@rubytech/create-maxy-code 0.1.330 → 0.1.332

package/payload/server/server.js

@@ -1293,8 +1293,8 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync31, existsSync as existsSync31, watchFile } from "fs";
-import { resolve as resolve33, join as join28, basename as basename10 } from "path";
+import { readFileSync as readFileSync32, existsSync as existsSync31, watchFile } from "fs";
+import { resolve as resolve33, join as join29, basename as basename10 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1650,7 +1650,7 @@ async function ensureAuth() {
 }
 
 // server/routes/health.ts
-import { existsSync as existsSync3, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync7 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -3297,6 +3297,23 @@ function enumerateValidAccountIds(accountsDir) {
   cache.set(accountsDir, valid);
   return valid;
 }
+function resolveHouseOrSoleAccountId(accountsDir) {
+  const valid = enumerateValidAccountIds(accountsDir);
+  const houses = [];
+  for (const id of valid) {
+    const configPath2 = resolve3(accountsDir, id, "account.json");
+    try {
+      const cfg = JSON.parse(readFileSync4(configPath2, "utf-8"));
+      if (cfg.role === "house") houses.push(id);
+    } catch {
+    }
+  }
+  if (houses.length === 1) return houses[0];
+  if (houses.length === 0 && valid.length === 1) return valid[0];
+  throw new Error(
+    `[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} under ${accountsDir} \u2014 expected exactly one role:"house" (or a single unlabelled account). Loud-fail rather than picking one silently.`
+  );
+}
 function getAccountsDirFromEnv() {
   const root = process.env.MAXY_PLATFORM_ROOT;
   if (!root) {
@@ -3324,26 +3341,39 @@ var cached = null;
 var cachedAccountsDir = null;
 function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
   if (cached !== null && cachedAccountsDir === accountsDir) return cached;
-  const valid = enumerateValidAccountIds(accountsDir);
-  if (valid.length === 0) {
-    throw new Error(
-      `[whatsapp-persist] resolvePlatformAccountId: no platform account found under ${accountsDir} \u2014 corrupt install? Cannot stamp n.accountId without a valid UUID.`
-    );
+  const resolved = resolveHouseOrSoleAccountId(accountsDir);
+  cached = resolved;
+  cachedAccountsDir = accountsDir;
+  return cached;
+}
+
+// app/lib/managed-service.ts
+import { join as join3 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
+  let houseId;
+  try {
+    houseId = resolvePlatformAccountId(accountsDir);
+  } catch {
+    return false;
   }
-  if (valid.length > 1) {
-    throw new Error(
-      `[whatsapp-persist] resolvePlatformAccountId: multiple platform accounts found under ${accountsDir} (${valid.join(", ")}) \u2014 Phase 0 invariant requires exactly one. Loud-fail rather than picking one silently.`
+  try {
+    const cfg = JSON.parse(
+      readFileSync5(join3(accountsDir, houseId, "account.json"), "utf-8")
     );
+    return cfg.managedService === true;
+  } catch {
+    return false;
   }
-  cached = valid[0];
-  cachedAccountsDir = accountsDir;
-  return cached;
+}
+function isCustomerTurnSuppressed(role, managedService) {
+  return managedService === true && role !== "admin";
 }
 
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { writeFile, mkdir } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -3429,7 +3459,7 @@ async function downloadInboundMedia(msg, sock, opts) {
     await mkdir(MEDIA_DIR, { recursive: true });
     const ext = mimeToExt(mimetype ?? "application/octet-stream");
     const filename = `${randomUUID3()}.${ext}`;
-    const filePath = join3(MEDIA_DIR, filename);
+    const filePath = join4(MEDIA_DIR, filename);
     await writeFile(filePath, buffer);
     const sizeKB = (buffer.length / 1024).toFixed(0);
     console.error(`${TAG9} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
@@ -4471,6 +4501,12 @@ async function handleInboundMessage(conn, msg) {
     `${TAG13} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
   );
   if (!accessResult.allowed) return;
+  if (isCustomerTurnSuppressed(accessResult.agentType, isHouseManagedService())) {
+    console.error(
+      `[channel-house] op=inbound from=${senderPhone} accountId=${conn.platformAccountId} autoReply=suppressed`
+    );
+    return;
+  }
   const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
   if (sendReceipts && msg.key.id) {
     sendReadReceipt(conn.sock, remoteJid, [msg.key.id], isGroup ? senderJid : void 0);
@@ -4541,7 +4577,7 @@ async function handleInboundMessage(conn, msg) {
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
-import { mkdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve4 } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
 var VNC_SCRIPT = resolve4(PLATFORM_ROOT3, "scripts/vnc.sh");
@@ -4599,7 +4635,7 @@ function discoverNativeDisplay() {
       const leaderPid = leaderResult.stdout?.trim();
       if (leaderPid) {
         try {
-          const environ = readFileSync5(`/proc/${leaderPid}/environ`, "utf8");
+          const environ = readFileSync6(`/proc/${leaderPid}/environ`, "utf8");
           const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
           if (match) waylandDisplay = match.split("=")[1];
         } catch {
@@ -4859,7 +4895,7 @@ app.get("/", async (c) => {
   let pinConfigured = false;
   try {
     if (existsSync3(USERS_FILE)) {
-      const raw = readFileSync6(USERS_FILE, "utf-8").trim();
+      const raw = readFileSync7(USERS_FILE, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -5117,7 +5153,7 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 var TAG14 = "[voice]";
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
@@ -5161,9 +5197,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join4(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join5(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join4(tempDir, `recording${ext}`);
+    tempPath = join5(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -5240,7 +5276,53 @@ function composePublicSessionTitle(input) {
   return segments.join(" \xB7 ");
 }
 
+// app/lib/webchat/persist-customer-inbound.ts
+var TAG15 = "[channel-house]";
+async function persistCustomerWebchatInbound(input) {
+  if (!input.text) return null;
+  try {
+    const conv = await ensureConversation(
+      input.houseAccountId,
+      "public",
+      input.sessionKey,
+      input.visitorId,
+      input.agentSlug,
+      void 0,
+      "webchat",
+      input.sessionKey
+    );
+    if (!conv.sessionId) {
+      console.error(
+        `${TAG15} op=persist-skip reason=conversation-merge-failed accountId=${input.houseAccountId} key=${input.sessionKey}`
+      );
+      return null;
+    }
+    const messageId = await persistMessage(
+      conv.sessionId,
+      "user",
+      input.text,
+      input.houseAccountId
+    );
+    if (!messageId) {
+      console.error(
+        `${TAG15} op=persist-skip reason=message-write-failed accountId=${input.houseAccountId} sessionId=${conv.sessionId.slice(0, 8)}`
+      );
+      return null;
+    }
+    console.error(
+      `${TAG15} op=persist accountId=${input.houseAccountId} sessionId=${conv.sessionId.slice(0, 8)} messageId=${messageId.slice(0, 8)} bytes=${Buffer.byteLength(input.text, "utf8")}`
+    );
+    return { sessionId: conv.sessionId, messageId };
+  } catch (err) {
+    console.error(
+      `${TAG15} op=persist-fail accountId=${input.houseAccountId} key=${input.sessionKey} reason=${err instanceof Error ? err.message : String(err)}`
+    );
+    return null;
+  }
+}
+
 // server/routes/chat.ts
+var MANAGED_SERVICE_ACK = "Thanks, we've received your message and someone will be in touch shortly.";
 var WEBCHAT_TAG = "[webchat-adaptor]";
 var SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
 function webchatTurnTimeoutMs() {
@@ -5416,6 +5498,38 @@ ${result.result.text}` : result.result.text;
     console.error(
       `${WEBCHAT_TAG} inbound from=${sk} bytes=${Buffer.byteLength(fullMessage, "utf8")} attachments=${attachmentCount} accountId=${account.accountId}`
     );
+    if (isCustomerTurnSuppressed("public", isHouseManagedService())) {
+      if (!isGreeting) {
+        await persistCustomerWebchatInbound({
+          houseAccountId: account.accountId,
+          sessionKey: session_key,
+          text: message,
+          ...agentSlug ? { agentSlug } : {},
+          ...visitorId ? { visitorId } : {}
+        });
+        console.error(
+          `[channel-house] op=inbound from=${sk} accountId=${account.accountId} autoReply=suppressed`
+        );
+      }
+      const ackStream = new ReadableStream({
+        start(controller) {
+          if (!isGreeting) {
+            controller.enqueue(encoder.encode(`data: ${JSON.stringify({ text: MANAGED_SERVICE_ACK })}
+
+`));
+          }
+          controller.enqueue(encoder.encode("data: [DONE]\n\n"));
+          controller.close();
+        }
+      });
+      return new Response(ackStream, {
+        headers: {
+          "Content-Type": "text/event-stream",
+          "Cache-Control": "no-cache",
+          Connection: "keep-alive"
+        }
+      });
+    }
     const readable = new ReadableStream({
       async start(controller) {
         try {
@@ -5483,23 +5597,23 @@ ${result.result.text}` : result.result.text;
 }
 
 // server/routes/whatsapp.ts
-import { join as join7, resolve as resolve9 } from "path";
-import { readdirSync as readdirSync3, readFileSync as readFileSync8, existsSync as existsSync5 } from "fs";
+import { join as join8, resolve as resolve9 } from "path";
+import { readdirSync as readdirSync3, readFileSync as readFileSync9, existsSync as existsSync5 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
-import { resolve as resolve7, join as join5 } from "path";
-var TAG15 = "[whatsapp:config]";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync4, existsSync as existsSync4 } from "fs";
+import { resolve as resolve7, join as join6 } from "path";
+var TAG16 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve7(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
   if (!existsSync4(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync7(path2, "utf-8"));
+  return JSON.parse(readFileSync8(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
   const path2 = configPath(accountDir);
@@ -5509,9 +5623,9 @@ function reloadManagerConfig(accountDir) {
   try {
     const config = readConfig(accountDir);
     reloadConfig(config);
-    console.error(`${TAG15} reloaded manager config`);
+    console.error(`${TAG16} reloaded manager config`);
   } catch (err) {
-    console.error(`${TAG15} manager config reload failed: ${String(err)}`);
+    console.error(`${TAG16} manager config reload failed: ${String(err)}`);
   }
 }
 var E164_PATTERN = /^\+\d{7,15}$/;
@@ -5537,25 +5651,25 @@ function persistAfterPairing(accountDir, accountId, selfPhone) {
       const adminPhones = wa.adminPhones;
       if (!adminPhones.includes(normalized)) {
         adminPhones.push(normalized);
-        console.error(`${TAG15} added selfPhone=${normalized} to adminPhones`);
+        console.error(`${TAG16} added selfPhone=${normalized} to adminPhones`);
       }
     } else {
-      console.error(`${TAG15} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
+      console.error(`${TAG16} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
     }
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG15} validation failed after pairing: ${msg}`);
+      console.error(`${TAG16} validation failed after pairing: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
+    console.error(`${TAG16} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
     reloadManagerConfig(accountDir);
     return { ok: true };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} persist failed account=${accountId}: ${msg}`);
+    console.error(`${TAG16} persist failed account=${accountId}: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5585,12 +5699,12 @@ function addAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} added admin phone=${normalized}`);
+    console.error(`${TAG16} added admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Added ${normalized} as admin phone. Messages from this number will route to the admin agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} addAdminPhone failed: ${msg}`);
+    console.error(`${TAG16} addAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5618,12 +5732,12 @@ function removeAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} removed admin phone=${normalized}`);
+    console.error(`${TAG16} removed admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Removed ${normalized} from admin phones. Messages from this number will now route to the public agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} removeAdminPhone failed: ${msg}`);
+    console.error(`${TAG16} removeAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5643,7 +5757,7 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join5(accountDir, "agents", trimmed, "config.json");
+  const agentConfigPath = join6(accountDir, "agents", trimmed, "config.json");
   if (!existsSync4(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
@@ -5661,12 +5775,12 @@ function setPublicAgent(accountDir, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} publicAgent set to ${trimmed}`);
+    console.error(`${TAG16} publicAgent set to ${trimmed}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Public agent set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} setPublicAgent failed: ${msg}`);
+    console.error(`${TAG16} setPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5707,17 +5821,17 @@ function updateConfig(accountDir, fields) {
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG15} update validation failed: ${msg}`);
+      console.error(`${TAG16} update validation failed: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG15} updated fields=[${fieldNames.join(",")}]`);
+    console.error(`${TAG16} updated fields=[${fieldNames.join(",")}]`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Updated WhatsApp config: ${fieldNames.join(", ")}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG15} updateConfig failed: ${msg}`);
+    console.error(`${TAG16} updateConfig failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -5754,17 +5868,17 @@ function migrateRemovedConfigKeys(accountDir) {
     }
     writeConfig(accountDir, config);
     console.error(
-      `${TAG15} migration: stripped unknown keys=[${result.droppedKeys.join(",")}] from account.json`
+      `${TAG16} migration: stripped unknown keys=[${result.droppedKeys.join(",")}] from account.json`
     );
     return { dropped: result.droppedKeys };
   } catch (err) {
-    console.error(`${TAG15} migration failed: ${String(err)}`);
+    console.error(`${TAG16} migration failed: ${String(err)}`);
     return { dropped: [] };
   }
 }
 
 // app/lib/whatsapp/login.ts
-var TAG16 = "[whatsapp:login]";
+var TAG17 = "[whatsapp:login]";
 function maskPhone(digits) {
   if (digits.length <= 4) return "*".repeat(digits.length);
   return digits.slice(0, 2) + "*".repeat(digits.length - 4) + digits.slice(-2);
@@ -5775,7 +5889,7 @@ function closeSocket(sock) {
   try {
     sock.ws?.close?.();
   } catch (err) {
-    console.warn(`${TAG16} socket close error during cleanup: ${String(err)}`);
+    console.warn(`${TAG17} socket close error during cleanup: ${String(err)}`);
   }
 }
 function resetActiveLogin(accountId) {
@@ -5802,18 +5916,18 @@ async function runPostPairing(login) {
         const masked = selfPhone ? `${selfPhone.slice(0, 4)}***` : "null";
         console.error(`[whatsapp-persist] wa-persist-on-connect account=${login.accountId} phone=${masked}`);
       } else {
-        console.error(`${TAG16} wa-persist-on-connect FAILED account=${login.accountId}: ${result.error}`);
+        console.error(`${TAG17} wa-persist-on-connect FAILED account=${login.accountId}: ${result.error}`);
       }
     } catch (err) {
-      console.error(`${TAG16} wa-persist-on-connect error account=${login.accountId}: ${String(err)}`);
+      console.error(`${TAG17} wa-persist-on-connect error account=${login.accountId}: ${String(err)}`);
     }
   } else {
-    console.error(`${TAG16} wa-persist-on-connect skipped \u2014 no accountDir account=${login.accountId}`);
+    console.error(`${TAG17} wa-persist-on-connect skipped \u2014 no accountDir account=${login.accountId}`);
   }
   try {
     await registerLoginSocket(login.accountId, login.sock, login.authDir);
   } catch (err) {
-    console.error(`${TAG16} registerLoginSocket failed account=${login.accountId}: ${String(err)}`);
+    console.error(`${TAG17} registerLoginSocket failed account=${login.accountId}: ${String(err)}`);
   }
 }
 async function loginConnectionLoop(accountId, login) {
@@ -5825,7 +5939,7 @@ async function loginConnectionLoop(accountId, login) {
       if (current?.id === login.id) {
         await runPostPairing(current);
         current.connected = true;
-        console.error(`${TAG16} loginConnectionLoop: connected account=${accountId} attempt=${attempt} configPersisted=${current.configPersisted}`);
+        console.error(`${TAG17} loginConnectionLoop: connected account=${accountId} attempt=${attempt} configPersisted=${current.configPersisted}`);
       }
       return;
     } catch (err) {
@@ -5835,7 +5949,7 @@ async function loginConnectionLoop(accountId, login) {
       if (!classification.shouldRetry || attempt >= LOGIN_MAX_RECONNECTS) {
         if (attempt >= LOGIN_MAX_RECONNECTS) {
           console.error(
-            `${TAG16} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
+            `${TAG17} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
           );
           current.error = `Login failed after ${attempt} reconnect attempts: ${formatError(err)}`;
         } else {
@@ -5847,7 +5961,7 @@ async function loginConnectionLoop(accountId, login) {
       attempt++;
       const delay = LOGIN_RECONNECT_DELAYS[attempt - 1] ?? 8e3;
       console.error(
-        `${TAG16} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
+        `${TAG17} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
       );
       closeSocket(current.sock);
       await new Promise((r) => setTimeout(r, delay));
@@ -5858,7 +5972,7 @@ async function loginConnectionLoop(accountId, login) {
         current.sock = newSock;
       } catch (sockErr) {
         console.error(
-          `${TAG16} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
+          `${TAG17} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
         );
         current.error = `Reconnection failed: ${String(sockErr)}`;
         return;
@@ -5872,7 +5986,7 @@ async function startLogin(opts) {
   const hasAuth = await authExists(authDir);
   const selfId = readSelfId(authDir);
   console.error(
-    `${TAG16} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasCode=${!!existing0.pairingCode}}` : " activeLogin=none")
+    `${TAG17} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasCode=${!!existing0.pairingCode}}` : " activeLogin=none")
   );
   if (hasAuth && !force) {
     const who = selfId.e164 ?? selfId.jid ?? "unknown";
@@ -5887,7 +6001,7 @@ async function startLogin(opts) {
   }
   const existing = activeLogins.get(accountId);
   if (existing && isLoginFresh(existing) && existing.pairingCode && !force) {
-    console.error(`${TAG16} startLogin account=${accountId} guard: returning existing pairing code (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
+    console.error(`${TAG17} startLogin account=${accountId} guard: returning existing pairing code (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
     return {
       pairingCode: existing.pairingCode,
       phone: existing.phone,
@@ -5895,7 +6009,7 @@ async function startLogin(opts) {
     };
   }
   if (existing) {
-    console.error(`${TAG16} startLogin account=${accountId} ${force ? "force override" : "stale/no-code"}, resetting active login`);
+    console.error(`${TAG17} startLogin account=${accountId} ${force ? "force override" : "stale/no-code"}, resetting active login`);
   }
   resetActiveLogin(accountId);
   await clearAuth(authDir);
@@ -5925,7 +6039,7 @@ async function startLogin(opts) {
           const current = activeLogins.get(accountId);
           if (current?.id !== login.id) return;
           if (!current.pairingCode) current.pairingCode = code;
-          console.error(`${TAG16} pairing-code-issued account=${accountId} phone=${maskPhone(digits)} codeLen=${code.length}`);
+          console.error(`${TAG17} pairing-code-issued account=${accountId} phone=${maskPhone(digits)} codeLen=${code.length}`);
           resolveCode?.(code);
         }).catch((err) => {
           clearTimeout(codeTimer);
@@ -5954,7 +6068,7 @@ async function startLogin(opts) {
   const ttlTimer = setTimeout(() => {
     const current = activeLogins.get(accountId);
     if (current?.id === login.id && !current.connected) {
-      console.error(`${TAG16} pairing-window-elapsed account=${accountId} (ttl sweep)`);
+      console.error(`${TAG17} pairing-window-elapsed account=${accountId} (ttl sweep)`);
       resetActiveLogin(accountId);
     }
   }, ACTIVE_LOGIN_TTL_MS);
@@ -5962,7 +6076,7 @@ async function startLogin(opts) {
     ttlTimer.unref();
   }
   loginConnectionLoop(accountId, login).catch((err) => {
-    console.error(`${TAG16} loginConnectionLoop unexpected error: ${String(err)}`);
+    console.error(`${TAG17} loginConnectionLoop unexpected error: ${String(err)}`);
     const current = activeLogins.get(accountId);
     if (current?.id === login.id) {
       current.error = `Unexpected login error: ${String(err)}`;
@@ -5987,13 +6101,13 @@ async function waitForLogin(opts) {
   const { accountId, timeoutMs = 6e4 } = opts;
   const login = activeLogins.get(accountId);
   console.error(
-    `${TAG16} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasCode=${!!login.pairingCode}}` : " login=none")
+    `${TAG17} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasCode=${!!login.pairingCode}}` : " login=none")
   );
   if (!login) {
     return { connected: false, message: "No active WhatsApp login in progress.", configPersisted: false };
   }
   if (!isLoginFresh(login)) {
-    console.error(`${TAG16} pairing-window-elapsed account=${accountId}`);
+    console.error(`${TAG17} pairing-window-elapsed account=${accountId}`);
     resetActiveLogin(accountId);
     return { connected: false, message: "The pairing window expired. Ask me to generate a new code.", configPersisted: false };
   }
@@ -6001,8 +6115,8 @@ async function waitForLogin(opts) {
   while (Date.now() < deadline) {
     if (login.connected) {
       const selfId = readSelfId(login.authDir);
-      console.error(`${TAG16} pairing-connected account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
-      console.error(`${TAG16} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"} configPersisted=${login.configPersisted}`);
+      console.error(`${TAG17} pairing-connected account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
+      console.error(`${TAG17} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"} configPersisted=${login.configPersisted}`);
       const configPersisted = login.configPersisted;
       activeLogins.delete(accountId);
       return {
@@ -6020,7 +6134,7 @@ async function waitForLogin(opts) {
     await new Promise((r) => setTimeout(r, 1e3));
   }
   const elapsed = Math.round((Date.now() - (deadline - timeoutMs)) / 1e3);
-  console.error(`${TAG16} waitForLogin poll timeout account=${accountId} elapsed=${elapsed}s \u2014 login kept alive (pairing code still valid)`);
+  console.error(`${TAG17} waitForLogin poll timeout account=${accountId} elapsed=${elapsed}s \u2014 login kept alive (pairing code still valid)`);
   return { connected: false, message: "Still waiting for you to enter the pairing code. The code is still valid \u2014 ask me to keep waiting, or request a new code.", configPersisted: false };
 }
 
@@ -6028,7 +6142,7 @@ async function waitForLogin(opts) {
 import { realpathSync as realpathSync3 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
 import { resolve as resolve8, basename } from "path";
-var TAG17 = "[whatsapp:outbound]";
+var TAG18 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
 var lastRouteDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -6062,16 +6176,16 @@ async function sendWhatsAppDocument(input) {
     const accountResolved = realpathSync3(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
       const sanitised = filePath.replace(accountDir, "<account>/");
-      console.error(`${TAG17} document REJECTED path=${sanitised} reason=outside_account_directory`);
+      console.error(`${TAG18} document REJECTED path=${sanitised} reason=outside_account_directory`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG17} document ENOENT path=${filePath}`);
+      console.error(`${TAG18} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG17} document path error: ${String(err)}`);
+    console.error(`${TAG18} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat2(resolvedPath);
@@ -6086,7 +6200,7 @@ async function sendWhatsAppDocument(input) {
   const jid = normalizeJid2(to);
   const sock = getSocket(accountId);
   if (!sock) {
-    console.error(`${TAG17} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=false reason=not-connected`);
+    console.error(`${TAG18} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=false reason=not-connected`);
     return { ok: false, status: 503, error: `WhatsApp account "${accountId}" is not connected` };
   }
   const buffer = Buffer.from(await readFile(resolvedPath));
@@ -6098,7 +6212,7 @@ async function sendWhatsAppDocument(input) {
     { accountId }
   );
   console.error(
-    `${TAG17} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
+    `${TAG18} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
   );
   if (result.success) {
     recordDocumentOutbound(to);
@@ -6217,11 +6331,11 @@ function serializeWhatsAppSchema() {
 
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync2 } from "fs";
-import { join as join6 } from "path";
-var TAG18 = "[whatsapp:reconcile]";
+import { join as join7 } from "path";
+var TAG19 = "[whatsapp:reconcile]";
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync2(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join6(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync2(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join7(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -6236,18 +6350,18 @@ function reconcileCredsOnDisk(opts) {
   const entries = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
-    const authDir = join6(credsRoot, accountId);
+    const authDir = join7(credsRoot, accountId);
     const selfPhone = readSelfId(authDir).e164 ?? void 0;
     const configured = accountDir ? isAccountConfigured(accountDir, accountId) : false;
     console.error(
-      `${TAG18} wa-link-unconfigured account=${accountId} creds=present config=${configured ? "present" : "absent"}`
+      `${TAG19} wa-link-unconfigured account=${accountId} creds=present config=${configured ? "present" : "absent"}`
     );
     if (!configured && accountDir) {
       const result = persistAfterPairing(accountDir, accountId, selfPhone ?? null);
       if (result.ok) {
-        console.error(`${TAG18} self-healed account=${accountId}`);
+        console.error(`${TAG19} self-healed account=${accountId}`);
       } else {
-        console.error(`${TAG18} self-heal FAILED account=${accountId}: ${result.error}`);
+        console.error(`${TAG19} self-heal FAILED account=${accountId}: ${result.error}`);
       }
     }
     entries.push({ accountId, selfPhone, connected: false, linkedUnconfigured: !configured });
@@ -6256,22 +6370,22 @@ function reconcileCredsOnDisk(opts) {
 }
 
 // server/routes/whatsapp.ts
-var TAG19 = "[whatsapp:api]";
+var TAG20 = "[whatsapp:api]";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
 var app2 = new Hono();
 app2.get("/status", (c) => {
   try {
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
-    const credsRoot = join7(MAXY_DIR, "credentials", "whatsapp");
+    const credsRoot = join8(MAXY_DIR, "credentials", "whatsapp");
     const accountDir = resolveAccount()?.accountDir ?? null;
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds });
     const accounts = [...live, ...reconciled];
     const summary = accounts.map((a) => `${a.accountId}:${a.connected ? "up" : a.linkedUnconfigured ? "linked-unconfigured" : "down"}`).join(", ");
-    console.error(`${TAG19} status accounts=${accounts.length} [${summary}]`);
+    console.error(`${TAG20} status accounts=${accounts.length} [${summary}]`);
     return c.json({ accounts });
   } catch (err) {
-    console.error(`${TAG19} status error: ${String(err)}`);
+    console.error(`${TAG20} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6284,13 +6398,13 @@ app2.post("/login/start", async (c) => {
     if (!phone) {
       return c.json({ error: 'Missing required field "phone" (E.164, e.g. +441234567890).' }, 400);
     }
-    const authDir = join7(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join8(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
-    console.error(`${TAG19} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
+    console.error(`${TAG20} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG19} login/start error: ${String(err)}`);
+    console.error(`${TAG20} login/start error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6300,7 +6414,7 @@ app2.post("/login/wait", async (c) => {
     const accountId = validateAccountId(body.accountId);
     const timeoutMs = body.timeoutMs ?? 6e4;
     const result = await waitForLogin({ accountId, timeoutMs });
-    console.error(`${TAG19} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${result.configPersisted}`);
+    console.error(`${TAG20} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${result.configPersisted}`);
     return c.json({
       connected: result.connected,
       message: result.message,
@@ -6308,7 +6422,7 @@ app2.post("/login/wait", async (c) => {
       configPersisted: result.configPersisted
     });
   } catch (err) {
-    console.error(`${TAG19} login/wait error: ${String(err)}`);
+    console.error(`${TAG20} login/wait error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6319,7 +6433,7 @@ app2.post("/disconnect", async (c) => {
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
   } catch (err) {
-    console.error(`${TAG19} disconnect error: ${String(err)}`);
+    console.error(`${TAG20} disconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6330,7 +6444,7 @@ app2.post("/reconnect", async (c) => {
     await startConnection(accountId);
     return c.json({ reconnecting: true, accountId });
   } catch (err) {
-    console.error(`${TAG19} reconnect error: ${String(err)}`);
+    console.error(`${TAG20} reconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6351,7 +6465,7 @@ app2.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG19} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG20} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -6359,12 +6473,12 @@ app2.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone".' }, 400);
         }
         const result = removeAdminPhone(account.accountDir, phone);
-        console.error(`${TAG19} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG20} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-admin-phones": {
         const phones = readAdminPhones(account.accountDir);
-        console.error(`${TAG19} config action=list-admin-phones count=${phones.length}`);
+        console.error(`${TAG20} config action=list-admin-phones count=${phones.length}`);
         return c.json({ ok: true, phones });
       }
       case "set-public-agent": {
@@ -6372,13 +6486,13 @@ app2.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
         }
         const result = setPublicAgent(account.accountDir, slug);
-        console.error(`${TAG19} config action=set-public-agent slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG20} config action=set-public-agent slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-public-agent": {
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount });
-        console.error(`${TAG19} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
+        console.error(`${TAG20} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
@@ -6392,29 +6506,29 @@ app2.post("/config", async (c) => {
               const configPath2 = resolve9(agentsDir, entry.name, "config.json");
               if (!existsSync5(configPath2)) continue;
               try {
-                const config = JSON.parse(readFileSync8(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync9(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
-                console.error(`${TAG19} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+                console.error(`${TAG20} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
               }
             }
           } catch (err) {
-            console.error(`${TAG19} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
+            console.error(`${TAG20} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
           }
         }
-        console.error(`${TAG19} config action=list-public-agents count=${agents.length}`);
+        console.error(`${TAG20} config action=list-public-agents count=${agents.length}`);
         return c.json({ ok: true, agents });
       }
       case "schema": {
         const text = serializeWhatsAppSchema();
-        console.error(`${TAG19} config action=schema`);
+        console.error(`${TAG20} config action=schema`);
         return c.json({ ok: true, text });
       }
       case "list-groups": {
         const groupAccountId = accountId ?? "default";
         const sock = getSocket(groupAccountId);
         if (!sock) {
-          console.error(`${TAG19} config action=list-groups error="not connected" accountId=${groupAccountId}`);
+          console.error(`${TAG20} config action=list-groups error="not connected" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `WhatsApp account "${groupAccountId}" is not connected. Connect first, then retry.` });
         }
         try {
@@ -6424,10 +6538,10 @@ app2.post("/config", async (c) => {
             name: g.subject ?? g.id,
             participantCount: Array.isArray(g.participants) ? g.participants.length : 0
           }));
-          console.error(`${TAG19} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
+          console.error(`${TAG20} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
           return c.json({ ok: true, groups });
         } catch (err) {
-          console.error(`${TAG19} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
+          console.error(`${TAG20} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `Failed to fetch groups: ${String(err)}` });
         }
       }
@@ -6437,12 +6551,12 @@ app2.post("/config", async (c) => {
         }
         const result = updateConfig(account.accountDir, fields);
         const fieldNames = Object.keys(fields);
-        console.error(`${TAG19} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
+        console.error(`${TAG20} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-config": {
         const waConfig = getConfig(account.accountDir);
-        console.error(`${TAG19} config action=get-config`);
+        console.error(`${TAG20} config action=get-config`);
         return c.json({ ok: true, config: waConfig });
       }
       default:
@@ -6452,7 +6566,7 @@ app2.post("/config", async (c) => {
         );
     }
   } catch (err) {
-    console.error(`${TAG19} config error: ${String(err)}`);
+    console.error(`${TAG20} config error: ${String(err)}`);
     return c.json({ ok: false, error: String(err) }, 500);
   }
 });
@@ -6473,7 +6587,7 @@ app2.post("/send-document", async (c) => {
     recordRouteDocumentOutbound(to, filePath);
     return c.json({ success: true, messageId: result.messageId });
   } catch (err) {
-    console.error(`${TAG19} send-document error: ${String(err)}`);
+    console.error(`${TAG20} send-document error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6483,11 +6597,11 @@ app2.get("/activity", (c) => {
     const result = getChannelActivity(accountId);
     const total = result.accounts.reduce((sum, a) => sum + a.total, 0);
     console.error(
-      `${TAG19} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
+      `${TAG20} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
     );
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG19} activity error: ${String(err)}`);
+    console.error(`${TAG20} activity error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6506,10 +6620,10 @@ app2.get("/conversations", (c) => {
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG19} conversations account=${accountId} count=${conversations.length}`);
+    console.error(`${TAG20} conversations account=${accountId} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
-    console.error(`${TAG19} conversations error: ${String(err)}`);
+    console.error(`${TAG20} conversations error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6524,10 +6638,10 @@ app2.get("/messages", (c) => {
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
     const messages = getMessages(accountId, jid, effectiveLimit);
-    console.error(`${TAG19} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    console.error(`${TAG20} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
     return c.json({ messages });
   } catch (err) {
-    console.error(`${TAG19} messages error: ${String(err)}`);
+    console.error(`${TAG20} messages error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6608,7 +6722,7 @@ app2.get("/conversation-graph-state", async (c) => {
       }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      console.error(`${TAG19} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
+      console.error(`${TAG20} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
       return c.json({ error: `Graph query failed: ${msg}`, cacheKey, cypher: cypher.trim() }, 500);
     }
     const ms = Date.now() - t0;
@@ -6621,7 +6735,7 @@ app2.get("/conversation-graph-state", async (c) => {
       ms
     });
   } catch (err) {
-    console.error(`${TAG19} conversation-graph-state error: ${String(err)}`);
+    console.error(`${TAG20} conversation-graph-state error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6633,12 +6747,12 @@ app2.get("/group-info", async (c) => {
       return c.json({ error: "Missing required parameter: jid" }, 400);
     }
     if (!isGroupJid(jid)) {
-      console.error(`${TAG19} group-info error="not a group JID" jid=${jid} account=${accountId}`);
+      console.error(`${TAG20} group-info error="not a group JID" jid=${jid} account=${accountId}`);
       return c.json({ error: `"${jid}" is not a group JID. Group JIDs end with @g.us.` }, 400);
     }
     const sock = getSocket(accountId);
     if (!sock) {
-      console.error(`${TAG19} group-info error="not connected" account=${accountId}`);
+      console.error(`${TAG20} group-info error="not connected" account=${accountId}`);
       return c.json({ error: `WhatsApp account "${accountId}" is not connected. Connect first, then retry.` }, 400);
     }
     const meta = await sock.groupMetadata(jid);
@@ -6651,22 +6765,22 @@ app2.get("/group-info", async (c) => {
       participantCount: meta.participants.length,
       participants: meta.participants.map((p) => ({ jid: p.id, admin: p.admin ?? null }))
     };
-    console.error(`${TAG19} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
+    console.error(`${TAG20} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG19} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
+    console.error(`${TAG20} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
     return c.json({ error: `Failed to fetch group info: ${String(err)}` }, 500);
   }
 });
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync12, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync7 } from "fs";
-import { basename as basename2, dirname, isAbsolute, join as join11, relative as relative2, resolve as resolve11, sep as sep3 } from "path";
+import { readFileSync as readFileSync13, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync7, readdirSync as readdirSync7 } from "fs";
+import { basename as basename2, dirname, isAbsolute, join as join12, relative as relative2, resolve as resolve11, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync2 } from "fs";
-import { join as join8, resolve as resolve10 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync10, statSync as statSync2 } from "fs";
+import { join as join9, resolve as resolve10 } from "path";
 
 // app/lib/whatsapp-reader/select-sessions.ts
 function isReaderChannelSession(role, channel) {
@@ -6725,7 +6839,7 @@ function enumerateJsonls(projectsRoot) {
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join8(projectsRoot, slug);
+    const slugDir = join9(projectsRoot, slug);
     let entries;
     try {
       entries = readdirSync4(slugDir, { withFileTypes: true });
@@ -6736,9 +6850,9 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join8(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join9(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join8(slugDir, entry.name);
+        const subDir = join9(slugDir, entry.name);
         let subEntries;
         try {
           subEntries = readdirSync4(subDir, { withFileTypes: true });
@@ -6749,11 +6863,11 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join8(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join9(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join8(slugDir, entry.name);
+        const archiveDir = join9(slugDir, entry.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync4(archiveDir, { withFileTypes: true });
@@ -6764,7 +6878,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join8(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join9(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -6797,10 +6911,10 @@ async function fetchLiveSessions() {
 function loadUserTitles(accountDir) {
   const out = /* @__PURE__ */ new Map();
   if (!accountDir) return out;
-  const path2 = join8(accountDir, "session-titles.json");
+  const path2 = join9(accountDir, "session-titles.json");
   let raw;
   try {
-    raw = readFileSync9(path2, "utf8");
+    raw = readFileSync10(path2, "utf8");
   } catch {
     return out;
   }
@@ -6823,10 +6937,10 @@ function loadUserTitles(accountDir) {
   return out;
 }
 function readSidecarMeta(metaPath) {
-  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null };
+  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null, accountId: null };
   let raw;
   try {
-    raw = readFileSync9(metaPath, "utf8");
+    raw = readFileSync10(metaPath, "utf8");
   } catch {
     return empty;
   }
@@ -6848,7 +6962,8 @@ function readSidecarMeta(metaPath) {
     personId: typeof r.personId === "string" ? r.personId : null,
     adminUserId: typeof r.adminUserId === "string" ? r.adminUserId : null,
     visitorId: typeof r.visitorId === "string" ? r.visitorId : null,
-    agentSlug: typeof r.agentSlug === "string" ? r.agentSlug : null
+    agentSlug: typeof r.agentSlug === "string" ? r.agentSlug : null,
+    accountId: typeof r.accountId === "string" ? r.accountId : null
   };
 }
 function startsWithCliMarker(s) {
@@ -6915,12 +7030,33 @@ function resolveTitle(body, sessionId, userTitles) {
 }
 app3.get("/", requireAdminSession, async (c) => {
   const accountId = process.env.ACCOUNT_ID ?? null;
+  const switcherUserId = (() => {
+    const cacheKey = c.get("cacheKey");
+    return cacheKey ? getUserIdForSession(cacheKey) : void 0;
+  })();
+  const accounts = [];
+  if (switcherUserId) {
+    for (const a of resolveUserAccounts(switcherUserId)) {
+      let businessName = null;
+      try {
+        const branding = await fetchBranding(a.accountId);
+        businessName = branding?.name || null;
+      } catch {
+      }
+      accounts.push({
+        accountId: a.accountId,
+        role: a.config.role ?? "",
+        businessName,
+        isHouse: a.config.role === "house"
+      });
+    }
+  }
   const configDir2 = claudeConfigDir();
   if (!configDir2) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
-    return c.json({ sessions: [], accountId });
+    return c.json({ sessions: [], accountId, accounts });
   }
-  const projectsRoot = join8(configDir2, "projects");
+  const projectsRoot = join9(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
   const accountDir = accountId ? resolve10(ACCOUNTS_DIR, accountId) : null;
@@ -6947,7 +7083,7 @@ app3.get("/", requireAdminSession, async (c) => {
     let body;
     let mtimeMs;
     try {
-      body = readFileSync9(path2, "utf8");
+      body = readFileSync10(path2, "utf8");
       mtimeMs = statSync2(path2).mtimeMs;
     } catch {
       continue;
@@ -6956,8 +7092,8 @@ app3.get("/", requireAdminSession, async (c) => {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join8(projectDir, `${sessionId}.meta.json`);
-    const { bridgeIds, role, channel: sidecarChannel, personId, adminUserId } = readSidecarMeta(metaPath);
+    const metaPath = join9(projectDir, `${sessionId}.meta.json`);
+    const { bridgeIds, role, channel: sidecarChannel, personId, adminUserId, accountId: rowAccountId } = readSidecarMeta(metaPath);
     if (isReaderChannelSession(role, sidecarChannel)) {
       excludedChannelCount += 1;
       continue;
@@ -6979,7 +7115,8 @@ app3.get("/", requireAdminSession, async (c) => {
       archived,
       channel: resolved.channel,
       personName: null,
-      model: lastAssistantModel(body)
+      model: lastAssistantModel(body),
+      accountId: rowAccountId
     });
     if (live) liveCount += 1;
     if (isSubagent) subagentCount += 1;
@@ -7015,20 +7152,20 @@ app3.get("/", requireAdminSession, async (c) => {
   console.log(
     `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} archived=${archivedCount} excludedChannel=${excludedChannelCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} personNames=${personNameCount} adminNames=${adminNameCount} accountId=${accountId ? accountId.slice(0, 8) : "unset"}`
   );
-  return c.json({ sessions: rows, accountId });
+  return c.json({ sessions: rows, accountId, accounts });
 });
 var sidebar_sessions_default = app3;
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync6, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync3 } from "fs";
+import { join as join10 } from "path";
 function hashPin(pin) {
   return createHash("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
   if (!existsSync6(usersFilePath)) return null;
-  const raw = readFileSync10(usersFilePath, "utf-8").trim();
+  const raw = readFileSync11(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -7056,16 +7193,16 @@ function scanForOrphanedAccountAdmins(users, accountsDir) {
   }
   for (const entry of entries) {
     if (entry.startsWith(".")) continue;
-    const accountDir = join9(accountsDir, entry);
+    const accountDir = join10(accountsDir, entry);
     try {
       if (!statSync3(accountDir).isDirectory()) continue;
     } catch {
       continue;
     }
-    const accountJsonPath = join9(accountDir, "account.json");
+    const accountJsonPath = join10(accountDir, "account.json");
     if (!existsSync6(accountJsonPath)) continue;
     try {
-      const config = JSON.parse(readFileSync10(accountJsonPath, "utf-8"));
+      const config = JSON.parse(readFileSync11(accountJsonPath, "utf-8"));
       const admins = config.admins ?? [];
       for (const a of admins) {
         if (typeof a.userId === "string" && !known.has(a.userId)) orphans.push(a.userId);
@@ -7321,8 +7458,8 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync11, readdirSync as readdirSync6 } from "fs";
-import { join as join10 } from "path";
+import { readFileSync as readFileSync12, readdirSync as readdirSync6 } from "fs";
+import { join as join11 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -7335,7 +7472,7 @@ function adminAttachmentIds(text) {
 function adminAttachmentsFromText(text, uploadsBase) {
   const out = [];
   for (const id of adminAttachmentIds(text)) {
-    const meta = readAttachmentMeta(join10(uploadsBase, id));
+    const meta = readAttachmentMeta(join11(uploadsBase, id));
     if (meta) out.push(meta);
   }
   return out;
@@ -7343,7 +7480,7 @@ function adminAttachmentsFromText(text, uploadsBase) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync11(join10(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync12(join11(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -7372,7 +7509,7 @@ function listSessionAttachmentsInDir(dir) {
   }
   const sidecars = [];
   for (const name of entries) {
-    const sidecar = readSidecar(join10(dir, name), name);
+    const sidecar = readSidecar(join11(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
   sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
@@ -7407,17 +7544,17 @@ var app4 = new Hono();
 app4.get("/conversations", requireAdminSession, async (c) => {
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join11(cfg, "projects");
+  const projectsRoot = join12(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename2(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname(path2);
-    const meta = readSidecarMeta(join11(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join12(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     let body = "";
     try {
-      body = readFileSync12(path2, "utf8");
+      body = readFileSync13(path2, "utf8");
     } catch {
     }
     const { title } = resolveTitle(body, sessionId, userTitles);
@@ -7521,11 +7658,11 @@ app4.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve11(join11(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve11(join12(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve11(join11(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve11(join12(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep3)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -7638,7 +7775,7 @@ app4.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync4(join11(dir, name)).size;
+      len = statSync4(join12(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -7653,11 +7790,11 @@ app4.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path2 = resolve11(join11(dir, name));
+  const path2 = resolve11(join12(dir, name));
   if (!path2.startsWith(dir + sep3)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
-    body = readFileSync12(path2, "utf8");
+    body = readFileSync13(path2, "utf8");
   } catch {
     return c.json({ error: "not found" }, 404);
   }
@@ -7666,8 +7803,8 @@ app4.get("/directive", requireAdminSession, (c) => {
 var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
-import { statSync as statSync5, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync13, readdirSync as readdirSync8 } from "fs";
-import { basename as basename3, dirname as dirname2, join as join12, resolve as resolve12, sep as sep4 } from "path";
+import { statSync as statSync5, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync14, readdirSync as readdirSync8 } from "fs";
+import { basename as basename3, dirname as dirname2, join as join13, resolve as resolve12, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -7714,7 +7851,7 @@ function resolveOpenVisitorSession(rows, visitorId, agentSlug) {
 
 // server/routes/public-reader.ts
 var app5 = new Hono();
-var TAG20 = "[public-webchat]";
+var TAG21 = "[public-webchat]";
 function parseAccessSessionId(cookieHeader) {
   if (!cookieHeader) return null;
   const part = cookieHeader.split(";").map((p) => p.trim()).find((p) => p.startsWith("__access_session="));
@@ -7741,10 +7878,10 @@ function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path2 } of enumerateJsonls(join12(cfg, "projects"))) {
+  for (const { path: path2 } of enumerateJsonls(join13(cfg, "projects"))) {
     const sessionId = basename3(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname2(path2);
-    const meta = readSidecarMeta(join12(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join13(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -7762,7 +7899,7 @@ function enumeratePublicRows() {
 app5.get("/session", (c) => {
   const visitor = resolveVisitor(c);
   if (!visitor) {
-    console.error(`${TAG20} op=reader-refused reason=no-anchor path=/session`);
+    console.error(`${TAG21} op=reader-refused reason=no-anchor path=/session`);
     return c.json({ error: "gate-required" }, 401);
   }
   const rows = enumeratePublicRows();
@@ -7781,11 +7918,11 @@ app5.get("/session", (c) => {
     found = effectiveSlug ? resolveOpenVisitorSession(rows, visitor.visitorId, effectiveSlug) : null;
   }
   if (found) {
-    console.log(`${TAG20} op=session-resume anchor=${visitor.kind} key=${(found.senderId ?? "").slice(0, 8)} sessionId=${found.sessionId.slice(0, 8)}`);
+    console.log(`${TAG21} op=session-resume anchor=${visitor.kind} key=${(found.senderId ?? "").slice(0, 8)} sessionId=${found.sessionId.slice(0, 8)}`);
     return c.json({ sessionId: found.sessionId, projectDir: found.projectDir, sessionKey: found.senderId });
   }
   const sessionKey = crypto.randomUUID();
-  console.log(`${TAG20} op=session-new anchor=${visitor.kind} key=${sessionKey.slice(0, 8)}`);
+  console.log(`${TAG21} op=session-new anchor=${visitor.kind} key=${sessionKey.slice(0, 8)}`);
   return c.json({ sessionId: null, projectDir: null, sessionKey });
 });
 function publicUploadsDir(accountId, sessionId) {
@@ -7814,30 +7951,30 @@ function readFrom2(path2, from) {
 app5.get("/stream", (c) => {
   const visitor = resolveVisitor(c);
   if (!visitor) {
-    console.error(`${TAG20} op=reader-refused reason=no-anchor path=/stream`);
+    console.error(`${TAG21} op=reader-refused reason=no-anchor path=/stream`);
     return c.json({ error: "gate-required" }, 401);
   }
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve12(join12(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve12(join13(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve12(join12(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve12(join13(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep4)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join12(projectDir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join13(projectDir, `${sessionId}.meta.json`));
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
-    console.error(`${TAG20} op=reader-refused reason=not-owner anchor=${visitor.kind} sessionId=${sessionId.slice(0, 8)}`);
+    console.error(`${TAG21} op=reader-refused reason=not-owner anchor=${visitor.kind} sessionId=${sessionId.slice(0, 8)}`);
     return c.json({ error: "forbidden" }, 403);
   }
   const senderShort = (meta.senderId ?? "").slice(0, 8);
   const encoder = new TextEncoder();
-  console.log(`${TAG20} op=reader-open anchor=${visitor.kind} key=${senderShort} mode=delivered-only sessionId=${sessionId.slice(0, 8)}`);
+  console.log(`${TAG21} op=reader-open anchor=${visitor.kind} key=${senderShort} mode=delivered-only sessionId=${sessionId.slice(0, 8)}`);
   const send = (controller, turn, id) => controller.enqueue(encoder.encode(`id: ${id}
 data: ${JSON.stringify(turn)}
 
@@ -7852,7 +7989,7 @@ data: ${JSON.stringify(turn)}
         const { turns, dropped } = filterDeliveredFrames(lines);
         if (uploadsDir) enrichPublicAttachments(turns, listSessionAttachmentsInDir(uploadsDir), attachmentCursor);
         for (const turn of turns) send(controller, turn, offset);
-        if (dropped > 0) console.log(`${TAG20} op=reader-filtered key=${senderShort} dropped=${dropped}`);
+        if (dropped > 0) console.log(`${TAG21} op=reader-filtered key=${senderShort} dropped=${dropped}`);
       };
       try {
         const { buf, end } = readFrom2(jsonlPath, 0);
@@ -7887,7 +8024,7 @@ data: ${JSON.stringify(turn)}
         watcher?.close();
         clearInterval(poll);
         clearInterval(heartbeat);
-        console.log(`${TAG20} op=reader-close key=${senderShort}`);
+        console.log(`${TAG21} op=reader-close key=${senderShort}`);
         try {
           controller.close();
         } catch {
@@ -7943,7 +8080,7 @@ app5.get("/attachment/:attachmentId", (c) => {
   try {
     dataFile = readdirSync8(dir).find((f) => !f.endsWith(".meta.json"));
     if (!dataFile) throw new Error("no data file");
-    buffer = readFileSync13(resolve12(dir, dataFile));
+    buffer = readFileSync14(resolve12(dir, dataFile));
   } catch {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
     return new Response("Not found", { status: 404 });
@@ -7962,20 +8099,20 @@ var public_reader_default = app5;
 
 // server/routes/webchat.ts
 import { basename as basename4, dirname as dirname3 } from "path";
-import { join as join15 } from "path";
-import { existsSync as existsSync9, readdirSync as readdirSync10, readFileSync as readFileSync16, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
+import { join as join16 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync10, readFileSync as readFileSync17, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
-import { readFileSync as readFileSync14, writeFileSync as writeFileSync5, renameSync } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync15, writeFileSync as writeFileSync5, renameSync } from "fs";
+import { join as join14 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join13(accountDir, FILE);
+  return join14(accountDir, FILE);
 }
 function readRaw(accountDir) {
   try {
-    return JSON.parse(readFileSync14(canonicalOverridePath(accountDir), "utf8"));
+    return JSON.parse(readFileSync15(canonicalOverridePath(accountDir), "utf8"));
   } catch {
     return null;
   }
@@ -8062,8 +8199,8 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync as readdirSync9, readFileSync as readFileSync15, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readdirSync as readdirSync9, readFileSync as readFileSync16, renameSync as renameSync2, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
+import { join as join15 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -8071,7 +8208,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join14(sessionsDir, `${id}${suffix}`);
+    return join15(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync2(sessionsDir, { recursive: true });
@@ -8092,7 +8229,7 @@ function createSidecarStore(config) {
   function readFileAt(path2) {
     let raw;
     try {
-      raw = readFileSync15(path2, "utf8");
+      raw = readFileSync16(path2, "utf8");
     } catch {
       return null;
     }
@@ -8115,10 +8252,10 @@ function createSidecarStore(config) {
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path2 = join14(sessionsDir, name);
+      const path2 = join15(sessionsDir, name);
       let raw;
       try {
-        raw = readFileSync15(path2, "utf8");
+        raw = readFileSync16(path2, "utf8");
       } catch {
         onSkip?.(name, "unreadable");
         continue;
@@ -8192,10 +8329,10 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return { projectDir: null, channel: null };
-  for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
+  for (const { path: path2 } of enumerateJsonls(join16(cfg, "projects"))) {
     if (basename4(path2) === `${sessionId}.jsonl`) {
       const dir = dirname3(path2);
-      const meta = readSidecarMeta(join15(dir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join16(dir, `${sessionId}.meta.json`));
       return { projectDir: dir, channel: meta.channel };
     }
   }
@@ -8204,7 +8341,7 @@ function locateSession(sessionId) {
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join15(cfg, "projects");
+  const projectsRoot = join16(cfg, "projects");
   let slugs;
   try {
     slugs = readdirSync10(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -8212,7 +8349,7 @@ function locateSidecar(sessionId) {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join15(projectsRoot, slug, `${sessionId}.meta.json`);
+    const metaPath = join16(projectsRoot, slug, `${sessionId}.meta.json`);
     if (existsSync9(metaPath)) {
       const meta = readSidecarMeta(metaPath);
       return { channel: meta.channel, adminUserId: meta.adminUserId };
@@ -8225,7 +8362,7 @@ function readTargetOwner(sessionId) {
   if (sidecar !== null) return { found: true, owner: sidecar.adminUserId };
   const { projectDir } = locateSession(sessionId);
   if (projectDir !== null) {
-    return { found: true, owner: readSidecarMeta(join15(projectDir, `${sessionId}.meta.json`)).adminUserId };
+    return { found: true, owner: readSidecarMeta(join16(projectDir, `${sessionId}.meta.json`)).adminUserId };
   }
   return { found: false, owner: null };
 }
@@ -8239,7 +8376,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync6(join15(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync6(join16(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -8327,10 +8464,10 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path2, isSubagent, archived } of enumerateJsonls(join15(cfg, "projects"))) {
+  for (const { path: path2, isSubagent, archived } of enumerateJsonls(join16(cfg, "projects"))) {
     if (isSubagent || archived) continue;
     const id = basename4(path2).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join15(dirname3(path2), `${id}.meta.json`));
+    const meta = readSidecarMeta(join16(dirname3(path2), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     let mtimeMs;
     try {
@@ -8581,9 +8718,9 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join15(account.accountDir, "account.json");
+    const accountJsonPath = join16(account.accountDir, "account.json");
     try {
-      const parsed = JSON.parse(readFileSync16(accountJsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync17(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
       else if (op === "effort") parsed.effort = value;
       else parsed.adminPermissionMode = value;
@@ -8628,7 +8765,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join15(cfg2, "sessions"),
+            join16(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -8660,7 +8797,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
+      for (const { path: path2 } of enumerateJsonls(join16(cfg, "projects"))) {
         if (basename4(path2) === `${sessionId}.jsonl`) {
           projectDir = dirname3(path2);
           break;
@@ -8668,7 +8805,7 @@ ${note}` : note;
       }
     }
     if (source === "latest" && requesterUserId !== null) {
-      const owner = readSidecarMeta(join15(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
+      const owner = readSidecarMeta(join16(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
       if (owner !== null && owner !== requesterUserId && requesterUserId !== primaryUserId) {
         console.error(`[webchat:inbound] op=session-resolve-foreign key=${sessionId.slice(0, 8)} owner=${owner.slice(0, 8)} requester=${requesterUserId.slice(0, 8)}`);
       }
@@ -8700,8 +8837,8 @@ ${note}` : note;
 import { resolve as resolve13 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync10, readFileSync as readFileSync17, readdirSync as readdirSync11 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync18, readdirSync as readdirSync11 } from "fs";
+import { join as join17 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -8720,7 +8857,7 @@ function readSpecialistRoster(specialistsDir) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync17(join16(specialistsDir, file), "utf-8");
+      raw = readFileSync18(join17(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -8837,8 +8974,8 @@ var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
 import { homedir } from "os";
-import { resolve as resolve17, join as join17 } from "path";
-import { existsSync as existsSync11, readFileSync as readFileSync18 } from "fs";
+import { resolve as resolve17, join as join18 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync19 } from "fs";
 
 // app/lib/channel-pty-bridge/bridge.ts
 import { resolve as resolve16 } from "path";
@@ -8992,7 +9129,7 @@ function classifyTimeout(ndjson, writeAtMs) {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID7 } from "crypto";
-var TAG21 = "[public-session-review]";
+var TAG22 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -9019,7 +9156,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG21} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG22} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -9043,7 +9180,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG21} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG22} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -9051,7 +9188,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG21} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG22} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -9080,7 +9217,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID7();
-  console.log(`${TAG21} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG22} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -9100,21 +9237,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG21} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG22} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG21} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG22} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG21} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG22} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -9128,19 +9265,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG21} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG22} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG21} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG22} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG21} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG22} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -9354,7 +9491,7 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG22 = "[whatsapp-adaptor]";
+var TAG23 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
@@ -9367,7 +9504,7 @@ function makeWhatsAppSendFile(entry) {
       maxyAccountId = resolvePlatformAccountId();
     } catch (err) {
       console.error(
-        `${TAG22} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+        `${TAG23} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
       );
       return { ok: false, error: "account-unresolved" };
     }
@@ -9381,7 +9518,7 @@ function makeWhatsAppSendFile(entry) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG22} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG23} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -9389,7 +9526,7 @@ function makeWhatsAppSendFile(entry) {
 function makeWhatsAppFileDelivery(entry) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG22,
+    tag: TAG23,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry)
   });
@@ -9424,7 +9561,7 @@ function makeWhatsAppFileDelivery(entry) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG22} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG23} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -9436,7 +9573,7 @@ function makeWhatsAppFileDelivery(entry) {
 import { realpathSync as realpathSync4 } from "fs";
 import { readFile as readFile2, stat as stat3 } from "fs/promises";
 import { resolve as resolve14, basename as basename5 } from "path";
-var TAG23 = "[telegram:outbound]";
+var TAG24 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot4 } = input;
@@ -9452,16 +9589,16 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync4(filePath);
     const accountResolved = realpathSync4(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG23} document REJECTED reason=outside_account_directory`);
+      console.error(`${TAG24} document REJECTED reason=outside_account_directory`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG23} document ENOENT path=${filePath}`);
+      console.error(`${TAG24} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG23} document path error: ${String(err)}`);
+    console.error(`${TAG24} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat3(resolvedPath);
@@ -9494,13 +9631,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG23} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG24} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG24 = "[telegram:outbound]";
+var TAG25 = "[telegram:outbound]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -9512,11 +9649,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG24} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG25} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG24} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG25} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     let maxyAccountId;
@@ -9524,7 +9661,7 @@ function makeTelegramSendFile(entry) {
       maxyAccountId = resolvePlatformAccountId();
     } catch (err) {
       console.error(
-        `${TAG24} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+        `${TAG25} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
       );
       return { ok: false, error: "account-unresolved" };
     }
@@ -9542,7 +9679,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG24,
+    tag: TAG25,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -9551,7 +9688,7 @@ function makeTelegramFileDelivery(entry) {
 // app/lib/webchat/file-delivery.ts
 import { realpathSync as realpathSync5 } from "fs";
 import { resolve as resolve15 } from "path";
-var TAG25 = "[webchat-adaptor]";
+var TAG26 = "[webchat-adaptor]";
 function platformRoot3() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -9562,7 +9699,7 @@ function makeWebchatSendFile(entry) {
       maxyAccountId = resolvePlatformAccountId();
     } catch (err) {
       console.error(
-        `${TAG25} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+        `${TAG26} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
       );
       return { ok: false, error: "account-unresolved" };
     }
@@ -9571,14 +9708,14 @@ function makeWebchatSendFile(entry) {
       const resolved = realpathSync5(filePath);
       const accountResolved = realpathSync5(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG25} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG26} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG25} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG26} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -9587,7 +9724,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG25,
+    tag: TAG26,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry)
   });
@@ -9955,14 +10092,14 @@ function routeTelegramUpdate(input) {
 }
 
 // server/routes/telegram.ts
-var TAG26 = "[telegram-inbound]";
+var TAG27 = "[telegram-inbound]";
 var DISPATCH_TIMEOUT_MS = 12e4;
 function configDirName() {
   const platformRoot4 = process.env.MAXY_PLATFORM_ROOT ?? resolve17(process.cwd(), "..");
-  const brandPath = join17(platformRoot4, "config", "brand.json");
+  const brandPath = join18(platformRoot4, "config", "brand.json");
   if (existsSync11(brandPath)) {
     try {
-      return JSON.parse(readFileSync18(brandPath, "utf-8")).configDir ?? ".maxy";
+      return JSON.parse(readFileSync19(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
     }
   }
@@ -9990,18 +10127,18 @@ app7.post("/", async (c) => {
   const botParam = c.req.query("bot");
   const botType = botParam === "admin" ? "admin" : botParam === "public" ? "public" : null;
   if (!botType) {
-    console.error(`${TAG26} op=reject reason=missing-bot-param`);
+    console.error(`${TAG27} op=reject reason=missing-bot-param`);
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
   if (!existsSync11(sp)) {
-    console.error(`${TAG26} op=reject reason=no-secret-file botType=${botType}`);
+    console.error(`${TAG27} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
-  const expected = readFileSync18(sp, "utf-8").trim();
+  const expected = readFileSync19(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
-    console.error(`${TAG26} op=reject reason=bad-secret botType=${botType}`);
+    console.error(`${TAG27} op=reject reason=bad-secret botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
   let update;
@@ -10012,25 +10149,25 @@ app7.post("/", async (c) => {
   }
   const account = resolveAccount();
   if (!account) {
-    console.error(`${TAG26} op=reject reason=no-account`);
+    console.error(`${TAG27} op=reject reason=no-account`);
     return c.json({ ok: true }, 200);
   }
   const decision = routeTelegramUpdate({ update, botType, config: account.config.telegram ?? {} });
   if (decision.kind === "ignore") {
-    console.error(`${TAG26} op=ignore reason=${decision.reason}`);
+    console.error(`${TAG27} op=ignore reason=${decision.reason}`);
     return c.json({ ok: true }, 200);
   }
   if (decision.kind === "denied") {
-    console.error(`${TAG26} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
+    console.error(`${TAG27} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
     return c.json({ ok: true }, 200);
   }
   const role = decision.agentType === "admin" ? "admin" : "public";
   const agentSlug = role === "admin" ? "admin" : resolveDefaultAgentSlug(account.accountDir);
   if (!agentSlug) {
-    console.error(`${TAG26} op=reject reason=no-default-agent`);
+    console.error(`${TAG27} op=reject reason=no-default-agent`);
     return c.json({ ok: true }, 200);
   }
-  console.error(`${TAG26} op=update accountId=${account.accountId} from=${decision.senderId}`);
+  console.error(`${TAG27} op=update accountId=${account.accountId} from=${decision.senderId}`);
   const botToken = botType === "admin" ? account.config.telegram?.adminBotToken : account.config.telegram?.publicBotToken;
   const { senderId, chatId, text } = decision;
   void (async () => {
@@ -10047,67 +10184,67 @@ app7.post("/", async (c) => {
       timeoutMs: DISPATCH_TIMEOUT_MS
     });
     if ("error" in result) {
-      console.error(`${TAG26} op=dispatch-failed from=${senderId} error=${result.error}`);
+      console.error(`${TAG27} op=dispatch-failed from=${senderId} error=${result.error}`);
       return;
     }
     if (!botToken) {
       const reason = account.config.telegram ? "no-bot-token" : "no-telegram-config";
-      console.error(`${TAG26} op=reply-dropped reason=${reason} botType=${botType}`);
+      console.error(`${TAG27} op=reply-dropped reason=${reason} botType=${botType}`);
       return;
     }
     const sent = await sendTelegram(botToken, chatId, result.turnText);
-    console.error(`${TAG26} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
+    console.error(`${TAG27} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
   })();
   return c.json({ ok: true }, 200);
 });
 var telegram_default = app7;
 
 // server/routes/quickbooks.ts
-import { join as join18 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync8, mkdirSync as mkdirSync3, rmSync, renameSync as renameSync4 } from "fs";
-var TAG27 = "[quickbooks]";
+import { join as join19 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync20, writeFileSync as writeFileSync8, mkdirSync as mkdirSync3, rmSync, renameSync as renameSync4 } from "fs";
+var TAG28 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join18(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join19(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join18(accountDir, "secrets", "quickbooks.json");
+  return join19(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
   if (!state || !STATE_RE.test(state) || !existsSync12(pendingPath(accountDir, state))) {
-    console.error(`${TAG27} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
+    console.error(`${TAG28} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
   const claimFile = `${pendingPath(accountDir, state)}.claimed`;
   try {
     renameSync4(pendingPath(accountDir, state), claimFile);
   } catch {
-    console.error(`${TAG27} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+    console.error(`${TAG28} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
   try {
     let pending;
     try {
-      pending = JSON.parse(readFileSync19(claimFile, "utf-8"));
+      pending = JSON.parse(readFileSync20(claimFile, "utf-8"));
     } catch {
-      console.error(`${TAG27} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      console.error(`${TAG28} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization state could not be read.", stateValid: false };
     }
     if (Date.now() > pending.expiresAt) {
-      console.error(`${TAG27} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      console.error(`${TAG28} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization request expired. Generate a new consent link.", stateValid: false };
     }
-    console.error(`${TAG27} op=callback state=${state} stateValid=true realmId=${realmId ?? ""}`);
+    console.error(`${TAG28} op=callback state=${state} stateValid=true realmId=${realmId ?? ""}`);
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
     if (!existsSync12(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
-    const store2 = JSON.parse(readFileSync19(storePath(accountDir), "utf-8"));
+    const store2 = JSON.parse(readFileSync20(storePath(accountDir), "utf-8"));
     const form = new URLSearchParams({
       grant_type: "authorization_code",
       code,
@@ -10124,12 +10261,12 @@ async function completeConsent(args) {
     });
     const text = await res.text();
     if (!res.ok) {
-      console.error(`${TAG27} op=token-exchange realmId=${realmId} persisted=false`);
+      console.error(`${TAG28} op=token-exchange realmId=${realmId} persisted=false`);
       return { ok: false, status: 502, message: `Token exchange failed (${res.status}). Generate a new consent link to retry.`, stateValid: true };
     }
     const body = JSON.parse(text);
     if (!body.refresh_token) {
-      console.error(`${TAG27} op=token-exchange realmId=${realmId} persisted=false`);
+      console.error(`${TAG28} op=token-exchange realmId=${realmId} persisted=false`);
       return { ok: false, status: 502, message: "Token exchange returned no refresh token.", stateValid: true };
     }
     const now = Date.now();
@@ -10139,10 +10276,10 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync3(join18(accountDir, "secrets"), { recursive: true });
+    mkdirSync3(join19(accountDir, "secrets"), { recursive: true });
     writeFileSync8(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
-    const persisted = JSON.parse(readFileSync19(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
-    console.error(`${TAG27} op=token-exchange realmId=${realmId} persisted=${persisted}`);
+    const persisted = JSON.parse(readFileSync20(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
+    console.error(`${TAG28} op=token-exchange realmId=${realmId} persisted=${persisted}`);
     return { ok: persisted, status: persisted ? 200 : 500, message: persisted ? `Connected company ${realmId}.` : "Failed to persist the connection.", stateValid: true };
   } finally {
     rmSync(claimFile, { force: true });
@@ -10155,7 +10292,7 @@ var app8 = new Hono();
 app8.get("/callback", async (c) => {
   const account = resolveAccount();
   if (!account) {
-    console.error(`${TAG27} op=callback stateValid=false realmId= reason=no-account`);
+    console.error(`${TAG28} op=callback stateValid=false realmId= reason=no-account`);
     return c.html(page("QuickBooks", "This install has no account configured."), 500);
   }
   const result = await completeConsent({
@@ -10172,12 +10309,12 @@ var quickbooks_default = app8;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync14, readFileSync as readFileSync21, unlinkSync as unlinkSync2 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync14, readFileSync as readFileSync22, unlinkSync as unlinkSync2 } from "fs";
 import { createHash as createHash3, randomUUID as randomUUID8 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync12, statSync as statSync7 } from "fs";
-import { dirname as dirname4, join as join19 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync21, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync12, statSync as statSync7 } from "fs";
+import { dirname as dirname4, join as join20 } from "path";
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -10195,7 +10332,7 @@ function writeAdminEntry(input) {
   try {
     let users = [];
     if (existsSync13(input.usersFile)) {
-      const raw = readFileSync20(input.usersFile, "utf-8").trim();
+      const raw = readFileSync21(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -10219,11 +10356,11 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join19(input.accountDir, "account.json");
+    const accountJsonPath = join20(input.accountDir, "account.json");
     if (!existsSync13(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -10249,7 +10386,7 @@ function checkAdminAuthInvariant(input) {
   const usersUserIds = /* @__PURE__ */ new Set();
   if (existsSync13(input.usersFile)) {
     try {
-      const raw = readFileSync20(input.usersFile, "utf-8").trim();
+      const raw = readFileSync21(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -10274,17 +10411,17 @@ function checkAdminAuthInvariant(input) {
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join19(input.accountsDir, entry);
+      const accountDir = join20(input.accountsDir, entry);
       try {
         if (!statSync7(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join19(accountDir, "account.json");
+      const accountJsonPath = join20(accountDir, "account.json");
       if (!existsSync13(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync20(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -10325,7 +10462,7 @@ function hashPin2(pin) {
 }
 function readUsersFile2() {
   if (!existsSync14(USERS_FILE)) return null;
-  const raw = readFileSync21(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync22(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -10487,7 +10624,7 @@ app9.post("/set-pin", async (c) => {
     let installOwner = null;
     if (existsSync14(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync21(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync22(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -10569,8 +10706,8 @@ var onboarding_default = app9;
 
 // server/routes/client-error.ts
 import { appendFileSync, existsSync as existsSync15, renameSync as renameSync6, statSync as statSync8 } from "fs";
-import { join as join20 } from "path";
-var CLIENT_ERRORS_LOG = join20(LOG_DIR, "client-errors.log");
+import { join as join21 } from "path";
+var CLIENT_ERRORS_LOG = join21(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -10895,17 +11032,17 @@ app11.post("/", async (c) => {
 var session_default = app11;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync17, readdirSync as readdirSync13, readFileSync as readFileSync22, statSync as statSync9 } from "fs";
+import { existsSync as existsSync17, readdirSync as readdirSync13, readFileSync as readFileSync23, statSync as statSync9 } from "fs";
 import { resolve as resolve18, basename as basename6 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync16 } from "fs";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join21(dir, filename);
+    const fullPath = join22(dir, filename);
     if (existsSync16(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -10934,7 +11071,7 @@ app12.get("/", async (c) => {
       const filePath = resolve18(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync22(filePath);
+        const buffer = readFileSync23(filePath);
         const onDiskBytes = statSync9(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -10999,7 +11136,7 @@ app12.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename6(hit.path);
-        const buffer = readFileSync22(hit.path);
+        const buffer = readFileSync23(hit.path);
         const onDiskBytes = statSync9(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -11046,7 +11183,7 @@ app12.get("/", async (c) => {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve18(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync22(resolve18(dir, name));
+        const content = readFileSync23(resolve18(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -11131,7 +11268,7 @@ var attachment_default = app14;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve20 } from "path";
-import { readdirSync as readdirSync14, readFileSync as readFileSync23, existsSync as existsSync19, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync14, readFileSync as readFileSync24, existsSync as existsSync19, rmSync as rmSync2 } from "fs";
 var app15 = new Hono();
 app15.get("/", (c) => {
   const account = resolveAccount();
@@ -11147,7 +11284,7 @@ app15.get("/", (c) => {
       const configPath2 = resolve20(agentsDir, entry.name, "config.json");
       if (!existsSync19(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync23(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync24(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -11906,8 +12043,8 @@ app16.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app16;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync21, readFileSync as readFileSync24, readdirSync as readdirSync15, statSync as statSync10 } from "fs";
-import { dirname as dirname5, resolve as resolve21, join as join22 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync25, readdirSync as readdirSync15, statSync as statSync10 } from "fs";
+import { dirname as dirname5, resolve as resolve21, join as join23 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -11948,14 +12085,14 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join22(pluginDir, "mcp/dist/index.js"),
-    join22(pluginDir, "mcp/src/index.ts")
+    join23(pluginDir, "mcp/dist/index.js"),
+    join23(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
     if (!existsSync21(path2)) continue;
     try {
-      raw = readFileSync24(path2, "utf-8");
+      raw = readFileSync25(path2, "utf-8");
       break;
     } catch {
     }
@@ -12007,7 +12144,7 @@ function listPluginDirs() {
   const platformPlugins = resolve21(PLATFORM_ROOT, "plugins");
   if (existsSync21(platformPlugins)) {
     for (const name of readdirSync15(platformPlugins)) {
-      const dir = join22(platformPlugins, name);
+      const dir = join23(platformPlugins, name);
       try {
         if (statSync10(dir).isDirectory()) out.set(name, dir);
       } catch {
@@ -12017,11 +12154,11 @@ function listPluginDirs() {
   const premiumRoot = resolve21(dirname5(PLATFORM_ROOT), "premium-plugins");
   if (existsSync21(premiumRoot)) {
     for (const bundle of readdirSync15(premiumRoot)) {
-      const bundlePlugins = join22(premiumRoot, bundle, "plugins");
+      const bundlePlugins = join23(premiumRoot, bundle, "plugins");
       if (!existsSync21(bundlePlugins)) continue;
       try {
         for (const name of readdirSync15(bundlePlugins)) {
-          const dir = join22(bundlePlugins, name);
+          const dir = join23(bundlePlugins, name);
           try {
             if (statSync10(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -12037,7 +12174,7 @@ function readEnabledPlugins(accountId) {
   const accountFile = resolve21(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync21(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync24(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync25(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -12049,7 +12186,7 @@ function readFrontmatter(path2) {
   if (!existsSync21(path2)) return null;
   let raw;
   try {
-    raw = readFileSync24(path2, "utf-8");
+    raw = readFileSync25(path2, "utf-8");
   } catch {
     return null;
   }
@@ -12064,7 +12201,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join22(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join23(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -12081,7 +12218,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync21(join22(dir, "mcp/dist/index.js")) || existsSync21(join22(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync21(join23(dir, "mcp/dist/index.js")) || existsSync21(join23(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -12091,7 +12228,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join22(dir, relPath);
+      const skillPath = join23(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -12135,7 +12272,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join22(specialistsDir, file));
+    const fm = readFrontmatter(join23(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -12157,7 +12294,7 @@ function computeDormantPlugins(accountId) {
   if (!existsSync21(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync24(accountFile, "utf-8");
+    const raw = readFileSync25(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -12183,7 +12320,7 @@ function computeDormantPlugins(accountId) {
     if (!existsSync21(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync24(manifestPath, "utf-8");
+      manifest = readFileSync25(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -12197,13 +12334,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync22, readFileSync as readFileSync25 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync26 } from "fs";
 import { resolve as resolve22 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync22(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync25(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync26(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -12217,7 +12354,7 @@ function resolveTunnelUrl() {
   const platformRoot4 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync25(resolve22(platformRoot4, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync26(resolve22(platformRoot4, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -12228,7 +12365,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG28 = "[claude-session-manager:wrapper]";
+var TAG29 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -12246,12 +12383,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG28} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG29} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG28} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG29} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -12278,24 +12415,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG28} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG29} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase("claude-session-manager:wrapper")}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG28} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG29} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG28} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG29} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG28} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG29} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -12330,7 +12467,7 @@ app17.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG28} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG29} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -12339,7 +12476,7 @@ app17.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG28} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG29} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -12358,13 +12495,13 @@ app17.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG28} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG29} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 var claude_sessions_default = app17;
 
 // server/routes/admin/log-ingest.ts
-var TAG29 = "[log-ingest]";
+var TAG30 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
@@ -12375,7 +12512,7 @@ function isLoopbackAddr(addr) {
 app18.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -12384,7 +12521,7 @@ app18.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -12426,18 +12563,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app19 = new Hono();
 app19.post("/", async (c) => {
-  const TAG38 = "[admin:events]";
+  const TAG39 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG38} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG39} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG38} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG39} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -12463,7 +12600,7 @@ import { createReadStream as createReadStream2, createWriteStream as createWrite
 import { readdir as readdir3, readFile as readFile5, stat as stat5, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync6 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename8, dirname as dirname6, join as join24, resolve as resolve24, sep as sep6 } from "path";
+import { basename as basename8, dirname as dirname6, join as join25, resolve as resolve24, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -12781,7 +12918,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve23, relative as relative3, join as join23, basename as basename7, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve23, relative as relative3, join as join24, basename as basename7, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -12863,7 +13000,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join23(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join24(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -12925,7 +13062,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join23(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join24(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -12946,7 +13083,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join23(root, entry.name);
+    const abs = join24(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -13219,7 +13356,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile5(join24(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile5(join25(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -13257,7 +13394,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join24(absolute, entry.name), entry.name);
+    const meta = await readMeta(join25(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -13421,7 +13558,7 @@ app20.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join24(absolute, name);
+        const entryPath = join25(absolute, name);
         const s = await stat5(entryPath);
         entries.push({
           name,
@@ -13562,7 +13699,7 @@ app20.post("/upload", requireAdminSession, async (c) => {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return c.json({ error: base.error }, base.status);
   const relDir = relpath ? dirname6(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join24(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join25(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
@@ -13739,7 +13876,7 @@ app20.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join24(dirname6(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join25(dirname6(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -16215,6 +16352,7 @@ var session_rename_default = app31;
 
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID11 } from "crypto";
+var ACCOUNT_UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID11, adminUserId, authenticatedName) {
   const operator = isOperatorHost(host, operatorDomains);
   const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
@@ -16225,6 +16363,7 @@ function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID11, ad
   const pickedModel = kind === "new" && typeof body.model === "string" && isSelectableModel(body.model) ? body.model : null;
   const pickedEffort = kind === "new" && typeof body.effort === "string" && isNewSessionEffortLevel(body.effort) ? body.effort : null;
   const paramsSource = pickedModel !== null && pickedEffort !== null ? "picker" : "default";
+  const targetAccountId = typeof body.targetAccountId === "string" && ACCOUNT_UUID_RE2.test(body.targetAccountId) ? body.targetAccountId : void 0;
   const payload = {};
   let sessionId;
   if (webchatBind) {
@@ -16239,6 +16378,7 @@ function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID11, ad
     if (pickedModel) payload.model = pickedModel;
     if (pickedEffort) payload.effort = pickedEffort;
     if (adminUserId) payload.adminUserId = adminUserId;
+    if (targetAccountId) payload.targetAccountId = targetAccountId;
     if (authenticatedName) payload.authenticatedName = authenticatedName;
   } else {
     sessionId = resumeId;
@@ -16549,14 +16689,14 @@ app34.get("/", async (c) => {
 var system_stats_default = app34;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync25, readFileSync as readFileSync26 } from "fs";
-import { resolve as resolve26, join as join25 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync27 } from "fs";
+import { resolve as resolve26, join as join26 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join25(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join26(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync25(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync26(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync27(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -16566,7 +16706,7 @@ var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync25(VERSION_FILE)) return "unknown";
-  return readFileSync26(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync27(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -16618,7 +16758,7 @@ var health_default2 = app35;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID13 } from "crypto";
-var TAG30 = "[linkedin-ingest-route]";
+var TAG31 = "[linkedin-ingest-route]";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -16722,29 +16862,29 @@ app36.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG30 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG31 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG30 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG31 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG30 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG31 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG30 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG31 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID13();
-  console.log(TAG30 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG31 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -16753,12 +16893,12 @@ app36.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG30 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG31 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG30 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG31 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
@@ -16766,7 +16906,7 @@ var linkedin_ingest_default = app36;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG31 = "[post-turn-context]";
+var TAG32 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -16808,7 +16948,7 @@ var app37 = new Hono();
 app37.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -16817,7 +16957,7 @@ app37.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -16849,7 +16989,7 @@ app37.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG31} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG32} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -16858,7 +16998,7 @@ app37.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG31} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG32} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -16971,7 +17111,7 @@ function formatPreviousContext(writes) {
 }
 
 // server/routes/admin/public-session-context.ts
-var TAG32 = "[public-session-context]";
+var TAG33 = "[public-session-context]";
 function isLoopbackAddr3(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -16979,7 +17119,7 @@ var app38 = new Hono();
 app38.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG33} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -16988,7 +17128,7 @@ app38.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG33} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -17002,14 +17142,14 @@ app38.get("/", async (c) => {
     const writes = await fetchSliceWrites(session, sliceToken, accountId);
     const total = Date.now() - started;
     console.log(
-      `${TAG32} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG33} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({ writes });
   } catch (err) {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG32} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG33} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
@@ -17019,7 +17159,7 @@ app38.get("/", async (c) => {
 var public_session_context_default = app38;
 
 // server/routes/admin/public-session-exit.ts
-var TAG33 = "[public-session-exit-route]";
+var TAG34 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -17027,7 +17167,7 @@ var app39 = new Hono();
 app39.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG33} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG34} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17036,7 +17176,7 @@ app39.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG33} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG34} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -17054,7 +17194,7 @@ app39.post("/", async (c) => {
 var public_session_exit_default = app39;
 
 // server/routes/admin/access-session-evict.ts
-var TAG34 = "[access-session-evict]";
+var TAG35 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -17062,7 +17202,7 @@ var app40 = new Hono();
 app40.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG34} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG35} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17071,7 +17211,7 @@ app40.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG34} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG35} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -17084,13 +17224,13 @@ app40.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG34} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG35} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
 var access_session_evict_default = app40;
 
 // server/routes/admin/enrol-person.ts
-var TAG35 = "[enrol]";
+var TAG36 = "[enrol]";
 function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -17099,7 +17239,7 @@ var app41 = new Hono();
 app41.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr6(remoteAddr)) {
-    console.error(`${TAG35} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG36} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "enrol-person-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17108,7 +17248,7 @@ app41.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr6(t));
     if (offender !== void 0) {
-      console.error(`${TAG35} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG36} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "enrol-person-loopback-only" }, 403);
     }
   }
@@ -17133,7 +17273,7 @@ app41.post("/", async (c) => {
   }
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG35} op=person result=no-account-id`);
+    console.error(`${TAG36} op=person result=no-account-id`);
     return c.json({ error: "no-account-id" }, 500);
   }
   let personId;
@@ -17141,7 +17281,7 @@ app41.post("/", async (c) => {
     personId = await enrolPerson({ accountId, phone, email, agentSlug });
   } catch (err) {
     console.error(
-      `${TAG35} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG36} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "enrol-failed" }, 500);
   }
@@ -17151,11 +17291,11 @@ app41.post("/", async (c) => {
     if (g) grant = { grantId: g.grantId, status: g.status, contactValue: g.contactValue };
   } catch (err) {
     console.error(
-      `${TAG35} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG36} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
   }
   console.log(
-    `${TAG35} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
+    `${TAG36} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
   );
   return c.json({ personId, grant }, 200);
 });
@@ -17231,7 +17371,7 @@ app43.route("/enrol-person", enrol_person_default);
 var admin_default = app43;
 
 // server/routes/access/verify-token.ts
-var TAG36 = "[access-verify]";
+var TAG37 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
 var app44 = new Hono();
@@ -17250,39 +17390,39 @@ app44.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG36} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG37} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG36} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG37} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -17298,12 +17438,12 @@ app44.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -17379,7 +17519,7 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG37 = "[access-request-link]";
+var TAG38 = "[access-request-link]";
 var app45 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
 app45.post("/", async (c) => {
@@ -17396,18 +17536,18 @@ app45.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG37} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG38} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG37} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG38} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG37} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG38} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -17415,7 +17555,7 @@ app45.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG37} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG38} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -17447,12 +17587,12 @@ app45.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG37} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG38} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG37} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG38} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
@@ -17465,7 +17605,7 @@ app46.route("/request-magic-link", request_magic_link_default);
 var access_default = app46;
 
 // server/routes/sites.ts
-import { existsSync as existsSync26, readFileSync as readFileSync27, realpathSync as realpathSync7, statSync as statSync11 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync28, realpathSync as realpathSync7, statSync as statSync11 } from "fs";
 import { resolve as resolve28 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -17569,7 +17709,7 @@ app47.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync27(realPath);
+    body = readFileSync28(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -17605,7 +17745,7 @@ var sites_default = app47;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync28, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync29, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname7 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -17614,7 +17754,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync28(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync29(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -17628,7 +17768,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync28(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync29(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -17681,8 +17821,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync27, readFileSync as readFileSync29 } from "fs";
-import { join as join26 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync30 } from "fs";
+import { join as join27 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -17690,10 +17830,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot4 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot4) return null;
-  const brandPath = join26(platformRoot4, "config", "brand.json");
+  const brandPath = join27(platformRoot4, "config", "brand.json");
   if (!existsSync27(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync29(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync30(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -18494,7 +18634,7 @@ function startGraphHealthTimer() {
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
 import { resolve as resolve30, sep as sep8 } from "path";
-var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
 function _routeEvent(rootName, filename) {
@@ -18502,7 +18642,7 @@ function _routeEvent(rootName, filename) {
   const segs = filename.split(sep8).filter(Boolean);
   if (segs.length < 2) return null;
   const accountId = segs[0];
-  if (!ACCOUNT_UUID_RE2.test(accountId)) return null;
+  if (!ACCOUNT_UUID_RE3.test(accountId)) return null;
   return { accountId, relativePath: `${rootName}/${segs.join("/")}` };
 }
 async function startFileWatcher(opts = {}) {
@@ -18597,7 +18737,7 @@ async function startFileWatcher(opts = {}) {
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
 import { dirname as dirname8, relative as relative5, resolve as resolve31 } from "path";
-var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
   let entries;
@@ -18673,7 +18813,7 @@ async function migrateUploads(opts = {}) {
   try {
     for (const entry of topEntries) {
       const name = entry.name;
-      if (ACCOUNT_UUID_RE3.test(name)) {
+      if (ACCOUNT_UUID_RE4.test(name)) {
         moved += await relocateTree(
           resolve31(oldRoot, name),
           resolve31(dataRoot, "accounts", name, "uploads"),
@@ -18720,7 +18860,7 @@ async function migrateUploads(opts = {}) {
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile7, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync29 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -18765,7 +18905,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join27(projectsRoot, slug.name);
+    const slugDir = join28(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -18774,9 +18914,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join27(slugDir, entry.name));
+        out.push(join28(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join27(slugDir, entry.name);
+        const subDir = join28(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -18784,7 +18924,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join27(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join28(subDir, s.name));
         }
       }
     }
@@ -18796,7 +18936,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join27(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join28(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -19622,6 +19762,26 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
+  app53.post("/webchat-channel/turn-end", async (c) => {
+    const body = await c.req.json().catch(() => null);
+    const key = body?.key;
+    const sessionId = body?.sessionId;
+    const replied = body?.replied;
+    if (typeof key !== "string" || typeof sessionId !== "string" || typeof replied !== "boolean") {
+      return c.json({ error: "key, sessionId and replied required" }, 400);
+    }
+    const k = key.slice(0, 8);
+    const sid = sessionId.slice(0, 8);
+    if (replied) {
+      return c.json({ ok: true, delivered: "reply" });
+    }
+    const finalBytes = typeof body?.finalBytes === "number" && Number.isFinite(body.finalBytes) ? body.finalBytes : 0;
+    if (finalBytes <= 0) {
+      return c.json({ ok: true, delivered: "none" });
+    }
+    console.error(`[webchat-native] op=turn-undelivered channel=webchat key=${k} sessionId=${sid} bytes=${finalBytes}`);
+    return c.json({ ok: true, delivered: "undelivered" });
+  });
   return app53;
 }
 
@@ -20114,7 +20274,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync30, statSync as statSync12 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync31, statSync as statSync12 } from "fs";
 import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -20178,7 +20338,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync30(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync31(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -20192,7 +20352,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync30(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync31(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -20353,14 +20513,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join28(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join29(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync31(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync31(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync32(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -20379,11 +20539,11 @@ var brandLoginOpts = {
   bodyFont: BRAND.defaultFonts?.body,
   logoContainsName: !!BRAND.logoContainsName
 };
-var ALIAS_DOMAINS_PATH = join28(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join29(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync31(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync31(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync32(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -20411,7 +20571,7 @@ var app52 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join28(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join29(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -20427,7 +20587,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join28(__dirname, ".."))
+      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join29(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -20902,7 +21062,7 @@ app52.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync31(filePath);
+  const body = readFileSync32(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -20932,7 +21092,7 @@ app52.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync31(filePath);
+  const body = readFileSync32(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -20947,19 +21107,29 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync31(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync32(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
   }
 }
+var DEFAULT_PRIMARY_CONTAINER = { label: "Project", term: "Projects" };
+var rawPrimaryContainer = BRAND.primaryContainer;
+var primaryContainerValid = !!rawPrimaryContainer && typeof rawPrimaryContainer.label === "string" && typeof rawPrimaryContainer.term === "string";
+var brandPrimaryContainer = primaryContainerValid ? rawPrimaryContainer : DEFAULT_PRIMARY_CONTAINER;
+if (primaryContainerValid) {
+  console.log(`[brand] op=inject primaryContainer=${brandPrimaryContainer.label}/${brandPrimaryContainer.term}`);
+} else {
+  console.log(`[brand] op=primaryContainer-default reason=${rawPrimaryContainer ? "malformed" : "absent"} brand=${BRAND.hostname}`);
+}
 var brandScript = `<script>window.__BRAND__=${JSON.stringify({
   productName: BRAND.productName,
   hostname: BRAND.hostname,
   marketingUrl: BRAND.marketingUrl,
   logo: brandLogoPath,
   icon: brandIconPath,
-  logoContainsName: !!BRAND.logoContainsName
+  logoContainsName: !!BRAND.logoContainsName,
+  primaryContainer: brandPrimaryContainer
 })}</script>`;
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
@@ -20967,7 +21137,7 @@ var brandIconFsPath = resolve33(process.cwd(), "public", brandIconPath.replace(/
 var brandIconExists = existsSync31(brandIconFsPath);
 var SW_SOURCE = (() => {
   try {
-    return readFileSync31(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync32(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -20975,9 +21145,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join28(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join29(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync31(versionFile)) return "unknown";
-    const content = readFileSync31(versionFile, "utf-8").trim();
+    const content = readFileSync32(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -21018,7 +21188,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync31(resolve33(process.cwd(), "public", file), "utf-8");
+    html = readFileSync32(resolve33(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -21035,13 +21205,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join28(homedir3(), BRAND.configDir);
+  const configDir2 = join29(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join28(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join29(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync31(cachePath)) return null;
-    return JSON.parse(readFileSync31(cachePath, "utf-8"));
+    return JSON.parse(readFileSync32(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -21136,7 +21306,7 @@ app52.use("/vnc-popout.html", logViewerFetch);
 app52.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync31(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync32(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -21347,7 +21517,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync31(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync32(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -21461,7 +21631,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join28(__dirname, "..")),
+  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join29(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {