@rubytech/create-maxy-code 0.1.297 → 0.1.299

package/payload/server/server.js

@@ -1215,7 +1215,7 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync26, existsSync as existsSync26, watchFile } from "fs";
-import { resolve as resolve28, join as join21, basename as basename8 } from "path";
+import { resolve as resolve29, join as join22, basename as basename8 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1244,6 +1244,21 @@ function isPublicPathAllowed(path2) {
   if (PUBLIC_ALLOWED_PREFIXES.some((prefix) => path2.startsWith(prefix))) return true;
   return AGENT_SLUG_PATTERN.test(path2);
 }
+function isOperatorHost(host) {
+  return host.startsWith("operator.");
+}
+
+// server/webchat-descriptor.ts
+import { resolve, join as join2 } from "path";
+function webchatGatewayUrl() {
+  return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
+}
+function webchatServerPath() {
+  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve(process.env.MAXY_PLATFORM_ROOT ?? join2(__dirname, ".."), "services/webchat-channel/dist/server.js");
+}
+function webchatChannelDescriptor(key) {
+  return { key, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() };
+}
 
 // app/lib/claude-auth.ts
 import { readFileSync, writeFileSync } from "fs";
@@ -1794,7 +1809,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve29) => setTimeout(() => resolve29("timeout"), timeoutMs)
+    (resolve30) => setTimeout(() => resolve30("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1922,11 +1937,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve30, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve30();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2040,14 +2055,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve30, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve29(value);
+        resolve30(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2646,8 +2661,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve29) => {
-    release = resolve29;
+  const mine = new Promise((resolve30) => {
+    release = resolve30;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -2833,7 +2848,7 @@ async function ensureWhatsAppConversation(input) {
 
 // ../lib/account-enumeration/src/index.ts
 import { readdirSync, readFileSync as readFileSync3 } from "fs";
-import { resolve } from "path";
+import { resolve as resolve2 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
 function enumerateValidAccountIds(accountsDir) {
@@ -2852,7 +2867,7 @@ function enumerateValidAccountIds(accountsDir) {
   const valid = [];
   for (const name of names) {
     if (!UUID_RE.test(name)) continue;
-    const configPath2 = resolve(accountsDir, name, "account.json");
+    const configPath2 = resolve2(accountsDir, name, "account.json");
     try {
       JSON.parse(readFileSync3(configPath2, "utf-8"));
       valid.push(name);
@@ -2871,7 +2886,7 @@ function getAccountsDirFromEnv() {
       "[graph-write] MAXY_PLATFORM_ROOT not set \u2014 cannot enforce accountId gate. Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly."
     );
   }
-  return resolve(root, "..", "data/accounts");
+  return resolve2(root, "..", "data/accounts");
 }
 function validateAccountIdEnv(envValue, diskIds) {
   if (!envValue) {
@@ -2910,7 +2925,7 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { writeFile, mkdir } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -2996,7 +3011,7 @@ async function downloadInboundMedia(msg, sock, opts) {
     await mkdir(MEDIA_DIR, { recursive: true });
     const ext = mimeToExt(mimetype ?? "application/octet-stream");
     const filename = `${randomUUID2()}.${ext}`;
-    const filePath = join2(MEDIA_DIR, filename);
+    const filePath = join3(MEDIA_DIR, filename);
     await writeFile(filePath, buffer);
     const sizeKB = (buffer.length / 1024).toFixed(0);
     console.error(`${TAG9} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
@@ -3727,11 +3742,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve29) => {
-        const timer2 = setTimeout(resolve29, delay);
+      await new Promise((resolve30) => {
+        const timer2 = setTimeout(resolve30, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve29();
+          resolve30();
         }, { once: true });
       });
     }
@@ -3739,16 +3754,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     if (!conn.sock) {
-      resolve29();
+      resolve30();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve30();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -4008,8 +4023,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve29) => {
-      resolvePending = resolve29;
+    const sttPending = new Promise((resolve30) => {
+      resolvePending = resolve30;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -4106,9 +4121,9 @@ async function handleInboundMessage(conn, msg) {
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
 import { mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve2 } from "path";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
-var VNC_SCRIPT = resolve2(PLATFORM_ROOT2, "scripts/vnc.sh");
+import { resolve as resolve3 } from "path";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
+var VNC_SCRIPT = resolve3(PLATFORM_ROOT2, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -4221,7 +4236,7 @@ function ensureLogDir() {
   mkdirSync(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve2(LOG_DIR, `${name}.log`);
+  return resolve3(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   const up = await waitForPort(RFB_PORT, 1e3);
@@ -4300,7 +4315,7 @@ function killChromium() {
 }
 function writeChromiumWrapper() {
   mkdirSync(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve2(BIN_DIR, "chromium");
+  const wrapperPath = resolve3(BIN_DIR, "chromium");
   writeFileSync3(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
@@ -4400,20 +4415,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve30) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve29(true);
+      resolve30(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve29(false);
+      resolve30(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve29(false);
+      resolve30(false);
     });
   });
 }
@@ -4483,9 +4498,9 @@ var health_default = app;
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { realpathSync } from "fs";
-import { resolve as resolve3, extname } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve3(PLATFORM_ROOT3, "..", "data/uploads");
+import { resolve as resolve4, extname } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "../platform");
+var ATTACHMENTS_ROOT = resolve4(PLATFORM_ROOT3, "..", "data/uploads");
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -4512,11 +4527,11 @@ function assertSupportedMime(mimeType) {
 }
 async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
   const attachmentId = randomUUID3();
-  const dir = resolve3(ATTACHMENTS_ROOT, scope, attachmentId);
+  const dir = resolve4(ATTACHMENTS_ROOT, scope, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve3(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve3(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope,
@@ -4590,11 +4605,11 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
       `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  const dir = resolve3(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve4(ATTACHMENTS_ROOT, accountId, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve3(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve3(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope: accountId,
@@ -4611,7 +4626,7 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var TAG14 = "[voice]";
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
@@ -4655,9 +4670,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join3(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join4(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join3(tempDir, `recording${ext}`);
+    tempPath = join4(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -4698,7 +4713,7 @@ async function transcribeVoiceNote(file, source) {
 }
 
 // app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase() {
@@ -5150,7 +5165,7 @@ async function fanOut(subscribers, text, onError, tag) {
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync2 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve4, basename } from "path";
+import { resolve as resolve5, basename } from "path";
 var TAG16 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -5181,7 +5196,7 @@ async function sendWhatsAppDocument(input) {
   if (!maxyAccountId || !platformRoot2) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve4(platformRoot2, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve5(platformRoot2, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync2(filePath);
@@ -5388,7 +5403,7 @@ async function ensureEntry(input) {
     });
   } else {
     console.error(`${tag} route role=${input.role} target=public-spawn senderId=${input.senderId}`);
-    const attachmentDir = resolve5(ATTACHMENTS_ROOT, "public", input.senderId);
+    const attachmentDir = resolve6(ATTACHMENTS_ROOT, "public", input.senderId);
     spawned = await managerSpawn({
       senderId: input.senderId,
       role: input.role,
@@ -5520,12 +5535,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve29;
+  let resolve30;
   const turnPromise = new Promise((r) => {
-    resolve29 = r;
+    resolve30 = r;
   });
   const listener = (text) => {
-    resolve29(text);
+    resolve30(text);
   };
   entry.subscribers.add(listener);
   const writeAtMs = Date.now();
@@ -5895,7 +5910,7 @@ ${result.result.text}` : result.result.text;
 var chat_default = app2;
 
 // server/routes/whatsapp.ts
-import { join as join6, resolve as resolve7 } from "path";
+import { join as join7, resolve as resolve8 } from "path";
 import { readdirSync as readdirSync3, readFileSync as readFileSync7, existsSync as existsSync5 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -5903,10 +5918,10 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
-import { resolve as resolve6, join as join4 } from "path";
+import { resolve as resolve7, join as join5 } from "path";
 var TAG18 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve6(accountDir, "account.json");
+  return resolve7(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
@@ -6055,7 +6070,7 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join4(accountDir, "agents", trimmed, "config.json");
+  const agentConfigPath = join5(accountDir, "agents", trimmed, "config.json");
   if (!existsSync4(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
@@ -6313,8 +6328,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve29, reject) => {
-    resolveCode = resolve29;
+  const codePromise = new Promise((resolve30, reject) => {
+    resolveCode = resolve30;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -6546,11 +6561,11 @@ function serializeWhatsAppSchema() {
 
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync2 } from "fs";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 var TAG20 = "[whatsapp:reconcile]";
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync2(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join5(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync2(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join6(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -6565,7 +6580,7 @@ function reconcileCredsOnDisk(opts) {
   const entries = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
-    const authDir = join5(credsRoot, accountId);
+    const authDir = join6(credsRoot, accountId);
     const selfPhone = readSelfId(authDir).e164 ?? void 0;
     const configured = accountDir ? isAccountConfigured(accountDir, accountId) : false;
     console.error(
@@ -6592,7 +6607,7 @@ app3.get("/status", (c) => {
   try {
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
-    const credsRoot = join6(MAXY_DIR, "credentials", "whatsapp");
+    const credsRoot = join7(MAXY_DIR, "credentials", "whatsapp");
     const accountDir = resolveAccount()?.accountDir ?? null;
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds });
     const accounts = [...live, ...reconciled];
@@ -6613,7 +6628,7 @@ app3.post("/login/start", async (c) => {
     if (!phone) {
       return c.json({ error: 'Missing required field "phone" (E.164, e.g. +441234567890).' }, 400);
     }
-    const authDir = join6(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join7(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
     console.error(`${TAG21} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
@@ -6711,14 +6726,14 @@ app3.post("/config", async (c) => {
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
-        const agentsDir = resolve7(account.accountDir, "agents");
+        const agentsDir = resolve8(account.accountDir, "agents");
         const agents = [];
         if (existsSync5(agentsDir)) {
           try {
             const entries = readdirSync3(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve7(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve8(agentsDir, entry.name, "config.json");
               if (!existsSync5(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync7(configPath2, "utf-8"));
@@ -6991,11 +7006,11 @@ var whatsapp_default = app3;
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync10, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync6 } from "fs";
-import { basename as basename2, dirname, join as join9, resolve as resolve9, sep as sep2 } from "path";
+import { basename as basename2, dirname, join as join10, resolve as resolve10, sep as sep2 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import { join as join7, resolve as resolve8 } from "path";
+import { join as join8, resolve as resolve9 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
 var PUBLIC_ROLE = "public";
@@ -7014,7 +7029,7 @@ function enumerateJsonls(projectsRoot) {
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join7(projectsRoot, slug);
+    const slugDir = join8(projectsRoot, slug);
     let entries;
     try {
       entries = readdirSync4(slugDir, { withFileTypes: true });
@@ -7025,9 +7040,9 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join7(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join8(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join7(slugDir, entry.name);
+        const subDir = join8(slugDir, entry.name);
         let subEntries;
         try {
           subEntries = readdirSync4(subDir, { withFileTypes: true });
@@ -7038,11 +7053,11 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join7(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join8(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join7(slugDir, entry.name);
+        const archiveDir = join8(slugDir, entry.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync4(archiveDir, { withFileTypes: true });
@@ -7053,7 +7068,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join7(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join8(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -7086,7 +7101,7 @@ async function fetchLiveSessions() {
 function loadUserTitles(accountDir) {
   const out = /* @__PURE__ */ new Map();
   if (!accountDir) return out;
-  const path2 = join7(accountDir, "session-titles.json");
+  const path2 = join8(accountDir, "session-titles.json");
   let raw;
   try {
     raw = readFileSync8(path2, "utf8");
@@ -7183,10 +7198,10 @@ app4.get("/", requireAdminSession, async (c) => {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return c.json({ sessions: [], accountId });
   }
-  const projectsRoot = join7(configDir2, "projects");
+  const projectsRoot = join8(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
-  const accountDir = accountId ? resolve8(ACCOUNTS_DIR, accountId) : null;
+  const accountDir = accountId ? resolve9(ACCOUNTS_DIR, accountId) : null;
   const userTitles = loadUserTitles(accountDir);
   const rows = [];
   const seenIds = /* @__PURE__ */ new Set();
@@ -7217,7 +7232,7 @@ app4.get("/", requireAdminSession, async (c) => {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join7(projectDir, `${sessionId}.meta.json`);
+    const metaPath = join8(projectDir, `${sessionId}.meta.json`);
     const { bridgeIds, role, channel } = readSidecarMeta(metaPath);
     const resumable = !(role === PUBLIC_ROLE && channel === WEBCHAT_CHANNEL);
     rows.push({
@@ -7264,7 +7279,7 @@ function selectAdminChannelSessions(rows) {
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync6, readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function hashPin(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
@@ -7298,13 +7313,13 @@ function scanForOrphanedAccountAdmins(users, accountsDir) {
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const accountDir = join8(accountsDir, entry);
+    const accountDir = join9(accountsDir, entry);
     try {
       if (!statSync3(accountDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    const accountJsonPath = join8(accountDir, "account.json");
+    const accountJsonPath = join9(accountDir, "account.json");
     if (!existsSync6(accountJsonPath)) continue;
     try {
       const config = JSON.parse(readFileSync9(accountJsonPath, "utf-8"));
@@ -7484,13 +7499,13 @@ var app5 = new Hono();
 app5.get("/conversations", requireAdminSession, async (c) => {
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join9(cfg, "projects");
+  const projectsRoot = join10(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename2(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname(path2);
-    const meta = readSidecarMeta(join9(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join10(projectDir, `${sessionId}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "whatsapp" && meta.channel !== "telegram") continue;
     let body = "";
     try {
@@ -7577,11 +7592,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve9(join9(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve10(join10(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve9(join9(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve10(join10(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep2)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -7668,7 +7683,7 @@ var DIRECTIVE_NAME_RE = /^\d+-\d+\.txt$/;
 function directiveStoreDir(sessionId) {
   const account = resolveAccount();
   if (!account) return null;
-  return resolve9(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
+  return resolve10(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
 }
 app5.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
@@ -7687,7 +7702,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync4(join9(dir, name)).size;
+      len = statSync4(join10(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -7702,7 +7717,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path2 = resolve9(join9(dir, name));
+  const path2 = resolve10(join10(dir, name));
   if (!path2.startsWith(dir + sep2)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -7716,17 +7731,17 @@ var whatsapp_reader_default = app5;
 
 // server/routes/webchat.ts
 import { basename as basename3, dirname as dirname2 } from "path";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 import { readFileSync as readFileSync11, renameSync, writeFileSync as writeFileSync5 } from "fs";
 var WEBCHAT_ADMIN_KEY = "webchat-admin";
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function locateSession(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return { projectDir: null, channel: null };
-  for (const { path: path2 } of enumerateJsonls(join10(cfg, "projects"))) {
+  for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
     if (basename3(path2) === `${sessionId}.jsonl`) {
       const dir = dirname2(path2);
-      const meta = readSidecarMeta(join10(dir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join11(dir, `${sessionId}.meta.json`));
       return { projectDir: dir, channel: meta.channel };
     }
   }
@@ -7772,19 +7787,22 @@ async function fetchComposerIndicators(sessionId) {
 }
 var MODEL_ID_PATTERN = /^claude-[a-z0-9][a-z0-9.-]*(\[1m\])?$/;
 var EFFORT_LEVELS = /* @__PURE__ */ new Set(["low", "medium", "high", "xhigh"]);
+var PERMISSION_MODE_VALUES = /* @__PURE__ */ new Set(["default", "acceptEdits", "plan", "auto", "bypassPermissions"]);
 function readLevers() {
   let account;
   try {
     account = resolveAccount();
   } catch {
-    return { leverModel: null, leverEffort: null };
+    return { leverModel: null, leverEffort: null, leverMode: null };
   }
-  if (!account) return { leverModel: null, leverEffort: null };
+  if (!account) return { leverModel: null, leverEffort: null, leverMode: null };
   const model = account.config.adminModel;
   const effort = account.config.effort;
+  const mode = account.config.adminPermissionMode;
   return {
     leverModel: typeof model === "string" && MODEL_ID_PATTERN.test(model) ? model : null,
-    leverEffort: typeof effort === "string" && EFFORT_LEVELS.has(effort) ? effort : null
+    leverEffort: typeof effort === "string" && EFFORT_LEVELS.has(effort) ? effort : null,
+    leverMode: typeof mode === "string" && PERMISSION_MODE_VALUES.has(mode) ? mode : null
   };
 }
 var REAPPLY_TIMEOUT_MS = 1500;
@@ -7937,11 +7955,11 @@ ${note}` : note;
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
-    if (op !== "model" && op !== "effort") {
+    if (op !== "model" && op !== "effort" && op !== "mode") {
       console.error(`[webchat:settings] op=${String(op)} outcome=refused reason=unknown-op`);
-      return c.json({ error: "op must be model or effort" }, 400);
+      return c.json({ error: "op must be model, effort, or mode" }, 400);
     }
-    if (typeof value !== "string" || op === "model" && !MODEL_ID_PATTERN.test(value) || op === "effort" && !EFFORT_LEVELS.has(value)) {
+    if (typeof value !== "string" || op === "model" && !MODEL_ID_PATTERN.test(value) || op === "effort" && !EFFORT_LEVELS.has(value) || op === "mode" && !PERMISSION_MODE_VALUES.has(value)) {
       console.error(`[webchat:settings] op=${op} outcome=refused value=${JSON.stringify(value)} reason=invalid-value`);
       return c.json({ error: `invalid ${op} value` }, 400);
     }
@@ -7955,11 +7973,12 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join10(account.accountDir, "account.json");
+    const accountJsonPath = join11(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync11(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
-      else parsed.effort = value;
+      else if (op === "effort") parsed.effort = value;
+      else parsed.adminPermissionMode = value;
       const tmp = `${accountJsonPath}.${process.pid}.tmp`;
       writeFileSync5(tmp, JSON.stringify(parsed, null, 2), "utf8");
       renameSync(tmp, accountJsonPath);
@@ -7994,7 +8013,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path2 } of enumerateJsonls(join10(cfg, "projects"))) {
+      for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
         if (basename3(path2) === `${sessionId}.jsonl`) {
           projectDir = dirname2(path2);
           break;
@@ -8008,11 +8027,11 @@ ${note}` : note;
 }
 
 // server/routes/webchat-greeting.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve11 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
 import { existsSync as existsSync8, readFileSync as readFileSync12, readdirSync as readdirSync7 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -8031,7 +8050,7 @@ function readSpecialistRoster(specialistsDir) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync12(join11(specialistsDir, file), "utf-8");
+      raw = readFileSync12(join12(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -8113,7 +8132,7 @@ app6.get("/", requireAdminSession, async (c) => {
     let specialists = [];
     try {
       const roster = readSpecialistRoster(
-        resolve10(ACCOUNTS_DIR, accountId, "specialists", "agents")
+        resolve11(ACCOUNTS_DIR, accountId, "specialists", "agents")
       );
       specialists = roster.specialists;
       for (const s of roster.skipped) {
@@ -8148,7 +8167,7 @@ var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve11, join as join12 } from "path";
+import { resolve as resolve12, join as join13 } from "path";
 import { existsSync as existsSync9, readFileSync as readFileSync13 } from "fs";
 
 // app/lib/telegram/access-control.ts
@@ -8199,8 +8218,8 @@ function routeTelegramUpdate(input) {
 var TAG22 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve11(process.cwd(), "..");
-  const brandPath = join12(platformRoot2, "config", "brand.json");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
+  const brandPath = join13(platformRoot2, "config", "brand.json");
   if (existsSync9(brandPath)) {
     try {
       return JSON.parse(readFileSync13(brandPath, "utf-8")).configDir ?? ".maxy";
@@ -8211,7 +8230,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve11(homedir(), configDirName(), filename);
+  return resolve12(homedir(), configDirName(), filename);
 }
 async function sendTelegram(botToken, chatId, text) {
   try {
@@ -8307,7 +8326,7 @@ import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync6, renameSync as renameSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync8, statSync as statSync5 } from "fs";
-import { dirname as dirname3, join as join13 } from "path";
+import { dirname as dirname3, join as join14 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -8349,7 +8368,7 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join13(input.accountDir, "account.json");
+    const accountJsonPath = join14(input.accountDir, "account.json");
     if (!existsSync10(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
@@ -8404,13 +8423,13 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join13(input.accountsDir, entry);
+      const accountDir = join14(input.accountsDir, entry);
       try {
         if (!statSync5(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join13(accountDir, "account.json");
+      const accountJsonPath = join14(accountDir, "account.json");
       if (!existsSync10(accountJsonPath)) continue;
       let admins = [];
       try {
@@ -8699,8 +8718,8 @@ var onboarding_default = app8;
 
 // server/routes/client-error.ts
 import { appendFileSync, existsSync as existsSync12, renameSync as renameSync3, statSync as statSync6 } from "fs";
-import { join as join14 } from "path";
-var CLIENT_ERRORS_LOG = join14(LOG_DIR, "client-errors.log");
+import { join as join15 } from "path";
+var CLIENT_ERRORS_LOG = join15(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -9026,16 +9045,16 @@ var session_default = app10;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync14, readdirSync as readdirSync9, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
-import { resolve as resolve12, basename as basename4 } from "path";
+import { resolve as resolve13, basename as basename4 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync13 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join15(dir, filename);
+    const fullPath = join16(dir, filename);
     if (existsSync13(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -9053,7 +9072,7 @@ app11.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve12(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve13(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -9061,7 +9080,7 @@ app11.get("/", async (c) => {
     const safe = basename4(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve12(dir, safe);
+      const filePath = resolve13(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync16(filePath);
@@ -9173,10 +9192,10 @@ app11.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve12(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve13(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync16(resolve12(dir, name));
+        const content = readFileSync16(resolve13(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -9216,7 +9235,7 @@ var claude_info_default = app12;
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync15 } from "fs";
-import { resolve as resolve13 } from "path";
+import { resolve as resolve14 } from "path";
 var app13 = new Hono();
 app13.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -9228,11 +9247,11 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve13(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve14(ATTACHMENTS_ROOT, accountId, attachmentId);
   if (!existsSync15(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve13(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve14(dir, `${attachmentId}.meta.json`);
   if (!existsSync15(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
@@ -9247,7 +9266,7 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve13(dir, dataFile);
+  const filePath = resolve14(dir, dataFile);
   const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -9260,13 +9279,13 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app13;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 import { readdirSync as readdirSync10, readFileSync as readFileSync17, existsSync as existsSync16, rmSync } from "fs";
 var app14 = new Hono();
 app14.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve14(account.accountDir, "agents");
+  const agentsDir = resolve15(account.accountDir, "agents");
   if (!existsSync16(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -9274,7 +9293,7 @@ app14.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve14(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve15(agentsDir, entry.name, "config.json");
       if (!existsSync16(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync17(configPath2, "utf-8"));
@@ -9303,7 +9322,7 @@ app14.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve14(account.accountDir, "agents", slug);
+  const agentDir = resolve15(account.accountDir, "agents", slug);
   if (!existsSync16(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -9333,7 +9352,7 @@ app14.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve14(account.accountDir, "agents", slug);
+  const agentDir = resolve15(account.accountDir, "agents", slug);
   if (!existsSync16(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -10037,7 +10056,7 @@ var sessions_default = app15;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync18, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync8 } from "fs";
-import { dirname as dirname4, resolve as resolve15, join as join16 } from "path";
+import { dirname as dirname4, resolve as resolve16, join as join17 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -10066,8 +10085,8 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join16(pluginDir, "mcp/dist/index.js"),
-    join16(pluginDir, "mcp/src/index.ts")
+    join17(pluginDir, "mcp/dist/index.js"),
+    join17(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
@@ -10122,24 +10141,24 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve15(PLATFORM_ROOT, "plugins");
+  const platformPlugins = resolve16(PLATFORM_ROOT, "plugins");
   if (existsSync18(platformPlugins)) {
     for (const name of readdirSync11(platformPlugins)) {
-      const dir = join16(platformPlugins, name);
+      const dir = join17(platformPlugins, name);
       try {
         if (statSync8(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve15(dirname4(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve16(dirname4(PLATFORM_ROOT), "premium-plugins");
   if (existsSync18(premiumRoot)) {
     for (const bundle of readdirSync11(premiumRoot)) {
-      const bundlePlugins = join16(premiumRoot, bundle, "plugins");
+      const bundlePlugins = join17(premiumRoot, bundle, "plugins");
       if (!existsSync18(bundlePlugins)) continue;
       try {
         for (const name of readdirSync11(bundlePlugins)) {
-          const dir = join16(bundlePlugins, name);
+          const dir = join17(bundlePlugins, name);
           try {
             if (statSync8(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -10152,7 +10171,7 @@ function listPluginDirs() {
   return out;
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve15(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync18(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync18(accountFile, "utf-8"));
@@ -10182,7 +10201,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join16(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join17(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -10199,7 +10218,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync18(join16(dir, "mcp/dist/index.js")) || existsSync18(join16(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync18(join17(dir, "mcp/dist/index.js")) || existsSync18(join17(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -10209,7 +10228,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join16(dir, relPath);
+      const skillPath = join17(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -10225,7 +10244,7 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve15(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  const specialistsDir = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
   if (!existsSync18(specialistsDir)) return [];
   let entries;
   try {
@@ -10253,7 +10272,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join16(specialistsDir, file));
+    const fm = readFrontmatter(join17(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -10271,7 +10290,7 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve15(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync18(accountFile)) return [];
   let enabled;
   try {
@@ -10286,7 +10305,7 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve15(PLATFORM_ROOT, "plugins");
+  const pluginsDir = resolve16(PLATFORM_ROOT, "plugins");
   if (!existsSync18(pluginsDir)) return [];
   let entries;
   try {
@@ -10297,7 +10316,7 @@ function computeDormantPlugins(accountId) {
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve15(pluginsDir, name, "PLUGIN.md");
+    const manifestPath = resolve16(pluginsDir, name, "PLUGIN.md");
     if (!existsSync18(manifestPath)) continue;
     let manifest;
     try {
@@ -10316,7 +10335,7 @@ function computeDormantPlugins(accountId) {
 
 // server/routes/admin/claude-sessions.ts
 import { existsSync as existsSync19, readFileSync as readFileSync19 } from "fs";
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync19(statePath)) return null;
@@ -10332,10 +10351,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve16(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync19(resolve16(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync19(resolve17(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -10580,15 +10599,15 @@ var events_default = app18;
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename6, dirname as dirname5, join as join18, resolve as resolve19, sep as sep5 } from "path";
+import { basename as basename6, dirname as dirname5, join as join19, resolve as resolve20, sep as sep5 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve17, normalize, sep as sep3, relative } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "../platform");
-var DATA_ROOT = resolve17(PLATFORM_ROOT5, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve17(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+import { resolve as resolve18, normalize, sep as sep3, relative } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "../platform");
+var DATA_ROOT = resolve18(PLATFORM_ROOT5, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve18(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath, accountId) {
@@ -10601,7 +10620,7 @@ function crossesForeignAccountPartition(relPath, accountId) {
 }
 function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve17(rootAbs, cleaned);
+  const absolute = resolve18(rootAbs, cleaned);
   let rootReal;
   try {
     rootReal = realpathSync3(rootAbs);
@@ -10960,7 +10979,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve18, relative as relative2, join as join17, basename as basename5, extname as extname2, sep as sep4 } from "path";
+import { resolve as resolve19, relative as relative2, join as join18, basename as basename5, extname as extname2, sep as sep4 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -11031,7 +11050,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join17(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join18(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -11093,7 +11112,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join17(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join18(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -11113,7 +11132,7 @@ async function walkSubtree(root, dataRoot, out) {
   let clean = true;
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
-    const abs = join17(root, entry.name);
+    const abs = join18(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -11268,8 +11287,8 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve18(dataRoot, "uploads", accountId),
-      resolve18(dataRoot, "accounts", accountId)
+      resolve19(dataRoot, "uploads", accountId),
+      resolve19(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -11350,7 +11369,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve18(dataRoot, relativePath);
+  const absolute = resolve19(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -11384,7 +11403,7 @@ async function dropFileIndex(accountId, relativePath, opts) {
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join18(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join19(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -11395,7 +11414,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve19(DATA_ROOT, "accounts");
+  const accountsDir = resolve20(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir3(accountsDir);
@@ -11404,7 +11423,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve19(accountsDir, name, "account.json");
+    const configPath2 = resolve20(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -11422,7 +11441,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join18(absolute, entry.name), entry.name);
+    const meta = await readMeta(join19(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -11520,7 +11539,7 @@ app19.get("/", requireAdminSession, async (c) => {
         continue;
       }
       try {
-        const entryPath = join18(absolute, name);
+        const entryPath = join19(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -11645,8 +11664,8 @@ app19.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve19(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve19(destDir, finalName);
+  const destDir = resolve20(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve20(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -11711,7 +11730,7 @@ app19.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join18(dirname5(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join19(dirname5(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -13760,7 +13779,7 @@ var graph_default_view_default = app25;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve20, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
+import { resolve as resolve21, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
 import { existsSync as existsSync20 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -13780,7 +13799,7 @@ app26.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve20(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve21(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -13831,8 +13850,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve20(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve20(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve21(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve21(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -13845,12 +13864,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve20(accountDir, "specialists", "agents");
-  const bundledDir = resolve20(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve21(accountDir, "specialists", "agents");
+  const bundledDir = resolve21(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve20(overrideDir, filename);
-    const bundledPath = resolve20(bundledDir, filename);
+    const overridePath = resolve21(overrideDir, filename);
+    const bundledPath = resolve21(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -14058,6 +14077,36 @@ app29.post("/", requireAdminSession, async (c) => {
 var session_archive_default = app29;
 
 // server/routes/admin/session-rc-spawn.ts
+import { randomUUID as randomUUID9 } from "crypto";
+function resolveSpawnPlan(host, body, mintId = randomUUID9) {
+  const operator = isOperatorHost(host);
+  const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
+  const name = typeof body.name === "string" && body.name.length > 0 ? body.name : void 0;
+  const webchatBind = resumeId === void 0 || operator;
+  const kind = resumeId === void 0 ? "new" : "resume";
+  const origin = operator ? "operator" : "admin";
+  const payload = {};
+  let sessionId;
+  if (webchatBind) {
+    sessionId = resumeId ?? mintId();
+    const key = `session:${sessionId}`;
+    payload.sessionId = sessionId;
+    payload.role = "admin";
+    payload.channel = "webchat";
+    payload.senderId = key;
+    payload.webchatChannel = webchatChannelDescriptor(key);
+    if (name) payload.name = name;
+  } else {
+    sessionId = resumeId;
+    payload.sessionId = resumeId;
+    if (name) payload.name = name;
+  }
+  return { webchatBind, origin, kind, sessionId, payload };
+}
+function shapeWebchatResponse(sessionId, manager) {
+  const outcome = typeof manager?.outcome === "string" ? manager.outcome : "bound";
+  return { sessionId, outcome, target: `/chat?session=${sessionId}` };
+}
 var app30 = new Hono();
 app30.post("/", requireAdminSession, async (c) => {
   let body;
@@ -14066,19 +14115,26 @@ app30.post("/", requireAdminSession, async (c) => {
   } catch {
     body = {};
   }
-  const payload = {};
-  if (typeof body.sessionId === "string" && body.sessionId.length > 0) payload.sessionId = body.sessionId;
-  if (typeof body.name === "string" && body.name.length > 0) payload.name = body.name;
+  const host = c.req.header("host") ?? "";
+  const plan = resolveSpawnPlan(host, body);
+  const spawnReqId = randomUUID9();
+  console.log(
+    `[chat-spawn] op=request spawnReqId=${spawnReqId} origin=${plan.origin} kind=${plan.kind} sessionId=${plan.kind === "new" ? "new" : plan.sessionId}`
+  );
+  if (plan.webchatBind) {
+    console.log(`[chat-spawn] op=args spawnReqId=${spawnReqId} webchatChannel=present sessionId=${plan.sessionId}`);
+  }
   let res;
   try {
     res = await fetch(`${managerBase3("session-rc-spawn:wrapper")}/rc-spawn`, {
       method: "POST",
       headers: { "content-type": "application/json" },
-      body: JSON.stringify(payload)
+      body: JSON.stringify(plan.payload)
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`[session-rc-spawn] manager-unreachable err=${msg}`);
+    console.log(`[chat-spawn] op=exit spawnReqId=${spawnReqId} outcome=spawn-failed`);
     return c.json({ error: `session manager unreachable: ${msg}` }, 502);
   }
   const text = await res.text();
@@ -14089,8 +14145,18 @@ app30.post("/", requireAdminSession, async (c) => {
   }
   if (!res.ok) {
     console.error(`[session-rc-spawn] manager-error status=${res.status} body=${text.slice(0, 200)}`);
+    console.log(`[chat-spawn] op=exit spawnReqId=${spawnReqId} outcome=spawn-failed`);
     return c.json(parsed ?? { error: text }, res.status);
   }
+  if (plan.webchatBind) {
+    const target = `/chat?session=${plan.sessionId}`;
+    console.log(
+      `[chat-spawn] op=acquired spawnReqId=${spawnReqId} pid=${parsed?.spawnedPid ?? "none"} sessionId=${plan.sessionId}`
+    );
+    console.log(`[chat-spawn] op=navigate spawnReqId=${spawnReqId} target=${target}`);
+    console.log(`[chat-spawn] op=exit spawnReqId=${spawnReqId} outcome=bound`);
+    return c.json(shapeWebchatResponse(plan.sessionId, parsed));
+  }
   return c.json(parsed ?? {});
 });
 var session_rc_spawn_default = app30;
@@ -14218,10 +14284,10 @@ var system_stats_default = app31;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync21, readFileSync as readFileSync20 } from "fs";
-import { resolve as resolve21, join as join19 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
+import { resolve as resolve22, join as join20 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join19(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join20(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync21(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync20(brandJsonPath, "utf-8"));
@@ -14229,7 +14295,7 @@ if (existsSync21(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve21(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve22(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
@@ -14285,7 +14351,7 @@ app32.get("/", async (c) => {
 var health_default2 = app32;
 
 // server/routes/admin/linkedin-ingest.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 var TAG25 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
@@ -14411,7 +14477,7 @@ app33.post("/", requireAdminSession, async (c) => {
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
-  const sessionId = randomUUID9();
+  const sessionId = randomUUID10();
   console.log(TAG25 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
@@ -14777,13 +14843,13 @@ var admin_default = app39;
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
 import { readFileSync as readFileSync21 } from "fs";
-import { resolve as resolve22 } from "path";
-import { randomUUID as randomUUID10 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
+import { resolve as resolve23 } from "path";
+import { randomUUID as randomUUID11 } from "crypto";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve22(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve23(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
     return readFileSync21(passwordFile, "utf-8").trim();
   } catch {
@@ -14961,7 +15027,7 @@ async function consumeMagicTokenAndActivate(grantId) {
   }
 }
 async function generateNewMagicToken(grantId) {
-  const token = randomUUID10();
+  const token = randomUUID11();
   const session = getSession3();
   try {
     const result = await session.run(
@@ -15073,9 +15139,9 @@ var verify_token_default = app40;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve23 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
-var SEND_SCRIPT = resolve23(
+import { resolve as resolve24 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+var SEND_SCRIPT = resolve24(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -15218,7 +15284,7 @@ var access_default = app42;
 
 // server/routes/sites.ts
 import { existsSync as existsSync22, readFileSync as readFileSync22, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
-import { resolve as resolve24 } from "path";
+import { resolve as resolve25 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -15275,8 +15341,8 @@ app43.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve24(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve24(rootDir, ...segments);
+  const rootDir = resolve25(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve25(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -15296,7 +15362,7 @@ app43.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve24(filePath, "index.html");
+    filePath = resolve25(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -15434,7 +15500,7 @@ var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
 import { existsSync as existsSync23, readFileSync as readFileSync24 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -15442,7 +15508,7 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot2) return null;
-  const brandPath = join20(platformRoot2, "config", "brand.json");
+  const brandPath = join21(platformRoot2, "config", "brand.json");
   if (!existsSync23(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync24(brandPath, "utf-8"));
@@ -15933,14 +15999,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app46;
 
 // server/routes/session.ts
-import { resolve as resolve25 } from "path";
+import { resolve as resolve26 } from "path";
 import { existsSync as existsSync24, writeFileSync as writeFileSync9, mkdirSync as mkdirSync5 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve25(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve26(MAXY_DIR, "branding-cache", accountId);
     mkdirSync5(cacheDir, { recursive: true });
-    writeFileSync9(resolve25(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync9(resolve26(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -16028,8 +16094,8 @@ app47.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve25(account.accountDir, "agents", agentSlug);
-    if (!existsSync24(agentDir) || !existsSync24(resolve25(agentDir, "config.json"))) {
+    const agentDir = resolve26(account.accountDir, "agents", agentSlug);
+    if (!existsSync24(agentDir) || !existsSync24(resolve26(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -16309,7 +16375,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve26, sep as sep7 } from "path";
+import { resolve as resolve27, sep as sep7 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["uploads", "accounts"];
@@ -16328,7 +16394,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve26(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve27(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -16349,7 +16415,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve26(dataRoot, relativePath);
+    const absolute = resolve27(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -16373,7 +16439,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve26(dataRoot, rootName);
+    const absRoot = resolve27(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -17268,7 +17334,7 @@ function broadcastAdminShutdown(reason) {
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
 import { existsSync as existsSync25, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
-import { resolve as resolve27 } from "path";
+import { resolve as resolve28 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -17303,7 +17369,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve27(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve28(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -17315,7 +17381,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve27(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve28(brand.configDir, "entitlement.json");
   if (!existsSync25(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -17506,7 +17572,7 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join21(PLATFORM_ROOT9, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join22(PLATFORM_ROOT9, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync26(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
@@ -17532,7 +17598,7 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join21(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join22(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync26(ALIAS_DOMAINS_PATH)) return null;
@@ -17564,7 +17630,7 @@ var app48 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -17580,7 +17646,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, ".."))
+      platformRoot: resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -17619,8 +17685,8 @@ var waGateway = new WaGateway({
 app48.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
-  gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, ".."), "services/webchat-channel/dist/server.js"),
+  gatewayUrl: webchatGatewayUrl(),
+  serverPath: webchatServerPath(),
   ensureChannelSession: async ({ accountId, key, role, gatewayUrl, serverPath, sessionId }) => {
     if (role !== "admin") {
       console.error(`[webchat:inbound] op=spawn-refused key=${key} role=${role} reason=public-path-not-wired`);
@@ -17961,8 +18027,8 @@ app48.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve28(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve29(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve29(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -17991,8 +18057,8 @@ app48.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "generated", filename);
-  const expectedDir = resolve28(account.accountDir, "generated");
+  const filePath = resolve29(account.accountDir, "generated", filename);
+  const expectedDir = resolve29(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -18036,7 +18102,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join21(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join22(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
     if (!existsSync26(versionFile)) return "unknown";
     const content = readFileSync26(versionFile, "utf-8").trim();
     return content || "unknown";
@@ -18079,7 +18145,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync26(resolve28(process.cwd(), "public", file), "utf-8");
+    html = readFileSync26(resolve29(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -18095,11 +18161,11 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join21(homedir3(), BRAND.configDir);
+  const configDir2 = join22(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join21(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join22(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync26(cachePath)) return null;
     return JSON.parse(readFileSync26(cachePath, "utf-8"));
   } catch {
@@ -18146,6 +18212,10 @@ function agentUnavailableHtml() {
 }
 app48.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isOperatorHost(host)) {
+    console.log(`[host-class] host=${host} class=operator served=operator.html`);
+    return c.html(cachedHtml("operator.html"));
+  }
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
     if (!defaultSlug) {
@@ -18158,6 +18228,7 @@ app48.get("/", (c) => {
     console.error(`[public-root] op=serve-default slug=${defaultSlug}`);
     return c.html(brandedPublicHtml(defaultSlug));
   }
+  console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
 app48.get("/public", (c) => {
@@ -18189,7 +18260,7 @@ app48.use("/vnc-popout.html", logViewerFetch);
 app48.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync26(resolve28(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync26(resolve29(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -18225,7 +18296,7 @@ app48.get("/g/:slug", (c) => {
 });
 app48.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host)) return c.text("Not found", 404);
+  if (isPublicHost(host) || isOperatorHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
 app48.get("/chat", (c) => {
@@ -18240,7 +18311,7 @@ app48.get("/data", (c) => {
 });
 app48.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
-  if (isPublicHost(host)) return c.text("Not found", 404);
+  if (isPublicHost(host) || isOperatorHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
 app48.get("/:slug", async (c, next) => {
@@ -18459,7 +18530,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve28(process.env.MAXY_PLATFORM_ROOT ?? join21(__dirname, "..")),
+  platformRoot: resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {