@rubytech/create-maxy-code 0.1.386 → 0.1.388

package/payload/server/server.js

@@ -1307,7 +1307,7 @@ var serveStatic = (options = { root: "" }) => {
 // server/index.ts
 import { readFileSync as readFileSync35, existsSync as existsSync33, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { resolve as resolve33, join as join34, basename as basename12 } from "path";
+import { resolve as resolve33, join as join34, basename as basename13 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1726,7 +1726,8 @@ var WhatsAppAccountSchema = z.object({
 var WhatsAppConfigSchema = z.object({
   accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional().describe("Per-account config keyed by account ID."),
   dmPolicy: DmPolicySchema.optional().default("disabled").describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
-  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone."),
+  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone. Authoritative only on the account that owns the WhatsApp paired socket; a list on any other account is inert and purged at boot \u2014 use accountManagers for sub-account routing."),
+  accountManagers: z.record(z.string(), z.string()).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account UUID. A designated phone spawns an admin session scoped to that sub-account rather than the house. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones."),
   allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
   sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
   mediaMaxMb: z.number().int().positive().optional().default(50).describe("Maximum file size in MB for media the agent will download and process."),
@@ -2601,13 +2602,24 @@ function extractMessage(msg) {
   return result;
 }
 
+// app/lib/whatsapp/managed-account.ts
+function managedAccountFor(accountManagers, phone) {
+  for (const [managerPhone, subAccountId] of Object.entries(accountManagers)) {
+    if (subAccountId && phonesMatch(managerPhone, phone)) return subAccountId;
+  }
+  return null;
+}
+
 // app/lib/whatsapp/inbound/access-control.ts
 function resolveAccountConfig(config, accountConfig) {
   return {
     dmPolicy: accountConfig?.dmPolicy ?? config.dmPolicy ?? "disabled",
     adminPhones: accountConfig?.adminPhones ?? config.adminPhones ?? [],
     allowFrom: accountConfig?.allowFrom ?? config.allowFrom ?? [],
-    selfChatMode: accountConfig?.selfChatMode ?? false
+    selfChatMode: accountConfig?.selfChatMode ?? false,
+    // Account-manager bindings are a house-level routing table only — never a
+    // per-account override, so this reads the top-level map unconditionally.
+    accountManagers: config.accountManagers ?? {}
   };
 }
 function isAdminPhone(phone, adminPhones) {
@@ -2616,24 +2628,31 @@ function isAdminPhone(phone, adminPhones) {
   return adminPhones.some((entry) => phonesMatch(entry, normalized));
 }
 function checkDmAccess(params) {
-  const { senderPhone, selfPhone } = params;
+  const { senderPhone, selfPhone, accountId } = params;
   const cfg = resolveAccountConfig(params.config, params.accountConfig);
   if (phonesMatch(senderPhone, selfPhone)) {
-    return { allowed: true, reason: "self-phone", agentType: "admin" };
+    return { allowed: true, reason: "self-phone", agentType: "admin", effectiveAccountId: accountId };
   }
   if (isAdminPhone(senderPhone, cfg.adminPhones)) {
-    return { allowed: true, reason: "admin-binding", agentType: "admin" };
+    return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
+  }
+  const managedSub = managedAccountFor(cfg.accountManagers, senderPhone);
+  if (managedSub) {
+    if (params.isValidAccount && !params.isValidAccount(managedSub)) {
+      return { allowed: false, reason: "account-manager-unresolved", agentType: "admin" };
+    }
+    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managedSub };
   }
   switch (cfg.dmPolicy) {
     case "open":
-      return { allowed: true, reason: "dm-policy-open", agentType: "public" };
+      return { allowed: true, reason: "dm-policy-open", agentType: "public", effectiveAccountId: accountId };
     case "allowlist": {
       const inList = cfg.allowFrom.some((entry) => {
         if (entry === "*") return true;
         return phonesMatch(entry, senderPhone);
       });
       if (inList) {
-        return { allowed: true, reason: "allowlist-match", agentType: "public" };
+        return { allowed: true, reason: "allowlist-match", agentType: "public", effectiveAccountId: accountId };
       }
       return { allowed: false, reason: "not-in-allowlist", agentType: "public" };
     }
@@ -4085,7 +4104,9 @@ function buildSelfChatDispatch(input) {
       senderPhone,
       isGroup: false
     }),
-    media: []
+    media: [],
+    // Self-chat is the owner: the session scopes to the house account (Task 1383).
+    effectiveAccountId: input.accountId
   };
 }
 async function init(opts) {
@@ -4733,12 +4754,24 @@ async function handleInboundMessage(conn, msg) {
       config: whatsAppConfig,
       accountConfig: whatsAppConfig.accounts?.[conn.accountId],
       accountId: conn.accountId,
+      isValidAccount: (id) => listValidAccounts().some((a) => a.accountId === id),
       resolvePersonByPhone
     });
   }
   console.error(
     `${TAG13} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
   );
+  if (!accessResult.allowed && accessResult.reason === "account-manager-unresolved") {
+    console.error(
+      `[whatsapp-native] op=account-manager-reject senderId=${senderPhone} reason=unresolved-effective-account`
+    );
+  }
+  if (accessResult.allowed && accessResult.reason === "account-manager" && accessResult.effectiveAccountId === conn.accountId) {
+    console.error(
+      `[whatsapp-native] op=escalation-tripwire senderId=${senderPhone} reason=account-manager-routed-to-house effectiveAccount=${accessResult.effectiveAccountId}`
+    );
+    return;
+  }
   if (!accessResult.allowed) return;
   if (isCustomerTurnSuppressed(accessResult.agentType, isHouseManagedService())) {
     console.error(
@@ -4786,7 +4819,10 @@ async function handleInboundMessage(conn, msg) {
     composing,
     cacheKey,
     media: mediaResult?.path ? [{ path: mediaResult.path, type: extracted.mediaType, mimetype: mediaResult.mimetype }] : [],
-    replyContext: extracted.quotedMessage
+    replyContext: extracted.quotedMessage,
+    // Task 1383 — the gate's single resolution feeds the spawn (house or the
+    // bound sub-account); the router never re-resolves.
+    effectiveAccountId: accessResult.effectiveAccountId
   };
   if (accessResult.agentType === "public") {
     const hoursResult = await isBusinessOpen(conn.accountId);
@@ -5971,6 +6007,137 @@ ${result.result.text}` : result.result.text;
   return app56;
 }
 
+// app/lib/channel-pty-bridge/admin-session-id.ts
+import { createHash } from "crypto";
+function adminSessionIdFor(accountId, senderId, personId) {
+  const subject = personId && personId.length > 0 ? `person:${personId}` : senderId;
+  const b = createHash("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
+  const v = Buffer.from(b);
+  v[6] = v[6] & 15 | 64;
+  v[8] = v[8] & 63 | 128;
+  const h = v.toString("hex");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+
+// server/routes/channel/schedule-inject.ts
+var TAG16 = "[schedule-inject]";
+function isLoopbackAddr(addr) {
+  return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
+}
+function createScheduleInjectRoutes(deps) {
+  const app56 = new Hono();
+  app56.post("/", async (c) => {
+    const env = c.env;
+    const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
+    if (!isLoopbackAddr(remoteAddr)) {
+      console.error(`${TAG16} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+      return c.json({ ok: false, error: "schedule-inject-loopback-only" }, 403);
+    }
+    const xffHeader = env?.incoming?.headers?.["x-forwarded-for"];
+    const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
+    if (xffRaw.length > 0) {
+      const offender = xffRaw.split(",").map((t) => t.trim()).filter(Boolean).find((t) => !isLoopbackAddr(t));
+      if (offender !== void 0) {
+        console.error(`${TAG16} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+        return c.json({ ok: false, error: "schedule-inject-loopback-only" }, 403);
+      }
+    }
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      return c.json({ ok: false, error: "invalid-json" }, 400);
+    }
+    const channel = body.channel;
+    const destination = typeof body.destination === "string" ? body.destination : "";
+    const prompt = typeof body.prompt === "string" ? body.prompt : "";
+    const eventId = typeof body.eventId === "string" ? body.eventId : "";
+    if (channel !== "whatsapp" && channel !== "telegram" || !destination || !prompt) {
+      console.error(`${TAG16} reject reason=bad-request channel=${String(channel)} hasDestination=${Boolean(destination)} hasPrompt=${Boolean(prompt)}`);
+      return c.json({ ok: false, error: "schedule-inject-bad-request" }, 400);
+    }
+    const account = deps.resolveAccount();
+    if (!account) {
+      console.error(`${TAG16} reject reason=no-account eventId=${eventId}`);
+      return c.json({ ok: false, error: "no-account" }, 500);
+    }
+    const houseAccountId = account.accountId;
+    console.error(`${TAG16} op=received eventId=${eventId} channel=${channel} destination=${destination} account=${houseAccountId}`);
+    if (channel === "whatsapp") {
+      const effectiveAccount2 = deps.effectiveAccountFor(houseAccountId, account.accountDir, destination);
+      console.error(`${TAG16} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount2}`);
+      const sessionId2 = adminSessionIdFor(effectiveAccount2, destination);
+      const reply2 = (text) => deps.sendWhatsAppText(houseAccountId, destination, text);
+      try {
+        await deps.waHandleInbound({
+          accountId: houseAccountId,
+          // Task 1383 — the router (ensureChannelSession) no longer re-resolves
+          // the accountManagers map; it consumes this value. The scheduler
+          // supplies its own resolution (effectiveAccountFor, computed above) so
+          // a manager destination scopes the spawned session to the sub-account,
+          // exactly as a real inbound now does via the gate.
+          effectiveAccountId: effectiveAccount2,
+          senderId: destination,
+          role: "admin",
+          personId: null,
+          text: prompt,
+          media: [],
+          source: "schedule",
+          reply: reply2
+        });
+      } catch (err) {
+        console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId2} result=inject-error status=${err instanceof Error ? err.message : String(err)}`);
+        return c.json({ ok: false, error: "inject-error" }, 502);
+      }
+      console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId2} result=ok status=-`);
+      return c.json({ ok: true }, 200);
+    }
+    const effectiveAccount = houseAccountId;
+    console.error(`${TAG16} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount}`);
+    const botToken = account.config.telegram?.adminBotToken;
+    if (!botToken) {
+      console.error(`${TAG16} reject reason=no-admin-bot-token eventId=${eventId}`);
+      return c.json({ ok: false, error: "no-admin-bot-token" }, 400);
+    }
+    const chatId = Number(destination);
+    const sessionId = adminSessionIdFor(effectiveAccount, destination);
+    const reply = (text) => deps.sendTelegramText(botToken, chatId, text);
+    try {
+      await deps.tgHandleInbound({
+        accountId: houseAccountId,
+        senderId: destination,
+        chatId: destination,
+        role: "admin",
+        personId: null,
+        text: prompt,
+        source: "schedule",
+        reply
+      });
+    } catch (err) {
+      console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=inject-error status=${err instanceof Error ? err.message : String(err)}`);
+      return c.json({ ok: false, error: "inject-error" }, 502);
+    }
+    console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
+    return c.json({ ok: true }, 200);
+  });
+  return app56;
+}
+
+// app/lib/telegram/outbound/send-text.ts
+async function sendTelegramText(botToken, chatId, text) {
+  try {
+    const res = await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ chat_id: chatId, text })
+    });
+    const data = await res.json();
+    return data.ok ? { ok: true } : { ok: false, error: data.description ?? "send failed" };
+  } catch (e) {
+    return { ok: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+
 // server/routes/whatsapp.ts
 import { join as join10, resolve as resolve10 } from "path";
 import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync6 } from "fs";
@@ -5980,8 +6147,8 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
-import { resolve as resolve8, join as join8 } from "path";
-var TAG16 = "[whatsapp:config]";
+import { resolve as resolve8, join as join8, dirname as dirname2, basename as basename2 } from "path";
+var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve8(accountDir, "account.json");
 }
@@ -5998,9 +6165,9 @@ function reloadManagerConfig(accountDir) {
   try {
     const config = readConfig(accountDir);
     reloadConfig(config);
-    console.error(`${TAG16} reloaded manager config`);
+    console.error(`${TAG17} reloaded manager config`);
   } catch (err) {
-    console.error(`${TAG16} manager config reload failed: ${String(err)}`);
+    console.error(`${TAG17} manager config reload failed: ${String(err)}`);
   }
 }
 var E164_PATTERN = /^\+\d{7,15}$/;
@@ -6026,25 +6193,25 @@ function persistAfterPairing(accountDir, accountId, selfPhone) {
       const adminPhones = wa.adminPhones;
       if (!adminPhones.includes(normalized)) {
         adminPhones.push(normalized);
-        console.error(`${TAG16} added selfPhone=${normalized} to adminPhones`);
+        console.error(`${TAG17} added selfPhone=${normalized} to adminPhones`);
       }
     } else {
-      console.error(`${TAG16} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
+      console.error(`${TAG17} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
     }
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG16} validation failed after pairing: ${msg}`);
+      console.error(`${TAG17} validation failed after pairing: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
+    console.error(`${TAG17} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
     reloadManagerConfig(accountDir);
     return { ok: true };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} persist failed account=${accountId}: ${msg}`);
+    console.error(`${TAG17} persist failed account=${accountId}: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -6055,6 +6222,16 @@ function addAdminPhone(accountDir, phone) {
   }
   try {
     const config = readConfig(accountDir);
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
+    const socketOwner = resolveHouseOrSoleAccountId(dirname2(resolve8(accountDir)));
+    if (targetId !== socketOwner) {
+      console.error(`${TAG17} add-admin-phone rejected accountId=${targetId} reason=not-socket-account`);
+      return {
+        ok: false,
+        reason: "not-socket-account",
+        error: `${targetId} does not own the WhatsApp paired socket, so its admin phones are never consulted. To route a phone to a sub-account, bind it as an account manager (add-account-manager) instead.`
+      };
+    }
     if (!config.whatsapp || typeof config.whatsapp !== "object") {
       config.whatsapp = {};
     }
@@ -6066,6 +6243,9 @@ function addAdminPhone(accountDir, phone) {
     if (adminPhones.includes(normalized)) {
       return { ok: true, message: `Phone ${normalized} is already in the admin list.` };
     }
+    if (managedAccountFor(readAccountManagers(accountDir), normalized)) {
+      return { ok: false, error: `${normalized} is bound as an account manager. Remove the account-manager binding before adding it as a house admin \u2014 a phone is a house admin or a sub-account manager, never both.` };
+    }
     adminPhones.push(normalized);
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
@@ -6074,12 +6254,12 @@ function addAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} added admin phone=${normalized}`);
+    console.error(`${TAG17} added admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Added ${normalized} as admin phone. Messages from this number will route to the admin agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} addAdminPhone failed: ${msg}`);
+    console.error(`${TAG17} addAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -6107,12 +6287,12 @@ function removeAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} removed admin phone=${normalized}`);
+    console.error(`${TAG17} removed admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Removed ${normalized} from admin phones. Messages from this number will now route to the public agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} removeAdminPhone failed: ${msg}`);
+    console.error(`${TAG17} removeAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -6127,6 +6307,139 @@ function readAdminPhones(accountDir) {
     return [];
   }
 }
+function purgeNonSocketAdminPhones(accountDir, socketOwnerId) {
+  try {
+    const config = readConfig(accountDir);
+    const wa = config.whatsapp;
+    if (!wa || typeof wa !== "object") return { removed: [] };
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
+    if (targetId === socketOwnerId) return { removed: [] };
+    const adminPhones = Array.isArray(wa.adminPhones) ? wa.adminPhones.filter((p) => typeof p === "string") : [];
+    if (adminPhones.length === 0) return { removed: [] };
+    delete wa.adminPhones;
+    writeConfig(accountDir, config);
+    for (const phone of adminPhones) {
+      console.error(`[admin-identity] op=purge-nonsocket-adminphone accountId=${targetId} phone=${phone} removed=true`);
+    }
+    return { removed: adminPhones };
+  } catch (err) {
+    console.error(`[admin-identity] purge-nonsocket-adminphone failed dir=${accountDir}: ${String(err)}`);
+    return { removed: [] };
+  }
+}
+function purgeNonSocketAdminPhonesAtBoot() {
+  let socketOwner;
+  try {
+    socketOwner = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch (err) {
+    console.error(`[admin-identity] purge-nonsocket-adminphone skipped \u2014 cannot resolve socket owner: ${String(err)}`);
+    return;
+  }
+  let accounts;
+  try {
+    accounts = listValidAccounts();
+  } catch {
+    return;
+  }
+  for (const acct of accounts) {
+    purgeNonSocketAdminPhones(acct.accountDir, socketOwner);
+  }
+}
+function setAccountManager(accountDir, phone, subAccountId) {
+  const normalized = phone.trim();
+  if (!E164_PATTERN.test(normalized)) {
+    return { ok: false, error: `Invalid phone format "${normalized}". Expected E.164 (e.g. +441234567890).` };
+  }
+  const sub = subAccountId.trim();
+  if (!sub) {
+    return { ok: false, error: "Missing sub-account id." };
+  }
+  let validIds;
+  try {
+    validIds = listValidAccounts().map((a) => a.accountId);
+  } catch (err) {
+    return { ok: false, error: `Could not read the account registry to validate the sub-account: ${err instanceof Error ? err.message : String(err)}. Try again.` };
+  }
+  if (!validIds.includes(sub)) {
+    return { ok: false, error: `Sub-account "${sub}" is not in this install's account registry. Check the sub-account id and try again.` };
+  }
+  try {
+    const config = readConfig(accountDir);
+    if (!config.whatsapp || typeof config.whatsapp !== "object") {
+      config.whatsapp = {};
+    }
+    const wa = config.whatsapp;
+    const adminPhones = Array.isArray(wa.adminPhones) ? wa.adminPhones.filter((p) => typeof p === "string") : [];
+    if (isAdminPhone(normalized, adminPhones)) {
+      return {
+        ok: false,
+        error: `${normalized} is a house admin phone. Remove it from admin phones before binding it as an account manager \u2014 a phone is a house admin or a sub-account manager, never both.`
+      };
+    }
+    if (!wa.accountManagers || typeof wa.accountManagers !== "object") {
+      wa.accountManagers = {};
+    }
+    wa.accountManagers[normalized] = sub;
+    const parsed = WhatsAppConfigSchema.safeParse(wa);
+    if (!parsed.success) {
+      const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+      return { ok: false, error: `Validation failed: ${msg}` };
+    }
+    config.whatsapp = parsed.data;
+    writeConfig(accountDir, config);
+    console.error(`${TAG17} bound account manager phone=${normalized} managesAccount=${sub}`);
+    reloadManagerConfig(accountDir);
+    return { ok: true, message: `Bound ${normalized} as account manager for sub-account ${sub}. Their WhatsApp messages will reach that sub-account's admin agent; replies still go out over this account's WhatsApp device.` };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG17} setAccountManager failed: ${msg}`);
+    return { ok: false, error: msg };
+  }
+}
+function clearAccountManager(accountDir, phone) {
+  const normalized = phone.trim();
+  try {
+    const config = readConfig(accountDir);
+    const wa = config.whatsapp;
+    if (!wa || typeof wa !== "object" || !wa.accountManagers || typeof wa.accountManagers !== "object") {
+      return { ok: true, message: `No account-manager binding for ${normalized}.` };
+    }
+    const map = wa.accountManagers;
+    const key = Object.keys(map).find((k) => phonesMatch(k, normalized));
+    if (!key) {
+      return { ok: true, message: `No account-manager binding for ${normalized}.` };
+    }
+    delete map[key];
+    const parsed = WhatsAppConfigSchema.safeParse(wa);
+    if (!parsed.success) {
+      const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
+      return { ok: false, error: `Validation failed: ${msg}` };
+    }
+    config.whatsapp = parsed.data;
+    writeConfig(accountDir, config);
+    console.error(`${TAG17} cleared account manager phone=${normalized}`);
+    reloadManagerConfig(accountDir);
+    return { ok: true, message: `Cleared the account-manager binding for ${normalized}.` };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG17} clearAccountManager failed: ${msg}`);
+    return { ok: false, error: msg };
+  }
+}
+function readAccountManagers(accountDir) {
+  try {
+    const config = readConfig(accountDir);
+    const wa = config.whatsapp;
+    if (!wa || typeof wa.accountManagers !== "object" || wa.accountManagers === null || Array.isArray(wa.accountManagers)) return {};
+    const out = {};
+    for (const [k, v] of Object.entries(wa.accountManagers)) {
+      if (typeof v === "string") out[k] = v;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
 function setPublicAgent(accountDir, slug) {
   const trimmed = slug.trim();
   if (!trimmed) {
@@ -6150,12 +6463,12 @@ function setPublicAgent(accountDir, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} publicAgent set to ${trimmed}`);
+    console.error(`${TAG17} publicAgent set to ${trimmed}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Public agent set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} setPublicAgent failed: ${msg}`);
+    console.error(`${TAG17} setPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -6196,17 +6509,17 @@ function updateConfig(accountDir, fields) {
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG16} update validation failed: ${msg}`);
+      console.error(`${TAG17} update validation failed: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} updated fields=[${fieldNames.join(",")}]`);
+    console.error(`${TAG17} updated fields=[${fieldNames.join(",")}]`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Updated WhatsApp config: ${fieldNames.join(", ")}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} updateConfig failed: ${msg}`);
+    console.error(`${TAG17} updateConfig failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -6243,17 +6556,17 @@ function migrateRemovedConfigKeys(accountDir) {
     }
     writeConfig(accountDir, config);
     console.error(
-      `${TAG16} migration: stripped unknown keys=[${result.droppedKeys.join(",")}] from account.json`
+      `${TAG17} migration: stripped unknown keys=[${result.droppedKeys.join(",")}] from account.json`
     );
     return { dropped: result.droppedKeys };
   } catch (err) {
-    console.error(`${TAG16} migration failed: ${String(err)}`);
+    console.error(`${TAG17} migration failed: ${String(err)}`);
     return { dropped: [] };
   }
 }
 
 // app/lib/whatsapp/login.ts
-var TAG17 = "[whatsapp:login]";
+var TAG18 = "[whatsapp:login]";
 function maskPhone(digits) {
   if (digits.length <= 4) return "*".repeat(digits.length);
   return digits.slice(0, 2) + "*".repeat(digits.length - 4) + digits.slice(-2);
@@ -6264,7 +6577,7 @@ function closeSocket(sock) {
   try {
     sock.ws?.close?.();
   } catch (err) {
-    console.warn(`${TAG17} socket close error during cleanup: ${String(err)}`);
+    console.warn(`${TAG18} socket close error during cleanup: ${String(err)}`);
   }
 }
 function resetActiveLogin(accountId) {
@@ -6291,18 +6604,18 @@ async function runPostPairing(login) {
         const masked = selfPhone ? `${selfPhone.slice(0, 4)}***` : "null";
         console.error(`[whatsapp-persist] wa-persist-on-connect account=${login.accountId} phone=${masked}`);
       } else {
-        console.error(`${TAG17} wa-persist-on-connect FAILED account=${login.accountId}: ${result.error}`);
+        console.error(`${TAG18} wa-persist-on-connect FAILED account=${login.accountId}: ${result.error}`);
       }
     } catch (err) {
-      console.error(`${TAG17} wa-persist-on-connect error account=${login.accountId}: ${String(err)}`);
+      console.error(`${TAG18} wa-persist-on-connect error account=${login.accountId}: ${String(err)}`);
     }
   } else {
-    console.error(`${TAG17} wa-persist-on-connect skipped \u2014 no accountDir account=${login.accountId}`);
+    console.error(`${TAG18} wa-persist-on-connect skipped \u2014 no accountDir account=${login.accountId}`);
   }
   try {
     await registerLoginSocket(login.accountId, login.sock, login.authDir);
   } catch (err) {
-    console.error(`${TAG17} registerLoginSocket failed account=${login.accountId}: ${String(err)}`);
+    console.error(`${TAG18} registerLoginSocket failed account=${login.accountId}: ${String(err)}`);
   }
 }
 async function loginConnectionLoop(accountId, login) {
@@ -6311,7 +6624,7 @@ async function loginConnectionLoop(accountId, login) {
   const logTerminal = (outcome, errMsg) => {
     const fc = credsCensus(login.authDir);
     console.error(
-      `${TAG17} op=terminal cid=${cidShort} outcome=${outcome} credsFinal={registered=${fc.registered},account=${fc.hasAccountSignature},me=${fc.e164 ?? "null"}}` + (errMsg ? ` error="${errMsg}"` : "")
+      `${TAG18} op=terminal cid=${cidShort} outcome=${outcome} credsFinal={registered=${fc.registered},account=${fc.hasAccountSignature},me=${fc.e164 ?? "null"}}` + (errMsg ? ` error="${errMsg}"` : "")
     );
   };
   while (true) {
@@ -6321,7 +6634,7 @@ async function loginConnectionLoop(accountId, login) {
       if (current?.id === login.id) {
         await runPostPairing(current);
         current.connected = true;
-        console.error(`${TAG17} loginConnectionLoop: connected account=${accountId} attempt=${attempt} configPersisted=${current.configPersisted}`);
+        console.error(`${TAG18} loginConnectionLoop: connected account=${accountId} attempt=${attempt} configPersisted=${current.configPersisted}`);
         logTerminal("connected");
       }
       return;
@@ -6333,7 +6646,7 @@ async function loginConnectionLoop(accountId, login) {
       if (!preRetryCensus.hasAccountSignature) {
         current.error = "WhatsApp accepted the code but did not finish linking. This usually means the number has reached its linked-device limit or has a stale linked device. On the phone, open WhatsApp, Linked Devices, remove existing devices, then ask for a new code.";
         console.error(
-          `${TAG17} op=pairing-incomplete cid=${cidShort} closeKind=${closeKind(getStatusCode(err), false)} reason=no-account-signature`
+          `${TAG18} op=pairing-incomplete cid=${cidShort} closeKind=${closeKind(getStatusCode(err), false)} reason=no-account-signature`
         );
         return;
       }
@@ -6341,7 +6654,7 @@ async function loginConnectionLoop(accountId, login) {
       if (!classification.shouldRetry || attempt >= LOGIN_MAX_RECONNECTS) {
         if (attempt >= LOGIN_MAX_RECONNECTS) {
           console.error(
-            `${TAG17} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
+            `${TAG18} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
           );
           current.error = `Login failed after ${attempt} reconnect attempts: ${formatError(err)}`;
         } else {
@@ -6354,7 +6667,7 @@ async function loginConnectionLoop(accountId, login) {
       attempt++;
       const delay = LOGIN_RECONNECT_DELAYS[attempt - 1] ?? 8e3;
       console.error(
-        `${TAG17} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
+        `${TAG18} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
       );
       closeSocket(current.sock);
       await new Promise((r) => setTimeout(r, delay));
@@ -6362,14 +6675,14 @@ async function loginConnectionLoop(accountId, login) {
       if (afterDelay?.id !== login.id) return;
       const rc = credsCensus(login.authDir);
       console.error(
-        `${TAG17} op=reconnect cid=${cidShort} attempt=${attempt}/${LOGIN_MAX_RECONNECTS} withRegistered=${rc.registered} withAccount=${rc.hasAccountSignature}`
+        `${TAG18} op=reconnect cid=${cidShort} attempt=${attempt}/${LOGIN_MAX_RECONNECTS} withRegistered=${rc.registered} withAccount=${rc.hasAccountSignature}`
       );
       try {
         const newSock = await createWaSocket({ authDir: login.authDir, correlationId: cidShort, account: accountId });
         current.sock = newSock;
       } catch (sockErr) {
         console.error(
-          `${TAG17} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
+          `${TAG18} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
         );
         current.error = `Reconnection failed: ${String(sockErr)}`;
         logTerminal("error", current.error);
@@ -6386,7 +6699,7 @@ async function startLogin(opts) {
   const hasAuth = await authExists(authDir);
   const selfId = readSelfId(authDir);
   console.error(
-    `${TAG17} op=start cid=${cid} account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasCode=${!!existing0.pairingCode}}` : " activeLogin=none")
+    `${TAG18} op=start cid=${cid} account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasCode=${!!existing0.pairingCode}}` : " activeLogin=none")
   );
   if (hasAuth && !force) {
     const who = selfId.e164 ?? selfId.jid ?? "unknown";
@@ -6401,7 +6714,7 @@ async function startLogin(opts) {
   }
   const existing = activeLogins.get(accountId);
   if (existing && isLoginFresh(existing) && existing.pairingCode && !force) {
-    console.error(`${TAG17} startLogin account=${accountId} guard: returning existing pairing code (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
+    console.error(`${TAG18} startLogin account=${accountId} guard: returning existing pairing code (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
     return {
       pairingCode: existing.pairingCode,
       phone: existing.phone,
@@ -6409,7 +6722,7 @@ async function startLogin(opts) {
     };
   }
   if (existing) {
-    console.error(`${TAG17} startLogin account=${accountId} ${force ? "force override" : "stale/no-code"}, resetting active login`);
+    console.error(`${TAG18} startLogin account=${accountId} ${force ? "force override" : "stale/no-code"}, resetting active login`);
   }
   resetActiveLogin(accountId);
   await clearAuth(authDir);
@@ -6440,7 +6753,7 @@ async function startLogin(opts) {
         if (requested) return;
         requested = true;
         console.error(
-          `${TAG17} op=pairing-request cid=${cid} account=${accountId} qrRef=#1 sinceOpenMs=${socketOpenTs ? Date.now() - socketOpenTs : 0}`
+          `${TAG18} op=pairing-request cid=${cid} account=${accountId} qrRef=#1 sinceOpenMs=${socketOpenTs ? Date.now() - socketOpenTs : 0}`
         );
         void sock.requestPairingCode(digits).then((code) => {
           clearTimeout(codeTimer);
@@ -6449,7 +6762,7 @@ async function startLogin(opts) {
           if (current?.id !== login.id) return;
           if (!current.pairingCode) current.pairingCode = code;
           console.error(
-            `${TAG17} op=code-issued cid=${cid} account=${accountId} phone=${maskPhone(digits)} codeLen=${code.length} sinceOpenMs=${socketOpenTs ? codeIssuedTs - socketOpenTs : 0}`
+            `${TAG18} op=code-issued cid=${cid} account=${accountId} phone=${maskPhone(digits)} codeLen=${code.length} sinceOpenMs=${socketOpenTs ? codeIssuedTs - socketOpenTs : 0}`
           );
           resolveCode?.(code);
         }).catch((err) => {
@@ -6480,7 +6793,7 @@ async function startLogin(opts) {
   const ttlTimer = setTimeout(() => {
     const current = activeLogins.get(accountId);
     if (current?.id === login.id && !current.connected) {
-      console.error(`${TAG17} pairing-window-elapsed account=${accountId} (ttl sweep)`);
+      console.error(`${TAG18} pairing-window-elapsed account=${accountId} (ttl sweep)`);
       resetActiveLogin(accountId);
     }
   }, ACTIVE_LOGIN_TTL_MS);
@@ -6488,7 +6801,7 @@ async function startLogin(opts) {
     ttlTimer.unref();
   }
   loginConnectionLoop(accountId, login).catch((err) => {
-    console.error(`${TAG17} loginConnectionLoop unexpected error: ${String(err)}`);
+    console.error(`${TAG18} loginConnectionLoop unexpected error: ${String(err)}`);
     const current = activeLogins.get(accountId);
     if (current?.id === login.id) {
       current.error = `Unexpected login error: ${String(err)}`;
@@ -6513,13 +6826,13 @@ async function waitForLogin(opts) {
   const { accountId, timeoutMs = 6e4 } = opts;
   const login = activeLogins.get(accountId);
   console.error(
-    `${TAG17} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasCode=${!!login.pairingCode}}` : " login=none")
+    `${TAG18} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasCode=${!!login.pairingCode}}` : " login=none")
   );
   if (!login) {
     return { connected: false, message: "No active WhatsApp login in progress.", configPersisted: false };
   }
   if (!isLoginFresh(login)) {
-    console.error(`${TAG17} pairing-window-elapsed account=${accountId}`);
+    console.error(`${TAG18} pairing-window-elapsed account=${accountId}`);
     resetActiveLogin(accountId);
     return { connected: false, message: "The pairing window expired. Ask me to generate a new code.", configPersisted: false };
   }
@@ -6527,8 +6840,8 @@ async function waitForLogin(opts) {
   while (Date.now() < deadline) {
     if (login.connected) {
       const selfId = readSelfId(login.authDir);
-      console.error(`${TAG17} pairing-connected account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
-      console.error(`${TAG17} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"} configPersisted=${login.configPersisted}`);
+      console.error(`${TAG18} pairing-connected account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
+      console.error(`${TAG18} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"} configPersisted=${login.configPersisted}`);
       const configPersisted = login.configPersisted;
       activeLogins.delete(accountId);
       return {
@@ -6546,7 +6859,7 @@ async function waitForLogin(opts) {
     await new Promise((r) => setTimeout(r, 1e3));
   }
   const elapsed = Math.round((Date.now() - (deadline - timeoutMs)) / 1e3);
-  console.error(`${TAG17} waitForLogin poll timeout account=${accountId} elapsed=${elapsed}s \u2014 login kept alive (pairing code still valid)`);
+  console.error(`${TAG18} waitForLogin poll timeout account=${accountId} elapsed=${elapsed}s \u2014 login kept alive (pairing code still valid)`);
   return { connected: false, message: "Still waiting for you to enter the pairing code. The code is still valid \u2014 ask me to keep waiting, or request a new code.", configPersisted: false };
 }
 function listActiveLoginAccountIds() {
@@ -6560,8 +6873,8 @@ function listActiveLoginAccountIds() {
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync3 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve9, basename as basename2 } from "path";
-var TAG18 = "[whatsapp:outbound]";
+import { resolve as resolve9, basename as basename3 } from "path";
+var TAG19 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
 var lastRouteDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -6595,16 +6908,16 @@ async function sendWhatsAppDocument(input) {
     const accountResolved = realpathSync3(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
       const sanitised = filePath.replace(accountDir, "<account>/");
-      console.error(`${TAG18} document REJECTED path=${sanitised} reason=outside_account_directory`);
+      console.error(`${TAG19} document REJECTED path=${sanitised} reason=outside_account_directory`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG18} document ENOENT path=${filePath}`);
+      console.error(`${TAG19} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG18} document path error: ${String(err)}`);
+    console.error(`${TAG19} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat2(resolvedPath);
@@ -6615,11 +6928,11 @@ async function sendWhatsAppDocument(input) {
       error: `File exceeds 100 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename2(resolvedPath);
+  const filename = basename3(resolvedPath);
   const jid = normalizeJid2(to);
   const sock = getSocket(accountId);
   if (!sock) {
-    console.error(`${TAG18} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=false reason=not-connected`);
+    console.error(`${TAG19} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=false reason=not-connected`);
     return { ok: false, status: 503, error: `WhatsApp account "${accountId}" is not connected` };
   }
   const buffer = Buffer.from(await readFile(resolvedPath));
@@ -6631,7 +6944,7 @@ async function sendWhatsAppDocument(input) {
     { accountId }
   );
   console.error(
-    `${TAG18} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
+    `${TAG19} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
   );
   if (result.success) {
     recordDocumentOutbound(to);
@@ -6751,7 +7064,7 @@ function serializeWhatsAppSchema() {
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync3 } from "fs";
 import { join as join9 } from "path";
-var TAG19 = "[whatsapp:reconcile]";
+var TAG20 = "[whatsapp:reconcile]";
 var HALF_REGISTERED_MIN_AGE_MS = 5 * 6e4;
 function listCredsAccountIds(credsRoot) {
   try {
@@ -6777,14 +7090,14 @@ function reconcileCredsOnDisk(opts) {
       const ageMs = getAuthAgeMs(authDir);
       const abandoned = !inFlight && ageMs !== null && ageMs >= HALF_REGISTERED_MIN_AGE_MS;
       if (!abandoned) {
-        console.error(`${TAG19} op=half-registered account=${accountId} registered=true hasAccount=false inFlight=${inFlight} ageMs=${ageMs ?? "null"}`);
+        console.error(`${TAG20} op=half-registered account=${accountId} registered=true hasAccount=false inFlight=${inFlight} ageMs=${ageMs ?? "null"}`);
         entries.push({ accountId, connected: false, linkedUnconfigured: true });
         continue;
       }
-      console.error(`${TAG19} op=discard-half-registered account=${accountId} registered=true hasAccount=false ageMs=${ageMs}`);
+      console.error(`${TAG20} op=discard-half-registered account=${accountId} registered=true hasAccount=false ageMs=${ageMs}`);
       const removed = discardAuthDirSync(authDir);
       if (!removed) {
-        console.error(`${TAG19} op=discard-half-registered-failed account=${accountId} \u2014 residue persists`);
+        console.error(`${TAG20} op=discard-half-registered-failed account=${accountId} \u2014 residue persists`);
         entries.push({ accountId, connected: false, linkedUnconfigured: true });
       }
       continue;
@@ -6792,14 +7105,14 @@ function reconcileCredsOnDisk(opts) {
     const selfPhone = readSelfId(authDir).e164 ?? void 0;
     const configured = accountDir ? isAccountConfigured(accountDir, accountId) : false;
     console.error(
-      `${TAG19} wa-link-unconfigured account=${accountId} creds=present config=${configured ? "present" : "absent"}`
+      `${TAG20} wa-link-unconfigured account=${accountId} creds=present config=${configured ? "present" : "absent"}`
     );
     if (!configured && accountDir) {
       const result = persistAfterPairing(accountDir, accountId, selfPhone ?? null);
       if (result.ok) {
-        console.error(`${TAG19} self-healed account=${accountId}`);
+        console.error(`${TAG20} self-healed account=${accountId}`);
       } else {
-        console.error(`${TAG19} self-heal FAILED account=${accountId}: ${result.error}`);
+        console.error(`${TAG20} self-heal FAILED account=${accountId}: ${result.error}`);
       }
     }
     entries.push({ accountId, selfPhone, connected: false, linkedUnconfigured: !configured });
@@ -6808,7 +7121,7 @@ function reconcileCredsOnDisk(opts) {
 }
 
 // server/routes/whatsapp.ts
-var TAG20 = "[whatsapp:api]";
+var TAG21 = "[whatsapp:api]";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
 var app2 = new Hono();
 app2.get("/status", (c) => {
@@ -6821,10 +7134,10 @@ app2.get("/status", (c) => {
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds, activeLoginAccountIds: activeLoginIds });
     const accounts = [...live, ...reconciled];
     const summary = accounts.map((a) => `${a.accountId}:${a.connected ? "up" : a.linkedUnconfigured ? "linked-unconfigured" : "down"}`).join(", ");
-    console.error(`${TAG20} status accounts=${accounts.length} [${summary}]`);
+    console.error(`${TAG21} status accounts=${accounts.length} [${summary}]`);
     return c.json({ accounts });
   } catch (err) {
-    console.error(`${TAG20} status error: ${String(err)}`);
+    console.error(`${TAG21} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6840,10 +7153,10 @@ app2.post("/login/start", async (c) => {
     const authDir = join10(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
-    console.error(`${TAG20} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
+    console.error(`${TAG21} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG20} login/start error: ${String(err)}`);
+    console.error(`${TAG21} login/start error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6853,7 +7166,7 @@ app2.post("/login/wait", async (c) => {
     const accountId = validateAccountId(body.accountId);
     const timeoutMs = body.timeoutMs ?? 6e4;
     const result = await waitForLogin({ accountId, timeoutMs });
-    console.error(`${TAG20} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${result.configPersisted}`);
+    console.error(`${TAG21} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${result.configPersisted}`);
     return c.json({
       connected: result.connected,
       message: result.message,
@@ -6861,7 +7174,7 @@ app2.post("/login/wait", async (c) => {
       configPersisted: result.configPersisted
     });
   } catch (err) {
-    console.error(`${TAG20} login/wait error: ${String(err)}`);
+    console.error(`${TAG21} login/wait error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6872,7 +7185,7 @@ app2.post("/disconnect", async (c) => {
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
   } catch (err) {
-    console.error(`${TAG20} disconnect error: ${String(err)}`);
+    console.error(`${TAG21} disconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -6883,14 +7196,14 @@ app2.post("/reconnect", async (c) => {
     await startConnection(accountId);
     return c.json({ reconnecting: true, accountId });
   } catch (err) {
-    console.error(`${TAG20} reconnect error: ${String(err)}`);
+    console.error(`${TAG21} reconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
 app2.post("/config", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const { action, phone, slug, fields, accountId } = body;
+    const { action, phone, slug, fields, accountId, managesAccount } = body;
     if (!action || typeof action !== "string") {
       return c.json({ ok: false, error: 'Missing required field "action".' }, 400);
     }
@@ -6904,7 +7217,8 @@ app2.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG20} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        const reasonTail = !result.ok && result.reason ? ` reason=${result.reason}` : "";
+        console.error(`${TAG21} config action=add-admin-phone accountId=${account.accountId} phone=${phone} ok=${result.ok}${reasonTail}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -6912,26 +7226,50 @@ app2.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone".' }, 400);
         }
         const result = removeAdminPhone(account.accountDir, phone);
-        console.error(`${TAG20} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG21} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-admin-phones": {
         const phones = readAdminPhones(account.accountDir);
-        console.error(`${TAG20} config action=list-admin-phones count=${phones.length}`);
+        console.error(`${TAG21} config action=list-admin-phones count=${phones.length}`);
         return c.json({ ok: true, phones });
       }
+      case "add-account-manager": {
+        if (!phone || typeof phone !== "string") {
+          return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
+        }
+        if (!managesAccount || typeof managesAccount !== "string") {
+          return c.json({ ok: false, error: 'Missing required field "managesAccount" (the sub-account UUID this phone should manage).' }, 400);
+        }
+        const result = setAccountManager(account.accountDir, phone, managesAccount);
+        console.error(`${TAG21} config action=add-account-manager phone=${phone} managesAccount=${managesAccount} ok=${result.ok}`);
+        return c.json(result, result.ok ? 200 : 400);
+      }
+      case "remove-account-manager": {
+        if (!phone || typeof phone !== "string") {
+          return c.json({ ok: false, error: 'Missing required field "phone".' }, 400);
+        }
+        const result = clearAccountManager(account.accountDir, phone);
+        console.error(`${TAG21} config action=remove-account-manager phone=${phone} ok=${result.ok}`);
+        return c.json(result, result.ok ? 200 : 400);
+      }
+      case "list-account-managers": {
+        const accountManagers = readAccountManagers(account.accountDir);
+        console.error(`${TAG21} config action=list-account-managers count=${Object.keys(accountManagers).length}`);
+        return c.json({ ok: true, accountManagers });
+      }
       case "set-public-agent": {
         if (!slug || typeof slug !== "string") {
           return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
         }
         const result = setPublicAgent(account.accountDir, slug);
-        console.error(`${TAG20} config action=set-public-agent slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG21} config action=set-public-agent slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-public-agent": {
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount });
-        console.error(`${TAG20} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
+        console.error(`${TAG21} config action=get-public-agent accountId=${targetAccount} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "list-public-agents": {
@@ -6948,26 +7286,26 @@ app2.post("/config", async (c) => {
                 const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
-                console.error(`${TAG20} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+                console.error(`${TAG21} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
               }
             }
           } catch (err) {
-            console.error(`${TAG20} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
+            console.error(`${TAG21} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
           }
         }
-        console.error(`${TAG20} config action=list-public-agents count=${agents.length}`);
+        console.error(`${TAG21} config action=list-public-agents count=${agents.length}`);
         return c.json({ ok: true, agents });
       }
       case "schema": {
         const text = serializeWhatsAppSchema();
-        console.error(`${TAG20} config action=schema`);
+        console.error(`${TAG21} config action=schema`);
         return c.json({ ok: true, text });
       }
       case "list-groups": {
         const groupAccountId = accountId ?? "default";
         const sock = getSocket(groupAccountId);
         if (!sock) {
-          console.error(`${TAG20} config action=list-groups error="not connected" accountId=${groupAccountId}`);
+          console.error(`${TAG21} config action=list-groups error="not connected" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `WhatsApp account "${groupAccountId}" is not connected. Connect first, then retry.` });
         }
         try {
@@ -6977,10 +7315,10 @@ app2.post("/config", async (c) => {
             name: g.subject ?? g.id,
             participantCount: Array.isArray(g.participants) ? g.participants.length : 0
           }));
-          console.error(`${TAG20} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
+          console.error(`${TAG21} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
           return c.json({ ok: true, groups });
         } catch (err) {
-          console.error(`${TAG20} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
+          console.error(`${TAG21} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `Failed to fetch groups: ${String(err)}` });
         }
       }
@@ -6990,22 +7328,22 @@ app2.post("/config", async (c) => {
         }
         const result = updateConfig(account.accountDir, fields);
         const fieldNames = Object.keys(fields);
-        console.error(`${TAG20} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
+        console.error(`${TAG21} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-config": {
         const waConfig = getConfig(account.accountDir);
-        console.error(`${TAG20} config action=get-config`);
+        console.error(`${TAG21} config action=get-config`);
         return c.json({ ok: true, config: waConfig });
       }
       default:
         return c.json(
-          { ok: false, error: `Unknown action "${action}". Valid actions: add-admin-phone, remove-admin-phone, list-admin-phones, set-public-agent, get-public-agent, list-public-agents, update-config, get-config, schema, list-groups.` },
+          { ok: false, error: `Unknown action "${action}". Valid actions: add-admin-phone, remove-admin-phone, list-admin-phones, add-account-manager, remove-account-manager, list-account-managers, set-public-agent, get-public-agent, list-public-agents, update-config, get-config, schema, list-groups.` },
           400
         );
     }
   } catch (err) {
-    console.error(`${TAG20} config error: ${String(err)}`);
+    console.error(`${TAG21} config error: ${String(err)}`);
     return c.json({ ok: false, error: String(err) }, 500);
   }
 });
@@ -7026,7 +7364,7 @@ app2.post("/send-document", async (c) => {
     recordRouteDocumentOutbound(to, filePath);
     return c.json({ success: true, messageId: result.messageId });
   } catch (err) {
-    console.error(`${TAG20} send-document error: ${String(err)}`);
+    console.error(`${TAG21} send-document error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -7063,7 +7401,7 @@ app2.post("/send-admin", async (c) => {
     }
     return c.json({ success: true, messageId: result.messageId });
   } catch (err) {
-    console.error(`${TAG20} send-admin error: ${String(err)}`);
+    console.error(`${TAG21} send-admin error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -7073,11 +7411,11 @@ app2.get("/activity", (c) => {
     const result = getChannelActivity(accountId);
     const total = result.accounts.reduce((sum, a) => sum + a.total, 0);
     console.error(
-      `${TAG20} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
+      `${TAG21} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
     );
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG20} activity error: ${String(err)}`);
+    console.error(`${TAG21} activity error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -7096,10 +7434,10 @@ app2.get("/conversations", (c) => {
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG20} conversations account=${accountId} count=${conversations.length}`);
+    console.error(`${TAG21} conversations account=${accountId} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
-    console.error(`${TAG20} conversations error: ${String(err)}`);
+    console.error(`${TAG21} conversations error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -7114,10 +7452,10 @@ app2.get("/messages", (c) => {
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
     const messages = getMessages(accountId, jid, effectiveLimit);
-    console.error(`${TAG20} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    console.error(`${TAG21} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
     return c.json({ messages });
   } catch (err) {
-    console.error(`${TAG20} messages error: ${String(err)}`);
+    console.error(`${TAG21} messages error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -7198,7 +7536,7 @@ app2.get("/conversation-graph-state", async (c) => {
       ms
     });
   } catch (err) {
-    console.error(`${TAG20} conversation-graph-state error: ${String(err)}`);
+    console.error(`${TAG21} conversation-graph-state error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -7210,12 +7548,12 @@ app2.get("/group-info", async (c) => {
       return c.json({ error: "Missing required parameter: jid" }, 400);
     }
     if (!isGroupJid(jid)) {
-      console.error(`${TAG20} group-info error="not a group JID" jid=${jid} account=${accountId}`);
+      console.error(`${TAG21} group-info error="not a group JID" jid=${jid} account=${accountId}`);
       return c.json({ error: `"${jid}" is not a group JID. Group JIDs end with @g.us.` }, 400);
     }
     const sock = getSocket(accountId);
     if (!sock) {
-      console.error(`${TAG20} group-info error="not connected" account=${accountId}`);
+      console.error(`${TAG21} group-info error="not connected" account=${accountId}`);
       return c.json({ error: `WhatsApp account "${accountId}" is not connected. Connect first, then retry.` }, 400);
     }
     const meta = await sock.groupMetadata(jid);
@@ -7228,10 +7566,10 @@ app2.get("/group-info", async (c) => {
       participantCount: meta.participants.length,
       participants: meta.participants.map((p) => ({ jid: p.id, admin: p.admin ?? null }))
     };
-    console.error(`${TAG20} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
+    console.error(`${TAG21} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG20} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
+    console.error(`${TAG21} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
     return c.json({ error: `Failed to fetch group info: ${String(err)}` }, 500);
   }
 });
@@ -7239,11 +7577,11 @@ var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync8, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname3, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
+import { basename as basename5, dirname as dirname4, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { basename as basename3, dirname as dirname2, join as join11, resolve as resolve11 } from "path";
+import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve11 } from "path";
 
 // app/lib/whatsapp-reader/select-sessions.ts
 function isReaderChannelSession(role, channel) {
@@ -7324,7 +7662,7 @@ function findSessionProjectDir(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
-    if (basename3(path2) === `${sessionId}.jsonl`) return dirname2(path2);
+    if (basename4(path2) === `${sessionId}.jsonl`) return dirname3(path2);
   }
   return null;
 }
@@ -7649,11 +7987,11 @@ app3.get("/", requireAdminSession, async (c) => {
 var sidebar_sessions_default = app3;
 
 // app/lib/admin-identity/pin-validator.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { existsSync as existsSync7, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join12 } from "path";
 function hashPin(pin) {
-  return createHash("sha256").update(pin).digest("hex");
+  return createHash2("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
   if (!existsSync7(usersFilePath)) return null;
@@ -8053,8 +8391,8 @@ app4.get("/conversations", requireAdminSession, async (c) => {
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
-    const sessionId = basename4(path2).replace(/\.jsonl$/, "");
-    const projectDir = dirname3(path2);
+    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
+    const projectDir = dirname4(path2);
     const meta = readSidecarMeta(join14(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
@@ -8584,7 +8922,7 @@ var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
 import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
-import { basename as basename5, dirname as dirname4, join as join15, resolve as resolve13, sep as sep4 } from "path";
+import { basename as basename6, dirname as dirname5, join as join15, resolve as resolve13, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -8631,7 +8969,7 @@ function resolveOpenVisitorSession(rows, visitorId, agentSlug) {
 
 // server/routes/public-reader.ts
 var app5 = new Hono();
-var TAG21 = "[public-webchat]";
+var TAG22 = "[public-webchat]";
 function parseAccessSessionId(cookieHeader) {
   if (!cookieHeader) return null;
   const part = cookieHeader.split(";").map((p) => p.trim()).find((p) => p.startsWith("__access_session="));
@@ -8659,8 +8997,8 @@ function enumeratePublicRows() {
   if (!cfg) return [];
   const rows = [];
   for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
-    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
-    const projectDir = dirname4(path2);
+    const sessionId = basename6(path2).replace(/\.jsonl$/, "");
+    const projectDir = dirname5(path2);
     const meta = readSidecarMeta(join15(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
@@ -8679,7 +9017,7 @@ function enumeratePublicRows() {
 app5.get("/session", (c) => {
   const visitor = resolveVisitor(c);
   if (!visitor) {
-    console.error(`${TAG21} op=reader-refused reason=no-anchor path=/session`);
+    console.error(`${TAG22} op=reader-refused reason=no-anchor path=/session`);
     return c.json({ error: "gate-required" }, 401);
   }
   const rows = enumeratePublicRows();
@@ -8698,11 +9036,11 @@ app5.get("/session", (c) => {
     found = effectiveSlug ? resolveOpenVisitorSession(rows, visitor.visitorId, effectiveSlug) : null;
   }
   if (found) {
-    console.log(`${TAG21} op=session-resume anchor=${visitor.kind} key=${(found.senderId ?? "").slice(0, 8)} sessionId=${found.sessionId.slice(0, 8)}`);
+    console.log(`${TAG22} op=session-resume anchor=${visitor.kind} key=${(found.senderId ?? "").slice(0, 8)} sessionId=${found.sessionId.slice(0, 8)}`);
     return c.json({ sessionId: found.sessionId, projectDir: found.projectDir, sessionKey: found.senderId });
   }
   const sessionKey = crypto.randomUUID();
-  console.log(`${TAG21} op=session-new anchor=${visitor.kind} key=${sessionKey.slice(0, 8)}`);
+  console.log(`${TAG22} op=session-new anchor=${visitor.kind} key=${sessionKey.slice(0, 8)}`);
   return c.json({ sessionId: null, projectDir: null, sessionKey });
 });
 function publicUploadsDir(accountId, sessionId) {
@@ -8731,7 +9069,7 @@ function readFrom2(path2, from) {
 app5.get("/stream", (c) => {
   const visitor = resolveVisitor(c);
   if (!visitor) {
-    console.error(`${TAG21} op=reader-refused reason=no-anchor path=/stream`);
+    console.error(`${TAG22} op=reader-refused reason=no-anchor path=/stream`);
     return c.json({ error: "gate-required" }, 401);
   }
   const sessionId = c.req.query("sessionId") ?? "";
@@ -8749,12 +9087,12 @@ app5.get("/stream", (c) => {
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
-    console.error(`${TAG21} op=reader-refused reason=not-owner anchor=${visitor.kind} sessionId=${sessionId.slice(0, 8)}`);
+    console.error(`${TAG22} op=reader-refused reason=not-owner anchor=${visitor.kind} sessionId=${sessionId.slice(0, 8)}`);
     return c.json({ error: "forbidden" }, 403);
   }
   const senderShort = (meta.senderId ?? "").slice(0, 8);
   const encoder = new TextEncoder();
-  console.log(`${TAG21} op=reader-open anchor=${visitor.kind} key=${senderShort} mode=delivered-only sessionId=${sessionId.slice(0, 8)}`);
+  console.log(`${TAG22} op=reader-open anchor=${visitor.kind} key=${senderShort} mode=delivered-only sessionId=${sessionId.slice(0, 8)}`);
   const send = (controller, turn, id) => controller.enqueue(encoder.encode(`id: ${id}
 data: ${JSON.stringify(turn)}
 
@@ -8769,7 +9107,7 @@ data: ${JSON.stringify(turn)}
         const { turns, dropped } = filterDeliveredFrames(lines);
         if (uploadsDir) enrichPublicAttachments(turns, listSessionAttachmentsInDir(uploadsDir), attachmentCursor);
         for (const turn of turns) send(controller, turn, offset);
-        if (dropped > 0) console.log(`${TAG21} op=reader-filtered key=${senderShort} dropped=${dropped}`);
+        if (dropped > 0) console.log(`${TAG22} op=reader-filtered key=${senderShort} dropped=${dropped}`);
       };
       try {
         const { buf, end } = readFrom2(jsonlPath, 0);
@@ -8804,7 +9142,7 @@ data: ${JSON.stringify(turn)}
         watcher?.close();
         clearInterval(poll);
         clearInterval(heartbeat);
-        console.log(`${TAG21} op=reader-close key=${senderShort}`);
+        console.log(`${TAG22} op=reader-close key=${senderShort}`);
         try {
           controller.close();
         } catch {
@@ -8878,7 +9216,7 @@ app5.get("/attachment/:attachmentId", (c) => {
 var public_reader_default = app5;
 
 // server/routes/webchat.ts
-import { basename as basename6, dirname as dirname5 } from "path";
+import { basename as basename7, dirname as dirname6 } from "path";
 import { join as join18 } from "path";
 import { existsSync as existsSync10, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync3, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
@@ -8924,18 +9262,6 @@ function writeCanonicalOverrideId(accountDir, userId, sessionId) {
   renameSync(tmp, path2);
 }
 
-// app/lib/channel-pty-bridge/admin-session-id.ts
-import { createHash as createHash2 } from "crypto";
-function adminSessionIdFor(accountId, senderId, personId) {
-  const subject = personId && personId.length > 0 ? `person:${personId}` : senderId;
-  const b = createHash2("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
-  const v = Buffer.from(b);
-  v[6] = v[6] & 15 | 64;
-  v[8] = v[8] & 63 | 128;
-  const h = v.toString("hex");
-  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
-}
-
 // ../lib/models/src/index.ts
 var OPUS_MODEL = "claude-opus-4-8[1m]";
 var SONNET_MODEL = "claude-sonnet-5";
@@ -9288,8 +9614,8 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   let best = null;
   for (const { path: path2, isSubagent, archived } of enumerateJsonls(join18(cfg, "projects"))) {
     if (isSubagent || archived) continue;
-    const id = basename6(path2).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join18(dirname5(path2), `${id}.meta.json`));
+    const id = basename7(path2).slice(0, -".jsonl".length);
+    const meta = readSidecarMeta(join18(dirname6(path2), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
@@ -9312,7 +9638,7 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
 function overrideKnownNonArchived(id) {
   const { projectDir } = locateSession(id);
   if (projectDir === null) return sessionSidecarExists(id);
-  return basename6(projectDir) !== "archive";
+  return basename7(projectDir) !== "archive";
 }
 function resolveCanonical(accountId, accountDir, requesterUserId, primaryUserId, scopeAccountId, multiAccount) {
   const bootstrapAccountId = scopeAccountId ?? accountId;
@@ -9680,8 +10006,8 @@ ${note}` : note;
     let projectDir = null;
     if (cfg) {
       for (const { path: path2 } of enumerateJsonls(join18(cfg, "projects"))) {
-        if (basename6(path2) === `${sessionId}.jsonl`) {
-          projectDir = dirname5(path2);
+        if (basename7(path2) === `${sessionId}.jsonl`) {
+          projectDir = dirname6(path2);
           break;
         }
       }
@@ -9913,7 +10239,7 @@ function routeTelegramUpdate(input) {
 }
 
 // server/routes/telegram.ts
-var TAG22 = "[telegram-inbound]";
+var TAG23 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
   const brandPath = join20(platformRoot3, "config", "brand.json");
@@ -9929,36 +10255,23 @@ function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
   return resolve15(homedir(), configDirName(), filename);
 }
-async function sendTelegram(botToken, chatId, text) {
-  try {
-    const res = await fetch(`https://api.telegram.org/bot${botToken}/sendMessage`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ chat_id: chatId, text })
-    });
-    const data = await res.json();
-    return data.ok ? { ok: true } : { ok: false, error: data.description ?? "send failed" };
-  } catch (e) {
-    return { ok: false, error: e instanceof Error ? e.message : String(e) };
-  }
-}
 var app7 = new Hono();
 app7.post("/", async (c) => {
   const botParam = c.req.query("bot");
   const botType = botParam === "admin" ? "admin" : botParam === "public" ? "public" : null;
   if (!botType) {
-    console.error(`${TAG22} op=reject reason=missing-bot-param`);
+    console.error(`${TAG23} op=reject reason=missing-bot-param`);
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
   if (!existsSync12(sp)) {
-    console.error(`${TAG22} op=reject reason=no-secret-file botType=${botType}`);
+    console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
   const expected = readFileSync21(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
-    console.error(`${TAG22} op=reject reason=bad-secret botType=${botType}`);
+    console.error(`${TAG23} op=reject reason=bad-secret botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
   let update;
@@ -9969,40 +10282,40 @@ app7.post("/", async (c) => {
   }
   const account = resolveAccount();
   if (!account) {
-    console.error(`${TAG22} op=reject reason=no-account`);
+    console.error(`${TAG23} op=reject reason=no-account`);
     return c.json({ ok: true }, 200);
   }
   const decision = routeTelegramUpdate({ update, botType, config: account.config.telegram ?? {} });
   if (decision.kind === "ignore") {
-    console.error(`${TAG22} op=ignore reason=${decision.reason}`);
+    console.error(`${TAG23} op=ignore reason=${decision.reason}`);
     return c.json({ ok: true }, 200);
   }
   if (decision.kind === "denied") {
-    console.error(`${TAG22} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
+    console.error(`${TAG23} op=denied reason=${decision.reason} agentType=${decision.agentType}`);
     return c.json({ ok: true }, 200);
   }
   const role = decision.agentType === "admin" ? "admin" : "public";
   const agentSlug = role === "admin" ? "admin" : resolveDefaultAgentSlug(account.accountDir);
   if (!agentSlug) {
-    console.error(`${TAG22} op=reject reason=no-default-agent`);
+    console.error(`${TAG23} op=reject reason=no-default-agent`);
     return c.json({ ok: true }, 200);
   }
-  console.error(`${TAG22} op=update accountId=${account.accountId} from=${decision.senderId}`);
+  console.error(`${TAG23} op=update accountId=${account.accountId} from=${decision.senderId}`);
   const botToken = botType === "admin" ? account.config.telegram?.adminBotToken : account.config.telegram?.publicBotToken;
   const { senderId, chatId, text } = decision;
   const gateway = getTelegramGateway();
   if (!gateway) {
-    console.error(`${TAG22} op=reject reason=gateway-not-ready from=${senderId}`);
+    console.error(`${TAG23} op=reject reason=gateway-not-ready from=${senderId}`);
     return c.json({ ok: true }, 200);
   }
   const reply = async (replyText) => {
     if (!botToken) {
       const reason = account.config.telegram ? "no-bot-token" : "no-telegram-config";
-      console.error(`${TAG22} op=reply-dropped reason=${reason} botType=${botType} from=${senderId}`);
+      console.error(`${TAG23} op=reply-dropped reason=${reason} botType=${botType} from=${senderId}`);
       return;
     }
-    const sent = await sendTelegram(botToken, chatId, replyText);
-    console.error(`${TAG22} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
+    const sent = await sendTelegramText(botToken, chatId, replyText);
+    console.error(`${TAG23} op=reply-sent from=${senderId} ok=${sent.ok}${sent.ok ? "" : ` error=${sent.error}`}`);
   };
   void gateway.handleInbound({
     accountId: account.accountId,
@@ -10020,7 +10333,7 @@ var telegram_default = app7;
 // server/routes/quickbooks.ts
 import { join as join21 } from "path";
 import { existsSync as existsSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync4 } from "fs";
-var TAG23 = "[quickbooks]";
+var TAG24 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
@@ -10033,14 +10346,14 @@ async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
   if (!state || !STATE_RE.test(state) || !existsSync13(pendingPath(accountDir, state))) {
-    console.error(`${TAG23} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
+    console.error(`${TAG24} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
   const claimFile = `${pendingPath(accountDir, state)}.claimed`;
   try {
     renameSync4(pendingPath(accountDir, state), claimFile);
   } catch {
-    console.error(`${TAG23} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+    console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
   try {
@@ -10048,14 +10361,14 @@ async function completeConsent(args) {
     try {
       pending = JSON.parse(readFileSync22(claimFile, "utf-8"));
     } catch {
-      console.error(`${TAG23} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization state could not be read.", stateValid: false };
     }
     if (Date.now() > pending.expiresAt) {
-      console.error(`${TAG23} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
+      console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization request expired. Generate a new consent link.", stateValid: false };
     }
-    console.error(`${TAG23} op=callback state=${state} stateValid=true realmId=${realmId ?? ""}`);
+    console.error(`${TAG24} op=callback state=${state} stateValid=true realmId=${realmId ?? ""}`);
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
@@ -10079,12 +10392,12 @@ async function completeConsent(args) {
     });
     const text = await res.text();
     if (!res.ok) {
-      console.error(`${TAG23} op=token-exchange realmId=${realmId} persisted=false`);
+      console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=false`);
       return { ok: false, status: 502, message: `Token exchange failed (${res.status}). Generate a new consent link to retry.`, stateValid: true };
     }
     const body = JSON.parse(text);
     if (!body.refresh_token) {
-      console.error(`${TAG23} op=token-exchange realmId=${realmId} persisted=false`);
+      console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=false`);
       return { ok: false, status: 502, message: "Token exchange returned no refresh token.", stateValid: true };
     }
     const now = Date.now();
@@ -10097,7 +10410,7 @@ async function completeConsent(args) {
     mkdirSync4(join21(accountDir, "secrets"), { recursive: true });
     writeFileSync8(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
     const persisted = JSON.parse(readFileSync22(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
-    console.error(`${TAG23} op=token-exchange realmId=${realmId} persisted=${persisted}`);
+    console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=${persisted}`);
     return { ok: persisted, status: persisted ? 200 : 500, message: persisted ? `Connected company ${realmId}.` : "Failed to persist the connection.", stateValid: true };
   } finally {
     rmSync(claimFile, { force: true });
@@ -10110,7 +10423,7 @@ var app8 = new Hono();
 app8.get("/callback", async (c) => {
   const account = resolveAccount();
   if (!account) {
-    console.error(`${TAG23} op=callback stateValid=false realmId= reason=no-account`);
+    console.error(`${TAG24} op=callback stateValid=false realmId= reason=no-account`);
     return c.html(page("QuickBooks", "This install has no account configured."), 500);
   }
   const result = await completeConsent({
@@ -10132,7 +10445,7 @@ import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
-import { dirname as dirname6, join as join22 } from "path";
+import { dirname as dirname7, join as join22 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -10145,7 +10458,7 @@ function appendUsersAuditLine(audit, fields) {
   const line = `[users-audit] action=${fields.action} actor=${actor}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
 `;
   try {
-    mkdirSync5(dirname6(audit.logFile), { recursive: true, mode: 448 });
+    mkdirSync5(dirname7(audit.logFile), { recursive: true, mode: 448 });
     appendFileSync2(audit.logFile, line, { mode: 384 });
   } catch (err) {
     console.error(
@@ -10163,7 +10476,7 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync5(dirname6(filePath), { recursive: true });
+  mkdirSync5(dirname7(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync9(tempPath, contents, mode !== void 0 ? { mode } : void 0);
   renameSync5(tempPath, filePath);
@@ -11012,7 +11325,7 @@ var accounts_default = app12;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync18, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
-import { resolve as resolve16, basename as basename7 } from "path";
+import { resolve as resolve16, basename as basename8 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync17 } from "fs";
@@ -11044,7 +11357,7 @@ app13.get("/", async (c) => {
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename7(fileParam);
+    const safe = basename8(fileParam);
     const searched = [];
     for (const dir of logDirs) {
       const filePath = resolve16(dir, safe);
@@ -11114,7 +11427,7 @@ app13.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename7(hit.path);
+        const filename = basename8(hit.path);
         const buffer = readFileSync25(hit.path);
         const onDiskBytes = statSync10(hit.path).size;
         const headers = {
@@ -12048,7 +12361,7 @@ var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
-import { dirname as dirname7, resolve as resolve19, join as join25 } from "path";
+import { dirname as dirname8, resolve as resolve19, join as join25 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -12155,7 +12468,7 @@ function listPluginDirs() {
       }
     }
   }
-  const premiumRoot = resolve19(dirname7(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve19(dirname8(PLATFORM_ROOT), "premium-plugins");
   if (existsSync22(premiumRoot)) {
     for (const bundle of readdirSync16(premiumRoot)) {
       const bundlePlugins = join25(premiumRoot, bundle, "plugins");
@@ -12369,7 +12682,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG24 = "[claude-session-manager:wrapper]";
+var TAG25 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -12387,12 +12700,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG24} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG25} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG24} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG25} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -12419,24 +12732,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG24} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG25} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase("claude-session-manager:wrapper")}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG24} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG25} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG24} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG25} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG24} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG25} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -12471,7 +12784,7 @@ app18.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG24} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG25} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -12480,7 +12793,7 @@ app18.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG24} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG25} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -12499,33 +12812,33 @@ app18.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG24} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG25} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 var claude_sessions_default = app18;
 
 // server/routes/admin/log-ingest.ts
-var TAG25 = "[log-ingest]";
+var TAG26 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
 var app19 = new Hono();
-function isLoopbackAddr(addr) {
+function isLoopbackAddr2(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 app19.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+  if (!isLoopbackAddr2(remoteAddr)) {
+    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
   const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
   if (xffRaw.length > 0) {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr(t));
+    const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -12567,18 +12880,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app20 = new Hono();
 app20.post("/", async (c) => {
-  const TAG38 = "[admin:events]";
+  const TAG39 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG38} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG39} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG38} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG39} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -12604,7 +12917,7 @@ import { createReadStream as createReadStream2, createWriteStream as createWrite
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
-import { basename as basename9, dirname as dirname8, join as join27, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
+import { basename as basename10, dirname as dirname9, join as join27, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -12922,7 +13235,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve21, relative as relative3, join as join26, basename as basename8, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve21, relative as relative3, join as join26, basename as basename9, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -13060,8 +13373,8 @@ async function extractFileContent(absolute) {
   }
 }
 async function readDisplayName(absolute) {
-  const dir = absolute.slice(0, absolute.length - basename8(absolute).length);
-  const base = basename8(absolute);
+  const dir = absolute.slice(0, absolute.length - basename9(absolute).length);
+  const base = basename9(absolute);
   const dot = base.lastIndexOf(".");
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
@@ -13199,7 +13512,7 @@ async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths
   return { kds, sections, chunks };
 }
 async function buildArtifact(accountId, wf, embed2) {
-  const name = basename8(wf.absolute);
+  const name = basename9(wf.absolute);
   const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
@@ -13729,7 +14042,7 @@ app21.get("/download", requireAdminSession, async (c) => {
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename9(absolute);
+    const filename = basename10(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -13834,7 +14147,7 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
       const info = await stat4(absolute);
       if (info.isDirectory()) {
         dirsWalked++;
-        const parentAbs = dirname8(absolute);
+        const parentAbs = dirname9(absolute);
         for await (const fileAbs of walkRegularFiles(absolute)) {
           const within = relative4(absolute, fileAbs).split(sep6).join("/");
           const fileRel = relPath === "" || relPath === "." ? within : `${relPath}/${within}`;
@@ -13845,7 +14158,7 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
           if (over) return over;
         }
       } else if (info.isFile()) {
-        const over = await addFile(absolute, info.size, basename9(absolute));
+        const over = await addFile(absolute, info.size, basename10(absolute));
         if (over) return over;
       } else {
         return c.json({ error: "Path is not a file or directory" }, 400);
@@ -13874,12 +14187,12 @@ function dataUploadCeiling() {
 }
 async function resolveUploadTarget(c, accountId, uid) {
   const rawName = c.req.query("filename") ?? "";
-  const safeName = basename9(rawName).replace(/[\0/\\]/g, "_");
+  const safeName = basename10(rawName).replace(/[\0/\\]/g, "_");
   if (!safeName) return { ok: false, status: 400, error: "filename query param required" };
   const rawRelpath = c.req.query("relpath") ?? "";
   const relpath = rawRelpath !== "" ? rawRelpath : null;
   const token = c.req.query("token") ?? "";
-  const finalName = relpath ? basename9(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
+  const finalName = relpath ? basename10(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
   const mimeType = (c.req.header("content-type") ?? "").split(";")[0].trim();
   if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
     console.error(`[data-upload] op=reject-mime uid=${uid} mime="${mimeType}" token=${token} rel="${relpath ?? ""}"`);
@@ -13888,7 +14201,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const rawDir = c.req.query("path") ?? "";
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
-  const relDir = relpath ? dirname8(relpath) : ".";
+  const relDir = relpath ? dirname9(relpath) : ".";
   const destRel = relDir === "." ? base.relative : join27(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
@@ -14249,7 +14562,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
-  const base = basename9(absolute);
+  const base = basename10(absolute);
   const protection = isProtectedFromDeletion(relPath);
   if (protection.protected) {
     console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
@@ -14265,7 +14578,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join27(dirname8(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join27(dirname9(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -14361,8 +14674,8 @@ app21.post("/rename", requireAdminSession, async (c) => {
     console.error(`[data] file-rename blocked path="${src.relative}" reason="protected"`);
     return c.json({ error: "Protected entry \u2014 refusing to rename" }, 403);
   }
-  const destAbs = resolve22(dirname8(src.absolute), newName);
-  const newRel = `${dirname8(src.relative)}/${newName}`.replace(/^\.\//, "");
+  const destAbs = resolve22(dirname9(src.absolute), newName);
+  const newRel = `${dirname9(src.relative)}/${newName}`.replace(/^\.\//, "");
   if (isProtectedFromRename(newRel)) {
     console.error(`[data] file-rename blocked path="${newRel}" reason="protected-target"`);
     return c.json({ error: "That name is reserved" }, 403);
@@ -16493,7 +16806,7 @@ var graph_default_view_default = app27;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
+import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename11 } from "path";
 import { existsSync as existsSync25 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -16546,7 +16859,7 @@ async function fetchAccountFileArtefacts(accountId) {
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
         id: `account-file:${relativePath}`,
-        name: displayName ?? basename10(relativePath),
+        name: displayName ?? basename11(relativePath),
         kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
@@ -17393,7 +17706,7 @@ function managerLogFollowUrl(sessionId, opts) {
 }
 
 // server/routes/admin/linkedin-ingest.ts
-var TAG26 = "[linkedin-ingest-route]";
+var TAG27 = "[linkedin-ingest-route]";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -17497,29 +17810,29 @@ app37.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG26 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG27 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG26 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG27 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG26 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG27 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG26 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG27 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID12();
-  console.log(TAG26 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG27 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -17528,12 +17841,12 @@ app37.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG26 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG27 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG26 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG27 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
@@ -17541,7 +17854,7 @@ var linkedin_ingest_default = app37;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG27 = "[post-turn-context]";
+var TAG28 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -17549,7 +17862,7 @@ var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "otpCode",
   "cacheKey"
 ]);
-function isLoopbackAddr2(addr) {
+function isLoopbackAddr3(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function convertValue(value) {
@@ -17582,17 +17895,17 @@ function pruneProperties(raw) {
 var app38 = new Hono();
 app38.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+  if (!isLoopbackAddr3(remoteAddr)) {
+    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
   const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
   if (xffRaw.length > 0) {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr2(t));
+    const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -17624,7 +17937,7 @@ app38.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG27} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG28} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -17633,7 +17946,7 @@ app38.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG27} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG28} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -17746,24 +18059,24 @@ function formatPreviousContext(writes) {
 }
 
 // server/routes/admin/public-session-context.ts
-var TAG28 = "[public-session-context]";
-function isLoopbackAddr3(addr) {
+var TAG29 = "[public-session-context]";
+function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var app39 = new Hono();
 app39.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+  if (!isLoopbackAddr4(remoteAddr)) {
+    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
   const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
   if (xffRaw.length > 0) {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr3(t));
+    const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -17777,14 +18090,14 @@ app39.get("/", async (c) => {
     const writes = await fetchSliceWrites(session, sliceToken, accountId);
     const total = Date.now() - started;
     console.log(
-      `${TAG28} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG29} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({ writes });
   } catch (err) {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG28} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG29} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
@@ -17803,24 +18116,24 @@ function getWebchatGateway() {
 }
 
 // server/routes/admin/public-session-exit.ts
-var TAG29 = "[public-session-exit-route]";
-function isLoopbackAddr4(addr) {
+var TAG30 = "[public-session-exit-route]";
+function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var app40 = new Hono();
 app40.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+  if (!isLoopbackAddr5(remoteAddr)) {
+    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
   const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
   if (xffRaw.length > 0) {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr4(t));
+    const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -17834,7 +18147,7 @@ app40.post("/", async (c) => {
   if (!sessionId) return c.json({ error: "sessionId required" }, 400);
   const gateway = getWebchatGateway();
   if (!gateway) {
-    console.error(`${TAG29} reject reason=gateway-unset sessionId=${sessionId.slice(0, 8)}`);
+    console.error(`${TAG30} reject reason=gateway-unset sessionId=${sessionId.slice(0, 8)}`);
     return c.json({ error: "webchat-gateway-unset" }, 503);
   }
   gateway.handlePublicSessionExit(sessionId);
@@ -17843,24 +18156,24 @@ app40.post("/", async (c) => {
 var public_session_exit_default = app40;
 
 // server/routes/admin/access-session-evict.ts
-var TAG30 = "[access-session-evict]";
-function isLoopbackAddr5(addr) {
+var TAG31 = "[access-session-evict]";
+function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var app41 = new Hono();
 app41.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+  if (!isLoopbackAddr6(remoteAddr)) {
+    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
   const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
   if (xffRaw.length > 0) {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr5(t));
+    const offender = tokens.find((t) => !isLoopbackAddr6(t));
     if (offender !== void 0) {
-      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -17873,31 +18186,31 @@ app41.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG30} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG31} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
 var access_session_evict_default = app41;
 
 // server/routes/admin/enrol-person.ts
-var TAG31 = "[enrol]";
-function isLoopbackAddr6(addr) {
+var TAG32 = "[enrol]";
+function isLoopbackAddr7(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var app42 = new Hono();
 app42.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
-  if (!isLoopbackAddr6(remoteAddr)) {
-    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+  if (!isLoopbackAddr7(remoteAddr)) {
+    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "enrol-person-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
   const xffRaw = Array.isArray(xffHeader) ? xffHeader.join(",") : typeof xffHeader === "string" ? xffHeader : "";
   if (xffRaw.length > 0) {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
-    const offender = tokens.find((t) => !isLoopbackAddr6(t));
+    const offender = tokens.find((t) => !isLoopbackAddr7(t));
     if (offender !== void 0) {
-      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "enrol-person-loopback-only" }, 403);
     }
   }
@@ -17922,7 +18235,7 @@ app42.post("/", async (c) => {
   }
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG31} op=person result=no-account-id`);
+    console.error(`${TAG32} op=person result=no-account-id`);
     return c.json({ error: "no-account-id" }, 500);
   }
   let personId;
@@ -17930,7 +18243,7 @@ app42.post("/", async (c) => {
     personId = await enrolPerson({ accountId, phone, email, agentSlug });
   } catch (err) {
     console.error(
-      `${TAG31} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG32} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "enrol-failed" }, 500);
   }
@@ -17940,11 +18253,11 @@ app42.post("/", async (c) => {
     if (g) grant = { grantId: g.grantId, status: g.status, contactValue: g.contactValue };
   } catch (err) {
     console.error(
-      `${TAG31} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG32} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
   }
   console.log(
-    `${TAG31} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
+    `${TAG32} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
   );
   return c.json({ personId, grant }, 200);
 });
@@ -18513,7 +18826,7 @@ app45.route("/calendar", calendar_default);
 var admin_default = app45;
 
 // server/routes/access/verify-token.ts
-var TAG32 = "[access-verify]";
+var TAG33 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
 var app46 = new Hono();
@@ -18532,39 +18845,39 @@ app46.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG32} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG32} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG33} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -18580,12 +18893,12 @@ app46.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG32} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG33} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -18661,7 +18974,7 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG33 = "[access-request-link]";
+var TAG34 = "[access-request-link]";
 var app47 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
 app47.post("/", async (c) => {
@@ -18678,18 +18991,18 @@ app47.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG33} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG33} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG34} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG33} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG34} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -18697,7 +19010,7 @@ app47.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG33} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG34} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -18729,12 +19042,12 @@ app47.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG33} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG34} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG33} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG34} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
@@ -18888,7 +19201,7 @@ var sites_default = app49;
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync32, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -18905,7 +19218,7 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync7(dirname9(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    mkdirSync7(dirname10(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
     writeFileSync11(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
@@ -20013,7 +20326,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname10, relative as relative6, resolve as resolve29 } from "path";
+import { dirname as dirname11, relative as relative6, resolve as resolve29 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -20045,7 +20358,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
     const newAbs = resolve29(destDir, suffix);
-    await mkdir5(dirname10(newAbs), { recursive: true });
+    await mkdir5(dirname11(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
     const oldRel = relative6(dataRoot, oldAbs);
@@ -20752,6 +21065,7 @@ var WaGateway = class {
     const willDeliverNow = this.hub.isReady(input.senderId);
     const openable = input.media.filter((m) => m.type !== "audio");
     const mediaField = openable.length > 0 ? `media=${openable.map((m) => m.type).join(",")} mediaPaths=${openable.map((m) => m.path).join(",")}` : input.media.some((m) => m.type === "audio") ? "media=audio mediaPath=transcribed" : "media=none";
+    const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
     this.docContexts.set(input.senderId, { accountId: input.accountId });
     this.hub.deliver(
@@ -20759,12 +21073,13 @@ var WaGateway = class {
         senderId: input.senderId,
         text: input.text,
         waMessageId: `wa-${++this.seq}`,
-        media: input.media
+        media: input.media,
+        source
       },
       Date.now()
     );
     console.error(
-      `[whatsapp-native] op=inbound senderId=${input.senderId} accountId=${input.accountId} bytes=${bytes} ${mediaField} delivery=${willDeliverNow ? "immediate" : "queued"}`
+      `[whatsapp-native] op=inbound senderId=${input.senderId} accountId=${input.accountId} bytes=${bytes} ${mediaField} source=${source} delivery=${willDeliverNow ? "immediate" : "queued"}`
     );
     if (!hadSubscriber && !this.spawning.has(input.senderId)) {
       this.spawning.add(input.senderId);
@@ -20772,6 +21087,7 @@ var WaGateway = class {
       try {
         await this.deps.ensureChannelSession({
           accountId: input.accountId,
+          effectiveAccountId: input.effectiveAccountId,
           senderId: input.senderId,
           role: input.role ?? "admin",
           personId: input.personId ?? null,
@@ -21701,7 +22017,7 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG34 = "[whatsapp-adaptor]";
+var TAG35 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
@@ -21714,7 +22030,7 @@ function makeWhatsAppSendFile(entry) {
       maxyAccountId = resolvePlatformAccountId();
     } catch (err) {
       console.error(
-        `${TAG34} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+        `${TAG35} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
       );
       return { ok: false, error: "account-unresolved" };
     }
@@ -21728,7 +22044,7 @@ function makeWhatsAppSendFile(entry) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG34} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG35} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -21736,7 +22052,7 @@ function makeWhatsAppSendFile(entry) {
 function makeWhatsAppFileDelivery(entry) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG34,
+    tag: TAG35,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry)
   });
@@ -21771,7 +22087,7 @@ function makeWhatsAppFileDelivery(entry) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG34} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG35} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -22080,13 +22396,14 @@ var TelegramGateway = class {
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.senderId);
     const willDeliverNow = this.hub.isReady(input.senderId);
+    const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
     this.hub.deliver(
-      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}` },
+      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source },
       Date.now()
     );
     console.error(
-      `[telegram-native] op=inbound key=${input.senderId} accountId=${input.accountId} botType=${input.role} bytes=${bytes} delivery=${willDeliverNow ? "immediate" : "queued"}`
+      `[telegram-native] op=inbound key=${input.senderId} accountId=${input.accountId} botType=${input.role} bytes=${bytes} source=${source} delivery=${willDeliverNow ? "immediate" : "queued"}`
     );
     if (!hadSubscriber && !this.spawning.has(input.senderId)) {
       this.spawning.add(input.senderId);
@@ -22135,8 +22452,8 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync7 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve30, basename as basename11 } from "path";
-var TAG35 = "[telegram:outbound]";
+import { resolve as resolve30, basename as basename12 } from "path";
+var TAG36 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot3 } = input;
@@ -22152,16 +22469,16 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync7(filePath);
     const accountResolved = realpathSync7(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG35} document REJECTED reason=outside_account_directory`);
+      console.error(`${TAG36} document REJECTED reason=outside_account_directory`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG35} document ENOENT path=${filePath}`);
+      console.error(`${TAG36} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG35} document path error: ${String(err)}`);
+    console.error(`${TAG36} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat7(resolvedPath);
@@ -22172,7 +22489,7 @@ async function sendTelegramDocument(input) {
       error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename11(resolvedPath);
+  const filename = basename12(resolvedPath);
   const buffer = Buffer.from(await readFile7(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
@@ -22194,13 +22511,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG35} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG36} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG36 = "[telegram:outbound]";
+var TAG37 = "[telegram:outbound]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -22212,11 +22529,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG36} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG37} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG36} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG37} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     let maxyAccountId;
@@ -22224,7 +22541,7 @@ function makeTelegramSendFile(entry) {
       maxyAccountId = resolvePlatformAccountId();
     } catch (err) {
       console.error(
-        `${TAG36} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+        `${TAG37} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
       );
       return { ok: false, error: "account-unresolved" };
     }
@@ -22242,7 +22559,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG36,
+    tag: TAG37,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -22292,7 +22609,7 @@ function telegramServerPath() {
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID13 } from "crypto";
-var TAG37 = "[public-session-review]";
+var TAG38 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -22319,7 +22636,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG37} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG38} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -22343,7 +22660,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG37} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG38} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -22351,7 +22668,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG37} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG38} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -22380,7 +22697,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID13();
-  console.log(`${TAG37} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG38} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -22400,21 +22717,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -22428,23 +22745,34 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG37} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG38} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
 // app/lib/whatsapp/inbound/channel-admin-binding-drift.ts
+function findAccountManagerDrift(accountManagers, adminPhones, validAccountIds) {
+  const drift = [];
+  for (const [phone, managesAccount] of Object.entries(accountManagers)) {
+    if (!validAccountIds.includes(managesAccount)) {
+      drift.push({ phone, managesAccount, reason: "not-in-registry" });
+    } else if (adminPhones.some((a) => phonesMatch(a, phone))) {
+      drift.push({ phone, managesAccount, reason: "phone-also-admin" });
+    }
+  }
+  return drift;
+}
 function findChannelAdminBindingDrift(adminPhones, admins, users) {
   const drift = [];
   for (const phone of adminPhones) {
@@ -22454,6 +22782,10 @@ function findChannelAdminBindingDrift(adminPhones, admins, users) {
   }
   return drift;
 }
+function classifyAdminPhonesForAccount(isSocketOwner, adminPhones, admins, users) {
+  if (!isSocketOwner) return { nonSocketPhones: [...adminPhones], drift: [] };
+  return { nonSocketPhones: [], drift: findChannelAdminBindingDrift(adminPhones, admins, users) };
+}
 function warnOnChannelAdminBindingDrift() {
   let users;
   try {
@@ -22467,15 +22799,39 @@ function warnOnChannelAdminBindingDrift() {
   } catch {
     return;
   }
+  let socketOwner;
+  try {
+    socketOwner = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch {
+    socketOwner = null;
+  }
+  const validAccountIds = accounts.map((a) => a.accountId);
   for (const acct of accounts) {
     const adminPhones = readAdminPhones(acct.accountDir);
-    const drift = findChannelAdminBindingDrift(adminPhones, acct.config.admins ?? [], users);
+    const isSocketOwner = socketOwner === null || acct.accountId === socketOwner;
+    const { nonSocketPhones, drift } = classifyAdminPhonesForAccount(
+      isSocketOwner,
+      adminPhones,
+      acct.config.admins ?? [],
+      users
+    );
+    for (const phone of nonSocketPhones) {
+      console.error(
+        `[admin-identity] adminphones-on-non-socket-account accountId=${acct.accountId} phone=${phone} count=${nonSocketPhones.length}`
+      );
+    }
     for (const d of drift) {
       const tail = d.reason === "userid-not-admin" ? ` userId=${d.userId}` : "";
       console.error(
         `[admin-identity] binding-drift accountId=${acct.accountId} phone=${d.phone} reason=${d.reason}${tail}`
       );
     }
+    const managerDrift = findAccountManagerDrift(readAccountManagers(acct.accountDir), adminPhones, validAccountIds);
+    for (const d of managerDrift) {
+      console.error(
+        `[admin-identity] account-manager-drift accountId=${acct.accountId} phone=${d.phone} managesAccount=${d.managesAccount} reason=${d.reason}`
+      );
+    }
   }
 }
 
@@ -22839,9 +23195,13 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, senderId, role, personId, gatewayUrl, serverPath }) => {
-    const req = buildWaSpawnRequest({ accountId, senderId, role, personId, gatewayUrl, serverPath });
-    const userId = role === "admin" ? resolveAdminUserId({ accountId, senderPhone: senderId }) ?? void 0 : void 0;
+  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath }) => {
+    if (role === "admin") {
+      const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
+      console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
+    }
+    const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
+    const userId = role === "admin" ? resolveAdminUserId({ accountId: effectiveAccountId, senderPhone: senderId }) ?? void 0 : void 0;
     if (role === "admin") {
       console.error(`[whatsapp-native] op=admin-identity senderId=${senderId} userId=${userId ?? "owner-fallback"}`);
     }
@@ -22987,6 +23347,22 @@ var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   awaitReply: (key, timeoutMs) => webchatGateway.awaitReply(key, timeoutMs)
 });
+var scheduleInjectRoutes = createScheduleInjectRoutes({
+  resolveAccount: () => resolveAccount(),
+  waHandleInbound: (input) => waGateway.handleInbound(input),
+  tgHandleInbound: (input) => telegramGateway.handleInbound(input),
+  sendWhatsAppText: async (accountId, destination, text) => {
+    const sock = getSocket(accountId);
+    if (!sock) throw new Error("WhatsApp disconnected \u2014 cannot deliver scheduled reply");
+    await sendTextMessage(sock, toWhatsappJid(destination), text, { accountId });
+  },
+  sendTelegramText: async (botToken, chatId, text) => {
+    const sent = await sendTelegramText(botToken, chatId, text);
+    if (!sent.ok) throw new Error(sent.error ?? "telegram send failed");
+  },
+  effectiveAccountFor: (accountId, accountDir, destination) => managedAccountFor(readAccountManagers(accountDir), destination) ?? accountId
+});
+app55.route("/api/channel/schedule-inject", scheduleInjectRoutes);
 app55.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path2) {
   return path2 === "/vnc-viewer.html" || path2.startsWith("/api/admin/attachment/") || path2.startsWith("/api/public-reader/attachment/") || path2 === "/api/admin/files/download";
@@ -23963,7 +24339,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename12(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename13(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -23983,6 +24359,7 @@ reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config, bootAccoun
 for (const acct of listValidAccounts()) {
   cleanupLeakedPremiumSubs(acct.accountDir, acct.config, acct.accountId);
 }
+purgeNonSocketAdminPhonesAtBoot();
 warnOnChannelAdminBindingDrift();
 var bootEnabled = Array.isArray(bootAccountConfig?.enabledPlugins) ? bootAccountConfig.enabledPlugins : [];
 var bootDelivered = [];
@@ -24042,6 +24419,10 @@ init({
       console.error(`[whatsapp:route] dropped reason=no-text-no-media senderId=${msg.senderPhone} mediaCount=${msg.media.length}`);
       return;
     }
+    if (!msg.effectiveAccountId) {
+      console.error(`[whatsapp:route] op=dropped reason=no-effective-account senderId=${msg.senderPhone}`);
+      return;
+    }
     if (decision.role === "public") {
       console.error(`[whatsapp:route] op=routed agentType=public personId=${decision.personId} senderId=${msg.senderPhone}`);
     }
@@ -24050,6 +24431,7 @@ init({
       });
       await waGateway.handleInbound({
         accountId: msg.accountId,
+        effectiveAccountId: msg.effectiveAccountId,
         senderId: msg.senderPhone,
         role: decision.role,
         personId: decision.personId,