@rubytech/create-maxy-code 0.1.305 → 0.1.307

package/payload/server/server.js

@@ -69,6 +69,7 @@ import {
   listAdminSessions,
   listValidAccounts,
   loadAdminUserName,
+  loadPersonNameByElementId,
   loadUserProfile,
   loadWhatsappSenderName,
   persistMessage,
@@ -105,7 +106,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-TUY3RB5G.js";
+} from "./chunk-4QFPGAUZ.js";
 import {
   __commonJS,
   __toESM
@@ -1223,10 +1224,93 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync26, existsSync as existsSync27, watchFile } from "fs";
-import { resolve as resolve29, join as join22, basename as basename8 } from "path";
+import { resolve as resolve30, join as join22, basename as basename8 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
+// app/lib/pwa.ts
+var PWA_SURFACES = [
+  {
+    surface: "admin",
+    shellFile: "index.html",
+    manifestPath: "/manifest-admin.webmanifest",
+    nameSuffix: "",
+    startUrl: "/",
+    scope: "/",
+    id: "/?pwa=admin"
+  },
+  {
+    surface: "operator",
+    shellFile: "operator.html",
+    manifestPath: "/manifest-operator.webmanifest",
+    nameSuffix: " Operator",
+    startUrl: "/",
+    scope: "/",
+    id: "/?pwa=operator"
+  },
+  {
+    surface: "chat",
+    shellFile: "chat.html",
+    manifestPath: "/manifest-chat.webmanifest",
+    nameSuffix: " Chat",
+    startUrl: "/chat",
+    scope: "/chat",
+    id: "/chat?pwa=chat"
+  }
+];
+var MANIFEST_CONTENT_TYPE = "application/manifest+json";
+var SW_CONTENT_TYPE = "application/javascript";
+function pwaSurfaceForShell(file) {
+  return PWA_SURFACES.find((s) => s.shellFile === file);
+}
+function buildManifest(s, b) {
+  const name = `${b.productName}${s.nameSuffix}`;
+  return {
+    id: s.id,
+    name,
+    short_name: name,
+    start_url: s.startUrl,
+    scope: s.scope,
+    display: "standalone",
+    theme_color: b.themeColor,
+    background_color: b.backgroundColor,
+    icons: [{ src: b.iconPath, sizes: "any", purpose: "any" }]
+  };
+}
+function escAttr(s) {
+  return s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function swRegisterScript(s) {
+  return [
+    "<script>",
+    "if('serviceWorker' in navigator){navigator.serviceWorker.register('/sw.js').catch(function(e){",
+    `try{fetch('/api/_client-error',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({kind:'event',source:'pwa',op:'sw-register-fail',surface:'${s.surface}',scope:'${s.scope}',err:String((e&&e.message)||e)}),keepalive:true}).catch(function(){});}catch(_){}`,
+    "});}",
+    "</script>"
+  ].join("\n");
+}
+function pwaHeadTags(s, b) {
+  return [
+    `<link rel="manifest" href="${escAttr(s.manifestPath)}">`,
+    `<link rel="apple-touch-icon" href="${escAttr(b.iconPath)}">`,
+    // Both the standards-based and the legacy Apple capable meta: Chromium
+    // deprecates `apple-mobile-web-app-capable` in favour of
+    // `mobile-web-app-capable`, while iOS Safari still reads the apple one.
+    '<meta name="mobile-web-app-capable" content="yes">',
+    '<meta name="apple-mobile-web-app-capable" content="yes">',
+    `<meta name="theme-color" content="${escAttr(b.themeColor)}">`,
+    swRegisterScript(s)
+  ].join("\n");
+}
+function pwaCensus(d) {
+  const manifestLinked = PWA_SURFACES.filter((s) => {
+    const html = d.shellHtml(s.shellFile);
+    return html != null && html.includes(`"${s.manifestPath}"`);
+  }).length;
+  const iconsPresent = d.iconExists() ? PWA_SURFACES.length : 0;
+  return { surfaces: PWA_SURFACES.length, manifestLinked, iconsPresent };
+}
+
 // server/webchat-descriptor.ts
 import { resolve, join as join2 } from "path";
 function webchatGatewayUrl() {
@@ -1788,7 +1872,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve30) => setTimeout(() => resolve30("timeout"), timeoutMs)
+    (resolve31) => setTimeout(() => resolve31("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -1916,11 +2000,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve30, reject) => {
+  return new Promise((resolve31, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve30();
+        resolve31();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2034,14 +2118,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve30, reject) => {
+  return new Promise((resolve31, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve30(value);
+        resolve31(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -2925,8 +3009,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve30) => {
-    release = resolve30;
+  const mine = new Promise((resolve31) => {
+    release = resolve31;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -4006,11 +4090,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve30) => {
-        const timer2 = setTimeout(resolve30, delay);
+      await new Promise((resolve31) => {
+        const timer2 = setTimeout(resolve31, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve30();
+          resolve31();
         }, { once: true });
       });
     }
@@ -4018,16 +4102,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     if (!conn.sock) {
-      resolve30();
+      resolve31();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve30();
+        resolve31();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -4287,8 +4371,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve30) => {
-      resolvePending = resolve30;
+    const sttPending = new Promise((resolve31) => {
+      resolvePending = resolve31;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -4682,20 +4766,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve30) => {
+  return new Promise((resolve31) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve30(true);
+      resolve31(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve30(false);
+      resolve31(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve30(false);
+      resolve31(false);
     });
   });
 }
@@ -4764,10 +4848,75 @@ var health_default = app;
 // app/lib/attachments.ts
 import { randomUUID as randomUUID4 } from "crypto";
 import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
+import { realpathSync as realpathSync2 } from "fs";
+import { resolve as resolve6, extname } from "path";
+
+// app/lib/data-path.ts
 import { realpathSync } from "fs";
-import { resolve as resolve5, extname } from "path";
+import { resolve as resolve5, normalize, sep as sep2, relative } from "path";
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve5(PLATFORM_ROOT4, "..", "data/uploads");
+var DATA_ROOT = resolve5(PLATFORM_ROOT4, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve5(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["accounts"]);
+var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function crossesForeignAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
+  if (segs.length < 2) return false;
+  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
+  const owner = segs[1];
+  if (!ACCOUNT_UUID_RE.test(owner)) return false;
+  return owner !== accountId;
+}
+function resolveUnderRoot(raw, rootAbs, rootLabel) {
+  const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
+  const absolute = resolve5(rootAbs, cleaned);
+  let rootReal;
+  try {
+    rootReal = realpathSync(rootAbs);
+  } catch (err) {
+    return {
+      ok: false,
+      status: 500,
+      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let resolvedReal;
+  try {
+    resolvedReal = realpathSync(absolute);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep2)) {
+        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
+      }
+      return { ok: false, status: 404, error: "Not found" };
+    }
+    return {
+      ok: false,
+      status: 500,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
+    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
+  }
+  const relPath = relative(rootReal, resolvedReal) || ".";
+  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
+}
+function resolveDataPath(raw) {
+  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
+}
+function resolveClaudeUploadsPath(raw) {
+  if (!CLAUDE_UPLOADS_ROOT) {
+    return { ok: false, status: 404, error: "Not found" };
+  }
+  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
+}
+
+// app/lib/attachments.ts
+function uploadsDirFor(accountId, subPath, attachmentId) {
+  return subPath ? resolve6(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve6(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+}
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -4792,16 +4941,16 @@ function assertSupportedMime(mimeType) {
     );
   }
 }
-async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
+async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer) {
   const attachmentId = randomUUID4();
-  const dir = resolve5(ATTACHMENTS_ROOT, scope, attachmentId);
+  const dir = uploadsDirFor(accountId, subPath, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
-    scope,
+    scope: subPath || accountId,
     filename,
     mimeType,
     sizeBytes,
@@ -4819,16 +4968,16 @@ async function storeAttachment(accountId, file) {
     );
   }
   const buffer = Buffer.from(await file.arrayBuffer());
-  return writeAttachment(accountId, file.name, file.type, file.size, buffer);
+  return writeAttachment(accountId, "", file.name, file.type, file.size, buffer);
 }
-async function storePublicAttachment(sessionId, file, buffer) {
+async function storePublicAttachment(accountId, sessionId, file, buffer) {
   assertSupportedMime(file.type);
   if (file.size > MAX_FILE_SIZE_BYTES) {
     throw new Error(
       `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  return writeAttachment(`public/${sessionId}`, file.name, file.type, file.size, buffer);
+  return writeAttachment(accountId, `public/${sessionId}`, file.name, file.type, file.size, buffer);
 }
 var MIME_BY_EXT = {
   ".pdf": "application/pdf",
@@ -4858,8 +5007,8 @@ function detectMimeType(filePath) {
   return MIME_BY_EXT[ext] ?? "application/octet-stream";
 }
 function validateFilePathInAccount(filePath, accountDir) {
-  const resolved = realpathSync(filePath);
-  const accountResolved = realpathSync(accountDir);
+  const resolved = realpathSync2(filePath);
+  const accountResolved = realpathSync2(accountDir);
   if (!resolved.startsWith(accountResolved + "/")) {
     throw new Error(`File path is outside the account directory`);
   }
@@ -4872,11 +5021,11 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
       `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  const dir = resolve5(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = uploadsDirFor(accountId, "", attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve5(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve5(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope: accountId,
@@ -4980,7 +5129,7 @@ async function transcribeVoiceNote(file, source) {
 }
 
 // app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve7 } from "path";
+import { resolve as resolve8 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase() {
@@ -5431,9 +5580,9 @@ async function fanOut(subscribers, text, onError, tag) {
 }
 
 // app/lib/whatsapp/outbound/send-document.ts
-import { realpathSync as realpathSync2 } from "fs";
+import { realpathSync as realpathSync3 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve6, basename } from "path";
+import { resolve as resolve7, basename } from "path";
 var TAG16 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -5464,11 +5613,11 @@ async function sendWhatsAppDocument(input) {
   if (!maxyAccountId || !platformRoot2) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve6(platformRoot2, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve7(platformRoot2, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
-    resolvedPath = realpathSync2(filePath);
-    const accountResolved = realpathSync2(accountDir);
+    resolvedPath = realpathSync3(filePath);
+    const accountResolved = realpathSync3(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
       const sanitised = filePath.replace(accountDir, "<account>/");
       console.error(`${TAG16} document REJECTED path=${sanitised} reason=outside_account_directory`);
@@ -5674,7 +5823,7 @@ async function ensureEntry(input) {
     });
   } else {
     console.error(`${tag} route role=${input.role} target=public-spawn senderId=${input.senderId}`);
-    const attachmentDir = resolve7(ATTACHMENTS_ROOT, "public", input.senderId);
+    const attachmentDir = resolve8(DATA_ROOT, "accounts", input.accountId, "uploads", "public", input.senderId);
     spawned = await managerSpawn({
       senderId: input.senderId,
       role: input.role,
@@ -5806,12 +5955,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve30;
+  let resolve31;
   const turnPromise = new Promise((r) => {
-    resolve30 = r;
+    resolve31 = r;
   });
   const listener = (text) => {
-    resolve30(text);
+    resolve31(text);
   };
   entry.subscribers.add(listener);
   const writeAtMs = Date.now();
@@ -5960,6 +6109,10 @@ var app2 = new Hono();
 app2.post("/", async (c) => {
   console.log(`[chat-route] entered route=public method=POST`);
   const contentType = c.req.header("content-type") ?? "";
+  const account = resolveAccount();
+  if (!account) {
+    return c.json({ error: "No account configured" }, 500);
+  }
   let message;
   let session_key;
   let userTimestamp;
@@ -6020,7 +6173,7 @@ ${result.result.text}` : result.result.text;
     const stored = [];
     for (const file of regularFiles) {
       const buffer = Buffer.from(await file.arrayBuffer());
-      const att = await storePublicAttachment(session_key, file, buffer);
+      const att = await storePublicAttachment(account.accountId, session_key, file, buffer);
       stored.push({ name: file.name, path: att.storagePath, mime: att.mimeType, sizeBytes: att.sizeBytes });
     }
     attachmentCount = stored.length;
@@ -6066,10 +6219,6 @@ ${result.result.text}` : result.result.text;
   );
   const fullMessage = message + uploadNote;
   const encoder = new TextEncoder();
-  const account = resolveAccount();
-  if (!account) {
-    return c.json({ error: "No account configured" }, 500);
-  }
   let agentSlug;
   let resolveSource;
   if (requestedSlug) {
@@ -6181,7 +6330,7 @@ ${result.result.text}` : result.result.text;
 var chat_default = app2;
 
 // server/routes/whatsapp.ts
-import { join as join7, resolve as resolve9 } from "path";
+import { join as join7, resolve as resolve10 } from "path";
 import { readdirSync as readdirSync3, readFileSync as readFileSync8, existsSync as existsSync5 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -6189,10 +6338,10 @@ import { randomUUID as randomUUID7 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
-import { resolve as resolve8, join as join5 } from "path";
+import { resolve as resolve9, join as join5 } from "path";
 var TAG18 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve8(accountDir, "account.json");
+  return resolve9(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
@@ -6599,8 +6748,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve30, reject) => {
-    resolveCode = resolve30;
+  const codePromise = new Promise((resolve31, reject) => {
+    resolveCode = resolve31;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -6997,14 +7146,14 @@ app3.post("/config", async (c) => {
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
-        const agentsDir = resolve9(account.accountDir, "agents");
+        const agentsDir = resolve10(account.accountDir, "agents");
         const agents = [];
         if (existsSync5(agentsDir)) {
           try {
             const entries = readdirSync3(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve9(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve10(agentsDir, entry.name, "config.json");
               if (!existsSync5(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync8(configPath2, "utf-8"));
@@ -7277,15 +7426,17 @@ var whatsapp_default = app3;
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync11, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync6 } from "fs";
-import { basename as basename2, dirname, join as join10, resolve as resolve11, sep as sep2 } from "path";
+import { basename as basename2, dirname, join as join10, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
-import { join as join8, resolve as resolve10 } from "path";
+import { join as join8, resolve as resolve11 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
 var PUBLIC_ROLE = "public";
+var ADMIN_ROLE = "admin";
 var WEBCHAT_CHANNEL = "webchat";
+var WHATSAPP_CHANNEL = "whatsapp";
 var app4 = new Hono();
 function claudeConfigDir() {
   return process.env.CLAUDE_CONFIG_DIR ?? null;
@@ -7398,7 +7549,7 @@ function loadUserTitles(accountDir) {
   return out;
 }
 function readSidecarMeta(metaPath) {
-  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null };
+  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null };
   let raw;
   try {
     raw = readFileSync9(metaPath, "utf8");
@@ -7419,7 +7570,9 @@ function readSidecarMeta(metaPath) {
     role: typeof r.role === "string" ? r.role : null,
     channel: typeof r.channel === "string" ? r.channel : null,
     senderId: typeof r.senderId === "string" ? r.senderId : null,
-    startedAt: typeof r.startedAt === "string" ? r.startedAt : null
+    startedAt: typeof r.startedAt === "string" ? r.startedAt : null,
+    personId: typeof r.personId === "string" ? r.personId : null,
+    adminUserId: typeof r.adminUserId === "string" ? r.adminUserId : null
   };
 }
 function startsWithCliMarker(s) {
@@ -7429,9 +7582,29 @@ function startsWithCliMarker(s) {
 function trimToTitle(raw) {
   return raw.trim().replace(/\s+/g, " ");
 }
+var CHANNEL_WRAPPER = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
+var SOURCE_ATTR = /\bsource="([^"]+)"/;
+var CHANNEL_SOURCE_MAP = {
+  whatsapp: "whatsapp",
+  "whatsapp-channel": "whatsapp",
+  webchat: "webchat",
+  "webchat-channel": "webchat"
+};
+function stripChannelEnvelope(text) {
+  const m = text.match(CHANNEL_WRAPPER);
+  if (!m) return { inner: text, channel: null };
+  let raw = m[1].match(SOURCE_ATTR)?.[1] ?? "";
+  let inner = m[2];
+  const im = inner.match(CHANNEL_WRAPPER);
+  const innerRaw = im?.[1].match(SOURCE_ATTR)?.[1];
+  if (im && innerRaw) {
+    raw = innerRaw;
+    inner = im[2];
+  }
+  return { inner, channel: CHANNEL_SOURCE_MAP[raw] ?? (raw || null) };
+}
 function resolveTitle(body, sessionId, userTitles) {
   const userTitle = userTitles.get(sessionId);
-  if (userTitle) return { title: trimToTitle(userTitle), source: "user" };
   let aiTitle = null;
   let firstUserMessage = null;
   for (const line of body.split("\n")) {
@@ -7458,9 +7631,12 @@ function resolveTitle(body, sessionId, userTitles) {
       firstUserMessage = trimmed;
     }
   }
-  if (aiTitle) return { title: trimToTitle(aiTitle), source: "ai" };
-  if (firstUserMessage) return { title: trimToTitle(firstUserMessage), source: "first-message" };
-  return { title: sessionId.slice(0, 8), source: "prefix" };
+  const stripped = firstUserMessage !== null ? stripChannelEnvelope(firstUserMessage) : { inner: null, channel: null };
+  const channel = stripped.channel;
+  if (userTitle) return { title: trimToTitle(userTitle), source: "user", channel };
+  if (aiTitle) return { title: trimToTitle(aiTitle), source: "ai", channel };
+  if (stripped.inner) return { title: trimToTitle(stripped.inner), source: "first-message", channel };
+  return { title: sessionId.slice(0, 8), source: "prefix", channel };
 }
 app4.get("/", requireAdminSession, async (c) => {
   const accountId = process.env.ACCOUNT_ID ?? null;
@@ -7472,7 +7648,7 @@ app4.get("/", requireAdminSession, async (c) => {
   const projectsRoot = join8(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
-  const accountDir = accountId ? resolve10(ACCOUNTS_DIR, accountId) : null;
+  const accountDir = accountId ? resolve11(ACCOUNTS_DIR, accountId) : null;
   const userTitles = loadUserTitles(accountDir);
   const rows = [];
   const seenIds = /* @__PURE__ */ new Set();
@@ -7481,6 +7657,8 @@ app4.get("/", requireAdminSession, async (c) => {
   let nonResumableCount = 0;
   let archivedCount = 0;
   const titleSourceCounts = { user: 0, ai: 0, "first-message": 0, prefix: 0 };
+  const personIdBySession = /* @__PURE__ */ new Map();
+  const adminUserIdBySession = /* @__PURE__ */ new Map();
   for (const { path: path2, isSubagent, archived } of jsonls) {
     const lastSlash = path2.lastIndexOf("/");
     const base = path2.slice(lastSlash + 1);
@@ -7504,8 +7682,12 @@ app4.get("/", requireAdminSession, async (c) => {
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
     const metaPath = join8(projectDir, `${sessionId}.meta.json`);
-    const { bridgeIds, role, channel } = readSidecarMeta(metaPath);
-    const resumable = !(role === PUBLIC_ROLE && channel === WEBCHAT_CHANNEL);
+    const { bridgeIds, role, channel: sidecarChannel, personId, adminUserId } = readSidecarMeta(metaPath);
+    const resumable = !(role === PUBLIC_ROLE && (sidecarChannel === WEBCHAT_CHANNEL || sidecarChannel === WHATSAPP_CHANNEL));
+    if (personId) personIdBySession.set(sessionId, personId);
+    if (adminUserId && role === ADMIN_ROLE && sidecarChannel === WEBCHAT_CHANNEL) {
+      adminUserIdBySession.set(sessionId, adminUserId);
+    }
     rows.push({
       sessionId,
       title: resolved.title,
@@ -7517,30 +7699,59 @@ app4.get("/", requireAdminSession, async (c) => {
       projectDir,
       bridgeIds,
       resumable,
-      archived
+      archived,
+      channel: resolved.channel,
+      personName: null
     });
     if (live) liveCount += 1;
     if (isSubagent) subagentCount += 1;
     if (!resumable) nonResumableCount += 1;
     if (archived) archivedCount += 1;
   }
+  let personNameCount = 0;
+  let adminNameCount = 0;
+  if (accountId) {
+    await Promise.all(
+      rows.map(async (row) => {
+        if (row.titleSource !== "first-message" && row.titleSource !== "prefix") return;
+        const pid = personIdBySession.get(row.sessionId);
+        if (pid) {
+          const name = await loadPersonNameByElementId(accountId, pid);
+          if (name) {
+            row.personName = name;
+            personNameCount += 1;
+          }
+          return;
+        }
+        const auid = adminUserIdBySession.get(row.sessionId);
+        if (auid) {
+          const resolved = await loadAdminUserName(accountId, auid);
+          if (resolved.source === "neo4j") {
+            row.personName = resolved.joined;
+            adminNameCount += 1;
+          }
+        }
+      })
+    );
+  }
   rows.sort((a, b) => a.startedAt < b.startedAt ? 1 : -1);
   console.log(
-    `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} archived=${archivedCount} nonResumable=${nonResumableCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} accountId=${accountId ? accountId.slice(0, 8) : "unset"}`
+    `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} archived=${archivedCount} nonResumable=${nonResumableCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} personNames=${personNameCount} adminNames=${adminNameCount} accountId=${accountId ? accountId.slice(0, 8) : "unset"}`
   );
   return c.json({ sessions: rows, accountId });
 });
 var sidebar_sessions_default = app4;
 
 // app/lib/whatsapp-reader/select-sessions.ts
-function selectAdminChannelSessions(rows) {
-  return rows.filter((r) => r.role === "admin" && (r.channel === "whatsapp" || r.channel === "telegram")).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).map((r) => ({
+function selectReaderChannelSessions(rows) {
+  return rows.filter((r) => r.role === "admin" && (r.channel === "whatsapp" || r.channel === "telegram") || r.role === "public" && (r.channel === "whatsapp" || r.channel === "webchat")).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).map((r) => ({
     sessionId: r.sessionId,
     projectDir: r.projectDir,
     title: r.title,
     senderId: r.senderId,
     startedAt: r.startedAt,
     channel: r.channel,
+    role: r.role,
     operatorName: null,
     whatsappName: null,
     lastMessageAt: r.lastMessageAt
@@ -7644,14 +7855,26 @@ function resolveOperatorDisplay(userIdRes, nameRes) {
   return { name: null, reason: "no-person-name" };
 }
 
+// app/lib/agent-errors.ts
+function classifyAgentError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  if (/\b(401|authentication_error|OAuth token has expired)\b/i.test(msg)) return "auth_expired";
+  if (/\b(529|overloaded)\b/i.test(msg)) return "claude_overloaded";
+  if (/\b(404|model_not_found)\b/i.test(msg) || /issue with the selected model|may not have access to it/i.test(msg))
+    return "model_unavailable";
+  if (/\b(500|api_error|internal server error)\b/i.test(msg)) return "claude_down";
+  return "agent_error";
+}
+
 // app/lib/whatsapp-reader/parse-transcript.ts
 var WA_REPLY_TOOL = "mcp__whatsapp-channel__reply";
 var WA_REPLY_DOCUMENT_TOOL = "mcp__whatsapp-channel__reply-document";
 var WEBCHAT_REPLY_TOOL = "mcp__webchat-channel__reply";
 var CHANNEL_REPLY_TOOL = "mcp__channel__reply";
+var CHANNEL_REPLY_DOCUMENT_TOOL = "mcp__channel__reply-document";
 var CLI_MARKER_PREFIXES2 = ["<local-command-", "<command-name>", "<command-message>"];
-var CHANNEL_WRAPPER = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
-var SOURCE_ATTR = /\bsource="([^"]+)"/;
+var CHANNEL_WRAPPER2 = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
+var SOURCE_ATTR2 = /\bsource="([^"]+)"/;
 var SOURCE_MAP = {
   whatsapp: "whatsapp",
   "whatsapp-channel": "whatsapp",
@@ -7659,13 +7882,13 @@ var SOURCE_MAP = {
   "webchat-channel": "webchat"
 };
 function unwrapChannel(text) {
-  const m = text.match(CHANNEL_WRAPPER);
+  const m = text.match(CHANNEL_WRAPPER2);
   if (!m) return { text };
-  let source = SOURCE_MAP[m[1].match(SOURCE_ATTR)?.[1] ?? ""];
+  let source = SOURCE_MAP[m[1].match(SOURCE_ATTR2)?.[1] ?? ""];
   let inner = m[2];
-  const im = inner.match(CHANNEL_WRAPPER);
+  const im = inner.match(CHANNEL_WRAPPER2);
   if (im) {
-    const innerSource = SOURCE_MAP[im[1].match(SOURCE_ATTR)?.[1] ?? ""];
+    const innerSource = SOURCE_MAP[im[1].match(SOURCE_ATTR2)?.[1] ?? ""];
     if (innerSource) {
       source = innerSource;
       inner = im[2];
@@ -7679,6 +7902,17 @@ function asString(content) {
 function tsOf(row) {
   return typeof row.timestamp === "string" ? row.timestamp : null;
 }
+function joinTextBlocks(content) {
+  if (!Array.isArray(content)) return "";
+  const parts = [];
+  for (const block of content) {
+    if (block && typeof block === "object") {
+      const b = block;
+      if (b.type === "text" && typeof b.text === "string") parts.push(b.text);
+    }
+  }
+  return parts.join("");
+}
 function assistantTurns(content, ts) {
   if (!Array.isArray(content)) return [];
   const out = [];
@@ -7690,7 +7924,7 @@ function assistantTurns(content, ts) {
     } else if (b.type === "tool_use" && (b.name === WA_REPLY_TOOL || b.name === WEBCHAT_REPLY_TOOL || b.name === CHANNEL_REPLY_TOOL)) {
       const text = b.input?.text;
       out.push({ kind: "agent-reply", text: typeof text === "string" ? text : "", ts });
-    } else if (b.type === "tool_use" && b.name === WA_REPLY_DOCUMENT_TOOL) {
+    } else if (b.type === "tool_use" && (b.name === WA_REPLY_DOCUMENT_TOOL || b.name === CHANNEL_REPLY_DOCUMENT_TOOL)) {
       const input = b.input ?? {};
       const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
       const caption = typeof input.caption === "string" ? input.caption : null;
@@ -7736,6 +7970,14 @@ function parseTranscript(lines) {
     const ts = tsOf(row);
     const msg = row.message;
     if (row.type === "assistant") {
+      if (row.isApiErrorMessage === true) {
+        const raw = joinTextBlocks(msg?.content);
+        const status = typeof row.apiErrorStatus === "number" ? String(row.apiErrorStatus) : "";
+        const errorSlug = typeof row.error === "string" ? row.error : "";
+        const code = classifyAgentError(`${status} ${errorSlug} ${raw}`.trim());
+        out.push({ kind: "agent-error", code, raw, ts });
+        continue;
+      }
       out.push(...assistantTurns(msg?.content, ts));
       continue;
     }
@@ -7799,7 +8041,9 @@ app5.get("/conversations", requireAdminSession, async (c) => {
     const sessionId = basename2(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname(path2);
     const meta = readSidecarMeta(join10(projectDir, `${sessionId}.meta.json`));
-    if (meta.role !== "admin" || meta.channel !== "whatsapp" && meta.channel !== "telegram") continue;
+    const isAdminChannel = meta.role === "admin" && (meta.channel === "whatsapp" || meta.channel === "telegram");
+    const isPublicChannel = meta.role === "public" && (meta.channel === "whatsapp" || meta.channel === "webchat");
+    if (!isAdminChannel && !isPublicChannel) continue;
     let body = "";
     try {
       body = readFileSync11(path2, "utf8");
@@ -7818,7 +8062,7 @@ app5.get("/conversations", requireAdminSession, async (c) => {
       lastMessageAt
     });
   }
-  const selected = selectAdminChannelSessions(rows);
+  const selected = selectReaderChannelSessions(rows);
   const account = resolveAccount();
   let users = [];
   if (account) {
@@ -7885,12 +8129,12 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve11(join10(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve12(join10(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve11(join10(projectDir, `${sessionId}.jsonl`));
-  if (!jsonlPath.startsWith(projectsRoot + sep2)) {
+  const jsonlPath = resolve12(join10(projectDir, `${sessionId}.jsonl`));
+  if (!jsonlPath.startsWith(projectsRoot + sep3)) {
     return c.json({ error: "bad session reference" }, 400);
   }
   const encoder = new TextEncoder();
@@ -7921,6 +8165,9 @@ data: ${JSON.stringify(turn)}
           let n = 0;
           for (const turn of parseTranscript(lines)) {
             send(controller, turn, offset);
+            if (turn.kind === "agent-error") {
+              console.log(`[wa-stream] op=agent-error conn=${connId} sessionId=${sessionId} code=${turn.code} source=jsonl`);
+            }
             n++;
           }
           if (n > 0) console.log(`[wa-stream] op=drain conn=${connId} turns=${n}`);
@@ -7934,6 +8181,9 @@ data: ${JSON.stringify(turn)}
           let n = 0;
           for (const turn of parseTranscript(buf.toString("utf8").split("\n"))) {
             send(controller, turn, offset);
+            if (turn.kind === "agent-error") {
+              console.log(`[wa-stream] op=agent-error conn=${connId} sessionId=${sessionId} code=${turn.code} source=jsonl`);
+            }
             n++;
           }
           console.log(`[wa-stream] op=backlog conn=${connId} turns=${n} bytes=${end}`);
@@ -7976,7 +8226,7 @@ var DIRECTIVE_NAME_RE = /^\d+-\d+\.txt$/;
 function directiveStoreDir(sessionId) {
   const account = resolveAccount();
   if (!account) return null;
-  return resolve11(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
+  return resolve12(account.accountDir, "logs", "prompt-optimiser-directives", sessionId);
 }
 app5.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
@@ -8010,8 +8260,8 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path2 = resolve11(join10(dir, name));
-  if (!path2.startsWith(dir + sep2)) return c.json({ error: "bad reference" }, 400);
+  const path2 = resolve12(join10(dir, name));
+  if (!path2.startsWith(dir + sep3)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
     body = readFileSync11(path2, "utf8");
@@ -8347,7 +8597,7 @@ ${note}` : note;
 }
 
 // server/routes/webchat-greeting.ts
-import { resolve as resolve12 } from "path";
+import { resolve as resolve13 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
 import { existsSync as existsSync9, readFileSync as readFileSync13, readdirSync as readdirSync8 } from "fs";
@@ -8452,7 +8702,7 @@ app6.get("/", requireAdminSession, async (c) => {
     let specialists = [];
     try {
       const roster = readSpecialistRoster(
-        resolve12(ACCOUNTS_DIR, accountId, "specialists", "agents")
+        resolve13(ACCOUNTS_DIR, accountId, "specialists", "agents")
       );
       specialists = roster.specialists;
       for (const s of roster.skipped) {
@@ -8487,7 +8737,7 @@ var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve13, join as join13 } from "path";
+import { resolve as resolve14, join as join13 } from "path";
 import { existsSync as existsSync10, readFileSync as readFileSync14 } from "fs";
 
 // app/lib/telegram/access-control.ts
@@ -8538,7 +8788,7 @@ function routeTelegramUpdate(input) {
 var TAG22 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
   const brandPath = join13(platformRoot2, "config", "brand.json");
   if (existsSync10(brandPath)) {
     try {
@@ -8550,7 +8800,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve13(homedir(), configDirName(), filename);
+  return resolve14(homedir(), configDirName(), filename);
 }
 async function sendTelegram(botToken, chatId, text) {
   try {
@@ -9153,7 +9403,7 @@ app9.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -9365,7 +9615,7 @@ var session_default = app10;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync15, readdirSync as readdirSync10, readFileSync as readFileSync17, statSync as statSync7 } from "fs";
-import { resolve as resolve14, basename as basename4 } from "path";
+import { resolve as resolve15, basename as basename4 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync14 } from "fs";
@@ -9392,7 +9642,7 @@ app11.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve14(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve15(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -9400,7 +9650,7 @@ app11.get("/", async (c) => {
     const safe = basename4(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve14(dir, safe);
+      const filePath = resolve15(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync17(filePath);
@@ -9512,10 +9762,10 @@ app11.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve14(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync7(resolve15(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync17(resolve14(dir, name));
+        const content = readFileSync17(resolve15(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -9555,7 +9805,7 @@ var claude_info_default = app12;
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync16 } from "fs";
-import { resolve as resolve15 } from "path";
+import { resolve as resolve16 } from "path";
 var app13 = new Hono();
 app13.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -9567,11 +9817,11 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve15(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve16(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
   if (!existsSync16(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve15(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve16(dir, `${attachmentId}.meta.json`);
   if (!existsSync16(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
@@ -9586,7 +9836,7 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve15(dir, dataFile);
+  const filePath = resolve16(dir, dataFile);
   const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -9599,13 +9849,13 @@ app13.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app13;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 import { readdirSync as readdirSync11, readFileSync as readFileSync18, existsSync as existsSync17, rmSync } from "fs";
 var app14 = new Hono();
 app14.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve16(account.accountDir, "agents");
+  const agentsDir = resolve17(account.accountDir, "agents");
   if (!existsSync17(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -9613,7 +9863,7 @@ app14.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve16(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve17(agentsDir, entry.name, "config.json");
       if (!existsSync17(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync18(configPath2, "utf-8"));
@@ -9642,7 +9892,7 @@ app14.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve16(account.accountDir, "agents", slug);
+  const agentDir = resolve17(account.accountDir, "agents", slug);
   if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -9672,7 +9922,7 @@ app14.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve16(account.accountDir, "agents", slug);
+  const agentDir = resolve17(account.accountDir, "agents", slug);
   if (!existsSync17(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -10376,7 +10626,7 @@ var sessions_default = app15;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync19, readFileSync as readFileSync19, readdirSync as readdirSync12, statSync as statSync8 } from "fs";
-import { dirname as dirname4, resolve as resolve17, join as join17 } from "path";
+import { dirname as dirname4, resolve as resolve18, join as join17 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -10461,7 +10711,7 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve17(PLATFORM_ROOT, "plugins");
+  const platformPlugins = resolve18(PLATFORM_ROOT, "plugins");
   if (existsSync19(platformPlugins)) {
     for (const name of readdirSync12(platformPlugins)) {
       const dir = join17(platformPlugins, name);
@@ -10471,7 +10721,7 @@ function listPluginDirs() {
       }
     }
   }
-  const premiumRoot = resolve17(dirname4(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve18(dirname4(PLATFORM_ROOT), "premium-plugins");
   if (existsSync19(premiumRoot)) {
     for (const bundle of readdirSync12(premiumRoot)) {
       const bundlePlugins = join17(premiumRoot, bundle, "plugins");
@@ -10491,7 +10741,7 @@ function listPluginDirs() {
   return out;
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve17(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve18(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync19(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync19(accountFile, "utf-8"));
@@ -10564,7 +10814,7 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve17(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  const specialistsDir = resolve18(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
   if (!existsSync19(specialistsDir)) return [];
   let entries;
   try {
@@ -10610,7 +10860,7 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve17(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve18(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync19(accountFile)) return [];
   let enabled;
   try {
@@ -10625,7 +10875,7 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve17(PLATFORM_ROOT, "plugins");
+  const pluginsDir = resolve18(PLATFORM_ROOT, "plugins");
   if (!existsSync19(pluginsDir)) return [];
   let entries;
   try {
@@ -10636,7 +10886,7 @@ function computeDormantPlugins(accountId) {
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve17(pluginsDir, name, "PLUGIN.md");
+    const manifestPath = resolve18(pluginsDir, name, "PLUGIN.md");
     if (!existsSync19(manifestPath)) continue;
     let manifest;
     try {
@@ -10655,7 +10905,7 @@ function computeDormantPlugins(accountId) {
 
 // server/routes/admin/claude-sessions.ts
 import { existsSync as existsSync20, readFileSync as readFileSync20 } from "fs";
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync20(statePath)) return null;
@@ -10671,10 +10921,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync20(resolve18(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync20(resolve19(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -10922,68 +11172,6 @@ import { realpathSync as realpathSync4 } from "fs";
 import { basename as basename6, dirname as dirname5, join as join19, resolve as resolve21, sep as sep5 } from "path";
 import { Readable as Readable2 } from "stream";
 
-// app/lib/data-path.ts
-import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve19, normalize, sep as sep3, relative } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "../platform");
-var DATA_ROOT = resolve19(PLATFORM_ROOT6, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve19(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
-var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
-var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function crossesForeignAccountPartition(relPath, accountId) {
-  const segs = relPath.split("/").filter(Boolean);
-  if (segs.length < 2) return false;
-  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
-  const owner = segs[1];
-  if (!ACCOUNT_UUID_RE.test(owner)) return false;
-  return owner !== accountId;
-}
-function resolveUnderRoot(raw, rootAbs, rootLabel) {
-  const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve19(rootAbs, cleaned);
-  let rootReal;
-  try {
-    rootReal = realpathSync3(rootAbs);
-  } catch (err) {
-    return {
-      ok: false,
-      status: 500,
-      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  let resolvedReal;
-  try {
-    resolvedReal = realpathSync3(absolute);
-  } catch (err) {
-    const code = err.code;
-    if (code === "ENOENT") {
-      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep3)) {
-        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
-      }
-      return { ok: false, status: 404, error: "Not found" };
-    }
-    return {
-      ok: false,
-      status: 500,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep3)) {
-    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
-  }
-  const relPath = relative(rootReal, resolvedReal) || ".";
-  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
-}
-function resolveDataPath(raw) {
-  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
-}
-function resolveClaudeUploadsPath(raw) {
-  if (!CLAUDE_UPLOADS_ROOT) {
-    return { ok: false, status: 404, error: "Not found" };
-  }
-  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
-}
-
 // ../lib/graph-trash/src/index.ts
 var UNIQUE_KEYS_BY_LABEL = {
   Person: ["email", "telephone"],
@@ -11221,11 +11409,11 @@ async function restoreNode(params) {
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function parseAttachmentPath(relPath) {
   const segments = relPath.split("/").filter(Boolean);
-  if (segments.length !== 4) return null;
-  if (segments[0] !== "uploads") return null;
+  if (segments.length !== 5) return null;
+  if (segments[0] !== "accounts" || segments[2] !== "uploads") return null;
   const accountId = segments[1];
-  const attachmentId = segments[2];
-  const filename = segments[3];
+  const attachmentId = segments[3];
+  const filename = segments[4];
   if (!UUID_RE2.test(accountId) || !UUID_RE2.test(attachmentId)) return null;
   const dot = filename.lastIndexOf(".");
   if (dot === -1) return null;
@@ -11303,6 +11491,17 @@ import { resolve as resolve20, relative as relative2, join as join18, basename a
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
+
+// app/lib/migration-state.ts
+var inProgress = false;
+function setUploadsMigrationInProgress(value) {
+  inProgress = value;
+}
+function uploadsMigrationInProgress() {
+  return inProgress;
+}
+
+// app/lib/file-index.ts
 var execFileAsync2 = promisify2(execFile2);
 var CONTENT_CAP = 1e5;
 var OCR_TIMEOUT_MS = 3e4;
@@ -11607,7 +11806,6 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve20(dataRoot, "uploads", accountId),
       resolve20(dataRoot, "accounts", accountId)
     ];
     let clean = true;
@@ -11644,7 +11842,9 @@ async function reconcileFileIndex(accountId, opts) {
     }
     let pruned = 0;
     let cascadeKds = 0, cascadeSections = 0, cascadeChunks = 0;
-    if (clean) {
+    if (clean && uploadsMigrationInProgress()) {
+      console.error(`[file-index] reconcile account=${accountId} prune-skipped reason="uploads-migration-in-progress"`);
+    } else if (clean) {
       const foundPaths = walked.map((w) => w.relativePath);
       const goneRes = await session.run(
         `MATCH (f:FileArtifact {accountId: $accountId})
@@ -11804,6 +12004,32 @@ function sortDirEntries(entries) {
     return aKey.localeCompare(bKey);
   });
 }
+var PROTECTED_DELETE_SEGMENTS = {
+  ".git": "git",
+  ".claude": "claude",
+  secrets: "secrets",
+  agents: "agents",
+  specialists: "specialists",
+  state: "state"
+};
+var PROTECTED_DELETE_BASENAMES = {
+  "account.json": "account-json",
+  "wa-channel-bindings.json": "channel-bindings",
+  "webchat-channel-bindings.json": "channel-bindings"
+};
+function isProtectedFromDeletion(relPath) {
+  const segments = relPath.split("/").filter(Boolean);
+  for (const seg of segments) {
+    if (Object.hasOwn(PROTECTED_DELETE_SEGMENTS, seg)) {
+      return { protected: true, rule: PROTECTED_DELETE_SEGMENTS[seg] };
+    }
+  }
+  const base = segments[segments.length - 1];
+  if (base && Object.hasOwn(PROTECTED_DELETE_BASENAMES, base)) {
+    return { protected: true, rule: PROTECTED_DELETE_BASENAMES[base] };
+  }
+  return { protected: false };
+}
 async function knowledgeDocOwnedByAccount(accountId, attachmentId) {
   if (!attachmentId) return false;
   const session = getSession();
@@ -11849,7 +12075,7 @@ app19.get("/", requireAdminSession, async (c) => {
     }
     const names = await readdir3(absolute);
     const segs = relPath.split("/").filter(Boolean);
-    const isAccountParent = segs.length === 1 && (segs[0] === "accounts" || segs[0] === "uploads");
+    const isAccountParent = segs.length === 1 && segs[0] === "accounts";
     const entries = [];
     for (const name of names) {
       if (UUID_RE3.test(name.replace(/\.meta\.json$/, "")) && name.endsWith(".meta.json")) {
@@ -11858,6 +12084,8 @@ app19.get("/", requireAdminSession, async (c) => {
       if (isAccountParent && UUID_RE3.test(name) && name !== accountId) {
         continue;
       }
+      const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
+      const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
         const entryPath = join19(absolute, name);
         const s = await stat4(entryPath);
@@ -11865,10 +12093,11 @@ app19.get("/", requireAdminSession, async (c) => {
           name,
           kind: s.isDirectory() ? "directory" : s.isFile() ? "file" : "other",
           sizeBytes: s.isDirectory() ? null : s.size,
-          modifiedAt: s.mtime.toISOString()
+          modifiedAt: s.mtime.toISOString(),
+          protected: protectedEntry
         });
       } catch {
-        entries.push({ name, kind: "other", sizeBytes: null, modifiedAt: (/* @__PURE__ */ new Date(0)).toISOString() });
+        entries.push({ name, kind: "other", sizeBytes: null, modifiedAt: (/* @__PURE__ */ new Date(0)).toISOString(), protected: protectedEntry });
       }
     }
     const accountNames = await readAccountNames();
@@ -11984,14 +12213,14 @@ app19.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve21(DATA_ROOT, "uploads", accountId);
+  const destDir = resolve21(DATA_ROOT, "accounts", accountId, "uploads");
   const destPath = resolve21(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
     const destDirReal = realpathSync4(destDir);
     if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep5)) {
-      console.error(`[data] path-traversal-blocked requested="uploads/${accountId}" resolved="${destDirReal}"`);
+      console.error(`[data] path-traversal-blocked requested="accounts/${accountId}/uploads" resolved="${destDirReal}"`);
       return c.json({ error: "Upload destination escapes DATA_ROOT" }, 403);
     }
     const buffer = Buffer.from(await file.arrayBuffer());
@@ -12001,7 +12230,7 @@ app19.post("/upload", requireAdminSession, async (c) => {
     console.error(`[data] file-upload error filename="${safeName}" err="${message}"`);
     return c.json({ error: message }, 500);
   }
-  const relativeDest = `uploads/${accountId}/${finalName}`;
+  const relativeDest = `accounts/${accountId}/uploads/${finalName}`;
   console.error(`[data] file-upload filename="${safeName}" size=${file.size} dest="${relativeDest}"`);
   void indexFile(accountId, relativeDest).catch((err) => {
     console.error(`[data] file-upload index-failed dest="${relativeDest}" err="${err instanceof Error ? err.message : String(err)}"`);
@@ -12035,9 +12264,9 @@ app19.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   const base = basename6(absolute);
-  const segments = relPath.split("/").filter(Boolean);
-  if (base === "account.json" || segments.includes(".git")) {
-    console.error(`[data] file-delete blocked path="${relPath}" reason="protected"`);
+  const protection = isProtectedFromDeletion(relPath);
+  if (protection.protected) {
+    console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
     return c.json({ error: "Protected file \u2014 refusing to delete" }, 403);
   }
   try {
@@ -14136,13 +14365,14 @@ async function fetchAccountFileArtefacts(accountId) {
     const result = await session.run(
       `MATCH (f:FileArtifact { accountId: $accountId })
        WHERE f.relativePath STARTS WITH 'accounts/'
+         AND NOT f.relativePath STARTS WITH $uploadsPrefix
        RETURN f.relativePath AS relativePath,
               f.displayName  AS displayName,
               f.mimeType     AS mimeType,
               f.modifiedAt   AS modifiedAt
        ORDER BY f.modifiedAt DESC
        LIMIT 50`,
-      { accountId }
+      { accountId, uploadsPrefix: `accounts/${accountId}/uploads/` }
     );
     return result.records.map((r) => {
       const relativePath = r.get("relativePath");
@@ -14398,7 +14628,7 @@ var session_archive_default = app29;
 
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID10 } from "crypto";
-function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10) {
+function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10, adminUserId) {
   const operator = isOperatorHost(host, operatorDomains);
   const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
   const name = typeof body.name === "string" && body.name.length > 0 ? body.name : void 0;
@@ -14416,6 +14646,7 @@ function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10) {
     payload.senderId = key;
     payload.webchatChannel = webchatChannelDescriptor(key);
     if (name) payload.name = name;
+    if (adminUserId) payload.adminUserId = adminUserId;
   } else {
     sessionId = resumeId;
     payload.sessionId = resumeId;
@@ -14436,7 +14667,9 @@ app30.post("/", requireAdminSession, async (c) => {
     body = {};
   }
   const host = (c.req.header("host") ?? "").split(":")[0];
-  const plan = resolveSpawnPlan(host, getOperatorDomains(), body);
+  const cacheKey = c.get("cacheKey");
+  const adminUserId = cacheKey ? getUserIdForSession(cacheKey) : void 0;
+  const plan = resolveSpawnPlan(host, getOperatorDomains(), body, randomUUID10, adminUserId);
   const spawnReqId = randomUUID10();
   console.log(
     `[chat-spawn] op=request spawnReqId=${spawnReqId} origin=${plan.origin} kind=${plan.kind} sessionId=${plan.kind === "new" ? "new" : plan.sessionId}`
@@ -14605,9 +14838,9 @@ var system_stats_default = app31;
 // server/routes/admin/health.ts
 import { existsSync as existsSync22, readFileSync as readFileSync21 } from "fs";
 import { resolve as resolve23, join as join20 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join20(PLATFORM_ROOT7, "config", "brand.json");
+var brandJsonPath = join20(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync22(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync21(brandJsonPath, "utf-8"));
@@ -14615,7 +14848,7 @@ if (existsSync22(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve23(PLATFORM_ROOT7, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve23(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
@@ -15325,9 +15558,9 @@ var verify_token_default = app41;
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
 import { resolve as resolve24 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var SEND_SCRIPT = resolve24(
-  PLATFORM_ROOT8,
+  PLATFORM_ROOT7,
   "plugins",
   "email",
   "mcp",
@@ -16563,7 +16796,7 @@ import * as fsp2 from "fs/promises";
 import { resolve as resolve27, sep as sep7 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
-var ROOTS = ["uploads", "accounts"];
+var ROOTS = ["accounts"];
 function _routeEvent(rootName, filename) {
   if (!filename) return null;
   const segs = filename.split(sep7).filter(Boolean);
@@ -16661,6 +16894,129 @@ async function startFileWatcher(opts = {}) {
   return { stop };
 }
 
+// app/lib/migrate-uploads.ts
+import { mkdir as mkdir5, readdir as readdir5, rename, rm as rm3 } from "fs/promises";
+import { dirname as dirname7, relative as relative4, resolve as resolve28 } from "path";
+var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+async function walkFiles(dir) {
+  const out = [];
+  let entries;
+  try {
+    entries = await readdir5(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries) {
+    const abs = resolve28(dir, e.name);
+    if (e.isDirectory()) {
+      out.push(...await walkFiles(abs));
+    } else if (e.isFile()) {
+      out.push(abs);
+    }
+  }
+  return out;
+}
+function toNumber2(v) {
+  if (v && typeof v.toNumber === "function") {
+    return v.toNumber();
+  }
+  return Number(v ?? 0);
+}
+async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
+  const files = await walkFiles(srcDir);
+  let moved = 0;
+  for (const oldAbs of files) {
+    const suffix = relative4(srcDir, oldAbs);
+    const newAbs = resolve28(destDir, suffix);
+    await mkdir5(dirname7(newAbs), { recursive: true });
+    await rename(oldAbs, newAbs);
+    moved++;
+    const oldRel = relative4(dataRoot, oldAbs);
+    const newRel = relative4(dataRoot, newAbs);
+    let linked = false;
+    if (accountId && session) {
+      const fa = await session.run(
+        `MATCH (f:FileArtifact {accountId: $accountId, relativePath: $oldRel})
+         SET f.relativePath = $newRel RETURN count(f) AS n`,
+        { accountId, oldRel, newRel }
+      );
+      const kd = await session.run(
+        `MATCH (d:KnowledgeDocument {accountId: $accountId, sourcePath: $oldAbs})
+         SET d.sourcePath = $newAbs RETURN count(d) AS n`,
+        { accountId, oldAbs, newAbs }
+      );
+      linked = toNumber2(fa.records[0]?.get("n")) + toNumber2(kd.records[0]?.get("n")) > 0;
+    }
+    console.error(`[uploads-migrate] from=${oldRel} to=${newRel} linked=${linked}`);
+  }
+  await rm3(srcDir, { recursive: true, force: true });
+  return moved;
+}
+async function migrateUploads(opts = {}) {
+  const dataRoot = opts.dataRoot ?? DATA_ROOT;
+  const oldRoot = resolve28(dataRoot, "uploads");
+  let topEntries;
+  try {
+    topEntries = await readdir5(oldRoot, { withFileTypes: true });
+  } catch (err) {
+    if (err.code === "ENOENT") {
+      return { moved: 0, skipped: 0, removedRoot: false };
+    }
+    throw err;
+  }
+  const installAccountId = opts.installAccountId ?? resolveAccount()?.accountId;
+  const session = opts.session ?? getSession();
+  const ownSession = !opts.session;
+  setUploadsMigrationInProgress(true);
+  let moved = 0;
+  let skipped = 0;
+  try {
+    for (const entry of topEntries) {
+      const name = entry.name;
+      if (ACCOUNT_UUID_RE3.test(name)) {
+        moved += await relocateTree(
+          resolve28(oldRoot, name),
+          resolve28(dataRoot, "accounts", name, "uploads"),
+          dataRoot,
+          name,
+          session
+        );
+      } else if (name === "public") {
+        if (!installAccountId) {
+          console.error(`[uploads-migrate] skip entry="public" reason="no-install-account"`);
+          skipped++;
+          continue;
+        }
+        moved += await relocateTree(
+          resolve28(oldRoot, "public"),
+          resolve28(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          dataRoot,
+          null,
+          // public uploads carry no graph nodes
+          session
+        );
+      } else {
+        console.error(`[uploads-migrate] skip entry="${name}" reason="not-account-or-public"`);
+        skipped++;
+      }
+    }
+    let removedRoot = false;
+    try {
+      const remaining = await readdir5(oldRoot);
+      if (remaining.length === 0) {
+        await rm3(oldRoot, { recursive: true, force: true });
+        removedRoot = true;
+      }
+    } catch {
+    }
+    console.error(`[uploads-migrate] done moved=${moved} skipped=${skipped} removedRoot=${removedRoot}`);
+    return { moved, skipped, removedRoot };
+  } finally {
+    setUploadsMigrationInProgress(false);
+    if (ownSession) await session.close();
+  }
+}
+
 // app/lib/whatsapp/gateway/inbound-hub.ts
 var InboundHub = class {
   senders = /* @__PURE__ */ new Map();
@@ -17572,7 +17928,7 @@ function broadcastAdminShutdown(reason) {
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
 import { existsSync as existsSync26, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
-import { resolve as resolve28 } from "path";
+import { resolve as resolve29 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -17607,7 +17963,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve28(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve29(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -17619,7 +17975,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve28(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve29(brand.configDir, "entitlement.json");
   if (!existsSync26(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -17809,8 +18165,8 @@ function clientFrom(c) {
     c.req.header("x-forwarded-for")
   );
 }
-var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT9 ? join22(PLATFORM_ROOT9, "config", "brand.json") : "";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join22(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync27(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
@@ -17868,7 +18224,7 @@ var app49 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -17884,7 +18240,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."))
+      platformRoot: resolve30(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -18188,10 +18544,11 @@ app49.post("/api/remote-auth/set-password", async (c) => {
 });
 app49.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
+var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
 app49.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
-  if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
+  if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || PWA_PUBLIC_PATHS.has(path2)) {
     await next();
     return;
   }
@@ -18266,8 +18623,8 @@ app49.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve29(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve29(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve30(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve30(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -18296,8 +18653,8 @@ app49.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve29(account.accountDir, "generated", filename);
-  const expectedDir = resolve29(account.accountDir, "generated");
+  const filePath = resolve30(account.accountDir, "generated", filename);
+  const expectedDir = resolve30(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -18338,10 +18695,21 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
   icon: brandIconPath,
   logoContainsName: !!BRAND.logoContainsName
 })}</script>`;
+var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
+var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
+var brandIconFsPath = resolve30(process.cwd(), "public", brandIconPath.replace(/^\//, ""));
+var brandIconExists = existsSync27(brandIconFsPath);
+var SW_SOURCE = (() => {
+  try {
+    return readFileSync26(resolve30(process.cwd(), "public", "sw.js"), "utf-8");
+  } catch {
+    return null;
+  }
+})();
 function readInstalledVersion() {
   try {
-    if (!PLATFORM_ROOT9) return "unknown";
-    const versionFile = join22(PLATFORM_ROOT9, "config", `.${BRAND.hostname}-version`);
+    if (!PLATFORM_ROOT8) return "unknown";
+    const versionFile = join22(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync27(versionFile)) return "unknown";
     const content = readFileSync26(versionFile, "utf-8").trim();
     return content || "unknown";
@@ -18384,15 +18752,17 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync26(resolve29(process.cwd(), "public", file), "utf-8");
+    html = readFileSync26(resolve30(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
-    const headInjection = file === "index.html" ? `${brandScript}
+    const pwaSurface = pwaSurfaceForShell(file);
+    const pwaHead = pwaSurface ? "\n" + pwaHeadTags(pwaSurface, { iconPath: brandIconPath, themeColor: brandThemeColor }) + "\n" : "";
+    const headInjection = (file === "index.html" ? `${brandScript}
 ${versionScript}
 ${clientErrorReporterScript}
 ` : `${brandScript}
-`;
+`) + pwaHead;
     html = html.replace("</head>", `${headInjection}</head>`);
     htmlCache.set(file, html);
   }
@@ -18500,7 +18870,7 @@ app49.use("/vnc-popout.html", logViewerFetch);
 app49.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync26(resolve29(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync26(resolve30(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -18534,6 +18904,30 @@ app49.post("/api/vnc/client-event", async (c) => {
 app49.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
+for (const pwa of PWA_SURFACES) {
+  app49.get(pwa.manifestPath, (c) => {
+    const manifest = buildManifest(pwa, {
+      productName: BRAND.productName,
+      iconPath: brandIconPath,
+      themeColor: brandThemeColor,
+      backgroundColor: brandBackgroundColor
+    });
+    c.header("Content-Type", MANIFEST_CONTENT_TYPE);
+    console.log(
+      `[pwa] op=manifest surface=${pwa.surface} brand=${BRAND.productName} status=200 ct=${MANIFEST_CONTENT_TYPE} icon=${brandIconPath} iconExists=${brandIconExists}`
+    );
+    return c.body(JSON.stringify(manifest));
+  });
+}
+app49.get("/sw.js", (c) => {
+  if (SW_SOURCE == null) {
+    console.error("[pwa] op=sw status=500 reason=sw-source-missing");
+    return c.text("Service worker unavailable", 500);
+  }
+  c.header("Content-Type", SW_CONTENT_TYPE);
+  console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
+  return c.body(SW_SOURCE);
+});
 app49.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
@@ -18591,6 +18985,21 @@ var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app49.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
+{
+  const census = pwaCensus({
+    shellHtml: (file) => {
+      try {
+        return cachedHtml(file);
+      } catch {
+        return null;
+      }
+    },
+    iconExists: () => brandIconExists
+  });
+  console.log(
+    `[pwa-census] surfaces=${census.surfaces} manifest-linked=${census.manifestLinked} icons-present=${census.iconsPresent}`
+  );
+}
 startAuthHealthHeartbeat();
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
@@ -18687,8 +19096,10 @@ var adminUserReconcileTimer = setInterval(() => {
 }, ADMINUSER_RECONCILE_INTERVAL_MS);
 if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer.unref();
 startGraphHealthTimer();
-void startFileWatcher().catch((err) => {
-  console.error(`[file-watcher] start-failed err="${err instanceof Error ? err.message : String(err)}"`);
+void migrateUploads().catch((err) => console.error(`[uploads-migrate] failed err="${err instanceof Error ? err.message : String(err)}"`)).finally(() => {
+  void startFileWatcher().catch((err) => {
+    console.error(`[file-watcher] start-failed err="${err instanceof Error ? err.message : String(err)}"`);
+  });
 });
 try {
   const accounts = enumerateValidAccountIds(getAccountsDirFromEnv());
@@ -18770,7 +19181,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve29(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, "..")),
+  platformRoot: resolve30(process.env.MAXY_PLATFORM_ROOT ?? join22(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {