is emitted at most once (removed when emitted). */
+  sweep(now, t) {
+    const events = [];
+    for (const [key, s] of this.keys) {
+      s.inFlight = s.inFlight.filter((e) => {
+        if (e.state === "queued" && s.subscriber && now - e.enqueuedAt > t.queuedThresholdMs) {
+          events.push({ kind: "inbound-undelivered", key, messageId: e.payload.messageId, ageMs: now - e.enqueuedAt });
+          return false;
+        }
+        if (e.state === "queued" && !s.subscriber && now - e.enqueuedAt > t.queuedThresholdMs) {
+          events.push({ kind: "spawn-undelivered", key, messageId: e.payload.messageId, ageMs: now - e.enqueuedAt });
+          return false;
+        }
+        if (e.state === "drained" && e.drainedAt != null && now - e.drainedAt > t.ackThresholdMs) {
+          events.push({ kind: "drain-undelivered", key, messageId: e.payload.messageId, ageMs: now - e.drainedAt });
+          return false;
+        }
+        return true;
+      });
+    }
+    return events;
+  }
+  /** Whether a key currently has a live channel server attached. The gateway
+   *  uses this to decide whether an inbound needs a cold-start spawn/resume. */
+  hasSubscriber(key) {
+    return this.keys.get(key)?.subscriber != null;
+  }
+  /** Whether a key's channel server is attached AND has signalled readiness.
+   *  Used only to log delivery=immediate vs queued accurately. */
+  isReady(key) {
+    const s = this.keys.get(key);
+    return s?.subscriber != null && s.ready;
+  }
+};
+
+// app/lib/webchat/gateway/routes.ts
+function createWebchatChannelRoutes(deps) {
+  const app48 = new Hono();
+  app48.get("/webchat-channel/inbound", (c) => {
+    const key = c.req.query("key");
+    if (!key) return c.json({ error: "key required" }, 400);
+    return streamSSE(c, async (stream2) => {
+      deps.hub.attach(key, (payload) => {
+        void stream2.writeSSE({ data: JSON.stringify(payload) });
+      });
+      console.error(`[webchat:inbound] op=channel-attached key=${key}`);
+      stream2.onAbort(() => {
+        deps.hub.detach(key);
+        console.error(`[webchat:inbound] op=channel-detached key=${key}`);
+      });
+      while (!stream2.aborted) {
+        await stream2.sleep(15e3);
+        await stream2.writeSSE({ data: "", event: "ping" });
+      }
+    });
+  });
+  app48.post("/webchat-channel/reply", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    const key = body?.key;
+    const text = body?.text;
+    if (typeof key !== "string" || typeof text !== "string") {
+      return c.json({ error: "key and text required" }, 400);
+    }
+    deps.onReply?.(key, Buffer.byteLength(text, "utf8"));
+    return c.json({ ok: true });
+  });
+  app48.post("/webchat-channel/ready", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    const key = body?.key;
+    if (typeof key !== "string") {
+      return c.json({ error: "key required" }, 400);
+    }
+    deps.onReady?.(key);
+    return c.json({ ok: true });
+  });
+  app48.post("/webchat-channel/received", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    const key = body?.key;
+    const messageId = body?.messageId;
+    if (typeof key !== "string" || typeof messageId !== "string") {
+      return c.json({ error: "key and messageId required" }, 400);
+    }
+    deps.onReceived?.(key, messageId);
+    return c.json({ ok: true });
+  });
+  return app48;
+}
+
+// app/lib/webchat/gateway/webchat-gateway.ts
+var QUEUED_THRESHOLD_MS2 = 3e4;
+var ACK_THRESHOLD_MS2 = 3e4;
+var SWEEP_INTERVAL_MS2 = 15e3;
+var WebchatGateway = class {
+  constructor(deps) {
+    this.deps = deps;
+  }
+  hub = new InboundHub2();
+  spawning = /* @__PURE__ */ new Set();
+  /** Last delivery time per key, the latency basis for the op=reply line. */
+  lastDeliveredAt = /* @__PURE__ */ new Map();
+  seq = 0;
+  /** Hono sub-app exposing the loopback channel routes; mount on the UI app. */
+  routes() {
+    return createWebchatChannelRoutes({
+      hub: this.hub,
+      onReady: (key) => {
+        const now = Date.now();
+        const count = this.hub.markReady(key, now);
+        if (count > 0) {
+          console.error(`[webchat:inbound] op=drained key=${key} count=${count}`);
+          this.lastDeliveredAt.set(key, now);
+        }
+      },
+      onReceived: (key, messageId) => {
+        const found = this.hub.ack(key, messageId);
+        console.error(
+          `[webchat:inbound] op=channel-received key=${key} messageId=${messageId}${found ? "" : " note=unknown"}`
+        );
+      },
+      onReply: (key, bytes) => {
+        const deliveredAt = this.lastDeliveredAt.get(key);
+        const latency = deliveredAt != null ? Date.now() - deliveredAt : -1;
+        console.error(`[webchat:inbound] op=reply key=${key} bytes=${bytes} latencyMs=${latency}`);
+      }
+    });
+  }
+  /** Run one reconciliation pass: log every terminal delivery event the sweep
+   *  surfaces. Returns the events (for tests). Driven by startSweeper() in
+   *  production; called directly with an injected clock in tests. */
+  reconcile(now) {
+    const events = this.hub.sweep(now, {
+      queuedThresholdMs: QUEUED_THRESHOLD_MS2,
+      ackThresholdMs: ACK_THRESHOLD_MS2
+    });
+    for (const e of events) {
+      console.error(`[webchat:inbound] op=${e.kind} key=${e.key} messageId=${e.messageId} ageMs=${e.ageMs}`);
+    }
+    return events;
+  }
+  /** Start the periodic reconciliation sweep in the long-lived UI process. */
+  startSweeper(intervalMs = SWEEP_INTERVAL_MS2) {
+    return setInterval(() => this.reconcile(Date.now()), intervalMs);
+  }
+  /** Handle one inbound webchat message (browser POST → here). */
+  async handleInbound(input) {
+    const bytes = Buffer.byteLength(input.text, "utf8");
+    const hadSubscriber = this.hub.hasSubscriber(input.key);
+    const willDeliverNow = this.hub.isReady(input.key);
+    this.hub.deliver(
+      { key: input.key, text: input.text, messageId: `wc-${++this.seq}` },
+      Date.now()
+    );
+    if (willDeliverNow) this.lastDeliveredAt.set(input.key, Date.now());
+    console.error(
+      `[webchat:inbound] op=received key=${input.key.slice(0, 8)} role=${input.role} bytes=${bytes} delivery=${willDeliverNow ? "immediate" : "queued"}`
+    );
+    if (!hadSubscriber && !this.spawning.has(input.key)) {
+      this.spawning.add(input.key);
+      console.error(`[webchat:inbound] op=spawn-trigger key=${input.key} role=${input.role}`);
+      try {
+        await this.deps.ensureChannelSession({
+          accountId: input.accountId,
+          key: input.key,
+          role: input.role,
+          gatewayUrl: this.deps.gatewayUrl,
+          serverPath: this.deps.serverPath
+        });
+      } finally {
+        this.spawning.delete(input.key);
+      }
+    }
+  }
+};
+
 // app/lib/whatsapp/gateway/native-file-follower.ts
 var COMPOSING_REFRESH_MS = 1e4;
 function startNativeFileFollower(input) {
@@ -16686,7 +17104,7 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join19(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join20(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync25(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
@@ -16712,7 +17130,7 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join19(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join20(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync25(ALIAS_DOMAINS_PATH)) return null;
@@ -16744,7 +17162,7 @@ var app47 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve27(process.env.MAXY_PLATFORM_ROOT ?? join19(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve27(process.env.MAXY_PLATFORM_ROOT ?? join20(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -16760,7 +17178,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join19(__dirname, ".."))
+      platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join20(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -16798,6 +17216,29 @@ var waGateway = new WaGateway({
 });
 app47.route("/", waGateway.routes());
 waGateway.startSweeper();
+var webchatGateway = new WebchatGateway({
+  gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
+  serverPath: process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve27(process.env.MAXY_PLATFORM_ROOT ?? join20(__dirname, ".."), "services/webchat-channel/dist/server.js"),
+  ensureChannelSession: async ({ accountId, key, role, gatewayUrl, serverPath }) => {
+    if (role !== "admin") {
+      console.error(`[webchat:inbound] op=spawn-refused key=${key} role=${role} reason=public-path-not-wired`);
+      return;
+    }
+    const result = await managerRcSpawn({
+      sessionId: adminSessionIdFor(accountId, key),
+      role: "admin",
+      channel: "webchat",
+      senderId: key,
+      webchatChannel: { key, gatewayUrl, serverPath },
+      logContext: `channel=webchat key=${key} role=${role}`
+    });
+    if ("error" in result) {
+      console.error(`[webchat:inbound] op=spawn-failed key=${key} error=${result.error} status=${result.status}`);
+    }
+  }
+});
+app47.route("/", webchatGateway.routes());
+webchatGateway.startSweeper();
 app47.use("*", clientIpMiddleware);
 app47.use("*", async (c, next) => {
   await next();
@@ -17084,6 +17525,7 @@ app47.route("/api/health", health_default);
 app47.route("/api/chat", chat_default);
 app47.route("/api/whatsapp", whatsapp_default);
 app47.route("/api/whatsapp-reader", whatsapp_reader_default);
+app47.route("/api/webchat", createWebchatRoutes({ handleInbound: (input) => webchatGateway.handleInbound(input) }));
 app47.route("/api/telegram", telegram_default);
 app47.route("/api/onboarding", onboarding_default);
 app47.route("/api/admin", admin_default);
@@ -17191,7 +17633,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join19(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join20(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
     if (!existsSync25(versionFile)) return "unknown";
     const content = readFileSync24(versionFile, "utf-8").trim();
     return content || "unknown";
@@ -17250,11 +17692,11 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join19(homedir3(), BRAND.configDir);
+  const configDir2 = join20(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join19(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join20(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync25(cachePath)) return null;
     return JSON.parse(readFileSync24(cachePath, "utf-8"));
   } catch {
@@ -17320,7 +17762,7 @@ app47.get("/public", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app47.get("/chat", (c) => {
+app47.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -17383,6 +17825,11 @@ app47.get("/graph", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
+app47.get("/chat", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("chat.html"));
+});
 app47.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
@@ -17552,7 +17999,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename7(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename8(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -17614,7 +18061,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join19(__dirname, "..")),
+  platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join20(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {