@rubytech/create-maxy-code 0.1.379 → 0.1.383

package/payload/server/server.js

@@ -1886,6 +1886,14 @@ function credsCensus(authDir) {
     return { credsPresent: true, registered: false, hasAccountSignature: false, e164: null };
   }
 }
+function getAuthAgeMs(authDir) {
+  try {
+    const stats = fsSync.statSync(resolveCredsPath(authDir));
+    return Date.now() - stats.mtimeMs;
+  } catch {
+    return null;
+  }
+}
 async function clearAuth(authDir) {
   try {
     await fs.access(authDir);
@@ -1897,6 +1905,17 @@ async function clearAuth(authDir) {
   console.error(`${TAG} cleared credentials at ${authDir}`);
   return true;
 }
+function discardAuthDirSync(authDir) {
+  try {
+    if (!fsSync.existsSync(authDir)) return false;
+    fsSync.rmSync(authDir, { recursive: true, force: true });
+    console.error(`${TAG} discarded credential dir ${authDir}`);
+    return true;
+  } catch (err) {
+    console.warn(`${TAG} discardAuthDirSync failed authDir=${authDir}: ${String(err)}`);
+    return false;
+  }
+}
 function listCredentialAccountIds(configDir2) {
   const credsRoot = path.join(os.homedir(), configDir2, "credentials", "whatsapp");
   try {
@@ -3154,7 +3173,7 @@ async function sendMediaMessage(sock, to, media, opts) {
 }
 
 // app/lib/whatsapp/message-store.ts
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, appendFileSync, readdirSync } from "fs";
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, appendFileSync, readdirSync, statSync as statSync2 } from "fs";
 import { dirname, join as join3 } from "path";
 var STORE_ROOT = () => join3(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
 function conversationFile(platformAccountId, remoteJid) {
@@ -3175,6 +3194,7 @@ function parseLines(raw) {
   }
   return out;
 }
+var byDateSentAsc = (a, b) => a.dateSent.localeCompare(b.dateSent);
 function appendMessage(platformAccountId, record) {
   const file = conversationFile(platformAccountId, record.remoteJid);
   try {
@@ -3209,13 +3229,79 @@ function readConversation(platformAccountId, remoteJid) {
   const file = conversationFile(platformAccountId, remoteJid);
   try {
     if (!existsSync3(file)) return [];
-    return parseLines(readFileSync4(file, "utf8")).sort((a, b) => a.dateSent.localeCompare(b.dateSent));
+    return parseLines(readFileSync4(file, "utf8")).sort(byDateSentAsc);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(`[whatsapp-message-store] FAIL op=read reason=${reason.slice(0, 100)} remoteJid=${remoteJid}`);
     return [];
   }
 }
+var summaryCache = /* @__PURE__ */ new Map();
+function summariseRecords(records) {
+  if (records.length === 0) return null;
+  const sorted = records.slice().sort(byDateSentAsc);
+  return {
+    first: sorted[0],
+    last: sorted[sorted.length - 1],
+    firstNamedSender: sorted.find((r) => r.senderName)?.senderName ?? null
+  };
+}
+function readConversationSummaries(platformAccountId) {
+  const dir = join3(STORE_ROOT(), platformAccountId);
+  const out = /* @__PURE__ */ new Map();
+  const seen = /* @__PURE__ */ new Set();
+  let fullReads = 0;
+  let cacheHits = 0;
+  let bytesRead = 0;
+  try {
+    if (!existsSync3(dir)) return out;
+    for (const entry of readdirSync(dir)) {
+      if (!entry.endsWith(".jsonl")) continue;
+      const remoteJid = entry.slice(0, -".jsonl".length);
+      const file = join3(dir, entry);
+      seen.add(file);
+      let size;
+      let mtimeMs;
+      try {
+        const st = statSync2(file);
+        size = st.size;
+        mtimeMs = st.mtimeMs;
+      } catch {
+        continue;
+      }
+      const cached2 = summaryCache.get(file);
+      if (cached2 && cached2.size === size && cached2.mtimeMs === mtimeMs) {
+        cacheHits++;
+        out.set(remoteJid, cached2.summary);
+        continue;
+      }
+      let summary;
+      try {
+        const raw = readFileSync4(file, "utf8");
+        bytesRead += Buffer.byteLength(raw);
+        fullReads++;
+        summary = summariseRecords(parseLines(raw));
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        console.error(`[whatsapp-message-store] FAIL op=summarise reason=${reason.slice(0, 100)} remoteJid=${remoteJid}`);
+        continue;
+      }
+      if (!summary) continue;
+      summaryCache.set(file, { size, mtimeMs, summary });
+      out.set(remoteJid, summary);
+    }
+    for (const key of summaryCache.keys()) {
+      if (dirname(key) === dir && !seen.has(key)) summaryCache.delete(key);
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`[whatsapp-message-store] FAIL op=summaries reason=${reason.slice(0, 100)} platformAccountId=${platformAccountId}`);
+  }
+  console.log(
+    `[whatsapp-message-store] op=summaries accountId=${platformAccountId} conversations=${out.size} fullReads=${fullReads} cacheHits=${cacheHits} bytesRead=${bytesRead}`
+  );
+  return out;
+}
 function readAllConversations(platformAccountId) {
   const dir = join3(STORE_ROOT(), platformAccountId);
   const out = /* @__PURE__ */ new Map();
@@ -5186,6 +5272,92 @@ function resolveScratchpadPath(raw, scratchpadRootAbs) {
   return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
 }
 
+// app/lib/doc-to-text.ts
+import { unzipSync, strFromU8 } from "fflate";
+var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+var ODT = "application/vnd.oasis.opendocument.text";
+var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
+  DOCX,
+  ODT,
+  "text/rtf",
+  "application/rtf"
+]);
+function bareMime(mimeType) {
+  return mimeType.split(";")[0].trim().toLowerCase();
+}
+function unescapeXml(s) {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function unzipEntry(buffer, entry) {
+  const files = unzipSync(new Uint8Array(buffer));
+  const bytes = files[entry];
+  if (!bytes) throw new Error(`zip entry not found: ${entry}`);
+  return strFromU8(bytes);
+}
+function docxToText(buffer) {
+  const xml = unzipEntry(buffer, "word/document.xml");
+  const paras = [];
+  for (const p of xml.split("</w:p>")) {
+    const withBreaks = p.replace(/<w:tab\b[^>]*\/?>/g, "	").replace(/<w:br\b[^>]*\/?>/g, "\n");
+    let line = "";
+    for (const m of withBreaks.matchAll(/<w:t\b[^>]*>([\s\S]*?)<\/w:t>/g)) {
+      line += unescapeXml(m[1]);
+    }
+    if (line.length > 0) paras.push(line);
+  }
+  return paras.join("\n");
+}
+function odtToText(buffer) {
+  const xml = unzipEntry(buffer, "content.xml");
+  const body = xml.replace(/^[\s\S]*?<office:text\b[^>]*>/, "").replace(/<\/office:text>[\s\S]*$/, "");
+  const withBreaks = body.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	").replace(/<\/text:(?:p|h)>/g, "\n");
+  const stripped = withBreaks.replace(/<[^>]+>/g, "");
+  return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
+}
+var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
+function stripRtfDestinations(s) {
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (ch === "\\" && i + 1 < s.length) {
+      out += ch + s[i + 1];
+      i++;
+      continue;
+    }
+    if (ch === "{" && RTF_DROP_DEST.test(s.slice(i + 1))) {
+      let depth = 1;
+      let j = i + 1;
+      for (; j < s.length && depth > 0; j++) {
+        if (s[j] === "\\") {
+          j++;
+          continue;
+        }
+        if (s[j] === "{") depth++;
+        else if (s[j] === "}") depth--;
+      }
+      i = j - 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function rtfToText(rtf) {
+  let s = stripRtfDestinations(rtf);
+  s = s.replace(/\\par[d]?\b/g, "\n").replace(/\\line\b/g, "\n").replace(/\\tab\b/g, "	");
+  s = s.replace(/\\'([0-9a-fA-F]{2})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)));
+  s = s.replace(/\\[a-zA-Z]+-?\d* ?/g, "");
+  s = s.replace(/\\([{}\\])/g, "$1").replace(/[{}]/g, "");
+  return s.replace(/[ \t]{2,}/g, " ").replace(/\n{3,}/g, "\n\n").trim();
+}
+function docToText(buffer, mimeType) {
+  const mime = bareMime(mimeType);
+  if (mime === DOCX) return docxToText(buffer);
+  if (mime === ODT) return odtToText(buffer);
+  if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
+  return null;
+}
+
 // app/lib/attachments.ts
 function uploadsDirFor(accountId, subPath, attachmentId) {
   return subPath ? resolve7(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve7(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
@@ -5203,6 +5375,14 @@ var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "text/calendar",
   "application/zip",
   "application/x-zip-compressed",
+  // Task 1347 — Word/OpenDocument/RTF text documents. The bytes are converted to
+  // a readable-text sibling at ingestion (writeAttachment → doc-to-text.ts)
+  // because the on-device Read tool cannot parse the binary containers. rtf is
+  // reported by browsers as either text/rtf or application/rtf.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.oasis.opendocument.text",
+  "text/rtf",
+  "application/rtf",
   // Task 1240 — voice recordings persist as playable clips in the admin bubble.
   // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
   "audio/ogg",
@@ -5218,6 +5398,7 @@ var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
 var MAX_FILES_PER_MESSAGE = 5;
 var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
+var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
 function assertSupportedMime(mimeType) {
   const bare = mimeType.split(";")[0].trim().toLowerCase();
   if (!SUPPORTED_MIME_TYPES.has(bare)) {
@@ -5243,7 +5424,15 @@ async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes
   };
   await writeFile2(storagePath, buffer);
   await writeFile2(metaPath, JSON.stringify(meta, null, 2));
-  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes };
+  let readableTextPath;
+  if (CONVERTIBLE_DOC_MIME.has(mimeType.split(";")[0].trim().toLowerCase())) {
+    const text = docToText(buffer, mimeType);
+    if (text) {
+      readableTextPath = resolve7(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
+      await writeFile2(readableTextPath, text);
+    }
+  }
+  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
 }
 async function storeAttachment(accountId, file) {
   assertSupportedMime(file.type);
@@ -5284,6 +5473,8 @@ var MIME_BY_EXT = {
   ".zip": "application/zip",
   ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
   ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".rtf": "text/rtf",
   ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
   ".ics": "text/calendar"
 };
@@ -6137,6 +6328,15 @@ async function loginConnectionLoop(accountId, login) {
     } catch (err) {
       const current = activeLogins.get(accountId);
       if (current?.id !== login.id) return;
+      await drainCredsSaveQueue();
+      const preRetryCensus = credsCensus(login.authDir);
+      if (!preRetryCensus.hasAccountSignature) {
+        current.error = "WhatsApp accepted the code but did not finish linking. This usually means the number has reached its linked-device limit or has a stale linked device. On the phone, open WhatsApp, Linked Devices, remove existing devices, then ask for a new code.";
+        console.error(
+          `${TAG17} op=pairing-incomplete cid=${cidShort} closeKind=${closeKind(getStatusCode(err), false)} reason=no-account-signature`
+        );
+        return;
+      }
       const classification = classifyDisconnect(err);
       if (!classification.shouldRetry || attempt >= LOGIN_MAX_RECONNECTS) {
         if (attempt >= LOGIN_MAX_RECONNECTS) {
@@ -6349,6 +6549,13 @@ async function waitForLogin(opts) {
   console.error(`${TAG17} waitForLogin poll timeout account=${accountId} elapsed=${elapsed}s \u2014 login kept alive (pairing code still valid)`);
   return { connected: false, message: "Still waiting for you to enter the pairing code. The code is still valid \u2014 ask me to keep waiting, or request a new code.", configPersisted: false };
 }
+function listActiveLoginAccountIds() {
+  const ids = [];
+  for (const [accountId, login] of activeLogins) {
+    if (isLoginFresh(login)) ids.push(accountId);
+  }
+  return ids;
+}
 
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync3 } from "fs";
@@ -6545,6 +6752,7 @@ function serializeWhatsAppSchema() {
 import { readdirSync as readdirSync3 } from "fs";
 import { join as join9 } from "path";
 var TAG19 = "[whatsapp:reconcile]";
+var HALF_REGISTERED_MIN_AGE_MS = 5 * 6e4;
 function listCredsAccountIds(credsRoot) {
   try {
     return readdirSync3(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join9(credsRoot, e.name))).map((e) => e.name);
@@ -6558,14 +6766,28 @@ function isAccountConfigured(accountDir, accountId) {
   return !!accounts && Object.prototype.hasOwnProperty.call(accounts, accountId);
 }
 function reconcileCredsOnDisk(opts) {
-  const { credsRoot, accountDir, liveAccountIds } = opts;
+  const { credsRoot, accountDir, liveAccountIds, activeLoginAccountIds } = opts;
   const entries = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
     const authDir = join9(credsRoot, accountId);
     const census = credsCensus(authDir);
     if (census.registered && !census.hasAccountSignature) {
-      console.error(`${TAG19} op=half-registered account=${accountId} registered=true hasAccount=false`);
+      const inFlight = activeLoginAccountIds.has(accountId);
+      const ageMs = getAuthAgeMs(authDir);
+      const abandoned = !inFlight && ageMs !== null && ageMs >= HALF_REGISTERED_MIN_AGE_MS;
+      if (!abandoned) {
+        console.error(`${TAG19} op=half-registered account=${accountId} registered=true hasAccount=false inFlight=${inFlight} ageMs=${ageMs ?? "null"}`);
+        entries.push({ accountId, connected: false, linkedUnconfigured: true });
+        continue;
+      }
+      console.error(`${TAG19} op=discard-half-registered account=${accountId} registered=true hasAccount=false ageMs=${ageMs}`);
+      const removed = discardAuthDirSync(authDir);
+      if (!removed) {
+        console.error(`${TAG19} op=discard-half-registered-failed account=${accountId} \u2014 residue persists`);
+        entries.push({ accountId, connected: false, linkedUnconfigured: true });
+      }
+      continue;
     }
     const selfPhone = readSelfId(authDir).e164 ?? void 0;
     const configured = accountDir ? isAccountConfigured(accountDir, accountId) : false;
@@ -6593,9 +6815,10 @@ app2.get("/status", (c) => {
   try {
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
+    const activeLoginIds = new Set(listActiveLoginAccountIds());
     const credsRoot = join10(MAXY_DIR, "credentials", "whatsapp");
     const accountDir = resolveAccount()?.accountDir ?? null;
-    const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds });
+    const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds, activeLoginAccountIds: activeLoginIds });
     const accounts = [...live, ...reconciled];
     const summary = accounts.map((a) => `${a.accountId}:${a.connected ? "up" : a.linkedUnconfigured ? "linked-unconfigured" : "down"}`).join(", ");
     console.error(`${TAG20} status accounts=${accounts.length} [${summary}]`);
@@ -7015,11 +7238,11 @@ app2.get("/group-info", async (c) => {
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync15, watch, statSync as statSync4, openSync, readSync, closeSync, existsSync as existsSync8, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
+import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync8, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
 import { basename as basename4, dirname as dirname3, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync2 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
 import { basename as basename3, dirname as dirname2, join as join11, resolve as resolve11 } from "path";
 
 // app/lib/whatsapp-reader/select-sessions.ts
@@ -7043,25 +7266,22 @@ function selectReaderChannelSessions(rows) {
     source: "session"
   }));
 }
-function buildStoreConversationRows(accountId, convos) {
+function buildStoreConversationRows(accountId, summaries) {
   const rows = [];
-  for (const [remoteJid, messages] of convos) {
-    if (messages.length === 0) continue;
-    const last = messages[messages.length - 1];
+  for (const [remoteJid, { first, last, firstNamedSender }] of summaries) {
     const scope = last.scope;
     const isGroup = remoteJid.endsWith("@g.us");
-    const senderTelephone = isGroup ? null : messages[0].senderTelephone;
-    const senderName = messages.find((m) => m.senderName)?.senderName ?? null;
+    const senderTelephone = isGroup ? null : first.senderTelephone;
     rows.push({
       sessionId: "",
       projectDir: "",
       title: remoteJid,
       senderId: senderTelephone,
-      startedAt: messages[0].dateSent,
+      startedAt: first.dateSent,
       channel: "whatsapp",
       role: scope === "admin" ? "admin" : "public",
       operatorName: null,
-      whatsappName: senderName,
+      whatsappName: firstNamedSender,
       lastMessageAt: last.dateSent,
       modelGated: false,
       model: null,
@@ -7312,26 +7532,10 @@ app3.get("/", requireAdminSession, async (c) => {
   const scopeAccountId = getAccountIdForSession(cacheKey) ?? null;
   const validAccounts = listValidAccounts();
   const multiAccount = validAccounts.length > 1;
-  const accounts = [];
-  for (const a of validAccounts) {
-    let businessName = null;
-    try {
-      const branding = await fetchBranding(a.accountId);
-      businessName = branding?.name || null;
-    } catch {
-    }
-    accounts.push({
-      accountId: a.accountId,
-      role: a.config.role ?? "",
-      businessName,
-      isHouse: a.config.role === "house"
-    });
-  }
-  console.log(`[admin-sessions-list] accounts=${accounts.length}`);
   const configDir2 = claudeConfigDir();
   if (!configDir2) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
-    return c.json({ sessions: [], accountId: scopeAccountId, accounts });
+    return c.json({ sessions: [], accountId: scopeAccountId });
   }
   const projectsRoot = join11(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
@@ -7362,7 +7566,7 @@ app3.get("/", requireAdminSession, async (c) => {
     let mtimeMs;
     try {
       body = readFileSync12(path2, "utf8");
-      mtimeMs = statSync2(path2).mtimeMs;
+      mtimeMs = statSync3(path2).mtimeMs;
     } catch {
       continue;
     }
@@ -7440,13 +7644,13 @@ app3.get("/", requireAdminSession, async (c) => {
   if (multiAccount) {
     console.log(`[admin-sessions-list] untagged-accountId-rows=${untaggedCount}`);
   }
-  return c.json({ sessions: rows, accountId: scopeAccountId, accounts });
+  return c.json({ sessions: rows, accountId: scopeAccountId });
 });
 var sidebar_sessions_default = app3;
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join12 } from "path";
 function hashPin(pin) {
   return createHash("sha256").update(pin).digest("hex");
@@ -7834,16 +8038,29 @@ function pickActivity(entries, grown, nowMs, concurrencyWindowMs) {
 // server/routes/whatsapp-reader.ts
 var app4 = new Hono();
 app4.get("/conversations", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const scopeAccountId = getAccountIdForSession(cacheKey) ?? null;
+  const validAccounts = listValidAccounts();
+  const multiAccount = validAccounts.length > 1;
+  if (multiAccount && !scopeAccountId) {
+    console.log(`[wa-reader] op=list-scope-unresolved cacheKey=${cacheKey.slice(0, 8)}`);
+    return c.json({ conversations: [] });
+  }
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
   const projectsRoot = join14(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
+  let sessionRowsExcludedUntagged = 0;
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename4(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname3(path2);
     const meta = readSidecarMeta(join14(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
+    if (multiAccount) {
+      if (meta.accountId === null) sessionRowsExcludedUntagged += 1;
+      if (meta.accountId !== scopeAccountId) continue;
+    }
     let body = "";
     try {
       body = readFileSync15(path2, "utf8");
@@ -7868,7 +8085,7 @@ app4.get("/conversations", requireAdminSession, async (c) => {
     });
   }
   const sessionRows = selectReaderChannelSessions(rows).filter((r) => r.channel !== "whatsapp");
-  const account = resolveAccount();
+  const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : resolveAccount();
   let users = [];
   if (account) {
     try {
@@ -7898,16 +8115,17 @@ app4.get("/conversations", requireAdminSession, async (c) => {
     ...r,
     operatorName: r.senderId ? nameBySender.get(r.senderId) ?? null : null
   }));
-  const storeRows = account ? buildStoreConversationRows(account.accountId, readAllConversations(account.accountId)) : [];
+  const storeRows = account ? buildStoreConversationRows(account.accountId, readConversationSummaries(account.accountId)) : [];
   const adminScope = storeRows.filter((r) => r.scope === "admin").length;
   const publicScope = storeRows.length - adminScope;
+  const sessionRowCount = sessionConversations.length;
   console.log(
-    `[wa-reader] op=list accountId=${account?.accountId ?? "null"} conversations=${storeRows.length} adminScope=${adminScope} publicScope=${publicScope}`
+    `[wa-reader] op=list pinnedAccount=${scopeAccountId?.slice(0, 8) ?? "null"} resolvedAccount=${account?.accountId.slice(0, 8) ?? "null"} multiAccount=${multiAccount} conversations=${sessionRowCount + storeRows.length} sessionRows=${sessionRowCount} storeRows=${storeRows.length} adminScope=${adminScope} publicScope=${publicScope} sessionRowsExcludedUntagged=${sessionRowsExcludedUntagged}`
   );
   return c.json({ conversations: [...sessionConversations, ...storeRows] });
 });
 function readFrom(path2, from) {
-  const end = statSync4(path2).size;
+  const end = statSync5(path2).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync(path2, "r");
   try {
@@ -8024,7 +8242,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync4(join14(c.subagentsDir, name));
+      const st = statSync5(join14(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -8090,7 +8308,7 @@ data: ${JSON.stringify(turn)}
     start(controller) {
       const fileEnd0 = (() => {
         try {
-          return statSync4(jsonlPath).size;
+          return statSync5(jsonlPath).size;
         } catch {
           return 0;
         }
@@ -8219,7 +8437,7 @@ app4.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync4(join14(dir, name)).size;
+      len = statSync5(join14(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -8284,7 +8502,7 @@ data: ${JSON.stringify(turn)}
       };
       const fileEnd0 = (() => {
         try {
-          return statSync4(file).size;
+          return statSync5(file).size;
         } catch {
           return 0;
         }
@@ -8365,7 +8583,7 @@ data: ${JSON.stringify(turn)}
 var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
-import { statSync as statSync5, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
+import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
 import { basename as basename5, dirname as dirname4, join as join15, resolve as resolve13, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
@@ -8499,7 +8717,7 @@ function enrichPublicAttachments(turns, sessionAttachments, cursor) {
   }
 }
 function readFrom2(path2, from) {
-  const end = statSync5(path2).size;
+  const end = statSync6(path2).size;
   if (end <= from) return { buf: Buffer.alloc(0), end: from };
   const fd = openSync2(path2, "r");
   try {
@@ -8640,7 +8858,7 @@ app5.get("/attachment/:attachmentId", (c) => {
   let dataFile;
   let buffer;
   try {
-    dataFile = readdirSync9(dir).find((f) => !f.endsWith(".meta.json"));
+    dataFile = readdirSync9(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
     if (!dataFile) throw new Error("no data file");
     buffer = readFileSync16(resolve13(dir, dataFile));
   } catch {
@@ -8662,7 +8880,7 @@ var public_reader_default = app5;
 // server/routes/webchat.ts
 import { basename as basename6, dirname as dirname5 } from "path";
 import { join as join18 } from "path";
-import { existsSync as existsSync10, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync3, statSync as statSync6, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync3, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync17, writeFileSync as writeFileSync5, renameSync } from "fs";
@@ -8932,7 +9150,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync6(join18(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync7(join18(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -9076,7 +9294,7 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
     try {
-      mtimeMs = statSync6(path2).mtimeMs;
+      mtimeMs = statSync7(path2).mtimeMs;
     } catch {
       continue;
     }
@@ -9269,8 +9487,13 @@ ${result.result.text}` : result.result.text;
         console.error(`[webchat:inbound] op=send-refused kind=files reason=store-failed detail=${detail}`);
         return c.json({ error: "failed to store attachment" }, 500);
       }
+      for (const s of stored) {
+        const dot = s.filename.lastIndexOf(".");
+        const ext = dot >= 0 ? s.filename.slice(dot).toLowerCase() : "";
+        console.log(`[attach-ingest] mime=${s.mimeType} ext=${ext} converted=${!!s.readableTextPath} path=${s.storagePath}`);
+      }
       if (stored.length > 0) {
-        const listing = stored.map((s) => `${s.filename} (${s.storagePath})`).join(", ");
+        const listing = stored.map((s) => `${s.filename} (${s.readableTextPath ?? s.storagePath})`).join(", ");
         const note = `[The operator uploaded ${stored.length} file(s): ${listing}]`;
         text = text.length > 0 ? `${text}
 
@@ -9908,7 +10131,7 @@ import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeF
 import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync7, appendFileSync as appendFileSync2 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
 import { dirname as dirname6, join as join22 } from "path";
 function id8(value) {
   return value.slice(0, 8);
@@ -10031,7 +10254,7 @@ function computeAdminStoreDivergence(input) {
       if (entry.startsWith(".")) continue;
       const accountDir = join22(input.accountsDir, entry);
       try {
-        if (!statSync7(accountDir).isDirectory()) continue;
+        if (!statSync8(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
@@ -10431,7 +10654,7 @@ ${body.newPin}
 var onboarding_default = app9;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync16, renameSync as renameSync6, statSync as statSync8 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync16, renameSync as renameSync6, statSync as statSync9 } from "fs";
 import { join as join23 } from "path";
 var CLIENT_ERRORS_LOG = join23(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -10482,7 +10705,7 @@ function stackHead(stack) {
 function rotateIfNeeded() {
   try {
     if (!existsSync16(CLIENT_ERRORS_LOG)) return;
-    const stats = statSync8(CLIENT_ERRORS_LOG);
+    const stats = statSync9(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync6(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
@@ -10788,7 +11011,7 @@ app12.get("/", requireAdminSession, async (c) => {
 var accounts_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync18, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync9 } from "fs";
+import { existsSync as existsSync18, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
 import { resolve as resolve16, basename as basename7 } from "path";
 
 // app/lib/logs-read-resolve.ts
@@ -10828,7 +11051,7 @@ app13.get("/", async (c) => {
       searched.push(filePath);
       try {
         const buffer = readFileSync25(filePath);
-        const onDiskBytes = statSync9(filePath).size;
+        const onDiskBytes = statSync10(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -10893,7 +11116,7 @@ app13.get("/", async (c) => {
       try {
         const filename = basename7(hit.path);
         const buffer = readFileSync25(hit.path);
-        const onDiskBytes = statSync9(hit.path).size;
+        const onDiskBytes = statSync10(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
           "Content-Length": String(buffer.byteLength)
@@ -10936,7 +11159,7 @@ app13.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve16(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync10(resolve16(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
         const content = readFileSync25(resolve16(dir, name));
@@ -11028,7 +11251,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const entries = await readdir(dir);
-  const dataFile = entries.find((f) => !f.endsWith(".meta.json"));
+  const dataFile = entries.find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
@@ -11821,7 +12044,7 @@ app17.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync10 } from "fs";
+import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
 import { dirname as dirname7, resolve as resolve19, join as join25 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -11924,7 +12147,7 @@ function listPluginDirs() {
     for (const name of readdirSync16(platformPlugins)) {
       const dir = join25(platformPlugins, name);
       try {
-        if (statSync10(dir).isDirectory()) out.set(name, dir);
+        if (statSync11(dir).isDirectory()) out.set(name, dir);
       } catch {
       }
     }
@@ -11938,7 +12161,7 @@ function listPluginDirs() {
         for (const name of readdirSync16(bundlePlugins)) {
           const dir = join25(bundlePlugins, name);
           try {
-            if (statSync10(dir).isDirectory()) out.set(name, dir);
+            if (statSync11(dir).isDirectory()) out.set(name, dir);
           } catch {
           }
         }
@@ -13508,11 +13731,11 @@ app21.get("/download", requireAdminSession, async (c) => {
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
     if (disposition === "inline") {
-      if (!mimeType.startsWith("image/")) {
-        console.error(`[data] op=thumb-refused path="${relPath}" mime="${mimeType}" reason=not-image`);
-        return c.json({ error: "Inline serve is image-only" }, 400);
+      if (!mimeType.startsWith("image/") && mimeType !== "application/pdf") {
+        console.error(`[data] op=inline-refused path="${relPath}" mime="${mimeType}" reason=not-image-or-pdf`);
+        return c.json({ error: "Inline serve is image- or PDF-only" }, 400);
       }
-      console.error(`[data] op=thumb-serve path="${relPath}" mime="${mimeType}" size=${info.size} status=200`);
+      console.error(`[data] op=inline-serve path="${relPath}" mime="${mimeType}" size=${info.size} status=200`);
       return new Response(webStream, {
         status: 200,
         headers: {
@@ -16456,10 +16679,8 @@ app29.post("/", requireAdminSession, async (c) => {
     return c.json({ error: "sessionId must be a v4 UUID" }, 400);
   }
   const base = managerBase("session-delete:wrapper");
-  const accountId = getAccountIdForSession(c.var.cacheKey);
-  const acctQuery = accountId ? `?accountId=${encodeURIComponent(accountId)}` : "";
   try {
-    const stop = await fetch(`${base}/${sessionId}/stop${acctQuery}`, { method: "POST" });
+    const stop = await fetch(`${base}/${sessionId}/stop`, { method: "POST" });
     if (stop.status !== 204 && stop.status !== 200 && stop.status !== 404) {
       console.error(`[session-delete] sessionId=${sessionId} stop-status=${stop.status}`);
       return c.json({ error: `stop-failed-${stop.status}` }, 502);
@@ -16470,7 +16691,7 @@ app29.post("/", requireAdminSession, async (c) => {
   }
   let del;
   try {
-    del = await fetch(`${base}/${sessionId}${acctQuery}`, { method: "DELETE" });
+    del = await fetch(`${base}/${sessionId}`, { method: "DELETE" });
   } catch (err) {
     console.error(`[session-delete] sessionId=${sessionId} delete-unreachable err=${err instanceof Error ? err.message : String(err)}`);
     return c.json({ error: "manager-unreachable" }, 502);
@@ -16499,11 +16720,9 @@ app30.post("/", requireAdminSession, async (c) => {
   if (!SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "sessionId must be a v4 UUID" }, 400);
   }
-  const accountId = getAccountIdForSession(c.var.cacheKey);
-  const acctQuery = accountId ? `?accountId=${encodeURIComponent(accountId)}` : "";
   let res;
   try {
-    res = await fetch(`${managerBase("session-stop:wrapper")}/${sessionId}/stop${acctQuery}`, { method: "POST" });
+    res = await fetch(`${managerBase("session-stop:wrapper")}/${sessionId}/stop`, { method: "POST" });
   } catch (err) {
     console.error(`[session-stop] sessionId=${sessionId} manager-unreachable err=${err instanceof Error ? err.message : String(err)}`);
     return c.json({ error: "manager-unreachable" }, 502);
@@ -18525,7 +18744,7 @@ app48.route("/request-magic-link", request_magic_link_default);
 var access_default = app48;
 
 // server/routes/sites.ts
-import { existsSync as existsSync28, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync11 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
 import { resolve as resolve26 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -18591,7 +18810,7 @@ app49.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync28(filePath) ? statSync11(filePath) : null;
+    stat8 = existsSync28(filePath) ? statSync12(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -22287,7 +22506,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync32, readFileSync as readFileSync34, statSync as statSync12 } from "fs";
+import { existsSync as existsSync32, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
 import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -22339,7 +22558,7 @@ function resolveEntitlement(brand, account) {
   if (!existsSync32(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat8 = statSync12(entitlementPath);
+  const stat8 = statSync13(entitlementPath);
   const key = memoKey(stat8.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
@@ -22766,14 +22985,14 @@ var chatRoutes = createChatRoutes({
   awaitReply: (key, timeoutMs) => webchatGateway.awaitReply(key, timeoutMs)
 });
 app55.use("*", clientIpMiddleware);
+function allowsSameOriginFraming(path2) {
+  return path2 === "/vnc-viewer.html" || path2.startsWith("/api/admin/attachment/") || path2.startsWith("/api/public-reader/attachment/") || path2 === "/api/admin/files/download";
+}
 app55.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
-  c.header(
-    "X-Frame-Options",
-    c.req.path === "/vnc-viewer.html" ? "SAMEORIGIN" : "DENY"
-  );
+  c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
 app55.use("*", async (c, next) => {