@rubytech/create-maxy-code 0.1.303 → 0.1.304

package/payload/server/server.js

@@ -60,6 +60,7 @@ import {
   getUserTimezone,
   httpLog,
   isActiveAgentSlug,
+  isApiRequestPath,
   isOperatorHost,
   isPasswordValid,
   isPublicPathAllowed,
@@ -104,7 +105,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-JHSF5VPE.js";
+} from "./chunk-TUY3RB5G.js";
 import {
   __commonJS,
   __toESM
@@ -1495,7 +1496,7 @@ async function ensureAuth() {
 }
 
 // server/routes/health.ts
-import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -2383,10 +2384,295 @@ function checkDmAccess(params) {
       return { allowed: false, reason: "unknown-dm-policy", agentType: "public" };
   }
 }
+async function resolveDmAccess(params) {
+  const base = checkDmAccess(params);
+  if (!base.allowed || base.agentType !== "public") return base;
+  const e164 = normalizeE164(params.senderPhone);
+  if (!e164 || !params.accountId) return base;
+  try {
+    const personId = await params.resolvePersonByPhone(params.accountId, e164);
+    return { ...base, personId };
+  } catch (err) {
+    console.error(
+      `[whatsapp:route] op=person-resolve-error senderId=${e164} err=${err instanceof Error ? err.message : String(err)}`
+    );
+    return base;
+  }
+}
 function checkGroupAccess(_params) {
   return { allowed: false, reason: "group-observe-only", agentType: "public" };
 }
 
+// app/lib/access-gate.ts
+import neo4j from "neo4j-driver";
+import { readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve2 } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
+var driver = null;
+function readPassword() {
+  if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
+  const passwordFile = resolve2(PLATFORM_ROOT2, "config/.neo4j-password");
+  try {
+    return readFileSync3(passwordFile, "utf-8").trim();
+  } catch {
+    throw new Error(
+      `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
+    );
+  }
+}
+function getDriver() {
+  if (!driver) {
+    const uri = process.env.NEO4J_URI;
+    if (!uri) {
+      throw new Error(
+        "[ui/access-gate] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687"
+      );
+    }
+    const user = process.env.NEO4J_USER ?? "neo4j";
+    const password = readPassword();
+    console.error(`[ui/access-gate] resolved neo4j_uri=${uri}`);
+    driver = neo4j.driver(uri, neo4j.auth.basic(user, password), {
+      maxConnectionPoolSize: 5
+    });
+  }
+  return driver;
+}
+var sessionFactory = null;
+function getSession2() {
+  return sessionFactory ? sessionFactory() : getDriver().session();
+}
+process.on("SIGINT", async () => {
+  if (driver) {
+    await driver.close();
+    driver = null;
+  }
+});
+var rateLimitMap = /* @__PURE__ */ new Map();
+var ACCESS_MAX_ATTEMPTS = 5;
+var ACCESS_LOCKOUT_MS = 15 * 60 * 1e3;
+var ACCESS_WINDOW_MS = 15 * 60 * 1e3;
+function checkAccessRateLimit(ip, agentSlug) {
+  const key = `${ip}:${agentSlug}`;
+  const entry = rateLimitMap.get(key);
+  if (!entry) return null;
+  const now = Date.now();
+  if (entry.lockedUntil && now < entry.lockedUntil) {
+    const remainingMs = entry.lockedUntil - now;
+    const remainingS = Math.ceil(remainingMs / 1e3);
+    return `Too many attempts. Try again in ${remainingS}s`;
+  }
+  if (now - entry.firstAttempt > ACCESS_WINDOW_MS) {
+    rateLimitMap.delete(key);
+    return null;
+  }
+  return null;
+}
+function recordAccessFailedAttempt(ip, agentSlug) {
+  const key = `${ip}:${agentSlug}`;
+  const now = Date.now();
+  const entry = rateLimitMap.get(key);
+  if (!entry || now - entry.firstAttempt > ACCESS_WINDOW_MS) {
+    rateLimitMap.set(key, { attempts: 1, firstAttempt: now });
+    return;
+  }
+  entry.attempts++;
+  if (entry.attempts >= ACCESS_MAX_ATTEMPTS) {
+    entry.lockedUntil = now + ACCESS_LOCKOUT_MS;
+  }
+}
+function clearAccessRateLimit(ip, agentSlug) {
+  rateLimitMap.delete(`${ip}:${agentSlug}`);
+}
+var contactRateMap = /* @__PURE__ */ new Map();
+var REQUEST_LINK_MAX = 3;
+var REQUEST_LINK_WINDOW_MS = 60 * 60 * 1e3;
+function checkRequestLinkRateLimit(contactValue) {
+  const entry = contactRateMap.get(contactValue);
+  if (!entry) return null;
+  const now = Date.now();
+  if (now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
+    contactRateMap.delete(contactValue);
+    return null;
+  }
+  if (entry.count >= REQUEST_LINK_MAX) {
+    const remainingMs = REQUEST_LINK_WINDOW_MS - (now - entry.windowStart);
+    const remainingM = Math.ceil(remainingMs / 6e4);
+    return `Too many requests. Try again in ${remainingM} minute(s)`;
+  }
+  return null;
+}
+function recordRequestLinkAttempt(contactValue) {
+  const now = Date.now();
+  const entry = contactRateMap.get(contactValue);
+  if (!entry || now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
+    contactRateMap.set(contactValue, { count: 1, windowStart: now });
+    return;
+  }
+  entry.count++;
+}
+function maskContact(value) {
+  if (value.includes("@")) {
+    const [local, domain] = value.split("@");
+    return `${local[0]}***@${domain}`;
+  }
+  return "****";
+}
+function readGrant(record) {
+  const g = record.get("g").properties;
+  const personId = record.get("personId");
+  return {
+    grantId: record.get("grantId"),
+    agentSlug: String(g.agentSlug),
+    accountId: String(g.accountId),
+    contactValue: String(g.contactValue),
+    displayName: record.get("givenName") ?? null,
+    personId,
+    expiresAt: g.expiresAt ? new Date(String(g.expiresAt)).getTime() : null,
+    status: String(g.status),
+    sliceToken: String(g.sliceToken ?? "")
+  };
+}
+async function findGrantByMagicToken(token) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {magicToken: $token})
+       RETURN g, p.givenName AS givenName,
+              elementId(g) AS grantId,
+              elementId(p) AS personId`,
+      { token }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {
+        contactValue: $contactValue,
+        agentSlug: $agentSlug,
+        accountId: $accountId
+      })
+      WHERE g.status IN ['invited', 'active']
+      RETURN g, p.givenName AS givenName,
+             elementId(g) AS grantId,
+             elementId(p) AS personId`,
+      { contactValue, agentSlug, accountId }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function findGrantByContact(contactValue, agentSlug, accountId) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {
+        contactValue: $contactValue,
+        agentSlug: $agentSlug,
+        accountId: $accountId
+      })
+      RETURN g, p.givenName AS givenName,
+             elementId(g) AS grantId,
+             elementId(p) AS personId
+      LIMIT 1`,
+      { contactValue, agentSlug, accountId }
+    );
+    if (result.records.length === 0) return null;
+    return readGrant(result.records[0]);
+  } finally {
+    await session.close();
+  }
+}
+async function resolvePersonByPhone(accountId, phone) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (p:Person {accountId: $accountId, phone: $phone})
+       RETURN elementId(p) AS personId
+       LIMIT 1`,
+      { accountId, phone }
+    );
+    if (result.records.length === 0) return null;
+    return result.records[0].get("personId");
+  } finally {
+    await session.close();
+  }
+}
+async function enrolPerson(input) {
+  const session = getSession2();
+  const sliceToken = randomUUID2();
+  const phone = normalizeE164(input.phone) || input.phone;
+  try {
+    const result = await session.run(
+      `MERGE (p:Person {accountId: $accountId, phone: $phone})
+       MERGE (p)-[:HAS_ACCESS]->(g:AccessGrant {
+         accountId: $accountId, agentSlug: $agentSlug, contactValue: $email
+       })
+       ON CREATE SET g.status = 'invited', g.sliceToken = $sliceToken
+       RETURN elementId(p) AS personId`,
+      {
+        accountId: input.accountId,
+        phone,
+        email: input.email,
+        agentSlug: input.agentSlug,
+        sliceToken
+      }
+    );
+    return result.records[0].get("personId");
+  } finally {
+    await session.close();
+  }
+}
+async function consumeMagicTokenAndActivate(grantId) {
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
+       SET g.magicToken = null,
+           g.magicTokenExpiresAt = null,
+           g.status = "active"
+       RETURN count(g) AS affected`,
+      { grantId }
+    );
+    const affected = result.records[0]?.get("affected");
+    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
+    if (count === 0) {
+      throw new Error(`[access-gate] consumeMagicTokenAndActivate: no grant matched grantId=${grantId}`);
+    }
+  } finally {
+    await session.close();
+  }
+}
+async function generateNewMagicToken(grantId) {
+  const token = randomUUID2();
+  const session = getSession2();
+  try {
+    const result = await session.run(
+      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
+       SET g.magicToken = $token,
+           g.magicTokenExpiresAt = datetime() + duration('PT15M')
+       RETURN count(g) AS affected`,
+      { grantId, token }
+    );
+    const affected = result.records[0]?.get("affected");
+    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
+    if (count === 0) {
+      throw new Error(`[access-gate] generateNewMagicToken: no grant matched grantId=${grantId}`);
+    }
+  } finally {
+    await session.close();
+  }
+  return token;
+}
+
 // app/lib/whatsapp/inbound/dedupe.ts
 var AGENT_SENT_TTL_MS = 2 * 6e4;
 var AGENT_SENT_MAX = 500;
@@ -2825,8 +3111,8 @@ async function ensureWhatsAppConversation(input) {
 }
 
 // ../lib/account-enumeration/src/index.ts
-import { readdirSync, readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve2 } from "path";
+import { readdirSync, readFileSync as readFileSync4 } from "fs";
+import { resolve as resolve3 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
 function enumerateValidAccountIds(accountsDir) {
@@ -2845,9 +3131,9 @@ function enumerateValidAccountIds(accountsDir) {
   const valid = [];
   for (const name of names) {
     if (!UUID_RE.test(name)) continue;
-    const configPath2 = resolve2(accountsDir, name, "account.json");
+    const configPath2 = resolve3(accountsDir, name, "account.json");
     try {
-      JSON.parse(readFileSync3(configPath2, "utf-8"));
+      JSON.parse(readFileSync4(configPath2, "utf-8"));
       valid.push(name);
     } catch (err) {
       const code = err.code;
@@ -2864,7 +3150,7 @@ function getAccountsDirFromEnv() {
       "[graph-write] MAXY_PLATFORM_ROOT not set \u2014 cannot enforce accountId gate. Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly."
     );
   }
-  return resolve2(root, "..", "data/accounts");
+  return resolve3(root, "..", "data/accounts");
 }
 function validateAccountIdEnv(envValue, diskIds) {
   if (!envValue) {
@@ -2901,7 +3187,7 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
 }
 
 // app/lib/whatsapp/inbound/media.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { writeFile, mkdir } from "fs/promises";
 import { join as join3 } from "path";
 import {
@@ -2988,7 +3274,7 @@ async function downloadInboundMedia(msg, sock, opts) {
     }
     await mkdir(MEDIA_DIR, { recursive: true });
     const ext = mimeToExt(mimetype ?? "application/octet-stream");
-    const filename = `${randomUUID2()}.${ext}`;
+    const filename = `${randomUUID3()}.${ext}`;
     const filePath = join3(MEDIA_DIR, filename);
     await writeFile(filePath, buffer);
     const sizeKB = (buffer.length / 1024).toFixed(0);
@@ -4018,11 +4304,13 @@ async function handleInboundMessage(conn, msg) {
   if (isGroup) {
     accessResult = checkGroupAccess({ groupJid: remoteJid });
   } else {
-    accessResult = checkDmAccess({
+    accessResult = await resolveDmAccess({
       senderPhone,
       selfPhone,
       config: whatsAppConfig,
-      accountConfig: whatsAppConfig.accounts?.[conn.accountId]
+      accountConfig: whatsAppConfig.accounts?.[conn.accountId],
+      accountId: conn.accountId,
+      resolvePersonByPhone
     });
   }
   console.error(
@@ -4060,6 +4348,7 @@ async function handleInboundMessage(conn, msg) {
   const payload = {
     accountId: conn.accountId,
     agentType: accessResult.agentType,
+    personId: accessResult.personId ?? null,
     senderPhone,
     text: extracted.text,
     isGroup,
@@ -4098,10 +4387,10 @@ async function handleInboundMessage(conn, msg) {
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
-import { mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve3 } from "path";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
-var VNC_SCRIPT = resolve3(PLATFORM_ROOT2, "scripts/vnc.sh");
+import { mkdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
+var VNC_SCRIPT = resolve4(PLATFORM_ROOT3, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -4156,7 +4445,7 @@ function discoverNativeDisplay() {
       const leaderPid = leaderResult.stdout?.trim();
       if (leaderPid) {
         try {
-          const environ = readFileSync4(`/proc/${leaderPid}/environ`, "utf8");
+          const environ = readFileSync5(`/proc/${leaderPid}/environ`, "utf8");
           const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
           if (match) waylandDisplay = match.split("=")[1];
         } catch {
@@ -4214,7 +4503,7 @@ function ensureLogDir() {
   mkdirSync(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve3(LOG_DIR, `${name}.log`);
+  return resolve4(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   const up = await waitForPort(RFB_PORT, 1e3);
@@ -4293,7 +4582,7 @@ function killChromium() {
 }
 function writeChromiumWrapper() {
   mkdirSync(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve3(BIN_DIR, "chromium");
+  const wrapperPath = resolve4(BIN_DIR, "chromium");
   writeFileSync3(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
@@ -4315,7 +4604,7 @@ fi
 # replaced). Refusing the legacy probe loop closes the silent-fallback path
 # where /snap/bin/chromium would re-introduce the AppArmor SingletonLock
 # denial that triggered.
-PATH_FILE="${PLATFORM_ROOT2}/config/chromium-binary.path"
+PATH_FILE="${PLATFORM_ROOT3}/config/chromium-binary.path"
 if [ ! -r "$PATH_FILE" ]; then
   echo "  ERROR: $PATH_FILE missing \u2014 re-run installer" >> "$LOG"
   exit 1
@@ -4416,7 +4705,7 @@ app.get("/", async (c) => {
   let pinConfigured = false;
   try {
     if (existsSync3(USERS_FILE)) {
-      const raw = readFileSync5(USERS_FILE, "utf-8").trim();
+      const raw = readFileSync6(USERS_FILE, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -4473,12 +4762,12 @@ app.get("/", async (c) => {
 var health_default = app;
 
 // app/lib/attachments.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
 import { realpathSync } from "fs";
-import { resolve as resolve4, extname } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve4(PLATFORM_ROOT3, "..", "data/uploads");
+import { resolve as resolve5, extname } from "path";
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "../platform");
+var ATTACHMENTS_ROOT = resolve5(PLATFORM_ROOT4, "..", "data/uploads");
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -4504,12 +4793,12 @@ function assertSupportedMime(mimeType) {
   }
 }
 async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
-  const attachmentId = randomUUID3();
-  const dir = resolve4(ATTACHMENTS_ROOT, scope, attachmentId);
+  const attachmentId = randomUUID4();
+  const dir = resolve5(ATTACHMENTS_ROOT, scope, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope,
@@ -4583,11 +4872,11 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
       `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  const dir = resolve4(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve5(ATTACHMENTS_ROOT, accountId, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve4(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve4(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope: accountId,
@@ -4691,7 +4980,7 @@ async function transcribeVoiceNote(file, source) {
 }
 
 // app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase() {
@@ -4811,8 +5100,9 @@ function classifyTimeout(ndjson, writeAtMs) {
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
 import { createHash } from "crypto";
-function adminSessionIdFor(accountId, senderId) {
-  const b = createHash("sha256").update(`${accountId}:admin:${senderId}`).digest().subarray(0, 16);
+function adminSessionIdFor(accountId, senderId, personId) {
+  const subject = personId && personId.length > 0 ? `person:${personId}` : senderId;
+  const b = createHash("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
   const v = Buffer.from(b);
   v[6] = v[6] & 15 | 64;
   v[8] = v[8] & 63 | 128;
@@ -4821,7 +5111,7 @@ function adminSessionIdFor(accountId, senderId) {
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var TAG15 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
@@ -4909,7 +5199,7 @@ function composeInitialMessage(input) {
   ].join("\n");
 }
 async function dispatchReviewer(input, initialMessage) {
-  const sessionId = randomUUID4();
+  const sessionId = randomUUID5();
   console.log(`${TAG15} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
@@ -5143,7 +5433,7 @@ async function fanOut(subscribers, text, onError, tag) {
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync2 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve5, basename } from "path";
+import { resolve as resolve6, basename } from "path";
 var TAG16 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -5174,7 +5464,7 @@ async function sendWhatsAppDocument(input) {
   if (!maxyAccountId || !platformRoot2) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve5(platformRoot2, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve6(platformRoot2, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync2(filePath);
@@ -5331,7 +5621,10 @@ function publicIdleMs() {
   return Number(process.env.CHANNEL_PTY_IDLE_MS ?? String(5 * 6e4));
 }
 var index = /* @__PURE__ */ new Map();
-function indexKey(accountId, agentSlug, senderId, sliceToken = "") {
+function indexKey(accountId, agentSlug, senderId, sliceToken = "", personId = null) {
+  if (personId && personId.length > 0) {
+    return `${accountId}:${agentSlug}:person:${personId}`;
+  }
   const slice = sliceToken && sliceToken.length > 0 ? sliceToken : "open";
   return `${accountId}:${agentSlug}:${slice}:${senderId}`;
 }
@@ -5340,7 +5633,7 @@ async function ensureEntry(input) {
   const sliceTokenValue = input.sliceToken ?? "";
   const personIdValue = input.personId ?? null;
   const nameValue = input.name ?? null;
-  const key = indexKey(input.accountId, input.agentSlug, input.senderId, sliceTokenValue);
+  const key = indexKey(input.accountId, input.agentSlug, input.senderId, sliceTokenValue, personIdValue);
   const existing = index.get(key);
   const tag = tagFor(input.channel);
   if (existing) {
@@ -5365,7 +5658,7 @@ async function ensureEntry(input) {
   }
   let spawned;
   if (input.role === "admin") {
-    const adminSessionId = adminSessionIdFor(input.accountId, input.senderId);
+    const adminSessionId = adminSessionIdFor(input.accountId, input.senderId, input.personId);
     console.error(`${tag} route role=admin target=rc-spawn senderId=${input.senderId}`);
     spawned = await managerRcSpawn({
       sessionId: adminSessionId,
@@ -5381,7 +5674,7 @@ async function ensureEntry(input) {
     });
   } else {
     console.error(`${tag} route role=${input.role} target=public-spawn senderId=${input.senderId}`);
-    const attachmentDir = resolve6(ATTACHMENTS_ROOT, "public", input.senderId);
+    const attachmentDir = resolve7(ATTACHMENTS_ROOT, "public", input.senderId);
     spawned = await managerSpawn({
       senderId: input.senderId,
       role: input.role,
@@ -5460,7 +5753,7 @@ async function writeInput(entry, text) {
             dispatchFor: "exit"
           });
         }
-        index.delete(indexKey(entry.accountId, entry.agentSlug, entry.senderId, entry.sliceToken));
+        index.delete(indexKey(entry.accountId, entry.agentSlug, entry.senderId, entry.sliceToken, entry.personId));
         const respawned = await ensureEntry({
           accountId: entry.accountId,
           senderId: entry.senderId,
@@ -5621,10 +5914,10 @@ function handlePublicSessionExit(sessionId) {
 }
 
 // app/lib/access-session-store.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var sessions = /* @__PURE__ */ new Map();
 function createAccessSession(input) {
-  const sessionId = randomUUID5();
+  const sessionId = randomUUID6();
   const session = {
     ...input,
     sessionId,
@@ -5888,23 +6181,23 @@ ${result.result.text}` : result.result.text;
 var chat_default = app2;
 
 // server/routes/whatsapp.ts
-import { join as join7, resolve as resolve8 } from "path";
-import { readdirSync as readdirSync3, readFileSync as readFileSync7, existsSync as existsSync5 } from "fs";
+import { join as join7, resolve as resolve9 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync8, existsSync as existsSync5 } from "fs";
 
 // app/lib/whatsapp/login.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
-import { resolve as resolve7, join as join5 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
+import { resolve as resolve8, join as join5 } from "path";
 var TAG18 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve7(accountDir, "account.json");
+  return resolve8(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
   if (!existsSync4(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync6(path2, "utf-8"));
+  return JSON.parse(readFileSync7(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
   const path2 = configPath(accountDir);
@@ -6347,7 +6640,7 @@ async function startLogin(opts) {
     accountId,
     authDir,
     accountDir,
-    id: randomUUID6(),
+    id: randomUUID7(),
     sock,
     startedAt: Date.now(),
     phone: digits,
@@ -6579,7 +6872,7 @@ function reconcileCredsOnDisk(opts) {
 
 // server/routes/whatsapp.ts
 var TAG21 = "[whatsapp:api]";
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT || "";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
 var app3 = new Hono();
 app3.get("/status", (c) => {
   try {
@@ -6704,17 +6997,17 @@ app3.post("/config", async (c) => {
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
-        const agentsDir = resolve8(account.accountDir, "agents");
+        const agentsDir = resolve9(account.accountDir, "agents");
         const agents = [];
         if (existsSync5(agentsDir)) {
           try {
             const entries = readdirSync3(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve8(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve9(agentsDir, entry.name, "config.json");
               if (!existsSync5(configPath2)) continue;
               try {
-                const config = JSON.parse(readFileSync7(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync8(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
                 console.error(`${TAG21} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -6789,7 +7082,7 @@ app3.post("/send-document", async (c) => {
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: PLATFORM_ROOT4
+      platformRoot: PLATFORM_ROOT5
     });
     if (!result.ok) return c.json({ error: result.error }, result.status);
     recordRouteDocumentOutbound(to, filePath);
@@ -6983,12 +7276,12 @@ app3.get("/group-info", async (c) => {
 var whatsapp_default = app3;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync10, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync6 } from "fs";
-import { basename as basename2, dirname, join as join10, resolve as resolve10, sep as sep2 } from "path";
+import { readFileSync as readFileSync11, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync6 } from "fs";
+import { basename as basename2, dirname, join as join10, resolve as resolve11, sep as sep2 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync2 } from "fs";
-import { join as join8, resolve as resolve9 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
+import { join as join8, resolve as resolve10 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
 var PUBLIC_ROLE = "public";
@@ -7082,7 +7375,7 @@ function loadUserTitles(accountDir) {
   const path2 = join8(accountDir, "session-titles.json");
   let raw;
   try {
-    raw = readFileSync8(path2, "utf8");
+    raw = readFileSync9(path2, "utf8");
   } catch {
     return out;
   }
@@ -7108,7 +7401,7 @@ function readSidecarMeta(metaPath) {
   const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null };
   let raw;
   try {
-    raw = readFileSync8(metaPath, "utf8");
+    raw = readFileSync9(metaPath, "utf8");
   } catch {
     return empty;
   }
@@ -7179,7 +7472,7 @@ app4.get("/", requireAdminSession, async (c) => {
   const projectsRoot = join8(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
-  const accountDir = accountId ? resolve9(ACCOUNTS_DIR, accountId) : null;
+  const accountDir = accountId ? resolve10(ACCOUNTS_DIR, accountId) : null;
   const userTitles = loadUserTitles(accountDir);
   const rows = [];
   const seenIds = /* @__PURE__ */ new Set();
@@ -7201,7 +7494,7 @@ app4.get("/", requireAdminSession, async (c) => {
     let body;
     let mtimeMs;
     try {
-      body = readFileSync8(path2, "utf8");
+      body = readFileSync9(path2, "utf8");
       mtimeMs = statSync2(path2).mtimeMs;
     } catch {
       continue;
@@ -7256,14 +7549,14 @@ function selectAdminChannelSessions(rows) {
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync9, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
 import { join as join9 } from "path";
 function hashPin(pin) {
   return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
   if (!existsSync6(usersFilePath)) return null;
-  const raw = readFileSync9(usersFilePath, "utf-8").trim();
+  const raw = readFileSync10(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -7300,7 +7593,7 @@ function scanForOrphanedAccountAdmins(users, accountsDir) {
     const accountJsonPath = join9(accountDir, "account.json");
     if (!existsSync6(accountJsonPath)) continue;
     try {
-      const config = JSON.parse(readFileSync9(accountJsonPath, "utf-8"));
+      const config = JSON.parse(readFileSync10(accountJsonPath, "utf-8"));
       const admins = config.admins ?? [];
       for (const a of admins) {
         if (typeof a.userId === "string" && !known.has(a.userId)) orphans.push(a.userId);
@@ -7355,9 +7648,32 @@ function resolveOperatorDisplay(userIdRes, nameRes) {
 var WA_REPLY_TOOL = "mcp__whatsapp-channel__reply";
 var WA_REPLY_DOCUMENT_TOOL = "mcp__whatsapp-channel__reply-document";
 var WEBCHAT_REPLY_TOOL = "mcp__webchat-channel__reply";
+var CHANNEL_REPLY_TOOL = "mcp__channel__reply";
 var CLI_MARKER_PREFIXES2 = ["<local-command-", "<command-name>", "<command-message>"];
-var CHANNEL_WRAPPER = /^<channel\b[^>]*>\n?([\s\S]*?)\n?<\/channel>$/;
-function asString(content) {
+var CHANNEL_WRAPPER = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
+var SOURCE_ATTR = /\bsource="([^"]+)"/;
+var SOURCE_MAP = {
+  whatsapp: "whatsapp",
+  "whatsapp-channel": "whatsapp",
+  webchat: "webchat",
+  "webchat-channel": "webchat"
+};
+function unwrapChannel(text) {
+  const m = text.match(CHANNEL_WRAPPER);
+  if (!m) return { text };
+  let source = SOURCE_MAP[m[1].match(SOURCE_ATTR)?.[1] ?? ""];
+  let inner = m[2];
+  const im = inner.match(CHANNEL_WRAPPER);
+  if (im) {
+    const innerSource = SOURCE_MAP[im[1].match(SOURCE_ATTR)?.[1] ?? ""];
+    if (innerSource) {
+      source = innerSource;
+      inner = im[2];
+    }
+  }
+  return source ? { text: inner, source } : { text: inner };
+}
+function asString(content) {
   return typeof content === "string" ? content : null;
 }
 function tsOf(row) {
@@ -7371,7 +7687,7 @@ function assistantTurns(content, ts) {
     const b = block;
     if (b.type === "text" && typeof b.text === "string") {
       out.push({ kind: "agent-text", text: b.text, ts });
-    } else if (b.type === "tool_use" && (b.name === WA_REPLY_TOOL || b.name === WEBCHAT_REPLY_TOOL)) {
+    } else if (b.type === "tool_use" && (b.name === WA_REPLY_TOOL || b.name === WEBCHAT_REPLY_TOOL || b.name === CHANNEL_REPLY_TOOL)) {
       const text = b.input?.text;
       out.push({ kind: "agent-reply", text: typeof text === "string" ? text : "", ts });
     } else if (b.type === "tool_use" && b.name === WA_REPLY_DOCUMENT_TOOL) {
@@ -7427,9 +7743,8 @@ function parseTranscript(lines) {
       const att = row.attachment;
       const isChannelQueued = att?.type === "queued_command" && att.isMeta === true && typeof att.origin === "object" && att.origin !== null && att.origin.kind === "channel" && typeof att.prompt === "string";
       if (isChannelQueued) {
-        const prompt = att.prompt;
-        const m = prompt.match(CHANNEL_WRAPPER);
-        out.push({ kind: "operator-inbound", text: m ? m[1] : prompt, ts });
+        const u = unwrapChannel(att.prompt);
+        out.push({ kind: "operator-inbound", text: u.text, ts, ...u.source ? { source: u.source } : {} });
       }
       continue;
     }
@@ -7443,8 +7758,8 @@ function parseTranscript(lines) {
     if (CLI_MARKER_PREFIXES2.some((p) => text.startsWith(p))) continue;
     const isChannel = row.isMeta === true && typeof row.origin === "object" && row.origin !== null && row.origin.kind === "channel";
     if (isChannel) {
-      const m = text.match(CHANNEL_WRAPPER);
-      out.push({ kind: "operator-inbound", text: m ? m[1] : text, ts });
+      const u = unwrapChannel(text);
+      out.push({ kind: "operator-inbound", text: u.text, ts, ...u.source ? { source: u.source } : {} });
     } else {
       out.push({ kind: "operator-typed", text, ts });
     }
@@ -7487,7 +7802,7 @@ app5.get("/conversations", requireAdminSession, async (c) => {
     if (meta.role !== "admin" || meta.channel !== "whatsapp" && meta.channel !== "telegram") continue;
     let body = "";
     try {
-      body = readFileSync10(path2, "utf8");
+      body = readFileSync11(path2, "utf8");
     } catch {
     }
     const { title } = resolveTitle(body, sessionId, userTitles);
@@ -7570,11 +7885,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve10(join10(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve11(join10(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve10(join10(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve11(join10(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep2)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -7661,7 +7976,7 @@ var DIRECTIVE_NAME_RE = /^\d+-\d+\.txt$/;
 function directiveStoreDir(sessionId) {
   const account = resolveAccount();
   if (!account) return null;
-  return resolve10(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
+  return resolve11(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
 }
 app5.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
@@ -7695,11 +8010,11 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path2 = resolve10(join10(dir, name));
+  const path2 = resolve11(join10(dir, name));
   if (!path2.startsWith(dir + sep2)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
-    body = readFileSync10(path2, "utf8");
+    body = readFileSync11(path2, "utf8");
   } catch {
     return c.json({ error: "not found" }, 404);
   }
@@ -7710,7 +8025,7 @@ var whatsapp_reader_default = app5;
 // server/routes/webchat.ts
 import { basename as basename3, dirname as dirname2 } from "path";
 import { join as join11 } from "path";
-import { existsSync as existsSync8, readdirSync as readdirSync7, readFileSync as readFileSync11, renameSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync7, readFileSync as readFileSync12, renameSync, writeFileSync as writeFileSync5 } from "fs";
 var WEBCHAT_ADMIN_KEY = "webchat-admin";
 var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function locateSession(sessionId) {
@@ -7823,8 +8138,8 @@ async function reapplyLeversViaManager() {
   }
 }
 function createWebchatRoutes(deps) {
-  const app49 = new Hono();
-  app49.post("/send", requireAdminSession, async (c) => {
+  const app50 = new Hono();
+  app50.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -7955,7 +8270,7 @@ ${note}` : note;
     }
     return c.json({ ok: true });
   });
-  app49.post("/settings", requireAdminSession, async (c) => {
+  app50.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -7979,7 +8294,7 @@ ${note}` : note;
     }
     const accountJsonPath = join11(account.accountDir, "account.json");
     try {
-      const parsed = JSON.parse(readFileSync11(accountJsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync12(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
       else if (op === "effort") parsed.effort = value;
       else parsed.adminPermissionMode = value;
@@ -7995,7 +8310,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app49.get("/session", requireAdminSession, async (c) => {
+  app50.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -8028,14 +8343,14 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, ...indicators, ...readLevers() });
   });
-  return app49;
+  return app50;
 }
 
 // server/routes/webchat-greeting.ts
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync9, readFileSync as readFileSync12, readdirSync as readdirSync8 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13, readdirSync as readdirSync8 } from "fs";
 import { join as join12 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
@@ -8055,7 +8370,7 @@ function readSpecialistRoster(specialistsDir) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync12(join12(specialistsDir, file), "utf-8");
+      raw = readFileSync13(join12(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -8137,7 +8452,7 @@ app6.get("/", requireAdminSession, async (c) => {
     let specialists = [];
     try {
       const roster = readSpecialistRoster(
-        resolve11(ACCOUNTS_DIR, accountId, "specialists", "agents")
+        resolve12(ACCOUNTS_DIR, accountId, "specialists", "agents")
       );
       specialists = roster.specialists;
       for (const s of roster.skipped) {
@@ -8172,8 +8487,8 @@ var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve12, join as join13 } from "path";
-import { existsSync as existsSync10, readFileSync as readFileSync13 } from "fs";
+import { resolve as resolve13, join as join13 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
 
 // app/lib/telegram/access-control.ts
 function checkTelegramAccess(params) {
@@ -8223,11 +8538,11 @@ function routeTelegramUpdate(input) {
 var TAG22 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "..");
   const brandPath = join13(platformRoot2, "config", "brand.json");
   if (existsSync10(brandPath)) {
     try {
-      return JSON.parse(readFileSync13(brandPath, "utf-8")).configDir ?? ".maxy";
+      return JSON.parse(readFileSync14(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
     }
   }
@@ -8235,7 +8550,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve12(homedir(), configDirName(), filename);
+  return resolve13(homedir(), configDirName(), filename);
 }
 async function sendTelegram(botToken, chatId, text) {
   try {
@@ -8263,7 +8578,7 @@ app7.post("/", async (c) => {
     console.error(`${TAG22} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
-  const expected = readFileSync13(sp, "utf-8").trim();
+  const expected = readFileSync14(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
     console.error(`${TAG22} op=reject reason=bad-secret botType=${botType}`);
@@ -8326,11 +8641,11 @@ var telegram_default = app7;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync7, writeSync, existsSync as existsSync12, readFileSync as readFileSync15, unlinkSync } from "fs";
-import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
+import { openSync as openSync2, closeSync as closeSync2, writeFileSync as writeFileSync7, writeSync, existsSync as existsSync12, readFileSync as readFileSync16, unlinkSync } from "fs";
+import { createHash as createHash3, randomUUID as randomUUID8 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync6, renameSync as renameSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync6, renameSync as renameSync2, mkdirSync as mkdirSync2, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
 import { dirname as dirname3, join as join14 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
@@ -8349,7 +8664,7 @@ function writeAdminEntry(input) {
   try {
     let users = [];
     if (existsSync11(input.usersFile)) {
-      const raw = readFileSync14(input.usersFile, "utf-8").trim();
+      const raw = readFileSync15(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -8377,7 +8692,7 @@ function writeAdminEntry(input) {
     if (!existsSync11(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync14(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync15(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -8403,7 +8718,7 @@ function checkAdminAuthInvariant(input) {
   const usersUserIds = /* @__PURE__ */ new Set();
   if (existsSync11(input.usersFile)) {
     try {
-      const raw = readFileSync14(input.usersFile, "utf-8").trim();
+      const raw = readFileSync15(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -8438,7 +8753,7 @@ function checkAdminAuthInvariant(input) {
       if (!existsSync11(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync14(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync15(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -8479,7 +8794,7 @@ function hashPin2(pin) {
 }
 function readUsersFile2() {
   if (!existsSync12(USERS_FILE)) return null;
-  const raw = readFileSync15(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync16(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -8610,7 +8925,7 @@ app8.post("/set-pin", async (c) => {
   const hash = hashPin2(body.pin);
   const account = resolveAccount();
   const existingOwnerUserId = account?.config.admins?.find((a) => a.role === "owner")?.userId;
-  const userId = existingOwnerUserId ?? randomUUID7();
+  const userId = existingOwnerUserId ?? randomUUID8();
   if (existingOwnerUserId) {
     console.log(`[set-pin] reusing existing owner userId=${userId.slice(0, 8)}\u2026 (change-PIN preserves identity)`);
   } else {
@@ -8641,7 +8956,7 @@ app8.post("/set-pin", async (c) => {
     let installOwner = null;
     if (existsSync12(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync15(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync16(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -8881,7 +9196,7 @@ app9.post("/", async (c) => {
 var client_error_default = app9;
 
 // server/routes/admin/session.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 async function resolveUserIdentity(accountId, userId) {
   const result = await loadAdminUserName(accountId, userId);
   if (result.source === "neo4j") {
@@ -8895,7 +9210,7 @@ async function resolveUserIdentity(accountId, userId) {
 async function createAdminSession(accountId, thinkingView, userId, userName, role, avatar) {
   const account = resolveAccount();
   const effectiveThinkingView = thinkingView ?? account?.config.thinkingView ?? "default";
-  const signedSessionToken = randomUUID8();
+  const signedSessionToken = randomUUID9();
   const cacheKey = fingerprintSessionKey(signedSessionToken);
   registerSession(cacheKey, "admin", accountId, void 0, userId, userName, role);
   if (userId) setWantsPriorConversation(cacheKey);
@@ -9049,8 +9364,8 @@ app10.post("/", async (c) => {
 var session_default = app10;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync15, readdirSync as readdirSync10, readFileSync as readFileSync16, statSync as statSync7 } from "fs";
-import { resolve as resolve13, basename as basename4 } from "path";
+import { existsSync as existsSync15, readdirSync as readdirSync10, readFileSync as readFileSync17, statSync as statSync7 } from "fs";
+import { resolve as resolve14, basename as basename4 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync14 } from "fs";
@@ -9077,7 +9392,7 @@ app11.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve13(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve14(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -9085,10 +9400,10 @@ app11.get("/", async (c) => {
     const safe = basename4(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve13(dir, safe);
+      const filePath = resolve14(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync16(filePath);
+        const buffer = readFileSync17(filePath);
         const onDiskBytes = statSync7(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -9153,7 +9468,7 @@ app11.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename4(hit.path);
-        const buffer = readFileSync16(hit.path);
+        const buffer = readFileSync17(hit.path);
         const onDiskBytes = statSync7(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -9197,10 +9512,10 @@ app11.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve13(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve14(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync16(resolve13(dir, name));
+        const content = readFileSync17(resolve14(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -9240,7 +9555,7 @@ var claude_info_default = app12;
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync16 } from "fs";
-import { resolve as resolve14 } from "path";
+import { resolve as resolve15 } from "path";
 var app13 = new Hono();
 app13.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -9252,11 +9567,11 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve14(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve15(ATTACHMENTS_ROOT, accountId, attachmentId);
   if (!existsSync16(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve14(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve15(dir, `${attachmentId}.meta.json`);
   if (!existsSync16(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
@@ -9271,7 +9586,7 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve14(dir, dataFile);
+  const filePath = resolve15(dir, dataFile);
   const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -9284,13 +9599,13 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app13;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve15 } from "path";
-import { readdirSync as readdirSync11, readFileSync as readFileSync17, existsSync as existsSync17, rmSync } from "fs";
+import { resolve as resolve16 } from "path";
+import { readdirSync as readdirSync11, readFileSync as readFileSync18, existsSync as existsSync17, rmSync } from "fs";
 var app14 = new Hono();
 app14.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve15(account.accountDir, "agents");
+  const agentsDir = resolve16(account.accountDir, "agents");
   if (!existsSync17(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -9298,10 +9613,10 @@ app14.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve15(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve16(agentsDir, entry.name, "config.json");
       if (!existsSync17(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync17(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync18(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -9327,7 +9642,7 @@ app14.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve15(account.accountDir, "agents", slug);
+  const agentDir = resolve16(account.accountDir, "agents", slug);
   if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -9357,7 +9672,7 @@ app14.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve15(account.accountDir, "agents", slug);
+  const agentDir = resolve16(account.accountDir, "agents", slug);
   if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -10060,8 +10375,8 @@ app15.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app15;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync19, readFileSync as readFileSync18, readdirSync as readdirSync12, statSync as statSync8 } from "fs";
-import { dirname as dirname4, resolve as resolve16, join as join17 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync19, readdirSync as readdirSync12, statSync as statSync8 } from "fs";
+import { dirname as dirname4, resolve as resolve17, join as join17 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -10097,7 +10412,7 @@ function extractPluginToolDescriptions(pluginDir) {
   for (const path2 of candidates) {
     if (!existsSync19(path2)) continue;
     try {
-      raw = readFileSync18(path2, "utf-8");
+      raw = readFileSync19(path2, "utf-8");
       break;
     } catch {
     }
@@ -10146,7 +10461,7 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve16(PLATFORM_ROOT, "plugins");
+  const platformPlugins = resolve17(PLATFORM_ROOT, "plugins");
   if (existsSync19(platformPlugins)) {
     for (const name of readdirSync12(platformPlugins)) {
       const dir = join17(platformPlugins, name);
@@ -10156,7 +10471,7 @@ function listPluginDirs() {
       }
     }
   }
-  const premiumRoot = resolve16(dirname4(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve17(dirname4(PLATFORM_ROOT), "premium-plugins");
   if (existsSync19(premiumRoot)) {
     for (const bundle of readdirSync12(premiumRoot)) {
       const bundlePlugins = join17(premiumRoot, bundle, "plugins");
@@ -10176,10 +10491,10 @@ function listPluginDirs() {
   return out;
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve17(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync19(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync18(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync19(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -10191,7 +10506,7 @@ function readFrontmatter(path2) {
   if (!existsSync19(path2)) return null;
   let raw;
   try {
-    raw = readFileSync18(path2, "utf-8");
+    raw = readFileSync19(path2, "utf-8");
   } catch {
     return null;
   }
@@ -10249,7 +10564,7 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  const specialistsDir = resolve17(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
   if (!existsSync19(specialistsDir)) return [];
   let entries;
   try {
@@ -10295,11 +10610,11 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve16(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve17(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync19(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync18(accountFile, "utf-8");
+    const raw = readFileSync19(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -10310,7 +10625,7 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve16(PLATFORM_ROOT, "plugins");
+  const pluginsDir = resolve17(PLATFORM_ROOT, "plugins");
   if (!existsSync19(pluginsDir)) return [];
   let entries;
   try {
@@ -10321,11 +10636,11 @@ function computeDormantPlugins(accountId) {
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve16(pluginsDir, name, "PLUGIN.md");
+    const manifestPath = resolve17(pluginsDir, name, "PLUGIN.md");
     if (!existsSync19(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync18(manifestPath, "utf-8");
+      manifest = readFileSync19(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -10339,13 +10654,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync20, readFileSync as readFileSync19 } from "fs";
-import { resolve as resolve17 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
+import { resolve as resolve18 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync20(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync19(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync20(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -10356,10 +10671,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync19(resolve17(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync20(resolve18(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -10568,18 +10883,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app18 = new Hono();
 app18.post("/", async (c) => {
-  const TAG32 = "[admin:events]";
+  const TAG33 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG32} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG33} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG32} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG33} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -10604,15 +10919,15 @@ var events_default = app18;
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename6, dirname as dirname5, join as join19, resolve as resolve20, sep as sep5 } from "path";
+import { basename as basename6, dirname as dirname5, join as join19, resolve as resolve21, sep as sep5 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve18, normalize, sep as sep3, relative } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "../platform");
-var DATA_ROOT = resolve18(PLATFORM_ROOT5, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve18(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+import { resolve as resolve19, normalize, sep as sep3, relative } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "../platform");
+var DATA_ROOT = resolve19(PLATFORM_ROOT6, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve19(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath, accountId) {
@@ -10625,7 +10940,7 @@ function crossesForeignAccountPartition(relPath, accountId) {
 }
 function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve18(rootAbs, cleaned);
+  const absolute = resolve19(rootAbs, cleaned);
   let rootReal;
   try {
     rootReal = realpathSync3(rootAbs);
@@ -10984,7 +11299,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve19, relative as relative2, join as join18, basename as basename5, extname as extname2, sep as sep4 } from "path";
+import { resolve as resolve20, relative as relative2, join as join18, basename as basename5, extname as extname2, sep as sep4 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -11292,8 +11607,8 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve19(dataRoot, "uploads", accountId),
-      resolve19(dataRoot, "accounts", accountId)
+      resolve20(dataRoot, "uploads", accountId),
+      resolve20(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -11374,7 +11689,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve19(dataRoot, relativePath);
+  const absolute = resolve20(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -11419,7 +11734,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve20(DATA_ROOT, "accounts");
+  const accountsDir = resolve21(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir3(accountsDir);
@@ -11428,7 +11743,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve20(accountsDir, name, "account.json");
+    const configPath2 = resolve21(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -11669,8 +11984,8 @@ app19.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve20(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve20(destDir, finalName);
+  const destDir = resolve21(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve21(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -12679,7 +12994,7 @@ app20.get("/", requireAdminSession, async (c) => {
 var graph_search_default = app20;
 
 // server/routes/admin/graph-subgraph.ts
-import neo4j from "neo4j-driver";
+import neo4j2 from "neo4j-driver";
 
 // app/lib/graph-labels.ts
 var import_dist2 = __toESM(require_dist2(), 1);
@@ -12933,12 +13248,12 @@ async function handleNeighbourhood(c, accountId) {
       // `neo4j.int` keeps the LIMIT value as a 64-bit Integer on the wire —
       // bare JS `number` works on Pi 4 today but errors on driver versions
       // that strictly type-check LIMIT clauses against Long.
-      neighbourhoodLimit: neo4j.int(NEIGHBOURHOOD_LIMIT),
+      neighbourhoodLimit: neo4j2.int(NEIGHBOURHOOD_LIMIT),
       // same Long-int discipline for the cluster-expand cap.
       // Used by NEIGHBOURHOOD_CYPHER's `siblingMessages[0..$clusterMessagesCap]`
       // slice. The search-intersect variant ignores it (cluster-expand
       // does not apply when search is narrowing the canvas).
-      clusterMessagesCap: neo4j.int(MAX_CLUSTER_MESSAGES)
+      clusterMessagesCap: neo4j2.int(MAX_CLUSTER_MESSAGES)
     };
     if (allowedIds !== null) cypherParams.allowedIds = allowedIds;
     const result = await session.executeRead(async (tx) => {
@@ -13281,10 +13596,10 @@ function structuralTemporalToIso(v) {
   return `${y}-${m}-${d}T${hh}:${mm}:${ss}${frac}${sign}${tzH}:${tzM}`;
 }
 function convertNeo4jValue(value, warnedClasses) {
-  if (neo4j.isDateTime(value) || neo4j.isDate(value) || neo4j.isLocalDateTime(value) || neo4j.isLocalTime(value) || neo4j.isTime(value) || neo4j.isDuration(value)) {
+  if (neo4j2.isDateTime(value) || neo4j2.isDate(value) || neo4j2.isLocalDateTime(value) || neo4j2.isLocalTime(value) || neo4j2.isTime(value) || neo4j2.isDuration(value)) {
     return value.toString();
   }
-  if (neo4j.isInt(value)) {
+  if (neo4j2.isInt(value)) {
     return value.inSafeRange() ? value.toNumber() : value.toString();
   }
   if (isStructuralInteger(value)) {
@@ -13784,7 +14099,7 @@ var graph_default_view_default = app25;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve21, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
+import { resolve as resolve22, relative as relative3, isAbsolute, sep as sep6, basename as basename7 } from "path";
 import { existsSync as existsSync21 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -13804,7 +14119,7 @@ app26.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve21(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve22(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -13855,8 +14170,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve21(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve21(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve22(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve22(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -13869,12 +14184,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve21(accountDir, "specialists", "agents");
-  const bundledDir = resolve21(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve22(accountDir, "specialists", "agents");
+  const bundledDir = resolve22(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve21(overrideDir, filename);
-    const bundledPath = resolve21(bundledDir, filename);
+    const overridePath = resolve22(overrideDir, filename);
+    const bundledPath = resolve22(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -14082,8 +14397,8 @@ app29.post("/", requireAdminSession, async (c) => {
 var session_archive_default = app29;
 
 // server/routes/admin/session-rc-spawn.ts
-import { randomUUID as randomUUID9 } from "crypto";
-function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID9) {
+import { randomUUID as randomUUID10 } from "crypto";
+function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10) {
   const operator = isOperatorHost(host, operatorDomains);
   const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
   const name = typeof body.name === "string" && body.name.length > 0 ? body.name : void 0;
@@ -14122,7 +14437,7 @@ app30.post("/", requireAdminSession, async (c) => {
   }
   const host = (c.req.header("host") ?? "").split(":")[0];
   const plan = resolveSpawnPlan(host, getOperatorDomains(), body);
-  const spawnReqId = randomUUID9();
+  const spawnReqId = randomUUID10();
   console.log(
     `[chat-spawn] op=request spawnReqId=${spawnReqId} origin=${plan.origin} kind=${plan.kind} sessionId=${plan.kind === "new" ? "new" : plan.sessionId}`
   );
@@ -14288,24 +14603,24 @@ app31.get("/", async (c) => {
 var system_stats_default = app31;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync22, readFileSync as readFileSync20 } from "fs";
-import { resolve as resolve22, join as join20 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
+import { existsSync as existsSync22, readFileSync as readFileSync21 } from "fs";
+import { resolve as resolve23, join as join20 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join20(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join20(PLATFORM_ROOT7, "config", "brand.json");
 if (existsSync22(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync20(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync21(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve22(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve23(PLATFORM_ROOT7, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync22(VERSION_FILE)) return "unknown";
-  return readFileSync20(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync21(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -14356,7 +14671,7 @@ app32.get("/", async (c) => {
 var health_default2 = app32;
 
 // server/routes/admin/linkedin-ingest.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 var TAG25 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
@@ -14482,7 +14797,7 @@ app33.post("/", requireAdminSession, async (c) => {
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
-  const sessionId = randomUUID10();
+  const sessionId = randomUUID11();
   console.log(TAG25 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
@@ -14504,7 +14819,7 @@ app33.post("/", requireAdminSession, async (c) => {
 var linkedin_ingest_default = app33;
 
 // server/routes/admin/post-turn-context.ts
-import neo4j2 from "neo4j-driver";
+import neo4j3 from "neo4j-driver";
 var TAG26 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
@@ -14517,10 +14832,10 @@ function isLoopbackAddr2(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function convertValue(value) {
-  if (neo4j2.isDateTime(value) || neo4j2.isDate(value) || neo4j2.isLocalDateTime(value) || neo4j2.isLocalTime(value) || neo4j2.isTime(value) || neo4j2.isDuration(value)) {
+  if (neo4j3.isDateTime(value) || neo4j3.isDate(value) || neo4j3.isLocalDateTime(value) || neo4j3.isLocalTime(value) || neo4j3.isTime(value) || neo4j3.isDuration(value)) {
     return value.toString();
   }
-  if (neo4j2.isInt(value)) {
+  if (neo4j3.isInt(value)) {
     return value.inSafeRange() ? value.toNumber() : value.toString();
   }
   if (Array.isArray(value)) {
@@ -14607,7 +14922,7 @@ app34.get("/", async (c) => {
 var post_turn_context_default = app34;
 
 // server/routes/admin/public-session-context.ts
-import neo4j3 from "neo4j-driver";
+import neo4j4 from "neo4j-driver";
 var TAG27 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
@@ -14620,10 +14935,10 @@ function isLoopbackAddr3(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function convertValue2(value) {
-  if (neo4j3.isDateTime(value) || neo4j3.isDate(value) || neo4j3.isLocalDateTime(value) || neo4j3.isLocalTime(value) || neo4j3.isTime(value) || neo4j3.isDuration(value)) {
+  if (neo4j4.isDateTime(value) || neo4j4.isDate(value) || neo4j4.isLocalDateTime(value) || neo4j4.isLocalTime(value) || neo4j4.isTime(value) || neo4j4.isDuration(value)) {
     return value.toString();
   }
-  if (neo4j3.isInt(value)) {
+  if (neo4j4.isInt(value)) {
     return value.inSafeRange() ? value.toNumber() : value.toString();
   }
   if (Array.isArray(value)) {
@@ -14779,9 +15094,81 @@ app37.post("/", async (c) => {
 });
 var access_session_evict_default = app37;
 
-// server/routes/admin/browser.ts
+// server/routes/admin/enrol-person.ts
+var TAG30 = "[enrol]";
+function isLoopbackAddr6(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var app38 = new Hono();
-app38.post("/launch", requireAdminSession, async (c) => {
+app38.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr6(remoteAddr)) {
+    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "enrol-person-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr6(t));
+    if (offender !== void 0) {
+      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "enrol-person-loopback-only" }, 403);
+    }
+  }
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const rawPhone = typeof body.phone === "string" ? body.phone : "";
+  const phone = normalizeE164(rawPhone);
+  if (phone.length <= 1) {
+    return c.json({ error: "invalid-phone" }, 400);
+  }
+  const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+  if (!EMAIL_RE.test(email)) {
+    return c.json({ error: "invalid-email" }, 400);
+  }
+  const agentSlug = typeof body.agentSlug === "string" ? body.agentSlug.trim() : "";
+  if (!agentSlug) {
+    return c.json({ error: "agentSlug required" }, 400);
+  }
+  const accountId = process.env.ACCOUNT_ID ?? "";
+  if (!accountId) {
+    console.error(`${TAG30} op=person result=no-account-id`);
+    return c.json({ error: "no-account-id" }, 500);
+  }
+  let personId;
+  try {
+    personId = await enrolPerson({ accountId, phone, email, agentSlug });
+  } catch (err) {
+    console.error(
+      `${TAG30} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return c.json({ error: "enrol-failed" }, 500);
+  }
+  let grant = null;
+  try {
+    const g = await findGrantByContact(email, agentSlug, accountId);
+    if (g) grant = { grantId: g.grantId, status: g.status, contactValue: g.contactValue };
+  } catch (err) {
+    console.error(
+      `${TAG30} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+    );
+  }
+  console.log(
+    `${TAG30} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
+  );
+  return c.json({ personId, grant }, 200);
+});
+var enrol_person_default = app38;
+
+// server/routes/admin/browser.ts
+var app39 = new Hono();
+app39.post("/launch", requireAdminSession, async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     console.error(`[admin/browser/launch] op=request transport=${transport}`);
@@ -14809,256 +15196,49 @@ app38.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app38;
+var browser_default = app39;
 
 // server/routes/admin/index.ts
-var app39 = new Hono();
-app39.route("/session", session_default);
-app39.route("/logs", logs_default);
-app39.route("/claude-info", claude_info_default);
-app39.route("/attachment", attachment_default);
-app39.route("/agents", agents_default);
-app39.route("/sessions", sessions_default);
-app39.route("/claude-sessions", claude_sessions_default);
-app39.route("/log-ingest", log_ingest_default);
-app39.route("/events", events_default);
-app39.route("/files", files_default);
-app39.route("/graph-search", graph_search_default);
-app39.route("/graph-subgraph", graph_subgraph_default);
-app39.route("/graph-delete", graph_delete_default);
-app39.route("/graph-restore", graph_restore_default);
-app39.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app39.route("/graph-default-view", graph_default_view_default);
-app39.route("/sidebar-artefacts", sidebar_artefacts_default);
-app39.route("/sidebar-sessions", sidebar_sessions_default);
-app39.route("/session-delete", session_delete_default);
-app39.route("/session-stop", session_stop_default);
-app39.route("/session-archive", session_archive_default);
-app39.route("/browser", browser_default);
-app39.route("/session-rc-spawn", session_rc_spawn_default);
-app39.route("/system-stats", system_stats_default);
-app39.route("/health-brand", health_default2);
-app39.route("/linkedin-ingest", linkedin_ingest_default);
-app39.route("/post-turn-context", post_turn_context_default);
-app39.route("/public-session-context", public_session_context_default);
-app39.route("/public-session-exit", public_session_exit_default);
-app39.route("/access-session-evict", access_session_evict_default);
-var admin_default = app39;
-
-// app/lib/access-gate.ts
-import neo4j4 from "neo4j-driver";
-import { readFileSync as readFileSync21 } from "fs";
-import { resolve as resolve23 } from "path";
-import { randomUUID as randomUUID11 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
-var driver = null;
-function readPassword() {
-  if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve23(PLATFORM_ROOT7, "config/.neo4j-password");
-  try {
-    return readFileSync21(passwordFile, "utf-8").trim();
-  } catch {
-    throw new Error(
-      `Neo4j password not found. Expected at ${passwordFile} or in NEO4J_PASSWORD env var.`
-    );
-  }
-}
-function getDriver() {
-  if (!driver) {
-    const uri = process.env.NEO4J_URI;
-    if (!uri) {
-      throw new Error(
-        "[ui/access-gate] NEO4J_URI unset \u2014 refusing to default to bolt://localhost:7687"
-      );
-    }
-    const user = process.env.NEO4J_USER ?? "neo4j";
-    const password = readPassword();
-    console.error(`[ui/access-gate] resolved neo4j_uri=${uri}`);
-    driver = neo4j4.driver(uri, neo4j4.auth.basic(user, password), {
-      maxConnectionPoolSize: 5
-    });
-  }
-  return driver;
-}
-function getSession3() {
-  return getDriver().session();
-}
-process.on("SIGINT", async () => {
-  if (driver) {
-    await driver.close();
-    driver = null;
-  }
-});
-var rateLimitMap = /* @__PURE__ */ new Map();
-var ACCESS_MAX_ATTEMPTS = 5;
-var ACCESS_LOCKOUT_MS = 15 * 60 * 1e3;
-var ACCESS_WINDOW_MS = 15 * 60 * 1e3;
-function checkAccessRateLimit(ip, agentSlug) {
-  const key = `${ip}:${agentSlug}`;
-  const entry = rateLimitMap.get(key);
-  if (!entry) return null;
-  const now = Date.now();
-  if (entry.lockedUntil && now < entry.lockedUntil) {
-    const remainingMs = entry.lockedUntil - now;
-    const remainingS = Math.ceil(remainingMs / 1e3);
-    return `Too many attempts. Try again in ${remainingS}s`;
-  }
-  if (now - entry.firstAttempt > ACCESS_WINDOW_MS) {
-    rateLimitMap.delete(key);
-    return null;
-  }
-  return null;
-}
-function recordAccessFailedAttempt(ip, agentSlug) {
-  const key = `${ip}:${agentSlug}`;
-  const now = Date.now();
-  const entry = rateLimitMap.get(key);
-  if (!entry || now - entry.firstAttempt > ACCESS_WINDOW_MS) {
-    rateLimitMap.set(key, { attempts: 1, firstAttempt: now });
-    return;
-  }
-  entry.attempts++;
-  if (entry.attempts >= ACCESS_MAX_ATTEMPTS) {
-    entry.lockedUntil = now + ACCESS_LOCKOUT_MS;
-  }
-}
-function clearAccessRateLimit(ip, agentSlug) {
-  rateLimitMap.delete(`${ip}:${agentSlug}`);
-}
-var contactRateMap = /* @__PURE__ */ new Map();
-var REQUEST_LINK_MAX = 3;
-var REQUEST_LINK_WINDOW_MS = 60 * 60 * 1e3;
-function checkRequestLinkRateLimit(contactValue) {
-  const entry = contactRateMap.get(contactValue);
-  if (!entry) return null;
-  const now = Date.now();
-  if (now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
-    contactRateMap.delete(contactValue);
-    return null;
-  }
-  if (entry.count >= REQUEST_LINK_MAX) {
-    const remainingMs = REQUEST_LINK_WINDOW_MS - (now - entry.windowStart);
-    const remainingM = Math.ceil(remainingMs / 6e4);
-    return `Too many requests. Try again in ${remainingM} minute(s)`;
-  }
-  return null;
-}
-function recordRequestLinkAttempt(contactValue) {
-  const now = Date.now();
-  const entry = contactRateMap.get(contactValue);
-  if (!entry || now - entry.windowStart > REQUEST_LINK_WINDOW_MS) {
-    contactRateMap.set(contactValue, { count: 1, windowStart: now });
-    return;
-  }
-  entry.count++;
-}
-function maskContact(value) {
-  if (value.includes("@")) {
-    const [local, domain] = value.split("@");
-    return `${local[0]}***@${domain}`;
-  }
-  return "****";
-}
-function readGrant(record) {
-  const g = record.get("g").properties;
-  const personId = record.get("personId");
-  return {
-    grantId: record.get("grantId"),
-    agentSlug: String(g.agentSlug),
-    accountId: String(g.accountId),
-    contactValue: String(g.contactValue),
-    displayName: record.get("givenName") ?? null,
-    personId,
-    expiresAt: g.expiresAt ? new Date(String(g.expiresAt)).getTime() : null,
-    status: String(g.status),
-    sliceToken: String(g.sliceToken ?? "")
-  };
-}
-async function findGrantByMagicToken(token) {
-  const session = getSession3();
-  try {
-    const result = await session.run(
-      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {magicToken: $token})
-       RETURN g, p.givenName AS givenName,
-              elementId(g) AS grantId,
-              elementId(p) AS personId`,
-      { token }
-    );
-    if (result.records.length === 0) return null;
-    return readGrant(result.records[0]);
-  } finally {
-    await session.close();
-  }
-}
-async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
-  const session = getSession3();
-  try {
-    const result = await session.run(
-      `MATCH (p:Person)-[:HAS_ACCESS]->(g:AccessGrant {
-        contactValue: $contactValue,
-        agentSlug: $agentSlug,
-        accountId: $accountId
-      })
-      WHERE g.status IN ['invited', 'active']
-      RETURN g, p.givenName AS givenName,
-             elementId(g) AS grantId,
-             elementId(p) AS personId`,
-      { contactValue, agentSlug, accountId }
-    );
-    if (result.records.length === 0) return null;
-    return readGrant(result.records[0]);
-  } finally {
-    await session.close();
-  }
-}
-async function consumeMagicTokenAndActivate(grantId) {
-  const session = getSession3();
-  try {
-    const result = await session.run(
-      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
-       SET g.magicToken = null,
-           g.magicTokenExpiresAt = null,
-           g.status = "active"
-       RETURN count(g) AS affected`,
-      { grantId }
-    );
-    const affected = result.records[0]?.get("affected");
-    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
-    if (count === 0) {
-      throw new Error(`[access-gate] consumeMagicTokenAndActivate: no grant matched grantId=${grantId}`);
-    }
-  } finally {
-    await session.close();
-  }
-}
-async function generateNewMagicToken(grantId) {
-  const token = randomUUID11();
-  const session = getSession3();
-  try {
-    const result = await session.run(
-      `MATCH (g:AccessGrant) WHERE elementId(g) = $grantId
-       SET g.magicToken = $token,
-           g.magicTokenExpiresAt = datetime() + duration('PT15M')
-       RETURN count(g) AS affected`,
-      { grantId, token }
-    );
-    const affected = result.records[0]?.get("affected");
-    const count = typeof affected === "number" ? affected : affected?.toNumber?.() ?? 0;
-    if (count === 0) {
-      throw new Error(`[access-gate] generateNewMagicToken: no grant matched grantId=${grantId}`);
-    }
-  } finally {
-    await session.close();
-  }
-  return token;
-}
+var app40 = new Hono();
+app40.route("/session", session_default);
+app40.route("/logs", logs_default);
+app40.route("/claude-info", claude_info_default);
+app40.route("/attachment", attachment_default);
+app40.route("/agents", agents_default);
+app40.route("/sessions", sessions_default);
+app40.route("/claude-sessions", claude_sessions_default);
+app40.route("/log-ingest", log_ingest_default);
+app40.route("/events", events_default);
+app40.route("/files", files_default);
+app40.route("/graph-search", graph_search_default);
+app40.route("/graph-subgraph", graph_subgraph_default);
+app40.route("/graph-delete", graph_delete_default);
+app40.route("/graph-restore", graph_restore_default);
+app40.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app40.route("/graph-default-view", graph_default_view_default);
+app40.route("/sidebar-artefacts", sidebar_artefacts_default);
+app40.route("/sidebar-sessions", sidebar_sessions_default);
+app40.route("/session-delete", session_delete_default);
+app40.route("/session-stop", session_stop_default);
+app40.route("/session-archive", session_archive_default);
+app40.route("/browser", browser_default);
+app40.route("/session-rc-spawn", session_rc_spawn_default);
+app40.route("/system-stats", system_stats_default);
+app40.route("/health-brand", health_default2);
+app40.route("/linkedin-ingest", linkedin_ingest_default);
+app40.route("/post-turn-context", post_turn_context_default);
+app40.route("/public-session-context", public_session_context_default);
+app40.route("/public-session-exit", public_session_exit_default);
+app40.route("/access-session-evict", access_session_evict_default);
+app40.route("/enrol-person", enrol_person_default);
+var admin_default = app40;
 
 // server/routes/access/verify-token.ts
-var TAG30 = "[access-verify]";
+var TAG31 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app40 = new Hono();
-app40.post("/", async (c) => {
+var app41 = new Hono();
+app41.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -15073,39 +15253,39 @@ app40.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG30} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG31} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG30} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG31} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG31} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG31} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG31} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG31} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -15121,12 +15301,12 @@ app40.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG31} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG30} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG31} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -15140,7 +15320,7 @@ app40.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app40;
+var verify_token_default = app41;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -15202,10 +15382,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG31 = "[access-request-link]";
-var app41 = new Hono();
+var TAG32 = "[access-request-link]";
+var app42 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app41.post("/", async (c) => {
+app42.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -15219,18 +15399,18 @@ app41.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG31} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG32} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG31} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG32} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG31} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG32} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -15238,7 +15418,7 @@ app41.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG31} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG32} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -15270,22 +15450,22 @@ app41.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG31} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG32} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG31} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG32} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app41;
+var request_magic_link_default = app42;
 
 // server/routes/access/index.ts
-var app42 = new Hono();
-app42.route("/verify-token", verify_token_default);
-app42.route("/request-magic-link", request_magic_link_default);
-var access_default = app42;
+var app43 = new Hono();
+app43.route("/verify-token", verify_token_default);
+app43.route("/request-magic-link", request_magic_link_default);
+var access_default = app43;
 
 // server/routes/sites.ts
 import { existsSync as existsSync23, readFileSync as readFileSync22, realpathSync as realpathSync5, statSync as statSync9 } from "fs";
@@ -15320,8 +15500,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app43 = new Hono();
-app43.get("/:rel{.*}", (c) => {
+var app44 = new Hono();
+app44.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -15424,7 +15604,7 @@ app43.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app43;
+var sites_default = app44;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -15524,7 +15704,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app44 = new Hono();
+var app45 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -15569,17 +15749,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app44.options("/consent", (c) => {
+app45.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app44.options("/brand-config", (c) => {
+app45.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app44.post("/consent", async (c) => {
+app45.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -15619,7 +15799,7 @@ app44.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app44.get("/brand-config", (c) => {
+app45.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -15629,7 +15809,7 @@ app44.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app44;
+var visitor_consent_default = app45;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -15656,8 +15836,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app45 = new Hono();
-app45.get("/:slug/click", async (c) => {
+var app46 = new Hono();
+app46.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -15721,10 +15901,10 @@ app45.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app45;
+var listings_default = app46;
 
 // server/routes/visitor-event.ts
-var app46 = new Hono();
+var app47 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -15791,12 +15971,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app46.options("/event", (c) => {
+app47.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app46.post("/event", async (c) => {
+app47.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -16001,7 +16181,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app46;
+var visitor_event_default = app47;
 
 // server/routes/session.ts
 import { resolve as resolve26 } from "path";
@@ -16047,8 +16227,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app47 = new Hono();
-app47.post("/", async (c) => {
+var app48 = new Hono();
+app48.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -16259,7 +16439,7 @@ app47.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app47;
+var session_default2 = app48;
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist3(), 1);
@@ -16749,8 +16929,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app49 = new Hono();
-  app49.get("/wa-channel/inbound", (c) => {
+  const app50 = new Hono();
+  app50.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -16768,7 +16948,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app49.post("/wa-channel/reply", async (c) => {
+  app50.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -16789,7 +16969,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app49.post("/wa-channel/reply-document", async (c) => {
+  app50.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -16828,7 +17008,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app49.post("/wa-channel/ready", async (c) => {
+  app50.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -16837,7 +17017,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app49.post("/wa-channel/received", async (c) => {
+  app50.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -16847,7 +17027,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app49.post("/wa-channel/turn-end", async (c) => {
+  app50.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -16878,7 +17058,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=fallback bytes=${bytes}`);
     return c.json({ ok: true, delivered: "fallback" });
   });
-  return app49;
+  return app50;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -16967,6 +17147,8 @@ var WaGateway = class {
         await this.deps.ensureChannelSession({
           accountId: input.accountId,
           senderId: input.senderId,
+          role: input.role ?? "admin",
+          personId: input.personId ?? null,
           gatewayUrl: this.deps.gatewayUrl,
           serverPath: this.deps.serverPath
         });
@@ -16990,6 +17172,26 @@ var WaGateway = class {
   }
 };
 
+// app/lib/whatsapp/gateway/spawn-request.ts
+function buildWaSpawnRequest(input) {
+  const personId = input.role === "public" && input.personId ? input.personId : void 0;
+  return {
+    sessionId: adminSessionIdFor(input.accountId, input.senderId, personId),
+    role: input.role,
+    channel: "whatsapp",
+    personId,
+    waChannel: { senderId: input.senderId, gatewayUrl: input.gatewayUrl, serverPath: input.serverPath },
+    logContext: `channel=whatsapp-native role=${input.role} senderId=${input.senderId}`
+  };
+}
+
+// app/lib/whatsapp/inbound/route-decision.ts
+function decideWaRoute(msg) {
+  if (msg.agentType === "admin") return { action: "route", role: "admin", personId: null };
+  if (msg.personId && msg.personId.length > 0) return { action: "route", role: "public", personId: msg.personId };
+  return { action: "drop", reason: "public-unresolved" };
+}
+
 // app/lib/webchat/gateway/inbound-hub.ts
 var InboundHub2 = class {
   keys = /* @__PURE__ */ new Map();
@@ -17109,8 +17311,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app49 = new Hono();
-  app49.get("/webchat-channel/inbound", (c) => {
+  const app50 = new Hono();
+  app50.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -17128,7 +17330,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app49.post("/webchat-channel/reply", async (c) => {
+  app50.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -17138,7 +17340,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, Buffer.byteLength(text, "utf8"));
     return c.json({ ok: true });
   });
-  app49.post("/webchat-channel/ready", async (c) => {
+  app50.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -17147,7 +17349,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app49.post("/webchat-channel/received", async (c) => {
+  app50.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -17157,7 +17359,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  return app49;
+  return app50;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -17662,7 +17864,7 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app48 = new Hono();
+var app49 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
@@ -17686,29 +17888,23 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, senderId, gatewayUrl, serverPath }) => {
-    const userId = resolveAdminUserId({ accountId, senderPhone: senderId }) ?? void 0;
-    console.error(`[whatsapp-native] op=admin-identity senderId=${senderId} userId=${userId ?? "owner-fallback"}`);
-    const result = await managerRcSpawn({
-      sessionId: adminSessionIdFor(accountId, senderId),
-      userId,
-      // Task 724 — supply the channel so /rc-spawn writes the classification
-      // sidecar from the body, the same path every other admin channel uses.
-      // senderId for the sidecar continues to come from the waChannel binding.
-      role: "admin",
-      channel: "whatsapp",
-      waChannel: { senderId, gatewayUrl, serverPath },
-      logContext: `channel=whatsapp-native senderId=${senderId}`
-    });
+  ensureChannelSession: async ({ accountId, senderId, role, personId, gatewayUrl, serverPath }) => {
+    const req = buildWaSpawnRequest({ accountId, senderId, role, personId, gatewayUrl, serverPath });
+    const userId = role === "admin" ? resolveAdminUserId({ accountId, senderPhone: senderId }) ?? void 0 : void 0;
+    if (role === "admin") {
+      console.error(`[whatsapp-native] op=admin-identity senderId=${senderId} userId=${userId ?? "owner-fallback"}`);
+    }
+    const result = await managerRcSpawn({ ...req, userId });
     if ("error" in result) {
-      console.error(`[whatsapp-native] spawn-failed senderId=${senderId} error=${result.error} status=${result.status}`);
+      console.error(`[whatsapp-native] spawn-failed senderId=${senderId} role=${role} error=${result.error} status=${result.status}`);
       return;
     }
+    if (role !== "admin") return;
     const prior = nativeFileFollowers.get(senderId);
     if (prior) prior.abort();
     let ac;
     ac = startNativeFileFollower({
-      sessionId: adminSessionIdFor(accountId, senderId),
+      sessionId: req.sessionId,
       senderId,
       accountId,
       onClose: () => {
@@ -17718,7 +17914,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app48.route("/", waGateway.routes());
+app49.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
   gatewayUrl: webchatGatewayUrl(),
@@ -17741,10 +17937,10 @@ var webchatGateway = new WebchatGateway({
     }
   }
 });
-app48.route("/", webchatGateway.routes());
+app49.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
-app48.use("*", clientIpMiddleware);
-app48.use("*", async (c, next) => {
+app49.use("*", clientIpMiddleware);
+app49.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -17754,7 +17950,7 @@ app48.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app48.use("*", async (c, next) => {
+app49.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -17772,7 +17968,7 @@ app48.use("*", async (c, next) => {
     });
   }
 });
-app48.use("*", async (c, next) => {
+app49.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -17803,7 +17999,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app48.post("/__remote-auth/login", async (c) => {
+app49.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -17848,7 +18044,7 @@ app48.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app48.get("/__remote-auth/logout", (c) => {
+app49.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -17861,7 +18057,7 @@ app48.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app48.post("/__remote-auth/change-password", async (c) => {
+app49.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -17912,13 +18108,13 @@ app48.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app48.get("/__remote-auth/setup", (c) => {
+app49.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app48.post("/__remote-auth/set-initial-password", async (c) => {
+app49.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -17956,10 +18152,10 @@ app48.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app48.get("/api/remote-auth/status", (c) => {
+app49.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app48.post("/api/remote-auth/set-password", async (c) => {
+app49.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17990,9 +18186,9 @@ app48.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app48.route("/api/_client-error", client_error_default);
+app49.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app48.use("*", async (c, next) => {
+app49.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -18025,20 +18221,24 @@ app48.use("*", async (c, next) => {
     console.error(`[remote-auth] not configured, redirecting to setup ip=${clientIp} path=${path2} ${disambig}`);
     return c.redirect("/__remote-auth/setup");
   }
-  console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
+  const respond = isApiRequestPath(path2) ? "401" : "html";
+  console.error(`[remote-auth] login required ip=${clientIp} path=${path2} respond=${respond} ${disambig}`);
+  if (respond === "401") {
+    return c.json({ code: "remote-auth-required" }, 401);
+  }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app48.route("/api/health", health_default);
-app48.route("/api/chat", chat_default);
-app48.route("/api/whatsapp", whatsapp_default);
-app48.route("/api/whatsapp-reader", whatsapp_reader_default);
-app48.route("/api/webchat", createWebchatRoutes({ handleInbound: (input) => webchatGateway.handleInbound(input) }));
-app48.route("/api/webchat/greeting", webchat_greeting_default);
-app48.route("/api/telegram", telegram_default);
-app48.route("/api/onboarding", onboarding_default);
-app48.route("/api/admin", admin_default);
-app48.route("/api/access", access_default);
-app48.route("/api/session", session_default2);
+app49.route("/api/health", health_default);
+app49.route("/api/chat", chat_default);
+app49.route("/api/whatsapp", whatsapp_default);
+app49.route("/api/whatsapp-reader", whatsapp_reader_default);
+app49.route("/api/webchat", createWebchatRoutes({ handleInbound: (input) => webchatGateway.handleInbound(input) }));
+app49.route("/api/webchat/greeting", webchat_greeting_default);
+app49.route("/api/telegram", telegram_default);
+app49.route("/api/onboarding", onboarding_default);
+app49.route("/api/admin", admin_default);
+app49.route("/api/access", access_default);
+app49.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -18050,7 +18250,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app48.get("/agent-assets/:slug/:filename", (c) => {
+app49.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -18085,7 +18285,7 @@ app48.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app48.get("/generated/:filename", (c) => {
+app49.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -18115,10 +18315,10 @@ app48.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app48.route("/sites", sites_default);
-app48.route("/listings", listings_default);
-app48.route("/v", visitor_event_default);
-app48.route("/v", visitor_consent_default);
+app49.route("/sites", sites_default);
+app49.route("/listings", listings_default);
+app49.route("/v", visitor_event_default);
+app49.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -18249,7 +18449,7 @@ function escapeHtml(s) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app48.get("/", (c) => {
+app49.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -18271,12 +18471,12 @@ app48.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app48.get("/public", (c) => {
+app49.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app48.get("/public-chat", (c) => {
+app49.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -18295,9 +18495,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app48.use("/vnc-viewer.html", logViewerFetch);
-app48.use("/vnc-popout.html", logViewerFetch);
-app48.get("/vnc-popout.html", (c) => {
+app49.use("/vnc-viewer.html", logViewerFetch);
+app49.use("/vnc-popout.html", logViewerFetch);
+app49.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync26(resolve29(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -18310,7 +18510,7 @@ app48.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app48.post("/api/vnc/client-event", async (c) => {
+app49.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -18331,30 +18531,30 @@ app48.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app48.get("/g/:slug", (c) => {
+app49.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app48.get("/graph", (c) => {
+app49.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app48.get("/chat", (c) => {
+app49.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app48.get("/data", (c) => {
+app49.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app48.get("/browser", (c) => {
+app49.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app48.get("/:slug", async (c, next) => {
+app49.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -18369,13 +18569,13 @@ app48.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app48.get("/favicon.ico", (c) => {
+  app49.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app48.use("/*", serveStatic({ root: "./public" }));
-app48.all("*", (c) => {
+app49.use("/*", serveStatic({ root: "./public" }));
+app49.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -18389,7 +18589,7 @@ app48.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app48.fetch, port, hostname });
+var httpServer = serve({ fetch: app49.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startAuthHealthHeartbeat();
 {
@@ -18428,7 +18628,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app48.routes ?? []) {
+  for (const r of app49.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -18577,8 +18777,9 @@ init({
       console.error(`[whatsapp:route] skipped reason=owner-mirror senderId=${msg.senderPhone}`);
       return;
     }
-    if (msg.agentType !== "admin") {
-      console.error(`[whatsapp:route] dropped reason=non-admin-sender senderId=${msg.senderPhone} agentType=${msg.agentType}`);
+    const decision = decideWaRoute(msg);
+    if (decision.action === "drop") {
+      console.error(`[whatsapp:route] op=dropped reason=${decision.reason} senderId=${msg.senderPhone}`);
       return;
     }
     const hasFileMedia = msg.media.some((m) => m.type !== "audio");
@@ -18586,12 +18787,17 @@ init({
       console.error(`[whatsapp:route] dropped reason=no-text-no-media senderId=${msg.senderPhone} mediaCount=${msg.media.length}`);
       return;
     }
+    if (decision.role === "public") {
+      console.error(`[whatsapp:route] op=routed agentType=public personId=${decision.personId} senderId=${msg.senderPhone}`);
+    }
     try {
       void msg.composing().catch(() => {
       });
       await waGateway.handleInbound({
         accountId: msg.accountId,
         senderId: msg.senderPhone,
+        role: decision.role,
+        personId: decision.personId,
         text: msg.text,
         reply: msg.reply,
         media: msg.media