@rubytech/create-maxy-code 0.1.313 → 0.1.315

package/payload/server/server.js

@@ -429,12 +429,14 @@ var require_dist2 = __commonJS({
       // apart from people-terracotta, viewing-amber, and task-rose bands so
       // siteoffice legends read as their own group. Top-level (operator-entry)
       // labels only; child labels (LineItem, Milestone, Valuation,
-      // VariationNote, TimeLog) intentionally stay fallback-grey.
+      // VariationNote, CheckIn) intentionally stay fallback-grey. The
+      // field-worker Worker label is an additional label on Person and takes
+      // the Person colour. A subcontractor company's received invoices use the
+      // supplier model (Organization + InboundInvoice), so they carry no
+      // construction-specific colour.
       Job: "#8C3B2E",
       QuoteDocument: "#A65A4A",
       InboundInvoice: "#6B2A20",
-      SubContractor: "#BF7E6E",
-      SubInvoice: "#52201A",
       WhatsAppGroup: "#D4A096",
       // External business entity — schema:Organization, written by memory-write
       // as the Supplier label. Warm tobacco — distinct hue from internal-business
@@ -1271,8 +1273,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync29, existsSync as existsSync31, watchFile } from "fs";
-import { resolve as resolve31, join as join27, basename as basename9 } from "path";
+import { readFileSync as readFileSync31, existsSync as existsSync31, watchFile } from "fs";
+import { resolve as resolve33, join as join28, basename as basename10 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1920,7 +1922,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve32) => setTimeout(() => resolve32("timeout"), timeoutMs)
+    (resolve34) => setTimeout(() => resolve34("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -2048,11 +2050,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve32, reject) => {
+  return new Promise((resolve34, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve32();
+        resolve34();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2166,14 +2168,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve32, reject) => {
+  return new Promise((resolve34, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve32(value);
+        resolve34(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -3057,8 +3059,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve32) => {
-    release = resolve32;
+  const mine = new Promise((resolve34) => {
+    release = resolve34;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -4138,11 +4140,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve32) => {
-        const timer2 = setTimeout(resolve32, delay);
+      await new Promise((resolve34) => {
+        const timer2 = setTimeout(resolve34, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve32();
+          resolve34();
         }, { once: true });
       });
     }
@@ -4150,16 +4152,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve32) => {
+  return new Promise((resolve34) => {
     if (!conn.sock) {
-      resolve32();
+      resolve34();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve32();
+        resolve34();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -4419,8 +4421,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve32) => {
-      resolvePending = resolve32;
+    const sttPending = new Promise((resolve34) => {
+      resolvePending = resolve34;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -4814,20 +4816,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve32) => {
+  return new Promise((resolve34) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve32(true);
+      resolve34(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve32(false);
+      resolve34(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve32(false);
+      resolve34(false);
     });
   });
 }
@@ -5383,6 +5385,13 @@ ${result.result.text}` : result.result.text;
       sliceToken = session.sliceToken;
       personId = session.personId;
     }
+    let visitorId;
+    if (accessMode === "open") {
+      const cookieHeader = c.req.header("cookie") ?? "";
+      const m = cookieHeader.match(/(?:^|;\s*)maxy_visitor=([^;]*)/);
+      const v = m ? decodeURIComponent(m[1]).trim() : "";
+      if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v)) visitorId = v;
+    }
     const sk = session_key.slice(0, 8);
     console.error(
       `${WEBCHAT_TAG} inbound from=${sk} bytes=${Buffer.byteLength(fullMessage, "utf8")} attachments=${attachmentCount} accountId=${account.accountId}`
@@ -5405,6 +5414,7 @@ ${result.result.text}` : result.result.text;
               agentSlug,
               ...sliceToken ? { sliceToken } : {},
               ...personId ? { personId } : {},
+              ...visitorId ? { visitorId } : {},
               name: publicTitle
             }
           });
@@ -5871,8 +5881,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve32, reject) => {
-    resolveCode = resolve32;
+  const codePromise = new Promise((resolve34, reject) => {
+    resolveCode = resolve34;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -6008,9 +6018,6 @@ function normalizeJid2(to) {
 function routeKey(to, filePath) {
   return `${normalizeJid2(to)}\0${filePath}`;
 }
-function documentOutboundAt(to) {
-  return lastDocumentOutboundAt.get(normalizeJid2(to));
-}
 function recordDocumentOutbound(to) {
   lastDocumentOutboundAt.set(normalizeJid2(to), Date.now());
 }
@@ -6021,14 +6028,14 @@ function routeDocumentOutboundAt(to, filePath) {
   return lastRouteDocumentOutboundAt.get(routeKey(to, filePath));
 }
 async function sendWhatsAppDocument(input) {
-  const { to, filePath, caption, accountId, maxyAccountId, platformRoot: platformRoot2 } = input;
+  const { to, filePath, caption, accountId, maxyAccountId, platformRoot: platformRoot4 } = input;
   if (!to || !filePath) {
     return { ok: false, status: 400, error: "Missing required fields: to, filePath" };
   }
-  if (!maxyAccountId || !platformRoot2) {
+  if (!maxyAccountId || !platformRoot4) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve8(platformRoot2, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve8(platformRoot4, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync3(filePath);
@@ -6634,8 +6641,8 @@ app2.get("/group-info", async (c) => {
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync11, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync6 } from "fs";
-import { basename as basename2, dirname, join as join10, resolve as resolve11, sep as sep3 } from "path";
+import { readFileSync as readFileSync12, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync7 } from "fs";
+import { basename as basename2, dirname, isAbsolute, join as join11, relative as relative2, resolve as resolve11, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
@@ -6657,12 +6664,30 @@ function selectReaderChannelSessions(rows) {
     operatorName: null,
     whatsappName: null,
     lastMessageAt: r.lastMessageAt,
-    modelGated: r.modelGated
+    modelGated: r.modelGated,
+    model: r.model
   }));
 }
 
 // server/routes/admin/sidebar-sessions.ts
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
+function lastAssistantModel(body) {
+  const lines = body.split("\n");
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!line || line[0] !== "{") continue;
+    let rec;
+    try {
+      rec = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (rec.type !== "assistant") continue;
+    const model = rec.message?.model;
+    if (typeof model === "string" && model !== "<synthetic>") return model;
+  }
+  return null;
+}
 var CLI_MARKER_PREFIXES = ["<local-command-", "<command-name>", "<command-message>"];
 var ADMIN_ROLE = "admin";
 var WEBCHAT_CHANNEL = "webchat";
@@ -6778,7 +6803,7 @@ function loadUserTitles(accountDir) {
   return out;
 }
 function readSidecarMeta(metaPath) {
-  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null };
+  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null };
   let raw;
   try {
     raw = readFileSync9(metaPath, "utf8");
@@ -6801,7 +6826,9 @@ function readSidecarMeta(metaPath) {
     senderId: typeof r.senderId === "string" ? r.senderId : null,
     startedAt: typeof r.startedAt === "string" ? r.startedAt : null,
     personId: typeof r.personId === "string" ? r.personId : null,
-    adminUserId: typeof r.adminUserId === "string" ? r.adminUserId : null
+    adminUserId: typeof r.adminUserId === "string" ? r.adminUserId : null,
+    visitorId: typeof r.visitorId === "string" ? r.visitorId : null,
+    agentSlug: typeof r.agentSlug === "string" ? r.agentSlug : null
   };
 }
 function startsWithCliMarker(s) {
@@ -6932,7 +6959,8 @@ app3.get("/", requireAdminSession, async (c) => {
       bridgeIds,
       archived,
       channel: resolved.channel,
-      personName: null
+      personName: null,
+      model: lastAssistantModel(body)
     });
     if (live) liveCount += 1;
     if (isSubagent) subagentCount += 1;
@@ -7086,6 +7114,7 @@ var WA_REPLY_DOCUMENT_TOOL = "mcp__whatsapp-channel__reply-document";
 var WEBCHAT_REPLY_TOOL = "mcp__webchat-channel__reply";
 var CHANNEL_REPLY_TOOL = "mcp__channel__reply";
 var CHANNEL_REPLY_DOCUMENT_TOOL = "mcp__channel__reply-document";
+var SEND_USER_FILE_TOOL = "SendUserFile";
 var CLI_MARKER_PREFIXES2 = ["<local-command-", "<command-name>", "<command-message>"];
 var CHANNEL_WRAPPER2 = /^<channel\b([^>]*)>\n?([\s\S]*?)\n?<\/channel>$/;
 var SOURCE_ATTR2 = /\bsource="([^"]+)"/;
@@ -7111,17 +7140,29 @@ function unwrapChannel(text) {
   return source ? { text: inner, source } : { text: inner };
 }
 var COMPOSED_ADMIN_FRAME = /^## Context\n([\s\S]*)\n\n## Instruction\n[\s\S]*$/;
+var UPLOAD_ANNOTATION = /(?:\n\n)?\[The operator uploaded \d+ file\(s\): [\s\S]*\]$/;
 function rawFromComposedAdminFrame(text) {
-  return text.match(COMPOSED_ADMIN_FRAME)?.[1];
+  const context = text.match(COMPOSED_ADMIN_FRAME)?.[1];
+  if (context === void 0) return void 0;
+  return context.replace(UPLOAD_ANNOTATION, "");
+}
+var PUBLIC_UPLOAD_ANNOTATION = /(?:\n\n)?\[The user uploaded \d+ file\(s\): [\s\S]*\]$/;
+var UPLOAD_COUNT = /\[The (?:operator|user) uploaded (\d+) file\(s\):/;
+function uploadCountOf(text) {
+  const n = Number(text.match(UPLOAD_COUNT)?.[1]);
+  return Number.isInteger(n) && n > 0 ? n : void 0;
 }
 function operatorInboundTurn(u, ts) {
   const rawBody = rawFromComposedAdminFrame(u.text);
+  const uploadCount = uploadCountOf(u.text);
+  const text = rawBody === void 0 ? u.text.replace(PUBLIC_UPLOAD_ANNOTATION, "") : u.text;
   return {
     kind: "operator-inbound",
-    text: u.text,
+    text,
     ts,
     ...u.source ? { source: u.source } : {},
-    ...rawBody !== void 0 ? { rawBody } : {}
+    ...rawBody !== void 0 ? { rawBody } : {},
+    ...uploadCount !== void 0 ? { uploadCount } : {}
   };
 }
 function asString(content) {
@@ -7157,6 +7198,11 @@ function assistantTurns(content, ts) {
       const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
       const caption = typeof input.caption === "string" ? input.caption : null;
       out.push({ kind: "agent-reply-document", files, caption, ts });
+    } else if (b.type === "tool_use" && b.name === SEND_USER_FILE_TOOL) {
+      const input = b.input ?? {};
+      const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
+      const caption = typeof input.caption === "string" ? input.caption : null;
+      out.push({ kind: "agent-file", files, caption, ts });
     } else if (b.type === "tool_use" && typeof b.name === "string") {
       out.push({ kind: "tool-call", name: b.name, input: b.input ?? null, ts });
     }
@@ -7194,9 +7240,8 @@ function renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress) {
     out.push(operatorInboundTurn(u, ts));
   }
 }
-function parseTranscript(lines) {
+function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map()) {
   const out = [];
-  const queuedPendingSuppress = /* @__PURE__ */ new Map();
   for (const line of lines) {
     if (!line || line[0] !== "{") continue;
     let row;
@@ -7256,6 +7301,65 @@ function parseTranscript(lines) {
   return out;
 }
 
+// app/lib/whatsapp-reader/enrich-attachments.ts
+import { readFileSync as readFileSync11, readdirSync as readdirSync6 } from "fs";
+import { join as join10 } from "path";
+var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
+function adminAttachmentIds(text) {
+  const ids = [];
+  for (const m of text.matchAll(ADMIN_UPLOAD_PATH)) {
+    const id = m[1].toLowerCase();
+    if (!ids.includes(id)) ids.push(id);
+  }
+  return ids;
+}
+function adminAttachmentsFromText(text, uploadsBase) {
+  const out = [];
+  for (const id of adminAttachmentIds(text)) {
+    const meta = readAttachmentMeta(join10(uploadsBase, id));
+    if (meta) out.push(meta);
+  }
+  return out;
+}
+function readSidecar(dir, attachmentId) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync11(join10(dir, `${attachmentId}.meta.json`), "utf8"));
+  } catch {
+    return null;
+  }
+  const filename = parsed.filename;
+  const mimeType = parsed.mimeType;
+  const sizeBytes = parsed.sizeBytes;
+  const storedAt = parsed.storedAt;
+  if (typeof filename !== "string" || typeof mimeType !== "string" || typeof sizeBytes !== "number" || typeof storedAt !== "string") {
+    return null;
+  }
+  return { attachmentId, filename, mimeType, sizeBytes, storedAt };
+}
+function readAttachmentMeta(dir) {
+  const attachmentId = dir.split("/").filter(Boolean).pop() ?? "";
+  const sidecar = readSidecar(dir, attachmentId);
+  if (!sidecar) return null;
+  const { storedAt: _storedAt, ...render } = sidecar;
+  return render;
+}
+function listSessionAttachmentsInDir(dir) {
+  let entries;
+  try {
+    entries = readdirSync6(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return [];
+  }
+  const sidecars = [];
+  for (const name of entries) {
+    const sidecar = readSidecar(join10(dir, name), name);
+    if (sidecar) sidecars.push(sidecar);
+  }
+  sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
+  return sidecars.map(({ storedAt: _storedAt, ...render }) => render);
+}
+
 // app/lib/whatsapp-reader/tail.ts
 function splitNewLines(buf, baseOffset) {
   const text = buf.toString("utf8");
@@ -7284,17 +7388,17 @@ var app4 = new Hono();
 app4.get("/conversations", requireAdminSession, async (c) => {
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join10(cfg, "projects");
+  const projectsRoot = join11(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename2(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname(path2);
-    const meta = readSidecarMeta(join10(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join11(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     let body = "";
     try {
-      body = readFileSync11(path2, "utf8");
+      body = readFileSync12(path2, "utf8");
     } catch {
     }
     const { title } = resolveTitle(body, sessionId, userTitles);
@@ -7311,7 +7415,8 @@ app4.get("/conversations", requireAdminSession, async (c) => {
       channel: meta.channel,
       senderId: meta.senderId,
       lastMessageAt,
-      modelGated
+      modelGated,
+      model: lastAssistantModel(body)
     });
   }
   const selected = selectReaderChannelSessions(rows);
@@ -7377,15 +7482,31 @@ function resumeOffset(lastEventId, fileEnd) {
   if (!Number.isFinite(n) || n < 0) return 0;
   return Math.min(n, fileEnd);
 }
+function enrichDownloads(turn) {
+  if (turn.kind !== "agent-file") return turn;
+  const downloads = turn.files.map((f) => {
+    const rel = relative2(DATA_ROOT, f);
+    return !rel || rel.startsWith("..") || isAbsolute(rel) ? null : rel;
+  });
+  return { ...turn, downloads };
+}
+function enrichAdminAttachments(turn) {
+  if (turn.kind !== "operator-inbound") return turn;
+  if (adminAttachmentIds(turn.text).length === 0) return turn;
+  const account = resolveAccount();
+  if (!account) return turn;
+  const attachments = adminAttachmentsFromText(turn.text, resolve11(DATA_ROOT, "accounts", account.accountId, "uploads"));
+  return attachments.length > 0 ? { ...turn, attachments } : turn;
+}
 app4.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve11(join10(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve11(join11(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve11(join10(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve11(join11(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep3)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -7408,6 +7529,7 @@ data: ${JSON.stringify(turn)}
       })();
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
+      const queuedPendingSuppress = /* @__PURE__ */ new Map();
       const drain = () => {
         try {
           const { buf, end } = readFrom(jsonlPath, offset);
@@ -7415,8 +7537,8 @@ data: ${JSON.stringify(turn)}
           const { lines, nextOffset } = splitNewLines(buf, offset);
           offset = nextOffset;
           let n = 0;
-          for (const turn of parseTranscript(lines)) {
-            send(controller, turn, offset);
+          for (const turn of parseTranscript(lines, queuedPendingSuppress)) {
+            send(controller, enrichAdminAttachments(enrichDownloads(turn)), offset);
             if (turn.kind === "agent-error") {
               console.log(`[wa-stream] op=agent-error conn=${connId} sessionId=${sessionId} code=${turn.code} source=jsonl`);
             }
@@ -7431,8 +7553,8 @@ data: ${JSON.stringify(turn)}
           const { buf, end } = readFrom(jsonlPath, 0);
           offset = end;
           let n = 0;
-          for (const turn of parseTranscript(buf.toString("utf8").split("\n"))) {
-            send(controller, turn, offset);
+          for (const turn of parseTranscript(buf.toString("utf8").split("\n"), queuedPendingSuppress)) {
+            send(controller, enrichAdminAttachments(enrichDownloads(turn)), offset);
             if (turn.kind === "agent-error") {
               console.log(`[wa-stream] op=agent-error conn=${connId} sessionId=${sessionId} code=${turn.code} source=jsonl`);
             }
@@ -7487,7 +7609,7 @@ app4.get("/directives", requireAdminSession, (c) => {
   if (!dir || !existsSync7(dir)) return c.json({ entries: [] });
   let names;
   try {
-    names = readdirSync6(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
+    names = readdirSync7(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
   } catch {
     return c.json({ entries: [] });
   }
@@ -7497,7 +7619,7 @@ app4.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync4(join10(dir, name)).size;
+      len = statSync4(join11(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -7512,11 +7634,11 @@ app4.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path2 = resolve11(join10(dir, name));
+  const path2 = resolve11(join11(dir, name));
   if (!path2.startsWith(dir + sep3)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
-    body = readFileSync11(path2, "utf8");
+    body = readFileSync12(path2, "utf8");
   } catch {
     return c.json({ error: "not found" }, 404);
   }
@@ -7525,8 +7647,8 @@ app4.get("/directive", requireAdminSession, (c) => {
 var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
-import { statSync as statSync5, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2 } from "fs";
-import { basename as basename3, dirname as dirname2, join as join11, resolve as resolve12, sep as sep4 } from "path";
+import { statSync as statSync5, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync13, readdirSync as readdirSync8 } from "fs";
+import { basename as basename3, dirname as dirname2, join as join12, resolve as resolve12, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -7563,6 +7685,13 @@ function resolveVisitorSession(rows, visitorPersonId) {
     (best, r) => (r.startedAt ?? "") > (best.startedAt ?? "") ? r : best
   );
 }
+function resolveOpenVisitorSession(rows, visitorId, agentSlug) {
+  const matches = rows.filter(
+    (r) => r.role === "public" && r.channel === "webchat" && r.personId === null && r.visitorId === visitorId && r.agentSlug === agentSlug
+  );
+  if (matches.length === 0) return null;
+  return matches.reduce((best, r) => (r.startedAt ?? "") > (best.startedAt ?? "") ? r : best);
+}
 
 // server/routes/public-reader.ts
 var app5 = new Hono();
@@ -7572,19 +7701,31 @@ function parseAccessSessionId(cookieHeader) {
   const part = cookieHeader.split(";").map((p) => p.trim()).find((p) => p.startsWith("__access_session="));
   return part ? part.slice("__access_session=".length) : null;
 }
+var VISITOR_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function parseVisitorCookie(cookieHeader) {
+  if (!cookieHeader) return null;
+  const m = cookieHeader.match(/(?:^|;\s*)maxy_visitor=([^;]*)/);
+  if (!m) return null;
+  const v = decodeURIComponent(m[1]).trim();
+  return VISITOR_UUID_RE.test(v) ? v : null;
+}
 function resolveVisitor(c) {
-  const id = parseAccessSessionId(c.req.header("cookie"));
-  const session = id ? getAccessSession(id) : null;
-  return session && session.personId ? { personId: session.personId } : null;
+  const cookie = c.req.header("cookie");
+  const grantId = parseAccessSessionId(cookie);
+  const session = grantId ? getAccessSession(grantId) : null;
+  if (session && session.personId) return { kind: "person", personId: session.personId };
+  const visitorId = parseVisitorCookie(cookie);
+  if (visitorId) return { kind: "visitor", visitorId };
+  return null;
 }
 function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
+  for (const { path: path2 } of enumerateJsonls(join12(cfg, "projects"))) {
     const sessionId = basename3(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname2(path2);
-    const meta = readSidecarMeta(join11(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join12(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -7592,7 +7733,9 @@ function enumeratePublicRows() {
       channel: meta.channel,
       personId: meta.personId,
       senderId: meta.senderId,
-      startedAt: meta.startedAt
+      startedAt: meta.startedAt,
+      visitorId: meta.visitorId,
+      agentSlug: meta.agentSlug
     });
   }
   return rows;
@@ -7600,18 +7743,43 @@ function enumeratePublicRows() {
 app5.get("/session", (c) => {
   const visitor = resolveVisitor(c);
   if (!visitor) {
-    console.error(`${TAG20} op=reader-refused reason=no-grant path=/session`);
+    console.error(`${TAG20} op=reader-refused reason=no-anchor path=/session`);
     return c.json({ error: "gate-required" }, 401);
   }
-  const found = resolveVisitorSession(enumeratePublicRows(), visitor.personId);
+  const rows = enumeratePublicRows();
+  let found = null;
+  if (visitor.kind === "person") {
+    found = resolveVisitorSession(rows, visitor.personId);
+  } else {
+    const account = resolveAccount();
+    const agentParam = c.req.query("agent");
+    let effectiveSlug;
+    if (agentParam) {
+      effectiveSlug = account && validateAgentSlug(agentParam) && isActiveAgentSlug(account.accountDir, agentParam) ? agentParam : null;
+    } else {
+      effectiveSlug = account ? resolveDefaultAgentSlug(account.accountDir) : null;
+    }
+    found = effectiveSlug ? resolveOpenVisitorSession(rows, visitor.visitorId, effectiveSlug) : null;
+  }
   if (found) {
-    console.log(`${TAG20} op=session-resume key=${(found.senderId ?? "").slice(0, 8)} sessionId=${found.sessionId.slice(0, 8)}`);
+    console.log(`${TAG20} op=session-resume anchor=${visitor.kind} key=${(found.senderId ?? "").slice(0, 8)} sessionId=${found.sessionId.slice(0, 8)}`);
     return c.json({ sessionId: found.sessionId, projectDir: found.projectDir, sessionKey: found.senderId });
   }
   const sessionKey = crypto.randomUUID();
-  console.log(`${TAG20} op=session-new key=${sessionKey.slice(0, 8)}`);
+  console.log(`${TAG20} op=session-new anchor=${visitor.kind} key=${sessionKey.slice(0, 8)}`);
   return c.json({ sessionId: null, projectDir: null, sessionKey });
 });
+function publicUploadsDir(accountId, sessionId) {
+  return resolve12(DATA_ROOT, "accounts", accountId, "uploads", "public", sessionId);
+}
+function enrichPublicAttachments(turns, sessionAttachments, cursor) {
+  for (const turn of turns) {
+    if (turn.kind !== "operator-inbound" || !turn.uploadCount) continue;
+    const slice = sessionAttachments.slice(cursor.consumed, cursor.consumed + turn.uploadCount);
+    cursor.consumed += turn.uploadCount;
+    if (slice.length > 0) turn.attachments = slice;
+  }
+}
 function readFrom2(path2, from) {
   const end = statSync5(path2).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
@@ -7627,37 +7795,43 @@ function readFrom2(path2, from) {
 app5.get("/stream", (c) => {
   const visitor = resolveVisitor(c);
   if (!visitor) {
-    console.error(`${TAG20} op=reader-refused reason=no-grant path=/stream`);
+    console.error(`${TAG20} op=reader-refused reason=no-anchor path=/stream`);
     return c.json({ error: "gate-required" }, 401);
   }
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve12(join11(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve12(join12(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve12(join11(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve12(join12(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep4)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join11(projectDir, `${sessionId}.meta.json`));
-  if (!(meta.role === "public" && meta.channel === "webchat" && meta.personId === visitor.personId)) {
-    console.error(`${TAG20} op=reader-refused reason=not-owner sessionId=${sessionId.slice(0, 8)}`);
+  const meta = readSidecarMeta(join12(projectDir, `${sessionId}.meta.json`));
+  const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
+  const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
+  if (!(isPublicWebchat && owns)) {
+    console.error(`${TAG20} op=reader-refused reason=not-owner anchor=${visitor.kind} sessionId=${sessionId.slice(0, 8)}`);
     return c.json({ error: "forbidden" }, 403);
   }
   const senderShort = (meta.senderId ?? "").slice(0, 8);
   const encoder = new TextEncoder();
-  console.log(`${TAG20} op=reader-open key=${senderShort} mode=delivered-only sessionId=${sessionId.slice(0, 8)}`);
+  console.log(`${TAG20} op=reader-open anchor=${visitor.kind} key=${senderShort} mode=delivered-only sessionId=${sessionId.slice(0, 8)}`);
   const send = (controller, turn, id) => controller.enqueue(encoder.encode(`id: ${id}
 data: ${JSON.stringify(turn)}
 
 `));
+  const account = resolveAccount();
+  const uploadsDir = account ? publicUploadsDir(account.accountId, sessionId) : null;
+  const attachmentCursor = { consumed: 0 };
   const readable = new ReadableStream({
     start(controller) {
       let offset = 0;
       const emit = (lines) => {
         const { turns, dropped } = filterDeliveredFrames(lines);
+        if (uploadsDir) enrichPublicAttachments(turns, listSessionAttachmentsInDir(uploadsDir), attachmentCursor);
         for (const turn of turns) send(controller, turn, offset);
         if (dropped > 0) console.log(`${TAG20} op=reader-filtered key=${senderShort} dropped=${dropped}`);
       };
@@ -7706,24 +7880,83 @@ data: ${JSON.stringify(turn)}
     headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache", Connection: "keep-alive" }
   });
 });
+var ATT_TAG = "[public-attachment]";
+var ATTACHMENT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+app5.get("/attachment/:attachmentId", (c) => {
+  const visitor = resolveVisitor(c);
+  const attachmentId = c.req.param("attachmentId");
+  const sessionId = c.req.query("sessionId") ?? "";
+  const ses = sessionId.slice(0, 8);
+  const at = attachmentId.slice(0, 8);
+  if (!visitor) {
+    console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=no-anchor`);
+    return new Response("Unauthorized", { status: 401 });
+  }
+  console.log(`${ATT_TAG} op=request session=${ses} att=${at}`);
+  if (!ATTACHMENT_ID_RE.test(attachmentId) || !SESSION_ID_RE2.test(sessionId)) {
+    console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=bad-id`);
+    return new Response("Not found", { status: 404 });
+  }
+  const row = enumeratePublicRows().find((r) => r.sessionId === sessionId);
+  const owns = row != null && row.role === "public" && row.channel === "webchat" && (visitor.kind === "person" ? row.personId === visitor.personId : row.personId === null && row.visitorId === visitor.visitorId);
+  if (!owns) {
+    console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=foreign-session`);
+    return new Response("Not found", { status: 404 });
+  }
+  const account = resolveAccount();
+  if (!account) {
+    console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
+    return new Response("Not found", { status: 404 });
+  }
+  const uploadsRoot = publicUploadsDir(account.accountId, sessionId);
+  const dir = resolve12(uploadsRoot, attachmentId);
+  if (!dir.startsWith(uploadsRoot + sep4)) {
+    console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=bad-id`);
+    return new Response("Not found", { status: 404 });
+  }
+  const meta = readAttachmentMeta(dir);
+  if (!meta) {
+    console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
+    return new Response("Not found", { status: 404 });
+  }
+  let dataFile;
+  let buffer;
+  try {
+    dataFile = readdirSync8(dir).find((f) => !f.endsWith(".meta.json"));
+    if (!dataFile) throw new Error("no data file");
+    buffer = readFileSync13(resolve12(dir, dataFile));
+  } catch {
+    console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
+    return new Response("Not found", { status: 404 });
+  }
+  console.log(`${ATT_TAG} op=served session=${ses} att=${at} bytes=${buffer.length} mime=${meta.mimeType}`);
+  const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
+  return new Response(new Uint8Array(buffer), {
+    headers: {
+      "Content-Type": meta.mimeType,
+      "Content-Disposition": `inline; filename="${safeName}"`,
+      "Cache-Control": "private, max-age=3600"
+    }
+  });
+});
 var public_reader_default = app5;
 
 // server/routes/webchat.ts
 import { basename as basename4, dirname as dirname3 } from "path";
-import { join as join14 } from "path";
-import { existsSync as existsSync9, readdirSync as readdirSync8, readFileSync as readFileSync14, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
+import { join as join15 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync10, readFileSync as readFileSync16, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
-import { readFileSync as readFileSync12, writeFileSync as writeFileSync5, renameSync } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync14, writeFileSync as writeFileSync5, renameSync } from "fs";
+import { join as join13 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join12(accountDir, FILE);
+  return join13(accountDir, FILE);
 }
 function readCanonicalOverrideId(accountDir) {
   try {
-    const raw = JSON.parse(readFileSync12(canonicalOverridePath(accountDir), "utf8"));
+    const raw = JSON.parse(readFileSync14(canonicalOverridePath(accountDir), "utf8"));
     return typeof raw.sessionId === "string" && UUID.test(raw.sessionId) ? raw.sessionId : null;
   } catch {
     return null;
@@ -7749,8 +7982,8 @@ function adminSessionIdFor(accountId, senderId, personId) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync as readdirSync7, readFileSync as readFileSync13, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync as readdirSync9, readFileSync as readFileSync15, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { join as join14 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -7758,7 +7991,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join13(sessionsDir, `${id}${suffix}`);
+    return join14(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync2(sessionsDir, { recursive: true });
@@ -7779,7 +8012,7 @@ function createSidecarStore(config) {
   function readFileAt(path2) {
     let raw;
     try {
-      raw = readFileSync13(path2, "utf8");
+      raw = readFileSync15(path2, "utf8");
     } catch {
       return null;
     }
@@ -7795,17 +8028,17 @@ function createSidecarStore(config) {
   function readAll(sessionsDir, onSkip) {
     let names;
     try {
-      names = readdirSync7(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+      names = readdirSync9(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
     } catch {
       return [];
     }
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path2 = join13(sessionsDir, name);
+      const path2 = join14(sessionsDir, name);
       let raw;
       try {
-        raw = readFileSync13(path2, "utf8");
+        raw = readFileSync15(path2, "utf8");
       } catch {
         onSkip?.(name, "unreadable");
         continue;
@@ -7879,10 +8112,10 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return { projectDir: null, channel: null };
-  for (const { path: path2 } of enumerateJsonls(join14(cfg, "projects"))) {
+  for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
     if (basename4(path2) === `${sessionId}.jsonl`) {
       const dir = dirname3(path2);
-      const meta = readSidecarMeta(join14(dir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join15(dir, `${sessionId}.meta.json`));
       return { projectDir: dir, channel: meta.channel };
     }
   }
@@ -7891,15 +8124,15 @@ function locateSession(sessionId) {
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join14(cfg, "projects");
+  const projectsRoot = join15(cfg, "projects");
   let slugs;
   try {
-    slugs = readdirSync8(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync10(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join14(projectsRoot, slug, `${sessionId}.meta.json`);
+    const metaPath = join15(projectsRoot, slug, `${sessionId}.meta.json`);
     if (existsSync9(metaPath)) {
       return { channel: readSidecarMeta(metaPath).channel };
     }
@@ -7912,7 +8145,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync6(join14(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync6(join15(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -7981,10 +8214,10 @@ function latestAdminWebchatSessionId() {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path2, isSubagent, archived } of enumerateJsonls(join14(cfg, "projects"))) {
+  for (const { path: path2, isSubagent, archived } of enumerateJsonls(join15(cfg, "projects"))) {
     if (isSubagent || archived) continue;
     const id = basename4(path2).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join14(dirname3(path2), `${id}.meta.json`));
+    const meta = readSidecarMeta(join15(dirname3(path2), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     let mtimeMs;
     try {
@@ -8213,9 +8446,9 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join14(account.accountDir, "account.json");
+    const accountJsonPath = join15(account.accountDir, "account.json");
     try {
-      const parsed = JSON.parse(readFileSync14(accountJsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync16(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
       else if (op === "effort") parsed.effort = value;
       else parsed.adminPermissionMode = value;
@@ -8252,7 +8485,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join14(cfg2, "sessions"),
+            join15(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -8281,7 +8514,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path2 } of enumerateJsonls(join14(cfg, "projects"))) {
+      for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
         if (basename4(path2) === `${sessionId}.jsonl`) {
           projectDir = dirname3(path2);
           break;
@@ -8298,8 +8531,8 @@ ${note}` : note;
 import { resolve as resolve13 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15, readdirSync as readdirSync9 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync17, readdirSync as readdirSync11 } from "fs";
+import { join as join16 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -8311,14 +8544,14 @@ function field(fm, name) {
 }
 function readSpecialistRoster(specialistsDir) {
   if (!existsSync10(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync9(specialistsDir);
+  const entries = readdirSync11(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync15(join15(specialistsDir, file), "utf-8");
+      raw = readFileSync17(join16(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -8435,11 +8668,11 @@ var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve15, join as join16 } from "path";
-import { existsSync as existsSync11, readFileSync as readFileSync16 } from "fs";
+import { resolve as resolve17, join as join17 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync18 } from "fs";
 
 // app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve14 } from "path";
+import { resolve as resolve16 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase2() {
@@ -8470,6 +8703,7 @@ async function managerSpawn(opts) {
       specialistDomains: opts.specialistDomains,
       sliceToken: opts.sliceToken,
       personId: opts.personId,
+      visitorId: opts.visitorId,
       name: opts.name,
       webchatChannel: opts.webchatChannel
     })
@@ -8878,81 +9112,114 @@ async function fanOut(subscribers, text, onError, tag) {
   );
 }
 
+// app/lib/channel-pty-bridge/file-delivery.ts
+var SEND_USER_FILE = "SendUserFile";
+function makeFileDelivery(opts) {
+  const { entry, tag, channel, sendFile } = opts;
+  let failedFiles = [];
+  let attempts = 0;
+  return {
+    isFileDeliveryTool(toolName) {
+      return toolName === SEND_USER_FILE;
+    },
+    async onFileToolUse(use) {
+      if (use.toolName !== SEND_USER_FILE) return;
+      const input = use.input ?? {};
+      const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
+      const caption = typeof input.caption === "string" ? input.caption : void 0;
+      for (let i = 0; i < files.length; i++) {
+        attempts++;
+        const result = await sendFile(files[i], i === 0 ? caption : void 0);
+        const name = files[i].split("/").pop() ?? files[i];
+        console.error(`${tag} op=file-forward channel=${channel} file=${name} outcome=${result.ok ? "ok" : "fail"}`);
+        if (!result.ok) failedFiles.push(files[i]);
+      }
+    },
+    onTurnEnd(firedTools) {
+      const failed = failedFiles;
+      const tried = attempts;
+      failedFiles = [];
+      attempts = 0;
+      const sid = entry.sessionId.slice(0, 8);
+      for (const file of failed) {
+        console.error(
+          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
+        );
+      }
+      if (firedTools.includes(SEND_USER_FILE) && tried === 0) {
+        console.error(
+          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
+        );
+      }
+    }
+  };
+}
+
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
 var TAG22 = "[whatsapp-adaptor]";
-var SEND_USER_FILE = "SendUserFile";
+var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
+function makeWhatsAppSendFile(entry) {
+  return async (filePath, caption) => {
+    let maxyAccountId;
+    try {
+      maxyAccountId = resolvePlatformAccountId();
+    } catch (err) {
+      console.error(
+        `${TAG22} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+      );
+      return { ok: false, error: "account-unresolved" };
+    }
+    const result = await sendWhatsAppDocument({
+      to: entry.senderId,
+      filePath,
+      caption,
+      accountId: entry.accountId,
+      maxyAccountId,
+      platformRoot: platformRoot()
+    });
+    if (result.ok) return { ok: true };
+    console.error(
+      `${TAG22} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+    );
+    return { ok: false, error: result.error };
+  };
+}
 function makeWhatsAppFileDelivery(entry) {
+  const shared = makeFileDelivery({
+    entry,
+    tag: TAG22,
+    channel: "whatsapp",
+    sendFile: makeWhatsAppSendFile(entry)
+  });
   let turnStartedAt = null;
-  let failedFiles = [];
-  let sendUserFileAttempts = 0;
   let routeCalls = [];
   return {
     isFileDeliveryTool(toolName) {
-      return toolName === SEND_USER_FILE || toolName === WHATSAPP_SEND_DOCUMENT;
+      return toolName === SEND_USER_FILE2 || toolName === WHATSAPP_SEND_DOCUMENT;
     },
     async onFileToolUse(use) {
       if (turnStartedAt === null) turnStartedAt = Date.now();
       if (use.toolName === WHATSAPP_SEND_DOCUMENT) {
-        const input2 = use.input ?? {};
+        const input = use.input ?? {};
         routeCalls.push({
-          to: typeof input2.to === "string" ? input2.to : void 0,
-          filePath: typeof input2.filePath === "string" ? input2.filePath : void 0
+          to: typeof input.to === "string" ? input.to : void 0,
+          filePath: typeof input.filePath === "string" ? input.filePath : void 0
         });
         return;
       }
-      if (use.toolName !== SEND_USER_FILE) return;
-      const input = use.input ?? {};
-      const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
-      const caption = typeof input.caption === "string" ? input.caption : void 0;
-      if (files.length === 0) return;
-      let maxyAccountId;
-      try {
-        maxyAccountId = resolvePlatformAccountId();
-      } catch (err) {
-        console.error(
-          `${TAG22} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
-        );
-        return;
-      }
-      for (let i = 0; i < files.length; i++) {
-        sendUserFileAttempts++;
-        const result = await sendWhatsAppDocument({
-          to: entry.senderId,
-          filePath: files[i],
-          caption: i === 0 ? caption : void 0,
-          accountId: entry.accountId,
-          maxyAccountId,
-          platformRoot: platformRoot()
-        });
-        if (!result.ok) {
-          failedFiles.push(files[i]);
-          console.error(
-            `${TAG22} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
-          );
-        }
-      }
+      await shared.onFileToolUse(use);
     },
     onTurnEnd(firedTools) {
       const startedAt = turnStartedAt ?? 0;
-      const failed = failedFiles;
-      const attempts = sendUserFileAttempts;
       const routes = routeCalls;
       turnStartedAt = null;
-      failedFiles = [];
-      sendUserFileAttempts = 0;
       routeCalls = [];
       const sid = entry.sessionId.slice(0, 8);
-      for (const file of failed) {
-        console.error(
-          `${TAG22} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
-        );
-      }
-      const okAt = documentOutboundAt(entry.senderId);
-      const documentWentOut = okAt !== void 0 && okAt >= startedAt;
+      shared.onTurnEnd(firedTools);
       for (const call of routes) {
         const routeAt = call.to !== void 0 && call.filePath !== void 0 ? routeDocumentOutboundAt(call.to, call.filePath) : void 0;
         const delivered = routeAt !== void 0 && routeAt >= startedAt;
@@ -8963,21 +9230,186 @@ function makeWhatsAppFileDelivery(entry) {
           );
         }
       }
-      if (firedTools.includes(SEND_USER_FILE) && attempts === 0 && !documentWentOut) {
-        console.error(
-          `${TAG22} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
-        );
+    }
+  };
+}
+
+// app/lib/telegram/outbound/send-document.ts
+import { realpathSync as realpathSync4 } from "fs";
+import { readFile as readFile2, stat as stat3 } from "fs/promises";
+import { resolve as resolve14, basename as basename5 } from "path";
+var TAG23 = "[telegram:outbound]";
+var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
+async function sendTelegramDocument(input) {
+  const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot4 } = input;
+  if (!botToken || !filePath) {
+    return { ok: false, status: 400, error: "Missing required fields: botToken, filePath" };
+  }
+  if (!maxyAccountId || !platformRoot4) {
+    return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
+  }
+  const accountDir = resolve14(platformRoot4, "..", "data/accounts", maxyAccountId);
+  let resolvedPath;
+  try {
+    resolvedPath = realpathSync4(filePath);
+    const accountResolved = realpathSync4(accountDir);
+    if (!resolvedPath.startsWith(accountResolved + "/")) {
+      console.error(`${TAG23} document REJECTED reason=outside_account_directory`);
+      return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
+    }
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      console.error(`${TAG23} document ENOENT path=${filePath}`);
+      return { ok: false, status: 404, error: `File not found: ${filePath}` };
+    }
+    console.error(`${TAG23} document path error: ${String(err)}`);
+    return { ok: false, status: 500, error: String(err) };
+  }
+  const fileStat = await stat3(resolvedPath);
+  if (fileStat.size > TELEGRAM_DOCUMENT_MAX_BYTES) {
+    return {
+      ok: false,
+      status: 400,
+      error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
+    };
+  }
+  const filename = basename5(resolvedPath);
+  const buffer = Buffer.from(await readFile2(resolvedPath));
+  const form = new FormData();
+  form.append("chat_id", String(chatId));
+  if (caption) form.append("caption", caption);
+  form.append("document", new File([buffer], filename, { type: detectMimeType(resolvedPath) }));
+  let ok = false;
+  let messageId;
+  let error = "send failed";
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${botToken}/sendDocument`, {
+      method: "POST",
+      body: form
+    });
+    const data = await res.json();
+    ok = data.ok;
+    messageId = data.result?.message_id;
+    if (!data.ok) error = data.description ?? "Unknown Telegram error";
+  } catch (e) {
+    error = e instanceof Error ? e.message : String(e);
+  }
+  console.error(
+    `${TAG23} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+  );
+  return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
+}
+
+// app/lib/telegram/outbound/file-delivery.ts
+var TAG24 = "[telegram:outbound]";
+function platformRoot2() {
+  return process.env.MAXY_PLATFORM_ROOT || "";
+}
+function makeTelegramSendFile(entry) {
+  let botToken;
+  return async (filePath, caption) => {
+    if (botToken === void 0) {
+      const tg = resolveAccount()?.config.telegram;
+      botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
+    }
+    if (!botToken) {
+      console.error(`${TAG24} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      return { ok: false, error: "no-bot-token" };
+    }
+    if (entry.replyTarget == null) {
+      console.error(`${TAG24} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      return { ok: false, error: "no-reply-target" };
+    }
+    let maxyAccountId;
+    try {
+      maxyAccountId = resolvePlatformAccountId();
+    } catch (err) {
+      console.error(
+        `${TAG24} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+      );
+      return { ok: false, error: "account-unresolved" };
+    }
+    const result = await sendTelegramDocument({
+      botToken,
+      chatId: Number(entry.replyTarget),
+      filePath,
+      caption,
+      maxyAccountId,
+      platformRoot: platformRoot2()
+    });
+    return result.ok ? { ok: true } : { ok: false, error: result.error };
+  };
+}
+function makeTelegramFileDelivery(entry) {
+  return makeFileDelivery({
+    entry,
+    tag: TAG24,
+    channel: "telegram",
+    sendFile: makeTelegramSendFile(entry)
+  });
+}
+
+// app/lib/webchat/file-delivery.ts
+import { realpathSync as realpathSync5 } from "fs";
+import { resolve as resolve15 } from "path";
+var TAG25 = "[webchat-adaptor]";
+function platformRoot3() {
+  return process.env.MAXY_PLATFORM_ROOT || "";
+}
+function makeWebchatSendFile(entry) {
+  return async (filePath) => {
+    let maxyAccountId;
+    try {
+      maxyAccountId = resolvePlatformAccountId();
+    } catch (err) {
+      console.error(
+        `${TAG25} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+      );
+      return { ok: false, error: "account-unresolved" };
+    }
+    const accountDir = resolve15(platformRoot3(), "..", "data/accounts", maxyAccountId);
+    try {
+      const resolved = realpathSync5(filePath);
+      const accountResolved = realpathSync5(accountDir);
+      if (!resolved.startsWith(accountResolved + "/")) {
+        console.error(`${TAG25} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        return { ok: false, error: "outside-account" };
       }
+      return { ok: true };
+    } catch (err) {
+      const code = err.code;
+      console.error(
+        `${TAG25} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+      );
+      return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
   };
 }
+function makeWebchatFileDelivery(entry) {
+  return makeFileDelivery({
+    entry,
+    tag: TAG25,
+    channel: "webchat",
+    sendFile: makeWebchatSendFile(entry)
+  });
+}
 
 // app/lib/channel-pty-bridge/bridge.ts
 function tagFor(channel) {
   return `[${channel}-adaptor]`;
 }
 function fileDeliveryFor(entry) {
-  return entry.channel === "whatsapp" ? makeWhatsAppFileDelivery(entry) : null;
+  switch (entry.channel) {
+    case "whatsapp":
+      return makeWhatsAppFileDelivery(entry);
+    case "telegram":
+      return makeTelegramFileDelivery(entry);
+    case "webchat":
+      return makeWebchatFileDelivery(entry);
+    case "email":
+      return null;
+  }
 }
 function publicIdleMs() {
   return Number(process.env.CHANNEL_PTY_IDLE_MS ?? String(5 * 6e4));
@@ -8995,6 +9427,7 @@ async function ensureEntry(input) {
   const sliceTokenValue = input.sliceToken ?? "";
   const personIdValue = input.personId ?? null;
   const nameValue = input.name ?? null;
+  const replyTargetValue = input.replyTarget ?? null;
   const key = indexKey(input.accountId, input.agentSlug, input.senderId, sliceTokenValue, personIdValue);
   const existing = index.get(key);
   const tag = tagFor(input.channel);
@@ -9016,6 +9449,7 @@ async function ensureEntry(input) {
       });
       existing.followerRunning = true;
     }
+    existing.replyTarget = replyTargetValue;
     return existing;
   }
   let spawned;
@@ -9036,7 +9470,7 @@ async function ensureEntry(input) {
     });
   } else {
     console.error(`${tag} route role=${input.role} target=public-spawn senderId=${input.senderId}`);
-    const attachmentDir = resolve14(DATA_ROOT, "accounts", input.accountId, "uploads", "public", input.senderId);
+    const attachmentDir = resolve16(DATA_ROOT, "accounts", input.accountId, "uploads", "public", input.senderId);
     spawned = await managerSpawn({
       senderId: input.senderId,
       role: input.role,
@@ -9072,7 +9506,8 @@ async function ensureEntry(input) {
     followerRunning: false,
     sliceToken: sliceTokenValue,
     personId: personIdValue,
-    name: nameValue
+    name: nameValue,
+    replyTarget: replyTargetValue
   };
   entry.followerAbort = startFollower({
     entry,
@@ -9124,7 +9559,8 @@ async function writeInput(entry, text) {
           agentSlug: entry.agentSlug,
           sliceToken: entry.sliceToken.length > 0 ? entry.sliceToken : void 0,
           personId: entry.personId,
-          name: entry.name
+          name: entry.name,
+          replyTarget: entry.replyTarget ?? void 0
         });
         if (!respawned) return false;
         for (const cb of entry.subscribers) respawned.subscribers.add(cb);
@@ -9164,16 +9600,17 @@ async function dispatchOnce(input) {
     agentSlug: input.agentSlug,
     sliceToken: input.sliceToken,
     personId: input.personId,
-    name: input.name
+    name: input.name,
+    replyTarget: input.replyTarget
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve32;
+  let resolve34;
   const turnPromise = new Promise((r) => {
-    resolve32 = r;
+    resolve34 = r;
   });
   const listener = (text) => {
-    resolve32(text);
+    resolve34(text);
   };
   entry.subscribers.add(listener);
   const writeAtMs = Date.now();
@@ -9320,14 +9757,14 @@ function routeTelegramUpdate(input) {
 }
 
 // server/routes/telegram.ts
-var TAG23 = "[telegram-inbound]";
+var TAG26 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
-  const brandPath = join16(platformRoot2, "config", "brand.json");
+  const platformRoot4 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
+  const brandPath = join17(platformRoot4, "config", "brand.json");
   if (existsSync11(brandPath)) {
     try {
-      return JSON.parse(readFileSync16(brandPath, "utf-8")).configDir ?? ".maxy";
+      return JSON.parse(readFileSync18(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
     }
   }
@@ -9335,7 +9772,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve15(homedir(), configDirName(), filename);
+  return resolve17(homedir(), configDirName(), filename);
 }
 async function sendTelegram(botToken, chatId, text) {
   try {
@@ -9355,18 +9792,18 @@ app7.post("/", async (c) => {
   const botParam = c.req.query("bot");
   const botType = botParam === "admin" ? "admin" : botParam === "public" ? "public" : null;
   if (!botType) {
-    console.error(`${TAG23} op=reject reason=missing-bot-param`);
+    console.error(`${TAG26} op=reject reason=missing-bot-param`);
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
   if (!existsSync11(sp)) {
-    console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
+    console.error(`${TAG26} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
-  const expected = readFileSync16(sp, "utf-8").trim();
+  const expected = readFileSync18(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
-    console.error(`${TAG23} op=reject reason=bad-secret botType=${botType}`);
+    console.error(`${TAG26} op=reject reason=bad-secret botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
   let update;
@@ -9377,25 +9814,25 @@ app7.post("/", async (c) => {
   }
   const account = resolveAccount();
   if (!account) {
-    console.error(`${TAG23} op=reject reason=no-account`);
+    console.error(`${TAG26} op=reject reason=no-account`);
     return c.json({ ok: true }, 200);
   }
   const decision = routeTelegramUpdate({ update, botType, config: account.config.telegram ?? {} });
   if (decision.kind === "ignore") {
-    console.error(`${TAG23} op=ignore reason=${decision.reason}`);
+    console.error(`${TAG26} op=ignore reason=${decision.reason}`);
     return c.json({ ok: true }, 200);
   }
   if (decision.kind === "denied") {
-    console.error(`${TAG23} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
+    console.error(`${TAG26} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
     return c.json({ ok: true }, 200);
   }
   const role = decision.agentType === "admin" ? "admin" : "public";
   const agentSlug = role === "admin" ? "admin" : resolveDefaultAgentSlug(account.accountDir);
   if (!agentSlug) {
-    console.error(`${TAG23} op=reject reason=no-default-agent`);
+    console.error(`${TAG26} op=reject reason=no-default-agent`);
     return c.json({ ok: true }, 200);
   }
-  console.error(`${TAG23} op=update accountId=${account.accountId} from=${decision.senderId}`);
+  console.error(`${TAG26} op=update accountId=${account.accountId} from=${decision.senderId}`);
   const botToken = botType === "admin" ? account.config.telegram?.adminBotToken : account.config.telegram?.publicBotToken;
   const { senderId, chatId, text } = decision;
   void (async () => {
@@ -9406,70 +9843,73 @@ app7.post("/", async (c) => {
       channel: "telegram",
       agentSlug,
       text,
+      // Task 924 — the file adapter delivers SendUserFile to this chat id, so a
+      // group turn's document reaches the group rather than the sender's DM.
+      replyTarget: String(chatId),
       timeoutMs: DISPATCH_TIMEOUT_MS
     });
     if ("error" in result) {
-      console.error(`${TAG23} op=dispatch-failed from=${senderId} error=${result.error}`);
+      console.error(`${TAG26} op=dispatch-failed from=${senderId} error=${result.error}`);
       return;
     }
     if (!botToken) {
       const reason = account.config.telegram ? "no-bot-token" : "no-telegram-config";
-      console.error(`${TAG23} op=reply-dropped reason=${reason} botType=${botType}`);
+      console.error(`${TAG26} op=reply-dropped reason=${reason} botType=${botType}`);
       return;
     }
     const sent = await sendTelegram(botToken, chatId, result.turnText);
-    console.error(`${TAG23} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
+    console.error(`${TAG26} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
   })();
   return c.json({ ok: true }, 200);
 });
 var telegram_default = app7;
 
 // server/routes/quickbooks.ts
-import { join as join17 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync8, mkdirSync as mkdirSync3, rmSync, renameSync as renameSync4 } from "fs";
-var TAG24 = "[quickbooks]";
+import { join as join18 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync8, mkdirSync as mkdirSync3, rmSync, renameSync as renameSync4 } from "fs";
+var TAG27 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join17(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join18(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join17(accountDir, "secrets", "quickbooks.json");
+  return join18(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
   if (!state || !STATE_RE.test(state) || !existsSync12(pendingPath(accountDir, state))) {
-    console.error(`${TAG24} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
+    console.error(`${TAG27} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
   const claimFile = `${pendingPath(accountDir, state)}.claimed`;
   try {
     renameSync4(pendingPath(accountDir, state), claimFile);
   } catch {
-    console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+    console.error(`${TAG27} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
   try {
     let pending;
     try {
-      pending = JSON.parse(readFileSync17(claimFile, "utf-8"));
+      pending = JSON.parse(readFileSync19(claimFile, "utf-8"));
     } catch {
-      console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      console.error(`${TAG27} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization state could not be read.", stateValid: false };
     }
     if (Date.now() > pending.expiresAt) {
-      console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      console.error(`${TAG27} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization request expired. Generate a new consent link.", stateValid: false };
     }
-    console.error(`${TAG24} op=callback state=${state} stateValid=true realmId=${realmId ?? ""}`);
+    console.error(`${TAG27} op=callback state=${state} stateValid=true realmId=${realmId ?? ""}`);
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
     if (!existsSync12(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
-    const store2 = JSON.parse(readFileSync17(storePath(accountDir), "utf-8"));
+    const store2 = JSON.parse(readFileSync19(storePath(accountDir), "utf-8"));
     const form = new URLSearchParams({
       grant_type: "authorization_code",
       code,
@@ -9486,12 +9926,12 @@ async function completeConsent(args) {
     });
     const text = await res.text();
     if (!res.ok) {
-      console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=false`);
+      console.error(`${TAG27} op=token-exchange realmId=${realmId} persisted=false`);
       return { ok: false, status: 502, message: `Token exchange failed (${res.status}). Generate a new consent link to retry.`, stateValid: true };
     }
     const body = JSON.parse(text);
     if (!body.refresh_token) {
-      console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=false`);
+      console.error(`${TAG27} op=token-exchange realmId=${realmId} persisted=false`);
       return { ok: false, status: 502, message: "Token exchange returned no refresh token.", stateValid: true };
     }
     const now = Date.now();
@@ -9501,10 +9941,10 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync3(join17(accountDir, "secrets"), { recursive: true });
+    mkdirSync3(join18(accountDir, "secrets"), { recursive: true });
     writeFileSync8(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
-    const persisted = JSON.parse(readFileSync17(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
-    console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=${persisted}`);
+    const persisted = JSON.parse(readFileSync19(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
+    console.error(`${TAG27} op=token-exchange realmId=${realmId} persisted=${persisted}`);
     return { ok: persisted, status: persisted ? 200 : 500, message: persisted ? `Connected company ${realmId}.` : "Failed to persist the connection.", stateValid: true };
   } finally {
     rmSync(claimFile, { force: true });
@@ -9517,7 +9957,7 @@ var app8 = new Hono();
 app8.get("/callback", async (c) => {
   const account = resolveAccount();
   if (!account) {
-    console.error(`${TAG24} op=callback stateValid=false realmId= reason=no-account`);
+    console.error(`${TAG27} op=callback stateValid=false realmId= reason=no-account`);
     return c.html(page("QuickBooks", "This install has no account configured."), 500);
   }
   const result = await completeConsent({
@@ -9534,12 +9974,12 @@ var quickbooks_default = app8;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync14, readFileSync as readFileSync19, unlinkSync as unlinkSync2 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync14, readFileSync as readFileSync21, unlinkSync as unlinkSync2 } from "fs";
 import { createHash as createHash3, randomUUID as randomUUID8 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync13, readFileSync as readFileSync18, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync10, statSync as statSync7 } from "fs";
-import { dirname as dirname4, join as join18 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync12, statSync as statSync7 } from "fs";
+import { dirname as dirname4, join as join19 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -9557,7 +9997,7 @@ function writeAdminEntry(input) {
   try {
     let users = [];
     if (existsSync13(input.usersFile)) {
-      const raw = readFileSync18(input.usersFile, "utf-8").trim();
+      const raw = readFileSync20(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -9581,11 +10021,11 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join18(input.accountDir, "account.json");
+    const accountJsonPath = join19(input.accountDir, "account.json");
     if (!existsSync13(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -9611,7 +10051,7 @@ function checkAdminAuthInvariant(input) {
   const usersUserIds = /* @__PURE__ */ new Set();
   if (existsSync13(input.usersFile)) {
     try {
-      const raw = readFileSync18(input.usersFile, "utf-8").trim();
+      const raw = readFileSync20(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -9627,7 +10067,7 @@ function checkAdminAuthInvariant(input) {
   if (existsSync13(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync10(input.accountsDir);
+      entries = readdirSync12(input.accountsDir);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[${input.tag}] accounts-dir unreadable accountsDir=${input.accountsDir} error=${msg}`);
@@ -9636,17 +10076,17 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join18(input.accountsDir, entry);
+      const accountDir = join19(input.accountsDir, entry);
       try {
         if (!statSync7(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join18(accountDir, "account.json");
+      const accountJsonPath = join19(accountDir, "account.json");
       if (!existsSync13(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync18(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -9687,7 +10127,7 @@ function hashPin2(pin) {
 }
 function readUsersFile2() {
   if (!existsSync14(USERS_FILE)) return null;
-  const raw = readFileSync19(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync21(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -9849,7 +10289,7 @@ app9.post("/set-pin", async (c) => {
     let installOwner = null;
     if (existsSync14(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync19(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync21(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -9931,8 +10371,8 @@ var onboarding_default = app9;
 
 // server/routes/client-error.ts
 import { appendFileSync, existsSync as existsSync15, renameSync as renameSync6, statSync as statSync8 } from "fs";
-import { join as join19 } from "path";
-var CLIENT_ERRORS_LOG = join19(LOG_DIR, "client-errors.log");
+import { join as join20 } from "path";
+var CLIENT_ERRORS_LOG = join20(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -10257,17 +10697,17 @@ app11.post("/", async (c) => {
 var session_default = app11;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync17, readdirSync as readdirSync11, readFileSync as readFileSync20, statSync as statSync9 } from "fs";
-import { resolve as resolve16, basename as basename5 } from "path";
+import { existsSync as existsSync17, readdirSync as readdirSync13, readFileSync as readFileSync22, statSync as statSync9 } from "fs";
+import { resolve as resolve18, basename as basename6 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync16 } from "fs";
-import { join as join20 } from "path";
+import { join as join21 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join20(dir, filename);
+    const fullPath = join21(dir, filename);
     if (existsSync16(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -10285,18 +10725,18 @@ app12.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve16(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve18(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename5(fileParam);
+    const safe = basename6(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve16(dir, safe);
+      const filePath = resolve18(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync20(filePath);
+        const buffer = readFileSync22(filePath);
         const onDiskBytes = statSync9(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -10360,8 +10800,8 @@ app12.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename5(hit.path);
-        const buffer = readFileSync20(hit.path);
+        const filename = basename6(hit.path);
+        const buffer = readFileSync22(hit.path);
         const onDiskBytes = statSync9(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -10399,16 +10839,16 @@ app12.get("/", async (c) => {
     if (!existsSync17(dir)) continue;
     let files;
     try {
-      files = readdirSync11(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync13(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve16(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve18(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync20(resolve16(dir, name));
+        const content = readFileSync22(resolve18(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -10446,9 +10886,9 @@ app13.get("/", (c) => {
 var claude_info_default = app13;
 
 // server/routes/admin/attachment.ts
-import { readFile as readFile2, readdir } from "fs/promises";
+import { readFile as readFile3, readdir } from "fs/promises";
 import { existsSync as existsSync18 } from "fs";
-import { resolve as resolve17 } from "path";
+import { resolve as resolve19 } from "path";
 var app14 = new Hono();
 app14.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -10460,17 +10900,17 @@ app14.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve17(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+  const dir = resolve19(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
   if (!existsSync18(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve17(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve19(dir, `${attachmentId}.meta.json`);
   if (!existsSync18(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile2(metaPath, "utf-8"));
+    meta = JSON.parse(await readFile3(metaPath, "utf-8"));
   } catch {
     return new Response("Not found", { status: 404 });
   }
@@ -10479,8 +10919,8 @@ app14.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve17(dir, dataFile);
-  const buffer = await readFile2(filePath);
+  const filePath = resolve19(dir, dataFile);
+  const buffer = await readFile3(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": meta.mimeType,
@@ -10492,24 +10932,24 @@ app14.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app14;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve18 } from "path";
-import { readdirSync as readdirSync12, readFileSync as readFileSync21, existsSync as existsSync19, rmSync as rmSync2 } from "fs";
+import { resolve as resolve20 } from "path";
+import { readdirSync as readdirSync14, readFileSync as readFileSync23, existsSync as existsSync19, rmSync as rmSync2 } from "fs";
 var app15 = new Hono();
 app15.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve18(account.accountDir, "agents");
+  const agentsDir = resolve20(account.accountDir, "agents");
   if (!existsSync19(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync12(agentsDir, { withFileTypes: true });
+    const entries = readdirSync14(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve18(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve20(agentsDir, entry.name, "config.json");
       if (!existsSync19(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync21(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync23(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -10535,7 +10975,7 @@ app15.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve18(account.accountDir, "agents", slug);
+  const agentDir = resolve20(account.accountDir, "agents", slug);
   if (!existsSync19(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -10565,7 +11005,7 @@ app15.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve18(account.accountDir, "agents", slug);
+  const agentDir = resolve20(account.accountDir, "agents", slug);
   if (!existsSync19(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -11268,8 +11708,8 @@ app16.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app16;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync21, readFileSync as readFileSync22, readdirSync as readdirSync13, statSync as statSync10 } from "fs";
-import { dirname as dirname5, resolve as resolve19, join as join21 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync24, readdirSync as readdirSync15, statSync as statSync10 } from "fs";
+import { dirname as dirname5, resolve as resolve21, join as join22 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -11310,14 +11750,14 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join21(pluginDir, "mcp/dist/index.js"),
-    join21(pluginDir, "mcp/src/index.ts")
+    join22(pluginDir, "mcp/dist/index.js"),
+    join22(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
     if (!existsSync21(path2)) continue;
     try {
-      raw = readFileSync22(path2, "utf-8");
+      raw = readFileSync24(path2, "utf-8");
       break;
     } catch {
     }
@@ -11366,24 +11806,24 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve19(PLATFORM_ROOT, "plugins");
+  const platformPlugins = resolve21(PLATFORM_ROOT, "plugins");
   if (existsSync21(platformPlugins)) {
-    for (const name of readdirSync13(platformPlugins)) {
-      const dir = join21(platformPlugins, name);
+    for (const name of readdirSync15(platformPlugins)) {
+      const dir = join22(platformPlugins, name);
       try {
         if (statSync10(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
   }
-  const premiumRoot = resolve19(dirname5(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve21(dirname5(PLATFORM_ROOT), "premium-plugins");
   if (existsSync21(premiumRoot)) {
-    for (const bundle of readdirSync13(premiumRoot)) {
-      const bundlePlugins = join21(premiumRoot, bundle, "plugins");
+    for (const bundle of readdirSync15(premiumRoot)) {
+      const bundlePlugins = join22(premiumRoot, bundle, "plugins");
       if (!existsSync21(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync13(bundlePlugins)) {
-          const dir = join21(bundlePlugins, name);
+        for (const name of readdirSync15(bundlePlugins)) {
+          const dir = join22(bundlePlugins, name);
           try {
             if (statSync10(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -11396,10 +11836,10 @@ function listPluginDirs() {
   return out;
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve21(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync21(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync22(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync24(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -11411,7 +11851,7 @@ function readFrontmatter(path2) {
   if (!existsSync21(path2)) return null;
   let raw;
   try {
-    raw = readFileSync22(path2, "utf-8");
+    raw = readFileSync24(path2, "utf-8");
   } catch {
     return null;
   }
@@ -11426,7 +11866,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join21(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join22(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -11443,7 +11883,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync21(join21(dir, "mcp/dist/index.js")) || existsSync21(join21(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync21(join22(dir, "mcp/dist/index.js")) || existsSync21(join22(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -11453,7 +11893,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join21(dir, relPath);
+      const skillPath = join22(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -11469,11 +11909,11 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  const specialistsDir = resolve21(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
   if (!existsSync21(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync13(specialistsDir);
+    entries = readdirSync15(specialistsDir);
   } catch {
     return [];
   }
@@ -11497,7 +11937,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join21(specialistsDir, file));
+    const fm = readFrontmatter(join22(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -11515,11 +11955,11 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve21(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync21(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync22(accountFile, "utf-8");
+    const raw = readFileSync24(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -11530,22 +11970,22 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve19(PLATFORM_ROOT, "plugins");
+  const pluginsDir = resolve21(PLATFORM_ROOT, "plugins");
   if (!existsSync21(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync13(pluginsDir);
+    entries = readdirSync15(pluginsDir);
   } catch {
     return [];
   }
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve19(pluginsDir, name, "PLUGIN.md");
+    const manifestPath = resolve21(pluginsDir, name, "PLUGIN.md");
     if (!existsSync21(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync22(manifestPath, "utf-8");
+      manifest = readFileSync24(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -11559,13 +11999,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
-import { resolve as resolve20 } from "path";
+import { existsSync as existsSync22, readFileSync as readFileSync25 } from "fs";
+import { resolve as resolve22 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync22(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync23(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -11576,10 +12016,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
+  const platformRoot4 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync23(resolve20(platformRoot2, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync25(resolve22(platformRoot4, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -11590,7 +12030,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG25 = "[claude-session-manager:wrapper]";
+var TAG28 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -11608,12 +12048,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG25} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG28} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG25} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG28} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -11640,24 +12080,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG25} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG28} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase("claude-session-manager:wrapper")}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG25} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG28} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG25} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG28} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG25} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG28} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -11692,7 +12132,7 @@ app17.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG25} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG28} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -11701,7 +12141,7 @@ app17.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG25} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG28} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -11720,13 +12160,13 @@ app17.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG25} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG28} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 var claude_sessions_default = app17;
 
 // server/routes/admin/log-ingest.ts
-var TAG26 = "[log-ingest]";
+var TAG29 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
@@ -11737,7 +12177,7 @@ function isLoopbackAddr(addr) {
 app18.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -11746,7 +12186,7 @@ app18.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -11788,18 +12228,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app19 = new Hono();
 app19.post("/", async (c) => {
-  const TAG35 = "[admin:events]";
+  const TAG38 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG35} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG38} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG35} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG38} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -11822,10 +12262,10 @@ var events_default = app19;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync23 } from "fs";
-import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
-import { realpathSync as realpathSync4 } from "fs";
+import { readdir as readdir3, readFile as readFile5, stat as stat5, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
+import { realpathSync as realpathSync6 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename7, dirname as dirname6, join as join23, resolve as resolve22, sep as sep6 } from "path";
+import { basename as basename8, dirname as dirname6, join as join24, resolve as resolve24, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -12143,7 +12583,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve21, relative as relative2, join as join22, basename as basename6, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve23, relative as relative3, join as join23, basename as basename7, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -12225,7 +12665,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join22(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join23(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -12276,18 +12716,18 @@ async function extractFileContent(absolute) {
     return { content: "", route: "name-only" };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`[file-index] extract-failed path="${relative2(DATA_ROOT, absolute)}" err="${msg}"`);
+    console.error(`[file-index] extract-failed path="${relative3(DATA_ROOT, absolute)}" err="${msg}"`);
     return { content: "", route: "name-only" };
   }
 }
 async function readDisplayName(absolute) {
-  const dir = absolute.slice(0, absolute.length - basename6(absolute).length);
-  const base = basename6(absolute);
+  const dir = absolute.slice(0, absolute.length - basename7(absolute).length);
+  const base = basename7(absolute);
   const dot = base.lastIndexOf(".");
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join22(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join23(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -12301,14 +12741,14 @@ async function walkSubtree(root, dataRoot, out) {
     entries = await fsp.readdir(root, { withFileTypes: true });
   } catch (err) {
     if (err.code === "ENOENT") return { clean: true };
-    console.error(`[file-index] walk-error dir="${relative2(dataRoot, root)}" err="${err.message}"`);
+    console.error(`[file-index] walk-error dir="${relative3(dataRoot, root)}" err="${err.message}"`);
     return { clean: false };
   }
   let clean = true;
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join22(root, entry.name);
+    const abs = join23(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -12317,12 +12757,12 @@ async function walkSubtree(root, dataRoot, out) {
         const st = await fsp.stat(abs);
         out.push({
           absolute: abs,
-          relativePath: relative2(dataRoot, abs).split(sep5).join("/"),
+          relativePath: relative3(dataRoot, abs).split(sep5).join("/"),
           sizeBytes: st.size,
           modifiedAt: st.mtime.toISOString()
         });
       } catch (err) {
-        console.error(`[file-index] stat-error path="${relative2(dataRoot, abs)}" err="${err.message}"`);
+        console.error(`[file-index] stat-error path="${relative3(dataRoot, abs)}" err="${err.message}"`);
         clean = false;
       }
     }
@@ -12420,7 +12860,7 @@ async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths
   return { kds, sections, chunks };
 }
 async function buildArtifact(accountId, wf, embed2) {
-  const name = basename6(wf.absolute);
+  const name = basename7(wf.absolute);
   const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
@@ -12463,7 +12903,7 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve21(dataRoot, "accounts", accountId)
+      resolve23(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -12546,7 +12986,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve21(dataRoot, relativePath);
+  const absolute = resolve23(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -12581,7 +13021,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join23(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile5(join24(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -12592,7 +13032,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve22(DATA_ROOT, "accounts");
+  const accountsDir = resolve24(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir3(accountsDir);
@@ -12601,9 +13041,9 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve22(accountsDir, name, "account.json");
+    const configPath2 = resolve24(accountsDir, name, "account.json");
     try {
-      const raw = await readFile4(configPath2, "utf8");
+      const raw = await readFile5(configPath2, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed?.name === "string" && parsed.name.length > 0) {
         map.set(name, parsed.name);
@@ -12619,7 +13059,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join23(absolute, entry.name), entry.name);
+    const meta = await readMeta(join24(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -12765,7 +13205,7 @@ app20.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   try {
-    const info = await stat4(absolute);
+    const info = await stat5(absolute);
     if (!info.isDirectory()) {
       return c.json({ error: "Path is not a directory \u2014 use /api/admin/files/download for files" }, 400);
     }
@@ -12783,8 +13223,8 @@ app20.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join23(absolute, name);
-        const s = await stat4(entryPath);
+        const entryPath = join24(absolute, name);
+        const s = await stat5(entryPath);
         entries.push({
           name,
           kind: s.isDirectory() ? "directory" : s.isFile() ? "file" : "other",
@@ -12846,11 +13286,11 @@ app20.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   try {
-    const info = await stat4(absolute);
+    const info = await stat5(absolute);
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename7(absolute);
+    const filename = basename8(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -12889,14 +13329,14 @@ app20.post("/upload", requireAdminSession, async (c) => {
     return c.json({ error: "Account not found for session" }, 401);
   }
   const rawName = c.req.query("filename") ?? "";
-  const safeName = basename7(rawName).replace(/[\0/\\]/g, "_");
+  const safeName = basename8(rawName).replace(/[\0/\\]/g, "_");
   if (!safeName) return c.json({ error: "filename query param required" }, 400);
   const uid = `${Date.now()}-${randomUUID10().slice(0, 8)}`;
   const declaredBytes = c.req.header("content-length") ?? "unknown";
   const rawRelpath = c.req.query("relpath") ?? "";
   const relpath = rawRelpath !== "" ? rawRelpath : null;
   const token = c.req.query("token") ?? "";
-  const finalName = relpath ? basename7(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
+  const finalName = relpath ? basename8(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
   const mimeType = (c.req.header("content-type") ?? "").split(";")[0].trim();
   if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
     console.error(`[data-upload] op=reject-mime uid=${uid} mime="${mimeType}" token=${token} rel="${relpath ?? ""}"`);
@@ -12908,7 +13348,7 @@ app20.post("/upload", requireAdminSession, async (c) => {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return c.json({ error: base.error }, base.status);
   const relDir = relpath ? dirname6(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join23(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join24(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
@@ -12917,17 +13357,17 @@ app20.post("/upload", requireAdminSession, async (c) => {
     console.error(`[data] write-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Path is outside your account folder" }, 403);
   }
-  const destDir = relDir === "." ? base.absolute : resolve22(base.absolute, relDir);
-  const destPath = resolve22(destDir, finalName);
+  const destDir = relDir === "." ? base.absolute : resolve24(base.absolute, relDir);
+  const destPath = resolve24(destDir, finalName);
   if (relpath) {
     const firstCreated = await mkdir3(destDir, { recursive: true });
     if (firstCreated) console.error(`[data-upload] op=mkdir uid=${uid} token=${token} dir="${destRel}"`);
   } else {
-    const info = await stat4(destDir).catch(() => null);
+    const info = await stat5(destDir).catch(() => null);
     if (!info || !info.isDirectory()) return c.json({ error: "Upload destination is not a directory" }, 400);
   }
-  const dataRootReal = realpathSync4(DATA_ROOT);
-  const destDirReal = realpathSync4(destDir);
+  const dataRootReal = realpathSync6(DATA_ROOT);
+  const destDirReal = realpathSync6(destDir);
   if (destDirReal !== dataRootReal && !destDirReal.startsWith(dataRootReal + sep6)) {
     console.error(`[data-upload] op=path-traversal-blocked uid=${uid} requested="${destRel}" resolved="${destDirReal}"`);
     return c.json({ error: "Upload destination escapes DATA_ROOT" }, 403);
@@ -12936,9 +13376,9 @@ app20.post("/upload", requireAdminSession, async (c) => {
   if (!body) return c.json({ error: "Empty request body" }, 400);
   console.error(`[data-upload] op=request uid=${uid} account=${accountId} dir="${destRel}" token=${token} rel="${relpath ?? ""}" declaredBytes=${declaredBytes}`);
   const ceiling = dataUploadCeiling();
-  const tmpDir = resolve22(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
+  const tmpDir = resolve24(DATA_ROOT, "accounts", accountId, UPLOAD_TMP_DIR);
   await mkdir3(tmpDir, { recursive: true });
-  const tmpPath = resolve22(tmpDir, `${uid}.part`);
+  const tmpPath = resolve24(tmpDir, `${uid}.part`);
   const out = createWriteStream2(tmpPath);
   const t0 = Date.now();
   let received = 0;
@@ -13020,7 +13460,7 @@ app20.post("/upload", requireAdminSession, async (c) => {
   });
 });
 async function sweepStaleUploadTemps() {
-  const accountsRoot = resolve22(DATA_ROOT, "accounts");
+  const accountsRoot = resolve24(DATA_ROOT, "accounts");
   let accounts;
   try {
     accounts = await readdir3(accountsRoot, { withFileTypes: true });
@@ -13030,7 +13470,7 @@ async function sweepStaleUploadTemps() {
   let removed = 0;
   for (const acc of accounts) {
     if (!acc.isDirectory()) continue;
-    const tmpDir = resolve22(accountsRoot, acc.name, UPLOAD_TMP_DIR);
+    const tmpDir = resolve24(accountsRoot, acc.name, UPLOAD_TMP_DIR);
     let entries;
     try {
       entries = await readdir3(tmpDir);
@@ -13039,7 +13479,7 @@ async function sweepStaleUploadTemps() {
     }
     for (const name of entries) {
       try {
-        await unlink2(resolve22(tmpDir, name));
+        await unlink2(resolve24(tmpDir, name));
         removed++;
       } catch {
       }
@@ -13069,14 +13509,14 @@ app20.delete("/", requireAdminSession, async (c) => {
     console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
-  const base = basename7(absolute);
+  const base = basename8(absolute);
   const protection = isProtectedFromDeletion(relPath);
   if (protection.protected) {
     console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
     return c.json({ error: "Protected file \u2014 refusing to delete" }, 403);
   }
   try {
-    const info = await stat4(absolute);
+    const info = await stat5(absolute);
     if (info.isDirectory()) {
       return c.json({ error: "Directory deletion not supported" }, 400);
     }
@@ -13085,7 +13525,7 @@ app20.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join23(dirname6(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join24(dirname6(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -13142,10 +13582,10 @@ app20.post("/folder", requireAdminSession, async (c) => {
   if (!isValidEntryName(name)) return c.json({ error: "Invalid folder name" }, 400);
   const parent = resolveOwnAccountWrite(rawPath, accountId, "POST /api/admin/files/folder");
   if (!parent.ok) return c.json({ error: parent.error }, parent.status);
-  const newAbs = resolve22(parent.absolute, name);
+  const newAbs = resolve24(parent.absolute, name);
   const newRel = `${parent.relative}/${name}`;
   try {
-    const info = await stat4(parent.absolute);
+    const info = await stat5(parent.absolute);
     if (!info.isDirectory()) return c.json({ error: "Parent is not a directory" }, 400);
     await mkdir3(newAbs, { recursive: false });
   } catch (err) {
@@ -13181,7 +13621,7 @@ app20.post("/rename", requireAdminSession, async (c) => {
     console.error(`[data] file-rename blocked path="${src.relative}" reason="protected"`);
     return c.json({ error: "Protected entry \u2014 refusing to rename" }, 403);
   }
-  const destAbs = resolve22(dirname6(src.absolute), newName);
+  const destAbs = resolve24(dirname6(src.absolute), newName);
   const newRel = `${dirname6(src.relative)}/${newName}`.replace(/^\.\//, "");
   if (isProtectedFromRename(newRel)) {
     console.error(`[data] file-rename blocked path="${newRel}" reason="protected-target"`);
@@ -13190,7 +13630,7 @@ app20.post("/rename", requireAdminSession, async (c) => {
   try {
     let collision = true;
     try {
-      await stat4(destAbs);
+      await stat5(destAbs);
     } catch (e) {
       if (e.code === "ENOENT") collision = false;
     }
@@ -13389,13 +13829,6 @@ function readFlags() {
   };
 }
 var FULLTEXT_INDEX_ADMIN = "entity_search_admin";
-var FULLTEXT_INDEX_PUBLIC = "entity_search_public";
-function pickFulltextIndex(allowedScopes) {
-  return isPublicOnlyScope(allowedScopes) ? FULLTEXT_INDEX_PUBLIC : FULLTEXT_INDEX_ADMIN;
-}
-function isPublicOnlyScope(allowedScopes) {
-  return Array.isArray(allowedScopes) && allowedScopes.length === 1 && allowedScopes[0] === "public";
-}
 function buildScopeAndSliceClause(allowedScopes, sliceToken, alias = "node") {
   const hasSlice = typeof sliceToken === "string" && sliceToken.length > 0;
   const hasScopes = Array.isArray(allowedScopes) && allowedScopes.length > 0;
@@ -13475,7 +13908,7 @@ async function bm25Only(session, params) {
        ORDER BY score DESC
        LIMIT $limit`,
       {
-        indexName: pickFulltextIndex(allowedScopes),
+        indexName: FULLTEXT_INDEX_ADMIN,
         query: escaped,
         accountId,
         limit: int(limit),
@@ -14149,8 +14582,6 @@ var FILTER_TOP_LEVEL_LABELS = Object.freeze(
     "Job",
     "QuoteDocument",
     "InboundInvoice",
-    "SubContractor",
-    "SubInvoice",
     "WhatsAppGroup",
     "AdminConversation",
     "PublicConversation",
@@ -15218,14 +15649,14 @@ var WRITE_CYPHER = `
 var graph_default_view_default = app26;
 
 // server/routes/admin/sidebar-artefacts.ts
-import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve23, relative as relative3, isAbsolute, sep as sep7, basename as basename8 } from "path";
+import { readdir as readdir4, stat as stat6 } from "fs/promises";
+import { resolve as resolve25, relative as relative4, isAbsolute as isAbsolute2, sep as sep7, basename as basename9 } from "path";
 import { existsSync as existsSync24 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
   if (absPath !== DATA_ROOT && !absPath.startsWith(DATA_ROOT + sep7)) return null;
-  return relative3(DATA_ROOT, absPath);
+  return relative4(DATA_ROOT, absPath);
 }
 var app27 = new Hono();
 app27.get("/", requireAdminSession, async (c) => {
@@ -15239,7 +15670,7 @@ app27.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve23(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve25(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -15272,7 +15703,7 @@ async function fetchAccountFileArtefacts(accountId) {
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
         id: `account-file:${relativePath}`,
-        name: displayName ?? basename8(relativePath),
+        name: displayName ?? basename9(relativePath),
         kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
@@ -15291,8 +15722,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve23(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve23(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve25(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve25(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -15305,12 +15736,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve23(accountDir, "specialists", "agents");
-  const bundledDir = resolve23(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve25(accountDir, "specialists", "agents");
+  const bundledDir = resolve25(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve23(overrideDir, filename);
-    const bundledPath = resolve23(bundledDir, filename);
+    const overridePath = resolve25(overrideDir, filename);
+    const bundledPath = resolve25(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -15364,7 +15795,7 @@ async function readAgentTemplateRow(inp) {
   }
   if (!chosenPath) return null;
   try {
-    const st = await stat5(chosenPath);
+    const st = await stat6(chosenPath);
     const dlPath = toDataRootRelPath(chosenPath);
     return {
       id: inp.id,
@@ -15389,8 +15820,8 @@ async function readAgentTemplateRow(inp) {
   }
 }
 function isWithin(target, root) {
-  const rel = relative3(root, target);
-  return !rel.startsWith("..") && !isAbsolute(rel);
+  const rel = relative4(root, target);
+  return !rel.startsWith("..") && !isAbsolute2(rel);
 }
 var sidebar_artefacts_default = app27;
 
@@ -15676,6 +16107,8 @@ function isSelectableModel(id) {
 }
 
 // server/routes/admin/session-reseat.ts
+var RESEAT_PERMISSION_MODES = /* @__PURE__ */ new Set(["default", "acceptEdits", "plan", "auto", "bypassPermissions"]);
+var RESEAT_EFFORT_LEVELS = /* @__PURE__ */ new Set(["low", "medium", "high", "xhigh"]);
 function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticatedName) {
   const sessionId = mintId();
   const key = `session:${sessionId}`;
@@ -15689,6 +16122,8 @@ function resolveReseatPlan(body, mintId = randomUUID12, adminUserId, authenticat
     webchatChannel: webchatChannelDescriptor(key)
   };
   if (body.name) payload.name = body.name;
+  if (body.permissionMode) payload.permissionMode = body.permissionMode;
+  if (body.effort) payload.effort = body.effort;
   if (adminUserId) payload.adminUserId = adminUserId;
   if (authenticatedName) payload.authenticatedName = authenticatedName;
   return { sessionId, payload };
@@ -15706,6 +16141,10 @@ app33.post("/", requireAdminSession, async (c) => {
   const model = typeof body.model === "string" && isSelectableModel(body.model) ? body.model : null;
   if (fromSessionId === null) return c.json({ error: "fromSessionId must be a valid session id" }, 400);
   if (model === null) return c.json({ error: "model must be a selectable model" }, 400);
+  const permissionMode = typeof body.permissionMode === "string" ? RESEAT_PERMISSION_MODES.has(body.permissionMode) ? body.permissionMode : null : void 0;
+  const effort = typeof body.effort === "string" ? RESEAT_EFFORT_LEVELS.has(body.effort) ? body.effort : null : void 0;
+  if (permissionMode === null) return c.json({ error: "permissionMode must be a composer-writable mode" }, 400);
+  if (effort === null) return c.json({ error: "effort must be an accepted level" }, 400);
   if (reseatsInFlight.has(fromSessionId)) {
     return c.json({ error: "re-seat already in progress for this session" }, 409);
   }
@@ -15715,9 +16154,14 @@ app33.post("/", requireAdminSession, async (c) => {
     const adminUserId = cacheKey ? getUserIdForSession(cacheKey) : void 0;
     const accountId = cacheKey ? getAccountIdForSession(cacheKey) : void 0;
     const authenticatedName = accountId ? await resolveAuthenticatedName(accountId, adminUserId) : void 0;
-    const plan = resolveReseatPlan({ fromSessionId, model }, randomUUID12, adminUserId, authenticatedName);
+    const plan = resolveReseatPlan(
+      { fromSessionId, model, ...permissionMode ? { permissionMode } : {}, ...effort ? { effort } : {} },
+      randomUUID12,
+      adminUserId,
+      authenticatedName
+    );
     const reseatReqId = randomUUID12();
-    console.log(`[chat-reseat] op=request reseatReqId=${reseatReqId} from=${fromSessionId} to-model=${model} new=${plan.sessionId}`);
+    console.log(`[chat-reseat] op=request reseatReqId=${reseatReqId} from=${fromSessionId} to-model=${model} to-mode=${permissionMode ?? "none"} to-effort=${effort ?? "none"} new=${plan.sessionId}`);
     let res;
     try {
       res = await fetch(`${managerBase("session-reseat:wrapper")}/rc-spawn`, {
@@ -15769,7 +16213,7 @@ app33.post("/", requireAdminSession, async (c) => {
 var session_reseat_default = app33;
 
 // server/routes/admin/system-stats.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { cpus, loadavg, totalmem, freemem } from "os";
 function parseCpuStat(blob) {
   const line = blob.split("\n", 1)[0] ?? "";
@@ -15813,11 +16257,11 @@ function parseMeminfo(blob) {
 }
 var SAMPLE_DELAY_MS = 100;
 async function sampleLinux() {
-  const a = parseCpuStat(await readFile5("/proc/stat", "utf-8"));
+  const a = parseCpuStat(await readFile6("/proc/stat", "utf-8"));
   await new Promise((r) => setTimeout(r, SAMPLE_DELAY_MS));
-  const b = parseCpuStat(await readFile5("/proc/stat", "utf-8"));
-  const meminfo = parseMeminfo(await readFile5("/proc/meminfo", "utf-8"));
-  const loadavgRaw = (await readFile5("/proc/loadavg", "utf-8")).trim();
+  const b = parseCpuStat(await readFile6("/proc/stat", "utf-8"));
+  const meminfo = parseMeminfo(await readFile6("/proc/meminfo", "utf-8"));
+  const loadavgRaw = (await readFile6("/proc/loadavg", "utf-8")).trim();
   const [l1, l5, l15] = loadavgRaw.split(/\s+/, 3).map(Number);
   if (![l1, l5, l15].every(Number.isFinite)) {
     throw new Error(`malformed /proc/loadavg: ${loadavgRaw}`);
@@ -15890,24 +16334,24 @@ app34.get("/", async (c) => {
 var system_stats_default = app34;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync25, readFileSync as readFileSync24 } from "fs";
-import { resolve as resolve24, join as join24 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+import { existsSync as existsSync25, readFileSync as readFileSync26 } from "fs";
+import { resolve as resolve26, join as join25 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join24(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join25(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync25(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync24(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync26(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve24(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve26(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync25(VERSION_FILE)) return "unknown";
-  return readFileSync24(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync26(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -15959,7 +16403,7 @@ var health_default2 = app35;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID13 } from "crypto";
-var TAG27 = "[linkedin-ingest-route]";
+var TAG30 = "[linkedin-ingest-route]";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -16063,29 +16507,29 @@ app36.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG27 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG30 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG27 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG30 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG27 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG30 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG27 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG30 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID13();
-  console.log(TAG27 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG30 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -16094,12 +16538,12 @@ app36.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG27 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG30 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG27 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG30 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
@@ -16107,7 +16551,7 @@ var linkedin_ingest_default = app36;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG28 = "[post-turn-context]";
+var TAG31 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -16149,7 +16593,7 @@ var app37 = new Hono();
 app37.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -16158,7 +16602,7 @@ app37.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -16190,7 +16634,7 @@ app37.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG28} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG31} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -16199,7 +16643,7 @@ app37.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG28} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG31} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -16210,7 +16654,7 @@ var post_turn_context_default = app37;
 
 // server/routes/admin/public-session-context.ts
 import neo4j4 from "neo4j-driver";
-var TAG29 = "[public-session-context]";
+var TAG32 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -16252,7 +16696,7 @@ var app38 = new Hono();
 app38.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -16261,7 +16705,7 @@ app38.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -16292,7 +16736,7 @@ app38.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG29} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG32} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -16301,7 +16745,7 @@ app38.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG29} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG32} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
@@ -16311,7 +16755,7 @@ app38.get("/", async (c) => {
 var public_session_context_default = app38;
 
 // server/routes/admin/public-session-exit.ts
-var TAG30 = "[public-session-exit-route]";
+var TAG33 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -16319,7 +16763,7 @@ var app39 = new Hono();
 app39.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG33} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -16328,7 +16772,7 @@ app39.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG33} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -16346,7 +16790,7 @@ app39.post("/", async (c) => {
 var public_session_exit_default = app39;
 
 // server/routes/admin/access-session-evict.ts
-var TAG31 = "[access-session-evict]";
+var TAG34 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -16354,7 +16798,7 @@ var app40 = new Hono();
 app40.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG34} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -16363,7 +16807,7 @@ app40.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG34} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -16376,13 +16820,13 @@ app40.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG31} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG34} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
 var access_session_evict_default = app40;
 
 // server/routes/admin/enrol-person.ts
-var TAG32 = "[enrol]";
+var TAG35 = "[enrol]";
 function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -16391,7 +16835,7 @@ var app41 = new Hono();
 app41.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr6(remoteAddr)) {
-    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG35} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "enrol-person-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -16400,7 +16844,7 @@ app41.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr6(t));
     if (offender !== void 0) {
-      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG35} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "enrol-person-loopback-only" }, 403);
     }
   }
@@ -16425,7 +16869,7 @@ app41.post("/", async (c) => {
   }
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG32} op=person result=no-account-id`);
+    console.error(`${TAG35} op=person result=no-account-id`);
     return c.json({ error: "no-account-id" }, 500);
   }
   let personId;
@@ -16433,7 +16877,7 @@ app41.post("/", async (c) => {
     personId = await enrolPerson({ accountId, phone, email, agentSlug });
   } catch (err) {
     console.error(
-      `${TAG32} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG35} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "enrol-failed" }, 500);
   }
@@ -16443,11 +16887,11 @@ app41.post("/", async (c) => {
     if (g) grant = { grantId: g.grantId, status: g.status, contactValue: g.contactValue };
   } catch (err) {
     console.error(
-      `${TAG32} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG35} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
   }
   console.log(
-    `${TAG32} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
+    `${TAG35} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
   );
   return c.json({ personId, grant }, 200);
 });
@@ -16523,7 +16967,7 @@ app43.route("/enrol-person", enrol_person_default);
 var admin_default = app43;
 
 // server/routes/access/verify-token.ts
-var TAG33 = "[access-verify]";
+var TAG36 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
 var app44 = new Hono();
@@ -16542,39 +16986,39 @@ app44.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG36} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG36} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -16590,12 +17034,12 @@ app44.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -16613,9 +17057,9 @@ var verify_token_default = app44;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve25 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
-var SEND_SCRIPT = resolve25(
+import { resolve as resolve27 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve27(process.cwd(), "..");
+var SEND_SCRIPT = resolve27(
   PLATFORM_ROOT7,
   "plugins",
   "email",
@@ -16671,7 +17115,7 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG34 = "[access-request-link]";
+var TAG37 = "[access-request-link]";
 var app45 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
 app45.post("/", async (c) => {
@@ -16688,18 +17132,18 @@ app45.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG37} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG37} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG34} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG37} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -16707,7 +17151,7 @@ app45.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG34} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG37} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -16739,12 +17183,12 @@ app45.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG34} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG37} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG34} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG37} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
@@ -16757,8 +17201,8 @@ app46.route("/request-magic-link", request_magic_link_default);
 var access_default = app46;
 
 // server/routes/sites.ts
-import { existsSync as existsSync26, readFileSync as readFileSync25, realpathSync as realpathSync5, statSync as statSync11 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync27, realpathSync as realpathSync7, statSync as statSync11 } from "fs";
+import { resolve as resolve28 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -16815,19 +17259,19 @@ app47.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve26(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve26(rootDir, ...segments);
+  const rootDir = resolve28(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve28(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat7;
+  let stat8;
   try {
-    stat7 = existsSync26(filePath) ? statSync11(filePath) : null;
+    stat8 = existsSync26(filePath) ? statSync11(filePath) : null;
   } catch {
-    stat7 = null;
+    stat8 = null;
   }
-  if (stat7?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat8?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -16835,8 +17279,8 @@ app47.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat7?.isDirectory()) {
-    filePath = resolve26(filePath, "index.html");
+  if (stat8?.isDirectory()) {
+    filePath = resolve28(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -16849,8 +17293,8 @@ app47.get("/:rel{.*}", (c) => {
   let realPath;
   let realRoot;
   try {
-    realPath = realpathSync5(filePath);
-    realRoot = realpathSync5(rootDir);
+    realPath = realpathSync7(filePath);
+    realRoot = realpathSync7(rootDir);
   } catch {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
@@ -16861,7 +17305,7 @@ app47.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync25(realPath);
+    body = readFileSync27(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -16897,7 +17341,7 @@ var sites_default = app47;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync26, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync28, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname7 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -16906,7 +17350,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync26(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync28(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -16920,7 +17364,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync26(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync28(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -16973,19 +17417,19 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync27, readFileSync as readFileSync27 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync29 } from "fs";
+import { join as join26 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
   if (cachedAttempted) return cached2;
   cachedAttempted = true;
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
-  if (!platformRoot2) return null;
-  const brandPath = join25(platformRoot2, "config", "brand.json");
+  const platformRoot4 = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot4) return null;
+  const brandPath = join26(platformRoot4, "config", "brand.json");
   if (!existsSync27(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync27(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync29(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -17473,19 +17917,19 @@ async function writeEvent(opts) {
 var visitor_event_default = app50;
 
 // server/routes/session.ts
-import { resolve as resolve27 } from "path";
+import { resolve as resolve29 } from "path";
 import { existsSync as existsSync28, writeFileSync as writeFileSync12, mkdirSync as mkdirSync7 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve27(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve29(MAXY_DIR, "branding-cache", accountId);
     mkdirSync7(cacheDir, { recursive: true });
-    writeFileSync12(resolve27(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync12(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
-function parseVisitorCookie(cookieHeader) {
+function parseVisitorCookie2(cookieHeader) {
   if (!cookieHeader) return null;
   const match = cookieHeader.match(/(?:^|;\s*)maxy_visitor=([^;]*)/);
   if (!match) return null;
@@ -17534,7 +17978,7 @@ app51.post("/", async (c) => {
   }
   const account = resolveAccount();
   const cookieHeader = c.req.header("cookie");
-  const visitorId = parseVisitorCookie(cookieHeader);
+  const visitorId = parseVisitorCookie2(cookieHeader);
   const groupSlug = body.group_slug && typeof body.group_slug === "string" ? body.group_slug : null;
   let groupInfo = null;
   if (groupSlug) {
@@ -17568,8 +18012,8 @@ app51.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve27(account.accountDir, "agents", agentSlug);
-    if (!existsSync28(agentDir) || !existsSync28(resolve27(agentDir, "config.json"))) {
+    const agentDir = resolve29(account.accountDir, "agents", agentSlug);
+    if (!existsSync28(agentDir) || !existsSync28(resolve29(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -17849,7 +18293,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve28, sep as sep8 } from "path";
+import { resolve as resolve30, sep as sep8 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -17868,7 +18312,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve28(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve30(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -17889,7 +18333,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve28(dataRoot, relativePath);
+    const absolute = resolve30(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -17913,7 +18357,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve28(dataRoot, rootName);
+    const absRoot = resolve30(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -17952,7 +18396,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname8, relative as relative4, resolve as resolve29 } from "path";
+import { dirname as dirname8, relative as relative5, resolve as resolve31 } from "path";
 var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -17963,7 +18407,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve29(dir, e.name);
+    const abs = resolve31(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -17982,13 +18426,13 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   const files = await walkFiles(srcDir);
   let moved = 0;
   for (const oldAbs of files) {
-    const suffix = relative4(srcDir, oldAbs);
-    const newAbs = resolve29(destDir, suffix);
+    const suffix = relative5(srcDir, oldAbs);
+    const newAbs = resolve31(destDir, suffix);
     await mkdir5(dirname8(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
-    const oldRel = relative4(dataRoot, oldAbs);
-    const newRel = relative4(dataRoot, newAbs);
+    const oldRel = relative5(dataRoot, oldAbs);
+    const newRel = relative5(dataRoot, newAbs);
     let linked = false;
     if (accountId && session) {
       const fa = await session.run(
@@ -18010,7 +18454,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve29(dataRoot, "uploads");
+  const oldRoot = resolve31(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir5(oldRoot, { withFileTypes: true });
@@ -18031,8 +18475,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE3.test(name)) {
         moved += await relocateTree(
-          resolve29(oldRoot, name),
-          resolve29(dataRoot, "accounts", name, "uploads"),
+          resolve31(oldRoot, name),
+          resolve31(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -18044,8 +18488,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve29(oldRoot, "public"),
-          resolve29(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve31(oldRoot, "public"),
+          resolve31(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -18074,9 +18518,9 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
+import { readdir as readdir6, readFile as readFile7, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync29 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -18087,7 +18531,7 @@ var defaultResolveName = async (accountId, userId) => {
 async function readRaw(path2) {
   let raw;
   try {
-    raw = await readFile6(path2, "utf8");
+    raw = await readFile7(path2, "utf8");
   } catch {
     return null;
   }
@@ -18121,7 +18565,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join26(projectsRoot, slug.name);
+    const slugDir = join27(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -18130,9 +18574,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join26(slugDir, entry.name));
+        out.push(join27(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join26(slugDir, entry.name);
+        const subDir = join27(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -18140,7 +18584,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join26(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join27(subDir, s.name));
         }
       }
     }
@@ -18152,7 +18596,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join26(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join27(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -18959,16 +19403,16 @@ var WebchatGateway = class {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve32) => {
+    return new Promise((resolve34) => {
       const timer2 = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve32({ timeout: true });
+        resolve34({ timeout: true });
       }, timeoutMs);
       if (timer2.unref) timer2.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer2);
         this.replyAwaiters.delete(key);
-        resolve32(r);
+        resolve34(r);
       });
     });
   }
@@ -19104,7 +19548,7 @@ var WebchatGateway = class {
 
 // app/lib/webchat/gateway/public-spawn-request.ts
 function buildPublicWebchatSpawnRequest(input) {
-  const { agentSlug, sliceToken, personId, name } = input.public;
+  const { agentSlug, sliceToken, personId, visitorId, name } = input.public;
   return {
     senderId: input.key,
     role: "public",
@@ -19115,6 +19559,7 @@ function buildPublicWebchatSpawnRequest(input) {
     // public agents carry neither (mirrors the bridge's open-mode key).
     ...sliceToken ? { sliceToken } : {},
     ...personId ? { personId } : {},
+    ...visitorId ? { visitorId } : {},
     name,
     webchatChannel: { key: input.key, gatewayUrl: input.gatewayUrl, serverPath: input.serverPath }
   };
@@ -19138,7 +19583,9 @@ function startNativeFileFollower(input) {
     followerRunning: false,
     sliceToken: "",
     personId: null,
-    name: null
+    name: null,
+    // WhatsApp addresses the document to senderId; no separate reply target.
+    replyTarget: null
   };
   const sid = input.senderId.slice(0, 8);
   let lastComposingAt = Number.NEGATIVE_INFINITY;
@@ -19237,8 +19684,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync28, statSync as statSync12 } from "fs";
-import { resolve as resolve30 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync30, statSync as statSync12 } from "fs";
+import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -19273,7 +19720,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve30(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve32(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -19285,12 +19732,12 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve30(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve32(brand.configDir, "entitlement.json");
   if (!existsSync30(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat7 = statSync12(entitlementPath);
-  const key = memoKey(stat7.mtimeMs, account);
+  const stat8 = statSync12(entitlementPath);
+  const key = memoKey(stat8.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
   }
@@ -19301,7 +19748,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync28(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync30(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -19315,7 +19762,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync28(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync30(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -19476,14 +19923,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join27(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join28(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync31(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync29(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync31(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -19502,11 +19949,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join27(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join28(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync31(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync29(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync31(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -19534,7 +19981,7 @@ var app52 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join27(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join28(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -19550,7 +19997,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve31(process.env.MAXY_PLATFORM_ROOT ?? join27(__dirname, ".."))
+      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join28(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -19973,8 +20420,8 @@ app52.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve31(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve31(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve33(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve33(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -19986,7 +20433,7 @@ app52.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync29(filePath);
+  const body = readFileSync31(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -20003,8 +20450,8 @@ app52.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve31(account.accountDir, "generated", filename);
-  const expectedDir = resolve31(account.accountDir, "generated");
+  const filePath = resolve33(account.accountDir, "generated", filename);
+  const expectedDir = resolve33(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -20016,7 +20463,7 @@ app52.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync29(filePath);
+  const body = readFileSync31(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -20031,7 +20478,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync29(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync31(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -20047,11 +20494,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 })}</script>`;
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
-var brandIconFsPath = resolve31(process.cwd(), "public", brandIconPath.replace(/^\//, ""));
+var brandIconFsPath = resolve33(process.cwd(), "public", brandIconPath.replace(/^\//, ""));
 var brandIconExists = existsSync31(brandIconFsPath);
 var SW_SOURCE = (() => {
   try {
-    return readFileSync29(resolve31(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync31(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -20059,9 +20506,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join27(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join28(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync31(versionFile)) return "unknown";
-    const content = readFileSync29(versionFile, "utf-8").trim();
+    const content = readFileSync31(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -20102,7 +20549,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync29(resolve31(process.cwd(), "public", file), "utf-8");
+    html = readFileSync31(resolve33(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -20120,13 +20567,13 @@ ${clientErrorReporterScript}
 }
 var brandedHtmlCache = /* @__PURE__ */ new Map();
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join27(homedir3(), BRAND.configDir);
+  const configDir2 = join28(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join27(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join28(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync31(cachePath)) return null;
-    return JSON.parse(readFileSync29(cachePath, "utf-8"));
+    return JSON.parse(readFileSync31(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -20226,7 +20673,7 @@ app52.use("/vnc-popout.html", logViewerFetch);
 app52.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync29(resolve31(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync31(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -20438,7 +20885,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync29(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync31(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -20490,7 +20937,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename9(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename10(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -20552,7 +20999,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve31(process.env.MAXY_PLATFORM_ROOT ?? join27(__dirname, "..")),
+  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join28(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {