@rubytech/create-maxy-code 0.1.352 → 0.1.354

package/payload/server/server.js

@@ -21,6 +21,7 @@ import {
   REMOTE_PASSWORD_FILE,
   RFB_PORT,
   SYSTEM_PATH_SLUGS,
+  USERS_AUDIT_LOG,
   USERS_FILE,
   VISITOR_TOKEN_SECRET_FILE,
   VNC_DISPLAY,
@@ -105,7 +106,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-QAKVFSEJ.js";
+} from "./chunk-7GNXBVGY.js";
 import {
   __commonJS,
   __toESM
@@ -361,9 +362,9 @@ var require_dist = __commonJS({
           try {
             await onEmpty(c);
           } catch (err) {
-            const id8 = c.elementId.slice(0, 8);
+            const id82 = c.elementId.slice(0, 8);
             const message = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`[trash:empty-run] reason=onEmpty-failed elementId=${id8} labels=${c.labels.join(",")} message=${message}
+            process.stderr.write(`[trash:empty-run] reason=onEmpty-failed elementId=${id82} labels=${c.labels.join(",")} message=${message}
 `);
             continue;
           }
@@ -1301,9 +1302,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync33, existsSync as existsSync31, watchFile } from "fs";
+import { readFileSync as readFileSync33, existsSync as existsSync32, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { resolve as resolve34, join as join31, basename as basename10 } from "path";
+import { resolve as resolve32, join as join32, basename as basename10 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1961,7 +1962,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve35) => setTimeout(() => resolve35("timeout"), timeoutMs)
+    (resolve33) => setTimeout(() => resolve33("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -2089,11 +2090,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve35, reject) => {
+  return new Promise((resolve33, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve35();
+        resolve33();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2207,14 +2208,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve35, reject) => {
+  return new Promise((resolve33, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve35(value);
+        resolve33(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -3098,8 +3099,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve35) => {
-    release = resolve35;
+  const mine = new Promise((resolve33) => {
+    release = resolve33;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -4209,11 +4210,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve35) => {
-        const timer2 = setTimeout(resolve35, delay);
+      await new Promise((resolve33) => {
+        const timer2 = setTimeout(resolve33, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve35();
+          resolve33();
         }, { once: true });
       });
     }
@@ -4221,16 +4222,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve35) => {
+  return new Promise((resolve33) => {
     if (!conn.sock) {
-      resolve35();
+      resolve33();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve35();
+        resolve33();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -4490,8 +4491,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve35) => {
-      resolvePending = resolve35;
+    const sttPending = new Promise((resolve33) => {
+      resolvePending = resolve33;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -4891,20 +4892,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve35) => {
+  return new Promise((resolve33) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve35(true);
+      resolve33(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve35(false);
+      resolve33(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve35(false);
+      resolve33(false);
     });
   });
 }
@@ -5173,7 +5174,8 @@ async function storeComponentArtefact(accountId, attachmentId, mimeType, content
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join5 } from "path";
-var TAG14 = "[voice]";
+
+// app/lib/stt/audio-mime.ts
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
   "audio/ogg",
   "audio/opus",
@@ -5212,6 +5214,9 @@ function audioExtension(mimeType) {
       return ".audio";
   }
 }
+
+// app/lib/stt/voice-note.ts
+var TAG14 = "[voice]";
 async function transcribeVoiceNote(file, source) {
   const startMs = Date.now();
   const bytes = file.size;
@@ -6040,8 +6045,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve35, reject) => {
-    resolveCode = resolve35;
+  const codePromise = new Promise((resolve33, reject) => {
+    resolveCode = resolve33;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -9467,8 +9472,31 @@ import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeF
 import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync13, readFileSync as readFileSync21, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync12, statSync as statSync7 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync21, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync4, readdirSync as readdirSync12, statSync as statSync7, appendFileSync } from "fs";
 import { dirname as dirname4, join as join20 } from "path";
+function id8(value) {
+  return value.slice(0, 8);
+}
+function formatAuditRowIds(userIds) {
+  return userIds.map(id8).join(",");
+}
+function appendUsersAuditLine(audit, fields) {
+  const sess = audit.session ? ` session=${id8(audit.session)}` : "";
+  const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
+  const line = `[users-audit] action=${fields.action} actor=${actor}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
+`;
+  try {
+    mkdirSync4(dirname4(audit.logFile), { recursive: true, mode: 448 });
+    appendFileSync(audit.logFile, line, { mode: 384 });
+  } catch (err) {
+    console.error(
+      `[users-audit] op=write-failed logFile=${audit.logFile} error=${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function logUsersAudit(audit, fields) {
+  appendUsersAuditLine(audit, fields);
+}
 function logLine(input, result) {
   const userIdShort = input.userId.slice(0, 8);
   console.error(
@@ -9495,6 +9523,7 @@ function writeAdminEntry(input) {
         users = parsed;
       }
     }
+    const rowsBefore = users.map((u) => id8(u.userId)).join(",");
     const existing = users.findIndex((u) => u.userId === input.userId);
     if (existing === -1) {
       users.push({ userId: input.userId, pin: input.pin });
@@ -9503,6 +9532,12 @@ function writeAdminEntry(input) {
     }
     writeFileAtomic(input.usersFile, JSON.stringify(users, null, 2) + "\n", 384);
     result.usersJsonResult = "ok";
+    appendUsersAuditLine(input.audit, {
+      action: existing === -1 ? "add" : "set-pin",
+      field: existing === -1 ? "row" : "pin",
+      rowsBefore,
+      rowsAfter: users.map((u) => id8(u.userId)).join(",")
+    });
   } catch (err) {
     result.usersJsonResult = "fail";
     result.usersError = err instanceof Error ? err.message : String(err);
@@ -9531,12 +9566,8 @@ function writeAdminEntry(input) {
   logLine(input, result);
   return result;
 }
-function checkAdminAuthInvariant(input) {
-  const result = {
-    divergences: 0,
-    accountWithoutUsers: [],
-    usersWithoutAccount: []
-  };
+function computeAdminStoreDivergence(input) {
+  const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
   const usersUserIds = /* @__PURE__ */ new Set();
   if (existsSync13(input.usersFile)) {
     try {
@@ -9548,8 +9579,7 @@ function checkAdminAuthInvariant(input) {
         }
       }
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`[${input.tag}] users.json unreadable usersFile=${input.usersFile} error=${msg}`);
+      result.errors.push({ source: input.usersFile, detail: err instanceof Error ? err.message : String(err) });
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
@@ -9558,9 +9588,7 @@ function checkAdminAuthInvariant(input) {
     try {
       entries = readdirSync12(input.accountsDir);
     } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      console.error(`[${input.tag}] accounts-dir unreadable accountsDir=${input.accountsDir} error=${msg}`);
-      console.error(`[${input.tag}] check complete divergences=0 (accounts-dir unreadable)`);
+      result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
     }
     for (const entry of entries) {
@@ -9578,18 +9606,13 @@ function checkAdminAuthInvariant(input) {
         const config = JSON.parse(readFileSync21(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[${input.tag}] account.json unreadable source=${accountJsonPath} error=${msg}`);
+        result.errors.push({ source: accountJsonPath, detail: err instanceof Error ? err.message : String(err) });
         continue;
       }
       for (const a of admins) {
         if (typeof a.userId !== "string") continue;
         accountUserIds.add(a.userId);
         if (!usersUserIds.has(a.userId)) {
-          const userIdShort = a.userId.slice(0, 8);
-          console.error(
-            `[${input.tag}] direction=account-without-users userId=${userIdShort} source=${accountJsonPath}`
-          );
           result.accountWithoutUsers.push({ userId: a.userId, source: accountJsonPath });
           result.divergences += 1;
         }
@@ -9598,17 +9621,30 @@ function checkAdminAuthInvariant(input) {
   }
   for (const uid of usersUserIds) {
     if (!accountUserIds.has(uid)) {
-      const userIdShort = uid.slice(0, 8);
-      console.error(
-        `[${input.tag}] direction=users-without-account userId=${userIdShort} source=${input.usersFile}`
-      );
       result.usersWithoutAccount.push({ userId: uid });
       result.divergences += 1;
     }
   }
-  console.error(`[${input.tag}] check complete divergences=${result.divergences}`);
   return result;
 }
+function checkAdminAuthInvariant(input) {
+  const d = computeAdminStoreDivergence({ usersFile: input.usersFile, accountsDir: input.accountsDir });
+  for (const e of d.errors) {
+    console.error(`[${input.tag}] unreadable source=${e.source} error=${e.detail}`);
+  }
+  for (const a of d.accountWithoutUsers) {
+    console.error(`[${input.tag}] direction=account-without-users userId=${a.userId.slice(0, 8)} source=${a.source}`);
+  }
+  for (const u of d.usersWithoutAccount) {
+    console.error(`[${input.tag}] direction=users-without-account userId=${u.userId.slice(0, 8)} source=${input.usersFile}`);
+  }
+  console.error(`[${input.tag}] check complete divergences=${d.divergences}`);
+  return {
+    divergences: d.divergences,
+    accountWithoutUsers: d.accountWithoutUsers,
+    usersWithoutAccount: d.usersWithoutAccount
+  };
+}
 
 // server/routes/onboarding.ts
 function hashPin2(pin) {
@@ -9763,7 +9799,8 @@ app9.post("/set-pin", async (c) => {
     role: "owner",
     usersFile: USERS_FILE,
     accountDir: account.accountDir,
-    caller: "set-pin"
+    caller: "set-pin",
+    audit: { actor: userId, logFile: USERS_AUDIT_LOG }
   });
   if (result.usersJsonResult !== "ok") {
     console.error(`[set-pin] users.json write failed: ${result.usersError ?? "unknown"}`);
@@ -9854,12 +9891,16 @@ app9.delete("/set-pin", async (c) => {
     writeFileSync10(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
     console.log(`[set-pin] removed entry from users.json: userId=${matchedUser.userId.slice(0, 8)}\u2026 remaining=${remaining.length}`);
   }
+  logUsersAudit(
+    { actor: matchedUser.userId, logFile: USERS_AUDIT_LOG },
+    { action: "remove", field: "row", rowsBefore: formatAuditRowIds(users.map((u) => u.userId)), rowsAfter: formatAuditRowIds(remaining.map((u) => u.userId)) }
+  );
   return c.json({ ok: true });
 });
 var onboarding_default = app9;
 
 // server/routes/client-error.ts
-import { appendFileSync, existsSync as existsSync15, renameSync as renameSync6, statSync as statSync8 } from "fs";
+import { appendFileSync as appendFileSync2, existsSync as existsSync15, renameSync as renameSync6, statSync as statSync8 } from "fs";
 import { join as join21 } from "path";
 var CLIENT_ERRORS_LOG = join21(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -10008,7 +10049,7 @@ app10.post("/", async (c) => {
         tag: typeof body.tag === "string" ? truncate(body.tag, 32) : void 0,
         status: typeof body.status === "number" ? body.status : void 0
       };
-      appendFileSync(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
+      appendFileSync2(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
     } catch (err) {
       console.error(`[client-error] append failed: ${err instanceof Error ? err.message : String(err)}`);
     }
@@ -10507,7 +10548,7 @@ import { existsSync as existsSync20, mkdirSync as mkdirSync5, createWriteStream
 async function purgeAdminConversationJsonls(args) {
   const fetchImpl = args.fetchImpl ?? fetch;
   const log = args.logger ?? ((line) => console.log(line));
-  const id8 = args.sessionId.slice(0, 8);
+  const id82 = args.sessionId.slice(0, 8);
   const purged = [];
   for (const sessionId of args.claudeSessionIds) {
     const url = `${args.managerBase}/${encodeURIComponent(sessionId)}`;
@@ -10517,7 +10558,7 @@ async function purgeAdminConversationJsonls(args) {
     } catch (err) {
       const message2 = err instanceof Error ? err.message : String(err);
       log(
-        `[admin-conversation-delete] sessionId=${id8} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message2}`
+        `[admin-conversation-delete] sessionId=${id82} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message2}`
       );
       return {
         ok: false,
@@ -10534,7 +10575,7 @@ async function purgeAdminConversationJsonls(args) {
     }
     if (res.status === 409) {
       log(
-        `[admin-conversation-delete] sessionId=${id8} reason=pty-still-alive claudeSessionId=${sessionId.slice(0, 8)}`
+        `[admin-conversation-delete] sessionId=${id82} reason=pty-still-alive claudeSessionId=${sessionId.slice(0, 8)}`
       );
       return {
         ok: false,
@@ -10551,7 +10592,7 @@ async function purgeAdminConversationJsonls(args) {
     } catch {
     }
     log(
-      `[admin-conversation-delete] sessionId=${id8} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message}`
+      `[admin-conversation-delete] sessionId=${id82} reason=jsonl-purge-failed claudeSessionId=${sessionId.slice(0, 8)} message=${message}`
     );
     return {
       ok: false,
@@ -10570,13 +10611,13 @@ async function cascadeAdminConversationDelete(args) {
   const started = Date.now();
   const fetchImpl = args.fetchImpl ?? fetch;
   const log = args.logger ?? ((line) => console.log(line));
-  const id8 = args.sessionId.slice(0, 8);
+  const id82 = args.sessionId.slice(0, 8);
   let claudeSessionIds;
   try {
     claudeSessionIds = args.claudeSessionIds ?? await getConversationClaudeSessionIds(args.sessionId, args.accountId);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    log(`[admin-conversation-delete] sessionId=${id8} reason=graph-delete-failed claudeSessionIds-purged= message=transcript-resolve:${message}`);
+    log(`[admin-conversation-delete] sessionId=${id82} reason=graph-delete-failed claudeSessionIds-purged= message=transcript-resolve:${message}`);
     return { ok: false, reason: "graph-delete-failed", claudeSessionIdsPurged: [], message };
   }
   const purgeOutcome = await purgeAdminConversationJsonls({
@@ -10607,7 +10648,7 @@ async function cascadeAdminConversationDelete(args) {
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     const csv2 = purged.map((s) => s.slice(0, 8)).join(",");
-    log(`[admin-conversation-delete] sessionId=${id8} reason=graph-delete-failed claudeSessionIds-purged=${csv2} message=${message}`);
+    log(`[admin-conversation-delete] sessionId=${id82} reason=graph-delete-failed claudeSessionIds-purged=${csv2} message=${message}`);
     return {
       ok: false,
       reason: "graph-delete-failed",
@@ -10620,7 +10661,7 @@ async function cascadeAdminConversationDelete(args) {
   }
   const ms = Date.now() - started;
   const csv = purged.map((s) => s.slice(0, 8)).join(",");
-  log(`[admin-conversation-delete] sessionId=${id8} claudeSessionIds=${csv} ms=${ms}`);
+  log(`[admin-conversation-delete] sessionId=${id82} claudeSessionIds=${csv} ms=${ms}`);
   return { ok: true, claudeSessionIds: purged, ms };
 }
 
@@ -16603,765 +16644,146 @@ app38.get("/", async (c) => {
 });
 var public_session_context_default = app38;
 
-// app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve26 } from "path";
-
-// app/lib/channel-pty-bridge/public-session-end-review.ts
-import { randomUUID as randomUUID13 } from "crypto";
-var TAG29 = "[public-session-review]";
-var CONSUMED_CAP = 500;
-var consumed = /* @__PURE__ */ new Set();
-function consumeOnce(sessionId) {
-  if (consumed.has(sessionId)) return false;
-  consumed.add(sessionId);
-  if (consumed.size > CONSUMED_CAP) {
-    const oldest = consumed.values().next().value;
-    if (oldest !== void 0) consumed.delete(oldest);
-  }
-  return true;
+// app/lib/webchat/gateway/instance.ts
+var instance2 = null;
+function setWebchatGateway(gw) {
+  instance2 = gw;
 }
-function managerBase3() {
-  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "public-session-end-review:manager" });
-  return `http://127.0.0.1:${port2}`;
+function getWebchatGateway() {
+  return instance2;
 }
-function uiBase() {
-  const port2 = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "public-session-end-review:ui" });
-  return `http://127.0.0.1:${port2}`;
+
+// server/routes/admin/public-session-exit.ts
+var TAG29 = "[public-session-exit-route]";
+function isLoopbackAddr4(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-async function fetchJsonl(sessionId) {
+var app39 = new Hono();
+app39.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr4(remoteAddr)) {
+    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "public-session-exit-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr4(t));
+    if (offender !== void 0) {
+      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "public-session-exit-loopback-only" }, 403);
+    }
+  }
+  let body;
   try {
-    const res = await fetch(`${managerBase3()}/${sessionId}/log?download=1`);
-    if (!res.ok) return null;
-    return await res.text();
-  } catch (err) {
-    console.error(
-      `${TAG29} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
-    );
-    return null;
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
+  if (!sessionId) return c.json({ error: "sessionId required" }, 400);
+  const gateway = getWebchatGateway();
+  if (!gateway) {
+    console.error(`${TAG29} reject reason=gateway-unset sessionId=${sessionId.slice(0, 8)}`);
+    return c.json({ error: "webchat-gateway-unset" }, 503);
   }
+  gateway.handlePublicSessionExit(sessionId);
+  return c.json({ ok: true });
+});
+var public_session_exit_default = app39;
+
+// server/routes/admin/access-session-evict.ts
+var TAG30 = "[access-session-evict]";
+function isLoopbackAddr5(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-function countOperatorTurns(jsonl) {
-  let count = 0;
-  for (const raw of jsonl.split("\n")) {
-    const line = raw.trim();
-    if (!line) continue;
-    try {
-      const obj = JSON.parse(line);
-      if (obj.type === "user") count += 1;
-    } catch {
+var app40 = new Hono();
+app40.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr5(remoteAddr)) {
+    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "access-session-evict-loopback-only" }, 403);
+  }
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr5(t));
+    if (offender !== void 0) {
+      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
-  return count;
-}
-async function fetchPriorWrites(sliceToken, accountId) {
-  const url = `${uiBase()}/api/admin/public-session-context?sliceToken=${encodeURIComponent(sliceToken)}&accountId=${encodeURIComponent(accountId)}`;
+  let body;
   try {
-    const res = await fetch(url);
-    if (!res.ok) {
-      console.error(
-        `${TAG29} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
-      );
-      return [];
-    }
-    const body = await res.json();
-    return Array.isArray(body.writes) ? body.writes : [];
-  } catch (err) {
-    console.error(
-      `${TAG29} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
-    );
-    return [];
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
   }
+  const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
+  if (!grantId) return c.json({ error: "grantId required" }, 400);
+  const dropped = evictAccessSessionsByGrant(grantId);
+  console.log(`${TAG30} grantId=${grantId} dropped=${dropped}`);
+  return c.json({ ok: true, dropped });
+});
+var access_session_evict_default = app40;
+
+// server/routes/admin/enrol-person.ts
+var TAG31 = "[enrol]";
+function isLoopbackAddr6(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-function composeInitialMessage(input) {
-  const priorJson = JSON.stringify(input.priorWrites, null, 2);
-  return [
-    `The gated public-agent session for agent "${input.agentSlug}" has just been reaped. Review the transcript and decide what is worth saving to the visitor's per-visitor memory slice. Dispatch \`database-operator\` for each individual write via the Task tool. Do not call memory-write or memory-update directly.`,
-    "",
-    "<slice-token>",
-    input.sliceToken,
-    "</slice-token>",
-    "",
-    "<person-id>",
-    input.personId ?? "(unknown)",
-    "</person-id>",
-    "",
-    "<prior-writes>",
-    priorJson,
-    "</prior-writes>",
-    "",
-    "<transcript>",
-    input.jsonl,
-    "</transcript>"
-  ].join("\n");
-}
-async function dispatchReviewer(input, initialMessage) {
-  const sessionId = randomUUID13();
-  console.log(`${TAG29} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
-  const spawned = await managerRcSpawn({
-    sessionId,
-    initialMessage,
-    closeAfterTurn: true,
-    sliceToken: input.sliceToken,
-    personId: input.personId ?? void 0,
-    logContext: `public-session-end sourceSession=${input.sessionId.slice(0, 8)}`
-  });
-  if ("error" in spawned) {
-    return { ok: false, reason: `rc-spawn-${spawned.status}-${spawned.error}` };
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var app41 = new Hono();
+app41.post("/", async (c) => {
+  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
+  if (!isLoopbackAddr6(remoteAddr)) {
+    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    return c.json({ error: "enrol-person-loopback-only" }, 403);
   }
-  return { ok: true, managerSessionId: spawned.sessionId };
-}
-async function firePublicSessionEndReview(input) {
-  const sliceShort = input.sliceToken.slice(0, 8);
-  const personField = input.personId ?? "none";
-  const dispatchedAt = Date.now();
-  if (consumed.has(input.sessionId)) {
-    console.log(
-      `${TAG29} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
-    );
-    return;
+  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
+  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+  if (xffRaw.length > 0) {
+    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
+    const offender = tokens.find((t) => !isLoopbackAddr6(t));
+    if (offender !== void 0) {
+      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      return c.json({ error: "enrol-person-loopback-only" }, 403);
+    }
   }
-  const jsonl = await fetchJsonl(input.sessionId);
-  if (!jsonl) {
-    console.log(
-      `${TAG29} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
-    );
-    return;
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "invalid-json" }, 400);
   }
-  const operatorTurns = countOperatorTurns(jsonl);
-  if (operatorTurns === 0) {
-    console.log(
-      `${TAG29} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
-    );
-    return;
+  const rawPhone = typeof body.phone === "string" ? body.phone : "";
+  const phone = normalizeE164(rawPhone);
+  if (phone.length <= 1) {
+    return c.json({ error: "invalid-phone" }, 400);
   }
-  const priorWrites = await fetchPriorWrites(input.sliceToken, input.accountId);
-  const initialMessage = composeInitialMessage({
-    agentSlug: input.agentSlug,
-    sliceToken: input.sliceToken,
-    personId: input.personId,
-    jsonl,
-    priorWrites
-  });
-  if (!consumeOnce(input.sessionId)) {
-    console.log(
-      `${TAG29} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
-    );
-    return;
+  const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+  if (!EMAIL_RE.test(email)) {
+    return c.json({ error: "invalid-email" }, 400);
   }
-  const dispatched = await dispatchReviewer(input, initialMessage);
-  if (!dispatched.ok) {
+  const agentSlug = typeof body.agentSlug === "string" ? body.agentSlug.trim() : "";
+  if (!agentSlug) {
+    return c.json({ error: "agentSlug required" }, 400);
+  }
+  const accountId = process.env.ACCOUNT_ID ?? "";
+  if (!accountId) {
+    console.error(`${TAG31} op=person result=no-account-id`);
+    return c.json({ error: "no-account-id" }, 500);
+  }
+  let personId;
+  try {
+    personId = await enrolPerson({ accountId, phone, email, agentSlug });
+  } catch (err) {
     console.error(
-      `${TAG29} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG31} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
-    return;
-  }
-  console.log(
-    `${TAG29} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
-  );
-}
-
-// app/lib/channel-pty-bridge/follower.ts
-function followerPendingMaxMs() {
-  return Number(process.env.CHANNEL_PTY_FOLLOWER_PENDING_MAX_MS ?? String(3e5));
-}
-function followerRetryMs() {
-  return Number(process.env.CHANNEL_PTY_FOLLOWER_RETRY_MS ?? String(1e3));
-}
-function startFollower(opts) {
-  const abort = new AbortController();
-  const { entry, tag } = opts;
-  void (async () => {
-    try {
-      const sid = entry.sessionId.slice(0, 8);
-      const deadline = Date.now() + followerPendingMaxMs();
-      const retryMs = followerRetryMs();
-      let res;
-      let attempt = 0;
-      for (; ; ) {
-        res = await fetch(
-          managerLogFollowUrl(entry.sessionId, { boundary: opts.suppressResumeReplay === true }),
-          { signal: abort.signal }
-        );
-        console.error(`${tag} follower-connect sessionId=${sid} status=${res.status}`);
-        if (res.status === 202) {
-          attempt += 1;
-          await res.body?.cancel().catch(() => {
-          });
-          if (abort.signal.aborted) return;
-          if (Date.now() >= deadline) {
-            console.error(`${tag} follower-give-up sessionId=${sid} reason=pending-timeout attempts=${attempt}`);
-            opts.onError?.("follow-pending-timeout");
-            return;
-          }
-          console.error(`${tag} follower-retry sessionId=${sid} attempt=${attempt} reason=pending`);
-          await new Promise((r) => setTimeout(r, retryMs));
-          if (abort.signal.aborted) return;
-          continue;
-        }
-        break;
-      }
-      if (!res.ok || !res.body) {
-        opts.onError?.(`follow-status-${res.status}`);
-        return;
-      }
-      console.error(`${tag} follower-open sessionId=${sid}`);
-      const reader = res.body.getReader();
-      const decoder = new TextDecoder("utf8");
-      let buffered = "";
-      const fileDelivery = opts.fileDelivery ?? null;
-      let firedFileTools = [];
-      let suppressing = opts.suppressResumeReplay === true;
-      let discardedTurns = 0;
-      let discardedFileTools = 0;
-      while (!abort.signal.aborted) {
-        const { value, done } = await reader.read();
-        if (done) break;
-        buffered += decoder.decode(value, { stream: true });
-        let nl = buffered.indexOf("\n");
-        while (nl !== -1) {
-          const line = buffered.slice(0, nl);
-          buffered = buffered.slice(nl + 1);
-          nl = buffered.indexOf("\n");
-          if (!line) continue;
-          let event;
-          try {
-            event = JSON.parse(line);
-          } catch (err) {
-            console.error(
-              `${tag} jsonl-parse-skip sessionId=${entry.sessionId.slice(0, 8)} bytes=${line.length} message=${err instanceof Error ? err.message : String(err)}`
-            );
-            continue;
-          }
-          if (event.type === "__channel_resume_boundary__") {
-            if (suppressing) {
-              suppressing = false;
-              console.error(
-                `${tag} follower-resume-boundary sessionId=${sid} discarded-head-turns=${discardedTurns} discarded-head-filetools=${discardedFileTools}`
-              );
-            }
-            continue;
-          }
-          if (event.type === "user") {
-            entry.pendingTurnText = "";
-            firedFileTools = [];
-            continue;
-          }
-          if (event.type !== "assistant") continue;
-          const msg = event.message;
-          if (!msg) continue;
-          let sawContent = false;
-          if (Array.isArray(msg.content)) {
-            for (const block of msg.content) {
-              if (block?.type === "text" && typeof block.text === "string") {
-                entry.pendingTurnText += block.text;
-                sawContent = true;
-              } else if (block?.type === "tool_use") {
-                sawContent = true;
-                if (fileDelivery && typeof block.name === "string" && fileDelivery.isFileDeliveryTool(block.name)) {
-                  if (suppressing) {
-                    discardedFileTools += 1;
-                    continue;
-                  }
-                  firedFileTools.push(block.name);
-                  try {
-                    await fileDelivery.onFileToolUse({ toolName: block.name, input: block.input });
-                  } catch (err) {
-                    console.error(
-                      `${tag} file-delivery-error sessionId=${sid} tool=${block.name} message=${err instanceof Error ? err.message : String(err)}`
-                    );
-                  }
-                }
-              }
-            }
-          }
-          if (msg.stop_reason === "end_turn") {
-            if (suppressing) {
-              entry.pendingTurnText = "";
-              firedFileTools = [];
-              discardedTurns += 1;
-              continue;
-            }
-            const flush = entry.pendingTurnText;
-            entry.pendingTurnText = "";
-            if (flush.trim()) {
-              await fanOut(entry.subscribers, flush, opts.onError, tag);
-            }
-            if (fileDelivery && firedFileTools.length > 0) {
-              const fired = firedFileTools;
-              firedFileTools = [];
-              try {
-                fileDelivery.onTurnEnd(fired);
-              } catch (err) {
-                console.error(
-                  `${tag} file-delivery-error sessionId=${sid} phase=turn-end message=${err instanceof Error ? err.message : String(err)}`
-                );
-              }
-            }
-            opts.onTurnComplete?.();
-          } else if (sawContent && !suppressing) {
-            opts.onActivity?.();
-          }
-        }
-      }
-    } catch (err) {
-      if (!abort.signal.aborted) {
-        opts.onError?.(`follower-error: ${err instanceof Error ? err.message : String(err)}`);
-      }
-    } finally {
-      opts.onClose();
-    }
-  })();
-  return abort;
-}
-async function fanOut(subscribers, text, onError, tag) {
-  const callbacks = Array.from(subscribers);
-  await Promise.all(
-    callbacks.map(
-      (cb) => Promise.resolve().then(() => cb(text)).catch((err) => {
-        const m = err instanceof Error ? err.message : String(err);
-        console.error(`${tag} subscriber-error message=${m}`);
-        onError?.(`subscriber-error: ${m}`);
-      })
-    )
-  );
-}
-
-// app/lib/channel-pty-bridge/file-delivery.ts
-var SEND_USER_FILE = "SendUserFile";
-function makeFileDelivery(opts) {
-  const { entry, tag, channel, sendFile } = opts;
-  let failedFiles = [];
-  let attempts = 0;
-  return {
-    isFileDeliveryTool(toolName) {
-      return toolName === SEND_USER_FILE;
-    },
-    async onFileToolUse(use) {
-      if (use.toolName !== SEND_USER_FILE) return;
-      const input = use.input ?? {};
-      const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
-      const caption = typeof input.caption === "string" ? input.caption : void 0;
-      for (let i = 0; i < files.length; i++) {
-        attempts++;
-        const result = await sendFile(files[i], i === 0 ? caption : void 0);
-        const name = files[i].split("/").pop() ?? files[i];
-        console.error(`${tag} op=file-forward channel=${channel} file=${name} outcome=${result.ok ? "ok" : "fail"}`);
-        if (!result.ok) failedFiles.push(files[i]);
-      }
-    },
-    onTurnEnd(firedTools) {
-      const failed = failedFiles;
-      const tried = attempts;
-      failedFiles = [];
-      attempts = 0;
-      const sid = entry.sessionId.slice(0, 8);
-      for (const file of failed) {
-        console.error(
-          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
-        );
-      }
-      if (firedTools.includes(SEND_USER_FILE) && tried === 0) {
-        console.error(
-          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
-        );
-      }
-    }
-  };
-}
-
-// app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG30 = "[whatsapp-adaptor]";
-var SEND_USER_FILE2 = "SendUserFile";
-var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
-function platformRoot() {
-  return process.env.MAXY_PLATFORM_ROOT || "";
-}
-function makeWhatsAppSendFile(entry) {
-  return async (filePath, caption) => {
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      console.error(
-        `${TAG30} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
-      );
-      return { ok: false, error: "account-unresolved" };
-    }
-    const result = await sendWhatsAppDocument({
-      to: entry.senderId,
-      filePath,
-      caption,
-      accountId: entry.accountId,
-      maxyAccountId,
-      platformRoot: platformRoot()
-    });
-    if (result.ok) return { ok: true };
-    console.error(
-      `${TAG30} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
-    );
-    return { ok: false, error: result.error };
-  };
-}
-function makeWhatsAppFileDelivery(entry) {
-  const shared = makeFileDelivery({
-    entry,
-    tag: TAG30,
-    channel: "whatsapp",
-    sendFile: makeWhatsAppSendFile(entry)
-  });
-  let turnStartedAt = null;
-  let routeCalls = [];
-  return {
-    isFileDeliveryTool(toolName) {
-      return toolName === SEND_USER_FILE2 || toolName === WHATSAPP_SEND_DOCUMENT;
-    },
-    async onFileToolUse(use) {
-      if (turnStartedAt === null) turnStartedAt = Date.now();
-      if (use.toolName === WHATSAPP_SEND_DOCUMENT) {
-        const input = use.input ?? {};
-        routeCalls.push({
-          to: typeof input.to === "string" ? input.to : void 0,
-          filePath: typeof input.filePath === "string" ? input.filePath : void 0
-        });
-        return;
-      }
-      await shared.onFileToolUse(use);
-    },
-    onTurnEnd(firedTools) {
-      const startedAt = turnStartedAt ?? 0;
-      const routes = routeCalls;
-      turnStartedAt = null;
-      routeCalls = [];
-      const sid = entry.sessionId.slice(0, 8);
-      shared.onTurnEnd(firedTools);
-      for (const call of routes) {
-        const routeAt = call.to !== void 0 && call.filePath !== void 0 ? routeDocumentOutboundAt(call.to, call.filePath) : void 0;
-        const delivered = routeAt !== void 0 && routeAt >= startedAt;
-        if (!delivered) {
-          const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
-          console.error(
-            `${TAG30} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
-          );
-        }
-      }
-    }
-  };
-}
-
-// app/lib/telegram/outbound/send-document.ts
-import { realpathSync as realpathSync5 } from "fs";
-import { readFile as readFile6, stat as stat6 } from "fs/promises";
-import { resolve as resolve24, basename as basename9 } from "path";
-var TAG31 = "[telegram:outbound]";
-var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
-async function sendTelegramDocument(input) {
-  const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot3 } = input;
-  if (!botToken || !filePath) {
-    return { ok: false, status: 400, error: "Missing required fields: botToken, filePath" };
-  }
-  if (!maxyAccountId || !platformRoot3) {
-    return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
-  }
-  const accountDir = resolve24(platformRoot3, "..", "data/accounts", maxyAccountId);
-  let resolvedPath;
-  try {
-    resolvedPath = realpathSync5(filePath);
-    const accountResolved = realpathSync5(accountDir);
-    if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG31} document REJECTED reason=outside_account_directory`);
-      return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
-    }
-  } catch (err) {
-    const code = err.code;
-    if (code === "ENOENT") {
-      console.error(`${TAG31} document ENOENT path=${filePath}`);
-      return { ok: false, status: 404, error: `File not found: ${filePath}` };
-    }
-    console.error(`${TAG31} document path error: ${String(err)}`);
-    return { ok: false, status: 500, error: String(err) };
-  }
-  const fileStat = await stat6(resolvedPath);
-  if (fileStat.size > TELEGRAM_DOCUMENT_MAX_BYTES) {
-    return {
-      ok: false,
-      status: 400,
-      error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
-    };
-  }
-  const filename = basename9(resolvedPath);
-  const buffer = Buffer.from(await readFile6(resolvedPath));
-  const form = new FormData();
-  form.append("chat_id", String(chatId));
-  if (caption) form.append("caption", caption);
-  form.append("document", new File([buffer], filename, { type: detectMimeType(resolvedPath) }));
-  let ok = false;
-  let messageId;
-  let error = "send failed";
-  try {
-    const res = await fetch(`https://api.telegram.org/bot${botToken}/sendDocument`, {
-      method: "POST",
-      body: form
-    });
-    const data = await res.json();
-    ok = data.ok;
-    messageId = data.result?.message_id;
-    if (!data.ok) error = data.description ?? "Unknown Telegram error";
-  } catch (e) {
-    error = e instanceof Error ? e.message : String(e);
-  }
-  console.error(
-    `${TAG31} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
-  );
-  return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
-}
-
-// app/lib/telegram/outbound/file-delivery.ts
-var TAG32 = "[telegram:outbound]";
-function platformRoot2() {
-  return process.env.MAXY_PLATFORM_ROOT || "";
-}
-function makeTelegramSendFile(entry) {
-  let botToken;
-  return async (filePath, caption) => {
-    if (botToken === void 0) {
-      const tg = resolveAccount()?.config.telegram;
-      botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
-    }
-    if (!botToken) {
-      console.error(`${TAG32} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
-      return { ok: false, error: "no-bot-token" };
-    }
-    if (entry.replyTarget == null) {
-      console.error(`${TAG32} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
-      return { ok: false, error: "no-reply-target" };
-    }
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      console.error(
-        `${TAG32} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
-      );
-      return { ok: false, error: "account-unresolved" };
-    }
-    const result = await sendTelegramDocument({
-      botToken,
-      chatId: Number(entry.replyTarget),
-      filePath,
-      caption,
-      maxyAccountId,
-      platformRoot: platformRoot2()
-    });
-    return result.ok ? { ok: true } : { ok: false, error: result.error };
-  };
-}
-function makeTelegramFileDelivery(entry) {
-  return makeFileDelivery({
-    entry,
-    tag: TAG32,
-    channel: "telegram",
-    sendFile: makeTelegramSendFile(entry)
-  });
-}
-
-// app/lib/webchat/file-delivery.ts
-import { realpathSync as realpathSync6 } from "fs";
-import { resolve as resolve25 } from "path";
-
-// app/lib/channel-pty-bridge/bridge.ts
-function tagFor(channel) {
-  return `[${channel}-adaptor]`;
-}
-function publicIdleMs() {
-  return Number(process.env.CHANNEL_PTY_IDLE_MS ?? String(5 * 6e4));
-}
-var index = /* @__PURE__ */ new Map();
-var reaperHandle = null;
-function startReaper() {
-  if (reaperHandle) return;
-  reaperHandle = setInterval(() => {
-    const now = Date.now();
-    const cutoff = now - publicIdleMs();
-    for (const [key, entry] of index) {
-      if (entry.role !== "public") continue;
-      if (entry.subscribers.size > 0) continue;
-      if (entry.lastInboundAt > cutoff) continue;
-      const idleMs = now - entry.lastInboundAt;
-      const tag = tagFor(entry.channel);
-      console.error(
-        `${tag} reap senderId=${entry.senderId} idle-ms=${idleMs} sessionId=${entry.sessionId.slice(0, 8)}`
-      );
-      if (entry.followerAbort) entry.followerAbort.abort();
-      index.delete(key);
-      if (entry.role === "public" && entry.sliceToken.length > 0) {
-        void firePublicSessionEndReview({
-          sessionId: entry.sessionId,
-          sliceToken: entry.sliceToken,
-          personId: entry.personId,
-          accountId: entry.accountId,
-          agentSlug: entry.agentSlug,
-          dispatchFor: "eviction"
-        });
-      }
-      void managerDelete(entry.sessionId);
-    }
-  }, 6e4);
-  if (reaperHandle.unref) reaperHandle.unref();
-}
-function handlePublicSessionExit(sessionId) {
-  let found = null;
-  for (const [key2, entry2] of index) {
-    if (entry2.sessionId === sessionId) {
-      found = { key: key2, entry: entry2 };
-      break;
-    }
-  }
-  if (!found) {
-    console.error(`[public-session-exit] sessionId=${sessionId} result=no-entry`);
-    return;
-  }
-  const { key, entry } = found;
-  if (entry.role !== "public" || entry.sliceToken.length === 0) {
-    return;
-  }
-  if (entry.followerAbort) entry.followerAbort.abort();
-  index.delete(key);
-  void firePublicSessionEndReview({
-    sessionId: entry.sessionId,
-    sliceToken: entry.sliceToken,
-    personId: entry.personId,
-    accountId: entry.accountId,
-    agentSlug: entry.agentSlug,
-    dispatchFor: "exit"
-  });
-}
-
-// server/routes/admin/public-session-exit.ts
-var TAG33 = "[public-session-exit-route]";
-function isLoopbackAddr4(addr) {
-  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
-}
-var app39 = new Hono();
-app39.post("/", async (c) => {
-  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG33} reject reason=non-loopback remoteAddr=${remoteAddr}`);
-    return c.json({ error: "public-session-exit-loopback-only" }, 403);
-  }
-  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
-  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
-  if (xffRaw.length > 0) {
-    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr4(t));
-    if (offender !== void 0) {
-      console.error(`${TAG33} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
-      return c.json({ error: "public-session-exit-loopback-only" }, 403);
-    }
-  }
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "invalid-json" }, 400);
-  }
-  const sessionId = typeof body.sessionId === "string" ? body.sessionId.trim() : "";
-  if (!sessionId) return c.json({ error: "sessionId required" }, 400);
-  handlePublicSessionExit(sessionId);
-  return c.json({ ok: true });
-});
-var public_session_exit_default = app39;
-
-// server/routes/admin/access-session-evict.ts
-var TAG34 = "[access-session-evict]";
-function isLoopbackAddr5(addr) {
-  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
-}
-var app40 = new Hono();
-app40.post("/", async (c) => {
-  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG34} reject reason=non-loopback remoteAddr=${remoteAddr}`);
-    return c.json({ error: "access-session-evict-loopback-only" }, 403);
-  }
-  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
-  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
-  if (xffRaw.length > 0) {
-    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr5(t));
-    if (offender !== void 0) {
-      console.error(`${TAG34} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
-      return c.json({ error: "access-session-evict-loopback-only" }, 403);
-    }
-  }
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "invalid-json" }, 400);
-  }
-  const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
-  if (!grantId) return c.json({ error: "grantId required" }, 400);
-  const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG34} grantId=${grantId} dropped=${dropped}`);
-  return c.json({ ok: true, dropped });
-});
-var access_session_evict_default = app40;
-
-// server/routes/admin/enrol-person.ts
-var TAG35 = "[enrol]";
-function isLoopbackAddr6(addr) {
-  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
-}
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var app41 = new Hono();
-app41.post("/", async (c) => {
-  const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr6(remoteAddr)) {
-    console.error(`${TAG35} reject reason=non-loopback remoteAddr=${remoteAddr}`);
-    return c.json({ error: "enrol-person-loopback-only" }, 403);
-  }
-  const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
-  const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
-  if (xffRaw.length > 0) {
-    const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr6(t));
-    if (offender !== void 0) {
-      console.error(`${TAG35} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
-      return c.json({ error: "enrol-person-loopback-only" }, 403);
-    }
-  }
-  let body;
-  try {
-    body = await c.req.json();
-  } catch {
-    return c.json({ error: "invalid-json" }, 400);
-  }
-  const rawPhone = typeof body.phone === "string" ? body.phone : "";
-  const phone = normalizeE164(rawPhone);
-  if (phone.length <= 1) {
-    return c.json({ error: "invalid-phone" }, 400);
-  }
-  const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-  if (!EMAIL_RE.test(email)) {
-    return c.json({ error: "invalid-email" }, 400);
-  }
-  const agentSlug = typeof body.agentSlug === "string" ? body.agentSlug.trim() : "";
-  if (!agentSlug) {
-    return c.json({ error: "agentSlug required" }, 400);
-  }
-  const accountId = process.env.ACCOUNT_ID ?? "";
-  if (!accountId) {
-    console.error(`${TAG35} op=person result=no-account-id`);
-    return c.json({ error: "no-account-id" }, 500);
-  }
-  let personId;
-  try {
-    personId = await enrolPerson({ accountId, phone, email, agentSlug });
-  } catch (err) {
-    console.error(
-      `${TAG35} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
-    );
-    return c.json({ error: "enrol-failed" }, 500);
+    return c.json({ error: "enrol-failed" }, 500);
   }
   let grant = null;
   try {
@@ -17369,11 +16791,11 @@ app41.post("/", async (c) => {
     if (g) grant = { grantId: g.grantId, status: g.status, contactValue: g.contactValue };
   } catch (err) {
     console.error(
-      `${TAG35} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG31} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
   }
   console.log(
-    `${TAG35} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
+    `${TAG31} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
   );
   return c.json({ personId, grant }, 200);
 });
@@ -17411,6 +16833,10 @@ app42.post("/launch", requireAdminSession, async (c) => {
 });
 var browser_default = app42;
 
+// server/routes/admin/calendar.ts
+import { existsSync as existsSync26 } from "fs";
+import { join as join28 } from "path";
+
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
 var PRODID = "-//Maxy//Calendar//EN";
@@ -17495,16 +16921,59 @@ function countVEvents(ics) {
       nested = 0;
       continue;
     }
-    if (!inEvent) continue;
-    if (line === "END:VEVENT") {
-      inEvent = false;
-      count++;
-      continue;
+    if (!inEvent) continue;
+    if (line === "END:VEVENT") {
+      inEvent = false;
+      count++;
+      continue;
+    }
+    if (line.startsWith("BEGIN:")) nested++;
+    else if (line.startsWith("END:") && nested > 0) nested--;
+  }
+  return count;
+}
+
+// server/lib/calendar-availability.ts
+import { readFileSync as readFileSync28 } from "fs";
+import { join as join27 } from "path";
+var AVAILABILITY_FILENAME = "calendar-availability.json";
+var REQUIRED_KEYS = [
+  "timezone",
+  "durationMins",
+  "bufferMins",
+  "weekly"
+];
+function readAvailabilityConfig(accountDir) {
+  const path2 = join27(accountDir, AVAILABILITY_FILENAME);
+  let raw;
+  try {
+    raw = readFileSync28(path2, "utf-8");
+  } catch {
+    throw new Error(`availability not configured: ${path2} not found`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`invalid JSON in ${path2}: ${err.message}`);
+  }
+  const cfg = parsed;
+  for (const key of REQUIRED_KEYS) {
+    if (cfg[key] === void 0 || cfg[key] === null) {
+      throw new Error(`availability config ${path2} missing required key: ${key}`);
+    }
+  }
+  if (cfg.daysAhead !== void 0 && cfg.daysAhead !== null) {
+    if (typeof cfg.daysAhead !== "number" || !Number.isInteger(cfg.daysAhead) || cfg.daysAhead < 1) {
+      throw new Error(`availability config ${path2} invalid daysAhead: must be a positive integer`);
     }
-    if (line.startsWith("BEGIN:")) nested++;
-    else if (line.startsWith("END:") && nested > 0) nested--;
   }
-  return count;
+  if (cfg.allowMultiSlot !== void 0 && cfg.allowMultiSlot !== null) {
+    if (typeof cfg.allowMultiSlot !== "boolean") {
+      throw new Error(`availability config ${path2} invalid allowMultiSlot: must be a boolean`);
+    }
+  }
+  return cfg;
 }
 
 // server/routes/admin/calendar.ts
@@ -17830,6 +17299,29 @@ app43.delete("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
+app43.get("/booking-link", requireAdminSession, (c) => {
+  try {
+    const account = resolveAccount();
+    if (!account) {
+      console.error('[calendar] op=booking-link-fail err="no account configured"');
+      return c.json({ bookingDomain: null });
+    }
+    if (!existsSync26(join28(account.accountDir, AVAILABILITY_FILENAME))) {
+      console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
+      return c.json({ bookingDomain: null });
+    }
+    const config = readAvailabilityConfig(account.accountDir);
+    const bookingDomain = typeof config.bookingDomain === "string" && config.bookingDomain.trim() ? config.bookingDomain.trim() : null;
+    console.log(
+      `[calendar] op=booking-link bookingDomain=${bookingDomain ?? "none"} source=availability-config`
+    );
+    return c.json({ bookingDomain });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(`[calendar] op=booking-link-fail err="${message}"`);
+    return c.json({ bookingDomain: null });
+  }
+});
 var calendar_default = app43;
 
 // server/routes/admin/index.ts
@@ -17871,7 +17363,7 @@ app44.route("/calendar", calendar_default);
 var admin_default = app44;
 
 // server/routes/access/verify-token.ts
-var TAG36 = "[access-verify]";
+var TAG32 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
 var app45 = new Hono();
@@ -17890,39 +17382,39 @@ app45.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG36} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG32} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG36} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG32} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -17938,12 +17430,12 @@ app45.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG36} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -17961,9 +17453,9 @@ var verify_token_default = app45;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve27 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve27(process.cwd(), "..");
-var SEND_SCRIPT = resolve27(
+import { resolve as resolve24 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+var SEND_SCRIPT = resolve24(
   PLATFORM_ROOT7,
   "plugins",
   "email",
@@ -18019,7 +17511,7 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG37 = "[access-request-link]";
+var TAG33 = "[access-request-link]";
 var app46 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
 app46.post("/", async (c) => {
@@ -18036,18 +17528,18 @@ app46.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG37} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG33} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG37} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG33} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG37} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG33} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -18055,7 +17547,7 @@ app46.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG37} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG33} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -18087,12 +17579,12 @@ app46.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG37} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG33} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG37} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG33} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
@@ -18105,8 +17597,8 @@ app47.route("/request-magic-link", request_magic_link_default);
 var access_default = app47;
 
 // server/routes/sites.ts
-import { existsSync as existsSync26, readFileSync as readFileSync28, realpathSync as realpathSync7, statSync as statSync11 } from "fs";
-import { resolve as resolve28 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync29, realpathSync as realpathSync5, statSync as statSync11 } from "fs";
+import { resolve as resolve25 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -18163,15 +17655,15 @@ app48.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve28(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve28(rootDir, ...segments);
+  const rootDir = resolve25(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve25(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
   let stat8;
   try {
-    stat8 = existsSync26(filePath) ? statSync11(filePath) : null;
+    stat8 = existsSync27(filePath) ? statSync11(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -18184,21 +17676,21 @@ app48.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat8?.isDirectory()) {
-    filePath = resolve28(filePath, "index.html");
+    filePath = resolve25(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync26(filePath)) {
+  if (!existsSync27(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
   let realPath;
   let realRoot;
   try {
-    realPath = realpathSync7(filePath);
-    realRoot = realpathSync7(rootDir);
+    realPath = realpathSync5(filePath);
+    realRoot = realpathSync5(rootDir);
   } catch {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
@@ -18209,7 +17701,7 @@ app48.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync28(realPath);
+    body = readFileSync29(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -18245,7 +17737,7 @@ var sites_default = app48;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync29, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync30, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname7 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -18254,7 +17746,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync29(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync30(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -18268,7 +17760,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync29(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync30(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -18321,8 +17813,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync27, readFileSync as readFileSync30 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync31 } from "fs";
+import { join as join29 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -18330,10 +17822,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot3) return null;
-  const brandPath = join27(platformRoot3, "config", "brand.json");
-  if (!existsSync27(brandPath)) return null;
+  const brandPath = join29(platformRoot3, "config", "brand.json");
+  if (!existsSync28(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync30(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync31(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -18821,14 +18313,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app51;
 
 // server/routes/session.ts
-import { resolve as resolve29 } from "path";
-import { existsSync as existsSync28, writeFileSync as writeFileSync12, mkdirSync as mkdirSync7 } from "fs";
+import { resolve as resolve26 } from "path";
+import { existsSync as existsSync29, writeFileSync as writeFileSync12, mkdirSync as mkdirSync7 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve29(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve26(MAXY_DIR, "branding-cache", accountId);
     mkdirSync7(cacheDir, { recursive: true });
-    writeFileSync12(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync12(resolve26(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -18905,8 +18397,8 @@ app52.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve29(account.accountDir, "agents", agentSlug);
-    if (!existsSync28(agentDir) || !existsSync28(resolve29(agentDir, "config.json"))) {
+    const agentDir = resolve26(account.accountDir, "agents", agentSlug);
+    if (!existsSync29(agentDir) || !existsSync29(resolve26(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -19014,39 +18506,6 @@ app52.post("/", async (c) => {
 });
 var session_default2 = app52;
 
-// server/lib/calendar-availability.ts
-import { readFileSync as readFileSync31 } from "fs";
-import { join as join28 } from "path";
-var AVAILABILITY_FILENAME = "calendar-availability.json";
-var REQUIRED_KEYS = [
-  "timezone",
-  "durationMins",
-  "bufferMins",
-  "weekly"
-];
-function readAvailabilityConfig(accountDir) {
-  const path2 = join28(accountDir, AVAILABILITY_FILENAME);
-  let raw;
-  try {
-    raw = readFileSync31(path2, "utf-8");
-  } catch {
-    throw new Error(`availability not configured: ${path2} not found`);
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch (err) {
-    throw new Error(`invalid JSON in ${path2}: ${err.message}`);
-  }
-  const cfg = parsed;
-  for (const key of REQUIRED_KEYS) {
-    if (cfg[key] === void 0 || cfg[key] === null) {
-      throw new Error(`availability config ${path2} missing required key: ${key}`);
-    }
-  }
-  return cfg;
-}
-
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
 function tzOffsetMs(instant, timeZone) {
@@ -19301,7 +18760,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve30, sep as sep8 } from "path";
+import { resolve as resolve27, sep as sep8 } from "path";
 var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
@@ -19320,7 +18779,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve30(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve27(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -19341,7 +18800,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve30(dataRoot, relativePath);
+    const absolute = resolve27(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -19365,7 +18824,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve30(dataRoot, rootName);
+    const absRoot = resolve27(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -19404,7 +18863,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname8, relative as relative6, resolve as resolve31 } from "path";
+import { dirname as dirname8, relative as relative6, resolve as resolve28 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -19415,7 +18874,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve31(dir, e.name);
+    const abs = resolve28(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -19435,7 +18894,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
-    const newAbs = resolve31(destDir, suffix);
+    const newAbs = resolve28(destDir, suffix);
     await mkdir5(dirname8(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
@@ -19462,7 +18921,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve31(dataRoot, "uploads");
+  const oldRoot = resolve28(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir5(oldRoot, { withFileTypes: true });
@@ -19483,8 +18942,8 @@ async function migrateUploads(opts = {}) {
       const name = entry.name;
       if (ACCOUNT_UUID_RE4.test(name)) {
         moved += await relocateTree(
-          resolve31(oldRoot, name),
-          resolve31(dataRoot, "accounts", name, "uploads"),
+          resolve28(oldRoot, name),
+          resolve28(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -19496,8 +18955,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve31(oldRoot, "public"),
-          resolve31(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve28(oldRoot, "public"),
+          resolve28(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -19526,9 +18985,9 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir6, readFile as readFile7, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync29 } from "fs";
-import { join as join29 } from "path";
+import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
+import { existsSync as existsSync30 } from "fs";
+import { join as join30 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -19539,7 +18998,7 @@ var defaultResolveName = async (accountId, userId) => {
 async function readRaw2(path2) {
   let raw;
   try {
-    raw = await readFile7(path2, "utf8");
+    raw = await readFile6(path2, "utf8");
   } catch {
     return null;
   }
@@ -19557,7 +19016,7 @@ async function writeRaw(path2, obj) {
     await rename3(tmp, path2);
   } catch (err) {
     try {
-      if (existsSync29(tmp)) await unlink3(tmp);
+      if (existsSync30(tmp)) await unlink3(tmp);
     } catch {
     }
     throw err;
@@ -19573,7 +19032,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join29(projectsRoot, slug.name);
+    const slugDir = join30(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -19582,9 +19041,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join29(slugDir, entry.name));
+        out.push(join30(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join29(slugDir, entry.name);
+        const subDir = join30(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -19592,7 +19051,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join29(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join30(subDir, s.name));
         }
       }
     }
@@ -19604,7 +19063,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join29(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join30(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -20508,16 +19967,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve35) => {
+    return new Promise((resolve33) => {
       const timer2 = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve35({ timeout: true });
+        resolve33({ timeout: true });
       }, timeoutMs);
       if (timer2.unref) timer2.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer2);
         this.replyAwaiters.delete(key);
-        resolve35(r);
+        resolve33(r);
       });
     });
   }
@@ -20528,11 +19987,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve35) => {
+    return new Promise((resolve33) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer2 = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve35({ timeout: true });
+        resolve33({ timeout: true });
       }, timeoutMs);
       if (timer2.unref) timer2.unref();
       this.pendingPrompts.set(k, {
@@ -20541,7 +20000,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer2);
           this.pendingPrompts.delete(k);
-          resolve35(r);
+          resolve33(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -20613,6 +20072,45 @@ var WebchatGateway = class _WebchatGateway {
     if (handle.unref) handle.unref();
     return handle;
   }
+  /** A gated public PTY exited explicitly on the manager side (operator stop,
+   *  claude crash, manager DELETE), not via the idle reaper. The manager POSTs
+   *  the sessionId to the loopback /api/admin/public-session-exit route, which
+   *  reaches this through the process-wide gateway handle. The slice ringfence
+   *  the reviewer needs lives only in this gateway's publicSessions map — the
+   *  manager has none of it — so resolve the record here and dispatch the same
+   *  reviewer the idle reaper uses, tagged dispatchFor='exit'. Dedup is internal
+   *  to firePublicSessionEndReview, so a session already reviewed by the reaper
+   *  (or a racing respawn) is a no-op.
+   *
+   *  Only gated records (non-empty slice) are reviewed and evicted here, the
+   *  same gate the reaper applies. An open-mode public record is left for the
+   *  idle reaper. No deleteSession — the PTY is already gone and the JSONL is
+   *  the audit record the reviewer just read. */
+  handlePublicSessionExit(sessionId) {
+    let found = null;
+    for (const [key2, rec2] of this.publicSessions) {
+      if (rec2.sessionId === sessionId) {
+        found = { key: key2, rec: rec2 };
+        break;
+      }
+    }
+    if (!found) {
+      console.error(`[webchat:inbound] op=public-exit sessionId=${sessionId.slice(0, 8)} result=no-record`);
+      return;
+    }
+    const { key, rec } = found;
+    if (!rec.sliceToken || rec.sliceToken.length === 0) return;
+    this.publicSessions.delete(key);
+    console.error(`[webchat:inbound] op=public-exit key=${keyDisplay(key)} sessionId=${sessionId.slice(0, 8)} result=review`);
+    void this.deps.firePublicSessionEndReview?.({
+      sessionId: rec.sessionId,
+      sliceToken: rec.sliceToken,
+      personId: rec.personId ?? null,
+      accountId: rec.accountId,
+      agentSlug: rec.agentSlug,
+      dispatchFor: "exit"
+    });
+  }
   /** Hono sub-app exposing the loopback channel routes; mount on the UI app. */
   routes() {
     return createWebchatChannelRoutes({
@@ -20729,97 +20227,385 @@ var WebchatGateway = class _WebchatGateway {
           );
         }
       }
-      for (const key of this.recoverable.keys()) {
-        if (!this.hub.hasInFlight(key)) this.recoverable.delete(key);
-      }
-      if (this.recoveryAttempted.size > 0) {
-        const liveIds = this.hub.inFlightIds();
-        for (const attemptKey of this.recoveryAttempted) {
-          if (!liveIds.has(attemptKey)) this.recoveryAttempted.delete(attemptKey);
-        }
+      for (const key of this.recoverable.keys()) {
+        if (!this.hub.hasInFlight(key)) this.recoverable.delete(key);
+      }
+      if (this.recoveryAttempted.size > 0) {
+        const liveIds = this.hub.inFlightIds();
+        for (const attemptKey of this.recoveryAttempted) {
+          if (!liveIds.has(attemptKey)) this.recoveryAttempted.delete(attemptKey);
+        }
+      }
+    } finally {
+      this.recovering = false;
+    }
+  }
+  /** Handle one inbound webchat message (browser POST → here). */
+  async handleInbound(input) {
+    const bytes = Buffer.byteLength(input.text, "utf8");
+    const hadSubscriber = this.hub.hasSubscriber(input.key);
+    const willDeliverNow = this.hub.isReady(input.key);
+    this.hub.deliver(
+      { key: input.key, text: input.text, messageId: `wc-${++this.seq}` },
+      Date.now()
+    );
+    if (willDeliverNow) this.lastDeliveredAt.set(input.key, Date.now());
+    console.error(
+      `[webchat:inbound] op=received key=${keyDisplay(input.key)} role=${input.role} bytes=${bytes} delivery=${willDeliverNow ? "immediate" : "queued"}`
+    );
+    if (input.role === "admin") {
+      this.recoverable.set(input.key, {
+        accountId: input.accountId,
+        key: input.key,
+        role: input.role,
+        ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
+        ...input.adminUserId !== void 0 ? { adminUserId: input.adminUserId } : {}
+      });
+    }
+    const existing = this.publicSessions.get(input.key);
+    if (existing) existing.lastActivityAt = Date.now();
+    if (!hadSubscriber && !this.spawning.has(input.key)) {
+      this.spawning.add(input.key);
+      console.error(`[webchat:inbound] op=spawn-trigger key=${input.key} role=${input.role}`);
+      try {
+        const spawned = await this.deps.ensureChannelSession({
+          accountId: input.accountId,
+          key: input.key,
+          role: input.role,
+          gatewayUrl: this.deps.gatewayUrl,
+          serverPath: this.deps.serverPath,
+          // Task 800 — only present on a session-targeted launch, so the
+          // default-path call shape stays byte-identical.
+          ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
+          // The authenticated admin's userId on an admin bootstrap inbound; the
+          // default-path call shape stays byte-identical when absent.
+          ...input.adminUserId !== void 0 ? { adminUserId: input.adminUserId } : {},
+          // Task 756 — public spawn params on a role:'public' inbound.
+          ...input.public !== void 0 ? { public: input.public } : {}
+        });
+        if (input.role === "public" && input.public && spawned && "sessionId" in spawned) {
+          this.publicSessions.set(input.key, {
+            sessionId: spawned.sessionId,
+            accountId: input.accountId,
+            agentSlug: input.public.agentSlug,
+            sliceToken: input.public.sliceToken,
+            personId: input.public.personId,
+            lastActivityAt: Date.now()
+          });
+        }
+      } finally {
+        this.spawning.delete(input.key);
+      }
+    }
+  }
+};
+
+// app/lib/webchat/gateway/public-spawn-request.ts
+function buildPublicWebchatSpawnRequest(input) {
+  const { agentSlug, sliceToken, personId, visitorId, name } = input.public;
+  return {
+    senderId: input.key,
+    role: "public",
+    channel: "webchat",
+    accountId: input.accountId,
+    agentSlug,
+    model: SONNET_MODEL,
+    // sliceToken/personId are present only for a gated visitor; open-mode
+    // public agents carry neither (mirrors the bridge's open-mode key).
+    ...sliceToken ? { sliceToken } : {},
+    ...personId ? { personId } : {},
+    ...visitorId ? { visitorId } : {},
+    ...input.previousContext ? { previousContext: input.previousContext } : {},
+    name,
+    webchatChannel: { key: input.key, gatewayUrl: input.gatewayUrl, serverPath: input.serverPath }
+  };
+}
+
+// app/lib/channel-pty-bridge/follower.ts
+function followerPendingMaxMs() {
+  return Number(process.env.CHANNEL_PTY_FOLLOWER_PENDING_MAX_MS ?? String(3e5));
+}
+function followerRetryMs() {
+  return Number(process.env.CHANNEL_PTY_FOLLOWER_RETRY_MS ?? String(1e3));
+}
+function startFollower(opts) {
+  const abort = new AbortController();
+  const { entry, tag } = opts;
+  void (async () => {
+    try {
+      const sid = entry.sessionId.slice(0, 8);
+      const deadline = Date.now() + followerPendingMaxMs();
+      const retryMs = followerRetryMs();
+      let res;
+      let attempt = 0;
+      for (; ; ) {
+        res = await fetch(
+          managerLogFollowUrl(entry.sessionId, { boundary: opts.suppressResumeReplay === true }),
+          { signal: abort.signal }
+        );
+        console.error(`${tag} follower-connect sessionId=${sid} status=${res.status}`);
+        if (res.status === 202) {
+          attempt += 1;
+          await res.body?.cancel().catch(() => {
+          });
+          if (abort.signal.aborted) return;
+          if (Date.now() >= deadline) {
+            console.error(`${tag} follower-give-up sessionId=${sid} reason=pending-timeout attempts=${attempt}`);
+            opts.onError?.("follow-pending-timeout");
+            return;
+          }
+          console.error(`${tag} follower-retry sessionId=${sid} attempt=${attempt} reason=pending`);
+          await new Promise((r) => setTimeout(r, retryMs));
+          if (abort.signal.aborted) return;
+          continue;
+        }
+        break;
+      }
+      if (!res.ok || !res.body) {
+        opts.onError?.(`follow-status-${res.status}`);
+        return;
+      }
+      console.error(`${tag} follower-open sessionId=${sid}`);
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder("utf8");
+      let buffered = "";
+      const fileDelivery = opts.fileDelivery ?? null;
+      let firedFileTools = [];
+      let suppressing = opts.suppressResumeReplay === true;
+      let discardedTurns = 0;
+      let discardedFileTools = 0;
+      while (!abort.signal.aborted) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        buffered += decoder.decode(value, { stream: true });
+        let nl = buffered.indexOf("\n");
+        while (nl !== -1) {
+          const line = buffered.slice(0, nl);
+          buffered = buffered.slice(nl + 1);
+          nl = buffered.indexOf("\n");
+          if (!line) continue;
+          let event;
+          try {
+            event = JSON.parse(line);
+          } catch (err) {
+            console.error(
+              `${tag} jsonl-parse-skip sessionId=${entry.sessionId.slice(0, 8)} bytes=${line.length} message=${err instanceof Error ? err.message : String(err)}`
+            );
+            continue;
+          }
+          if (event.type === "__channel_resume_boundary__") {
+            if (suppressing) {
+              suppressing = false;
+              console.error(
+                `${tag} follower-resume-boundary sessionId=${sid} discarded-head-turns=${discardedTurns} discarded-head-filetools=${discardedFileTools}`
+              );
+            }
+            continue;
+          }
+          if (event.type === "user") {
+            entry.pendingTurnText = "";
+            firedFileTools = [];
+            continue;
+          }
+          if (event.type !== "assistant") continue;
+          const msg = event.message;
+          if (!msg) continue;
+          let sawContent = false;
+          if (Array.isArray(msg.content)) {
+            for (const block of msg.content) {
+              if (block?.type === "text" && typeof block.text === "string") {
+                entry.pendingTurnText += block.text;
+                sawContent = true;
+              } else if (block?.type === "tool_use") {
+                sawContent = true;
+                if (fileDelivery && typeof block.name === "string" && fileDelivery.isFileDeliveryTool(block.name)) {
+                  if (suppressing) {
+                    discardedFileTools += 1;
+                    continue;
+                  }
+                  firedFileTools.push(block.name);
+                  try {
+                    await fileDelivery.onFileToolUse({ toolName: block.name, input: block.input });
+                  } catch (err) {
+                    console.error(
+                      `${tag} file-delivery-error sessionId=${sid} tool=${block.name} message=${err instanceof Error ? err.message : String(err)}`
+                    );
+                  }
+                }
+              }
+            }
+          }
+          if (msg.stop_reason === "end_turn") {
+            if (suppressing) {
+              entry.pendingTurnText = "";
+              firedFileTools = [];
+              discardedTurns += 1;
+              continue;
+            }
+            const flush = entry.pendingTurnText;
+            entry.pendingTurnText = "";
+            if (flush.trim()) {
+              await fanOut(entry.subscribers, flush, opts.onError, tag);
+            }
+            if (fileDelivery && firedFileTools.length > 0) {
+              const fired = firedFileTools;
+              firedFileTools = [];
+              try {
+                fileDelivery.onTurnEnd(fired);
+              } catch (err) {
+                console.error(
+                  `${tag} file-delivery-error sessionId=${sid} phase=turn-end message=${err instanceof Error ? err.message : String(err)}`
+                );
+              }
+            }
+            opts.onTurnComplete?.();
+          } else if (sawContent && !suppressing) {
+            opts.onActivity?.();
+          }
+        }
+      }
+    } catch (err) {
+      if (!abort.signal.aborted) {
+        opts.onError?.(`follower-error: ${err instanceof Error ? err.message : String(err)}`);
       }
     } finally {
-      this.recovering = false;
-    }
-  }
-  /** Handle one inbound webchat message (browser POST → here). */
-  async handleInbound(input) {
-    const bytes = Buffer.byteLength(input.text, "utf8");
-    const hadSubscriber = this.hub.hasSubscriber(input.key);
-    const willDeliverNow = this.hub.isReady(input.key);
-    this.hub.deliver(
-      { key: input.key, text: input.text, messageId: `wc-${++this.seq}` },
-      Date.now()
-    );
-    if (willDeliverNow) this.lastDeliveredAt.set(input.key, Date.now());
-    console.error(
-      `[webchat:inbound] op=received key=${keyDisplay(input.key)} role=${input.role} bytes=${bytes} delivery=${willDeliverNow ? "immediate" : "queued"}`
-    );
-    if (input.role === "admin") {
-      this.recoverable.set(input.key, {
-        accountId: input.accountId,
-        key: input.key,
-        role: input.role,
-        ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
-        ...input.adminUserId !== void 0 ? { adminUserId: input.adminUserId } : {}
-      });
+      opts.onClose();
     }
-    const existing = this.publicSessions.get(input.key);
-    if (existing) existing.lastActivityAt = Date.now();
-    if (!hadSubscriber && !this.spawning.has(input.key)) {
-      this.spawning.add(input.key);
-      console.error(`[webchat:inbound] op=spawn-trigger key=${input.key} role=${input.role}`);
-      try {
-        const spawned = await this.deps.ensureChannelSession({
-          accountId: input.accountId,
-          key: input.key,
-          role: input.role,
-          gatewayUrl: this.deps.gatewayUrl,
-          serverPath: this.deps.serverPath,
-          // Task 800 — only present on a session-targeted launch, so the
-          // default-path call shape stays byte-identical.
-          ...input.sessionId !== void 0 ? { sessionId: input.sessionId } : {},
-          // The authenticated admin's userId on an admin bootstrap inbound; the
-          // default-path call shape stays byte-identical when absent.
-          ...input.adminUserId !== void 0 ? { adminUserId: input.adminUserId } : {},
-          // Task 756 — public spawn params on a role:'public' inbound.
-          ...input.public !== void 0 ? { public: input.public } : {}
-        });
-        if (input.role === "public" && input.public && spawned && "sessionId" in spawned) {
-          this.publicSessions.set(input.key, {
-            sessionId: spawned.sessionId,
-            accountId: input.accountId,
-            agentSlug: input.public.agentSlug,
-            sliceToken: input.public.sliceToken,
-            personId: input.public.personId,
-            lastActivityAt: Date.now()
-          });
-        }
-      } finally {
-        this.spawning.delete(input.key);
+  })();
+  return abort;
+}
+async function fanOut(subscribers, text, onError, tag) {
+  const callbacks = Array.from(subscribers);
+  await Promise.all(
+    callbacks.map(
+      (cb) => Promise.resolve().then(() => cb(text)).catch((err) => {
+        const m = err instanceof Error ? err.message : String(err);
+        console.error(`${tag} subscriber-error message=${m}`);
+        onError?.(`subscriber-error: ${m}`);
+      })
+    )
+  );
+}
+
+// app/lib/channel-pty-bridge/file-delivery.ts
+var SEND_USER_FILE = "SendUserFile";
+function makeFileDelivery(opts) {
+  const { entry, tag, channel, sendFile } = opts;
+  let failedFiles = [];
+  let attempts = 0;
+  return {
+    isFileDeliveryTool(toolName) {
+      return toolName === SEND_USER_FILE;
+    },
+    async onFileToolUse(use) {
+      if (use.toolName !== SEND_USER_FILE) return;
+      const input = use.input ?? {};
+      const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
+      const caption = typeof input.caption === "string" ? input.caption : void 0;
+      for (let i = 0; i < files.length; i++) {
+        attempts++;
+        const result = await sendFile(files[i], i === 0 ? caption : void 0);
+        const name = files[i].split("/").pop() ?? files[i];
+        console.error(`${tag} op=file-forward channel=${channel} file=${name} outcome=${result.ok ? "ok" : "fail"}`);
+        if (!result.ok) failedFiles.push(files[i]);
+      }
+    },
+    onTurnEnd(firedTools) {
+      const failed = failedFiles;
+      const tried = attempts;
+      failedFiles = [];
+      attempts = 0;
+      const sid = entry.sessionId.slice(0, 8);
+      for (const file of failed) {
+        console.error(
+          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE} file=${file}`
+        );
+      }
+      if (firedTools.includes(SEND_USER_FILE) && tried === 0) {
+        console.error(
+          `${tag} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${SEND_USER_FILE}`
+        );
       }
     }
-  }
-};
+  };
+}
 
-// app/lib/webchat/gateway/public-spawn-request.ts
-function buildPublicWebchatSpawnRequest(input) {
-  const { agentSlug, sliceToken, personId, visitorId, name } = input.public;
+// app/lib/whatsapp/inbound/file-delivery-bridge.ts
+var TAG34 = "[whatsapp-adaptor]";
+var SEND_USER_FILE2 = "SendUserFile";
+var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
+function platformRoot() {
+  return process.env.MAXY_PLATFORM_ROOT || "";
+}
+function makeWhatsAppSendFile(entry) {
+  return async (filePath, caption) => {
+    let maxyAccountId;
+    try {
+      maxyAccountId = resolvePlatformAccountId();
+    } catch (err) {
+      console.error(
+        `${TAG34} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+      );
+      return { ok: false, error: "account-unresolved" };
+    }
+    const result = await sendWhatsAppDocument({
+      to: entry.senderId,
+      filePath,
+      caption,
+      accountId: entry.accountId,
+      maxyAccountId,
+      platformRoot: platformRoot()
+    });
+    if (result.ok) return { ok: true };
+    console.error(
+      `${TAG34} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+    );
+    return { ok: false, error: result.error };
+  };
+}
+function makeWhatsAppFileDelivery(entry) {
+  const shared = makeFileDelivery({
+    entry,
+    tag: TAG34,
+    channel: "whatsapp",
+    sendFile: makeWhatsAppSendFile(entry)
+  });
+  let turnStartedAt = null;
+  let routeCalls = [];
   return {
-    senderId: input.key,
-    role: "public",
-    channel: "webchat",
-    accountId: input.accountId,
-    agentSlug,
-    model: SONNET_MODEL,
-    // sliceToken/personId are present only for a gated visitor; open-mode
-    // public agents carry neither (mirrors the bridge's open-mode key).
-    ...sliceToken ? { sliceToken } : {},
-    ...personId ? { personId } : {},
-    ...visitorId ? { visitorId } : {},
-    ...input.previousContext ? { previousContext: input.previousContext } : {},
-    name,
-    webchatChannel: { key: input.key, gatewayUrl: input.gatewayUrl, serverPath: input.serverPath }
+    isFileDeliveryTool(toolName) {
+      return toolName === SEND_USER_FILE2 || toolName === WHATSAPP_SEND_DOCUMENT;
+    },
+    async onFileToolUse(use) {
+      if (turnStartedAt === null) turnStartedAt = Date.now();
+      if (use.toolName === WHATSAPP_SEND_DOCUMENT) {
+        const input = use.input ?? {};
+        routeCalls.push({
+          to: typeof input.to === "string" ? input.to : void 0,
+          filePath: typeof input.filePath === "string" ? input.filePath : void 0
+        });
+        return;
+      }
+      await shared.onFileToolUse(use);
+    },
+    onTurnEnd(firedTools) {
+      const startedAt = turnStartedAt ?? 0;
+      const routes = routeCalls;
+      turnStartedAt = null;
+      routeCalls = [];
+      const sid = entry.sessionId.slice(0, 8);
+      shared.onTurnEnd(firedTools);
+      for (const call of routes) {
+        const routeAt = call.to !== void 0 && call.filePath !== void 0 ? routeDocumentOutboundAt(call.to, call.filePath) : void 0;
+        const delivered = routeAt !== void 0 && routeAt >= startedAt;
+        if (!delivered) {
+          const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
+          console.error(
+            `${TAG34} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+          );
+        }
+      }
+    }
   };
 }
 
@@ -21170,6 +20956,122 @@ function buildTelegramSpawnRequest(input) {
   };
 }
 
+// app/lib/telegram/outbound/send-document.ts
+import { realpathSync as realpathSync6 } from "fs";
+import { readFile as readFile7, stat as stat7 } from "fs/promises";
+import { resolve as resolve29, basename as basename9 } from "path";
+var TAG35 = "[telegram:outbound]";
+var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
+async function sendTelegramDocument(input) {
+  const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot3 } = input;
+  if (!botToken || !filePath) {
+    return { ok: false, status: 400, error: "Missing required fields: botToken, filePath" };
+  }
+  if (!maxyAccountId || !platformRoot3) {
+    return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
+  }
+  const accountDir = resolve29(platformRoot3, "..", "data/accounts", maxyAccountId);
+  let resolvedPath;
+  try {
+    resolvedPath = realpathSync6(filePath);
+    const accountResolved = realpathSync6(accountDir);
+    if (!resolvedPath.startsWith(accountResolved + "/")) {
+      console.error(`${TAG35} document REJECTED reason=outside_account_directory`);
+      return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
+    }
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      console.error(`${TAG35} document ENOENT path=${filePath}`);
+      return { ok: false, status: 404, error: `File not found: ${filePath}` };
+    }
+    console.error(`${TAG35} document path error: ${String(err)}`);
+    return { ok: false, status: 500, error: String(err) };
+  }
+  const fileStat = await stat7(resolvedPath);
+  if (fileStat.size > TELEGRAM_DOCUMENT_MAX_BYTES) {
+    return {
+      ok: false,
+      status: 400,
+      error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
+    };
+  }
+  const filename = basename9(resolvedPath);
+  const buffer = Buffer.from(await readFile7(resolvedPath));
+  const form = new FormData();
+  form.append("chat_id", String(chatId));
+  if (caption) form.append("caption", caption);
+  form.append("document", new File([buffer], filename, { type: detectMimeType(resolvedPath) }));
+  let ok = false;
+  let messageId;
+  let error = "send failed";
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${botToken}/sendDocument`, {
+      method: "POST",
+      body: form
+    });
+    const data = await res.json();
+    ok = data.ok;
+    messageId = data.result?.message_id;
+    if (!data.ok) error = data.description ?? "Unknown Telegram error";
+  } catch (e) {
+    error = e instanceof Error ? e.message : String(e);
+  }
+  console.error(
+    `${TAG35} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+  );
+  return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
+}
+
+// app/lib/telegram/outbound/file-delivery.ts
+var TAG36 = "[telegram:outbound]";
+function platformRoot2() {
+  return process.env.MAXY_PLATFORM_ROOT || "";
+}
+function makeTelegramSendFile(entry) {
+  let botToken;
+  return async (filePath, caption) => {
+    if (botToken === void 0) {
+      const tg = resolveAccount()?.config.telegram;
+      botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
+    }
+    if (!botToken) {
+      console.error(`${TAG36} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      return { ok: false, error: "no-bot-token" };
+    }
+    if (entry.replyTarget == null) {
+      console.error(`${TAG36} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      return { ok: false, error: "no-reply-target" };
+    }
+    let maxyAccountId;
+    try {
+      maxyAccountId = resolvePlatformAccountId();
+    } catch (err) {
+      console.error(
+        `${TAG36} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+      );
+      return { ok: false, error: "account-unresolved" };
+    }
+    const result = await sendTelegramDocument({
+      botToken,
+      chatId: Number(entry.replyTarget),
+      filePath,
+      caption,
+      maxyAccountId,
+      platformRoot: platformRoot2()
+    });
+    return result.ok ? { ok: true } : { ok: false, error: result.error };
+  };
+}
+function makeTelegramFileDelivery(entry) {
+  return makeFileDelivery({
+    entry,
+    tag: TAG36,
+    channel: "telegram",
+    sendFile: makeTelegramSendFile(entry)
+  });
+}
+
 // app/lib/telegram/gateway/native-file-follower.ts
 function startTelegramNativeFileFollower(input) {
   const entry = {
@@ -21204,12 +21106,166 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve32, join as join30 } from "path";
+import { resolve as resolve30, join as join31 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve32(process.env.MAXY_PLATFORM_ROOT ?? join30(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join31(__dirname, ".."), "services/telegram-channel/dist/server.js");
+}
+
+// app/lib/channel-pty-bridge/public-session-end-review.ts
+import { randomUUID as randomUUID13 } from "crypto";
+var TAG37 = "[public-session-review]";
+var CONSUMED_CAP = 500;
+var consumed = /* @__PURE__ */ new Set();
+function consumeOnce(sessionId) {
+  if (consumed.has(sessionId)) return false;
+  consumed.add(sessionId);
+  if (consumed.size > CONSUMED_CAP) {
+    const oldest = consumed.values().next().value;
+    if (oldest !== void 0) consumed.delete(oldest);
+  }
+  return true;
+}
+function managerBase3() {
+  const port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "public-session-end-review:manager" });
+  return `http://127.0.0.1:${port2}`;
+}
+function uiBase() {
+  const port2 = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "public-session-end-review:ui" });
+  return `http://127.0.0.1:${port2}`;
+}
+async function fetchJsonl(sessionId) {
+  try {
+    const res = await fetch(`${managerBase3()}/${sessionId}/log?download=1`);
+    if (!res.ok) return null;
+    return await res.text();
+  } catch (err) {
+    console.error(
+      `${TAG37} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return null;
+  }
+}
+function countOperatorTurns(jsonl) {
+  let count = 0;
+  for (const raw of jsonl.split("\n")) {
+    const line = raw.trim();
+    if (!line) continue;
+    try {
+      const obj = JSON.parse(line);
+      if (obj.type === "user") count += 1;
+    } catch {
+    }
+  }
+  return count;
+}
+async function fetchPriorWrites(sliceToken, accountId) {
+  const url = `${uiBase()}/api/admin/public-session-context?sliceToken=${encodeURIComponent(sliceToken)}&accountId=${encodeURIComponent(accountId)}`;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      console.error(
+        `${TAG37} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+      );
+      return [];
+    }
+    const body = await res.json();
+    return Array.isArray(body.writes) ? body.writes : [];
+  } catch (err) {
+    console.error(
+      `${TAG37} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+    );
+    return [];
+  }
+}
+function composeInitialMessage(input) {
+  const priorJson = JSON.stringify(input.priorWrites, null, 2);
+  return [
+    `The gated public-agent session for agent "${input.agentSlug}" has just been reaped. Review the transcript and decide what is worth saving to the visitor's per-visitor memory slice. Dispatch \`database-operator\` for each individual write via the Task tool. Do not call memory-write or memory-update directly.`,
+    "",
+    "<slice-token>",
+    input.sliceToken,
+    "</slice-token>",
+    "",
+    "<person-id>",
+    input.personId ?? "(unknown)",
+    "</person-id>",
+    "",
+    "<prior-writes>",
+    priorJson,
+    "</prior-writes>",
+    "",
+    "<transcript>",
+    input.jsonl,
+    "</transcript>"
+  ].join("\n");
+}
+async function dispatchReviewer(input, initialMessage) {
+  const sessionId = randomUUID13();
+  console.log(`${TAG37} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  const spawned = await managerRcSpawn({
+    sessionId,
+    initialMessage,
+    closeAfterTurn: true,
+    sliceToken: input.sliceToken,
+    personId: input.personId ?? void 0,
+    logContext: `public-session-end sourceSession=${input.sessionId.slice(0, 8)}`
+  });
+  if ("error" in spawned) {
+    return { ok: false, reason: `rc-spawn-${spawned.status}-${spawned.error}` };
+  }
+  return { ok: true, managerSessionId: spawned.sessionId };
+}
+async function firePublicSessionEndReview(input) {
+  const sliceShort = input.sliceToken.slice(0, 8);
+  const personField = input.personId ?? "none";
+  const dispatchedAt = Date.now();
+  if (consumed.has(input.sessionId)) {
+    console.log(
+      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+    );
+    return;
+  }
+  const jsonl = await fetchJsonl(input.sessionId);
+  if (!jsonl) {
+    console.log(
+      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+    );
+    return;
+  }
+  const operatorTurns = countOperatorTurns(jsonl);
+  if (operatorTurns === 0) {
+    console.log(
+      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+    );
+    return;
+  }
+  const priorWrites = await fetchPriorWrites(input.sliceToken, input.accountId);
+  const initialMessage = composeInitialMessage({
+    agentSlug: input.agentSlug,
+    sliceToken: input.sliceToken,
+    personId: input.personId,
+    jsonl,
+    priorWrites
+  });
+  if (!consumeOnce(input.sessionId)) {
+    console.log(
+      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+    );
+    return;
+  }
+  const dispatched = await dispatchReviewer(input, initialMessage);
+  if (!dispatched.ok) {
+    console.error(
+      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+    );
+    return;
+  }
+  console.log(
+    `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+  );
 }
 
 // app/lib/whatsapp/inbound/channel-admin-binding-drift.ts
@@ -21277,8 +21333,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync30, readFileSync as readFileSync32, statSync as statSync12 } from "fs";
-import { resolve as resolve33 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync32, statSync as statSync12 } from "fs";
+import { resolve as resolve31 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -21313,7 +21369,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve33(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve31(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -21325,8 +21381,8 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve33(brand.configDir, "entitlement.json");
-  if (!existsSync30(entitlementPath)) {
+  const entitlementPath = resolve31(brand.configDir, "entitlement.json");
+  if (!existsSync31(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat8 = statSync12(entitlementPath);
@@ -21516,12 +21572,12 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join31(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join32(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync31(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync32(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync32(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync33(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -21555,10 +21611,10 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join31(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join32(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync31(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync32(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync33(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -21587,7 +21643,7 @@ var app54 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join31(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve32(process.env.MAXY_PLATFORM_ROOT ?? join32(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 — file delivery on the native channel: resolve the platform
   // account + path validation here and funnel through the shared send core.
   sendDocument: async ({ senderId, accountId, filePath, caption }) => {
@@ -21603,7 +21659,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve34(process.env.MAXY_PLATFORM_ROOT ?? join31(__dirname, ".."))
+      platformRoot: resolve32(process.env.MAXY_PLATFORM_ROOT ?? join32(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -21706,6 +21762,7 @@ var webchatGateway = new WebchatGateway({
   deleteSession: (sessionId) => managerDelete(sessionId),
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
+setWebchatGateway(webchatGateway);
 app54.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
@@ -21917,7 +21974,7 @@ app54.post("/__remote-auth/change-password", async (c) => {
   }
   try {
     if (targetUserId) {
-      await setAccessPassword(targetUserId, newPassword, USERS_FILE);
+      await setAccessPassword(targetUserId, newPassword, USERS_FILE, { actor: targetUserId, logFile: USERS_AUDIT_LOG });
     } else {
       await setRemotePassword(newPassword);
     }
@@ -22004,7 +22061,7 @@ app54.post("/api/remote-auth/set-password", async (c) => {
   }
   try {
     if (sessionUserId) {
-      await setAccessPassword(sessionUserId, body.password, USERS_FILE);
+      await setAccessPassword(sessionUserId, body.password, USERS_FILE, { actor: sessionUserId, logFile: USERS_AUDIT_LOG });
     } else {
       await setRemotePassword(body.password);
     }
@@ -22109,13 +22166,13 @@ app54.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve34(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve34(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve32(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve32(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync31(filePath)) {
+  if (!existsSync32(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -22139,13 +22196,13 @@ app54.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve34(account.accountDir, "generated", filename);
-  const expectedDir = resolve34(account.accountDir, "generated");
+  const filePath = resolve32(account.accountDir, "generated", filename);
+  const expectedDir = resolve32(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync31(filePath)) {
+  if (!existsSync32(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -22165,7 +22222,7 @@ app54.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync31(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync32(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync33(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -22194,11 +22251,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync31(resolve34(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync32(resolve32(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync33(resolve34(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync33(resolve32(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -22206,8 +22263,8 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join31(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync31(versionFile)) return "unknown";
+    const versionFile = join32(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync32(versionFile)) return "unknown";
     const content = readFileSync33(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -22249,7 +22306,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync33(resolve34(process.cwd(), "public", file), "utf-8");
+    html = readFileSync33(resolve32(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -22266,12 +22323,12 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join31(homedir3(), BRAND.configDir);
+  const configDir2 = join32(homedir3(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join31(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync31(cachePath)) return null;
+    const cachePath = join32(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync32(cachePath)) return null;
     return JSON.parse(readFileSync33(cachePath, "utf-8"));
   } catch {
     return null;
@@ -22367,7 +22424,7 @@ app54.use("/vnc-popout.html", logViewerFetch);
 app54.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync33(resolve34(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync33(resolve32(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -22490,11 +22547,11 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app54.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join31(__dirname, "..");
-  const reconcileScript = resolve34(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join32(__dirname, "..");
+  const reconcileScript = resolve32(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
-    if (!existsSync31(reconcileScript)) return;
+    if (!existsSync32(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -22512,12 +22569,12 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   loop.unref();
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join31(__dirname, "..");
-  const auditScript = resolve34(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join32(__dirname, "..");
+  const auditScript = resolve32(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
-    if (!existsSync31(auditScript)) return;
+    if (!existsSync32(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -22616,7 +22673,7 @@ try {
   const migAccount = resolveAccount();
   const ownerUserId = migAccount?.config.admins?.find((a) => a.role === "owner")?.userId;
   if (ownerUserId) {
-    const result = migrateLegacyRemotePassword(USERS_FILE, REMOTE_PASSWORD_FILE, ownerUserId);
+    const result = migrateLegacyRemotePassword(USERS_FILE, REMOTE_PASSWORD_FILE, ownerUserId, { actor: "boot", logFile: USERS_AUDIT_LOG });
     console.error(`[remote-access-migrate] result=${result} ownerUserId=${ownerUserId.slice(0, 8)}`);
   } else {
     console.error("[remote-access-migrate] result=noop-no-owner ownerUserId=none");
@@ -22627,7 +22684,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync31(USERS_FILE)) {
+    if (!existsSync32(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -22657,6 +22714,35 @@ var adminUserReconcileTimer = setInterval(() => {
   void runAdminUserReconcileTick();
 }, ADMINUSER_RECONCILE_INTERVAL_MS);
 if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer.unref();
+var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
+function countUsersRows() {
+  if (!existsSync32(USERS_FILE)) return 0;
+  const raw = readFileSync33(USERS_FILE, "utf-8").trim();
+  if (!raw) return 0;
+  const users = JSON.parse(raw);
+  return users.filter((u) => typeof u.userId === "string").length;
+}
+function runUsersReconcileTick() {
+  try {
+    const d = computeAdminStoreDivergence({ usersFile: USERS_FILE, accountsDir: ACCOUNTS_DIR });
+    if (d.errors.length > 0) {
+      console.error(`[users-reconcile] op=error detail=${d.errors.map((e) => `${e.source}:${e.detail}`).join(";")}`);
+      return;
+    }
+    if (d.divergences === 0) {
+      console.error(`[users-reconcile] op=ok admins=${countUsersRows()}`);
+      return;
+    }
+    const accountOnly = d.accountWithoutUsers.map((a) => a.userId.slice(0, 8)).join(",");
+    const usersOnly = d.usersWithoutAccount.map((u) => u.userId.slice(0, 8)).join(",");
+    console.error(`[users-reconcile] op=divergence accountOnly=${accountOnly} usersOnly=${usersOnly}`);
+  } catch (err) {
+    console.error(`[users-reconcile] op=error detail=${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+runUsersReconcileTick();
+var usersReconcileTimer = setInterval(runUsersReconcileTick, USERS_RECONCILE_INTERVAL_MS);
+if (typeof usersReconcileTimer.unref === "function") usersReconcileTimer.unref();
 startGraphHealthTimer();
 void migrateUploads().catch((err) => console.error(`[uploads-migrate] failed err="${err instanceof Error ? err.message : String(err)}"`)).finally(() => {
   void startFileWatcher().catch((err) => {
@@ -22745,7 +22831,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve34(process.env.MAXY_PLATFORM_ROOT ?? join31(__dirname, "..")),
+  platformRoot: resolve32(process.env.MAXY_PLATFORM_ROOT ?? join32(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {
@@ -22786,7 +22872,6 @@ init({
 }).catch((err) => {
   console.error(`[whatsapp] init failed: ${String(err)}`);
 });
-startReaper();
 var shuttingDown = false;
 process.on("SIGTERM", async () => {
   if (shuttingDown) {