@rubytech/create-maxy-code 0.1.387 → 0.1.388

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.387",
+  "version": "0.1.388",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/whatsapp/references/channels-whatsapp.md

@@ -101,13 +101,15 @@ The platform enforces this at multiple levels:
 | Term | Definition | Code |
 |------|-----------|------|
 | **Self phone** | The WhatsApp account's own phone number (the phone that scanned the QR code). Self-chat only. | `phonesMatch(senderPhone, selfPhone)` in `access-control.ts` |
-| **Admin phones** | Phones listed in `adminPhones` in `account.json`. The user's personal phone is auto-registered on QR link; additional phones are added via `whatsapp-config action: "add-admin-phone"`. Their admin session is scoped to the **house** account. | `isAdminPhone()` in `access-control.ts` — iterates `adminPhones` |
-| **Account managers** | Phones in the `accountManagers` map (`account.json`, phone → sub-account UUID), added via `whatsapp-config action: "add-account-manager"`. Their admin session is scoped to the **bound sub-account**, not the house. Disjoint from `adminPhones` — a phone is a house admin or a sub-account manager, never both. | `managedAccountFor()` in `access-control.ts`; the sub-account scope is applied in `ensureChannelSession` |
+| **Admin phones** | Phones listed in `adminPhones` in `account.json`. The user's personal phone is auto-registered on QR link; additional phones are added via `whatsapp-config action: "add-admin-phone"`. Their admin session is scoped to the **house** account. `adminPhones` is authoritative only on the account that owns the WhatsApp paired socket (the house): `add-admin-phone` is refused on any other account, and a list left on a non-socket (sub-)account is inert and purged at boot with `[admin-identity] op=purge-nonsocket-adminphone`. To answer "is this phone a manager?" read the house account's `adminPhones` + `accountManagers` only — never a sub-account's list. | `isAdminPhone()` in `access-control.ts` — iterates `adminPhones` |
+| **Account managers** | Phones in the `accountManagers` map (`account.json`, phone → sub-account UUID), added via `whatsapp-config action: "add-account-manager"`. Their admin session is scoped to the **bound sub-account**, not the house. Disjoint from `adminPhones` — a phone is a house admin or a sub-account manager, never both. | `managedAccountFor()` in `access-control.ts` resolves the sub-account **once**; `checkDmAccess` returns it as `effectiveAccountId`, and `ensureChannelSession` consumes that value without re-resolving |
 | **Public/unknown** | Any phone that is not self, not in `adminPhones`, and not in `accountManagers`. Subject to DM policy gating. | Everything else in `checkDmAccess()` |
 
 **Critical distinction:** The *self phone* is the paired device's number (the WhatsApp account Maxy controls). The *admin phone* is the user's personal phone (the phone they message *from*). These are typically different numbers. If the user's personal phone is not in `adminPhones` or `accountManagers`, their messages route as public — not admin.
 
-**Account-manager scoping — the two-account split.** A designated manager's inbound spawns an admin session scoped to their sub-account (its graph, skills, and `${USER_ID}` attribution). Replies and file delivery still go out over the **house's** paired WhatsApp device — the only WhatsApp socket — so the sub-account scope never redirects the transport. `ensureChannelSession` feeds the effective (sub-account) id to the spawn while keeping the connection (house) account for `startNativeFileFollower` and the reply path. A stale binding (deleted sub-account, or a phone wrongly also on `adminPhones`) is surfaced at boot by `account-manager-drift` and never silently mis-routes.
+**Account-manager scoping — the two-account split.** A designated manager's inbound spawns an admin session scoped to their sub-account (its graph, skills, and `${USER_ID}` attribution). Replies and file delivery still go out over the **house's** paired WhatsApp device — the only WhatsApp socket — so the sub-account scope never redirects the transport. The connection (house) account is kept for `startNativeFileFollower` and the reply path. A stale binding (a phone wrongly also on `adminPhones`) is surfaced at boot by `account-manager-drift` and never silently mis-routes.
+
+**Single source of truth + fail-closed.** The effective account is resolved **exactly once**, in the gate: `checkDmAccess` returns `effectiveAccountId` (the house account for owner/`adminPhones`/public, the bound sub-account for a manager), and that value threads through the inbound payload → gateway → `ensureChannelSession`, which spawns into it **without re-reading** the `accountManagers` map. There is no second resolution and no `?? accountId` house fallback: if a manager's bound sub-account is not a valid account, the inbound is **rejected** (no session spawned, no reply), never routed to the house. This closes the escalation where a divergence between two independent map reads handed a scoped manager a house-owner admin session. Observable signals: `op=account-manager-route … effectiveAccount=… source=gate` on a routed manager inbound; `op=account-manager-reject … reason=unresolved-effective-account` on the fail-closed drop; a standing `op=escalation-tripwire` belt that can only fire if a future change reintroduces the divergence.
 
 **`dmPolicy` behaviour (per-account):**
 

package/payload/platform/plugins/whatsapp/skills/manage-whatsapp-config/SKILL.md

@@ -31,6 +31,8 @@ Call `whatsapp-config action: list-admin-phones` and present the current list. A
 
 Each add/remove fires immediately — admin phones are managed per-action, independent of the form's batch submit.
 
+Admin phones are authoritative only on the account that owns the WhatsApp paired socket (the house). Adding an admin phone always applies to that account; the write is refused on any other account, because a phone in a sub-account's admin list is never consulted. To route a person to a specific sub-account, bind them as an account manager with `add-account-manager` instead — do not read or edit a sub-account's admin list to answer "is this phone a manager?".
+
 **Account managers:**
 
 An account manager is a phone bound to a specific sub-account. Its WhatsApp messages spawn an admin session scoped to that sub-account's agent, not the house. Use this when a person who manages one client sub-account should reach that sub-account's agent over WhatsApp.

package/payload/server/server.js

@@ -1307,7 +1307,7 @@ var serveStatic = (options = { root: "" }) => {
 // server/index.ts
 import { readFileSync as readFileSync35, existsSync as existsSync33, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { resolve as resolve33, join as join34, basename as basename12 } from "path";
+import { resolve as resolve33, join as join34, basename as basename13 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1726,7 +1726,7 @@ var WhatsAppAccountSchema = z.object({
 var WhatsAppConfigSchema = z.object({
   accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional().describe("Per-account config keyed by account ID."),
   dmPolicy: DmPolicySchema.optional().default("disabled").describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
-  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone."),
+  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone. Authoritative only on the account that owns the WhatsApp paired socket; a list on any other account is inert and purged at boot \u2014 use accountManagers for sub-account routing."),
   accountManagers: z.record(z.string(), z.string()).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account UUID. A designated phone spawns an admin session scoped to that sub-account rather than the house. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones."),
   allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
   sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
@@ -2628,27 +2628,31 @@ function isAdminPhone(phone, adminPhones) {
   return adminPhones.some((entry) => phonesMatch(entry, normalized));
 }
 function checkDmAccess(params) {
-  const { senderPhone, selfPhone } = params;
+  const { senderPhone, selfPhone, accountId } = params;
   const cfg = resolveAccountConfig(params.config, params.accountConfig);
   if (phonesMatch(senderPhone, selfPhone)) {
-    return { allowed: true, reason: "self-phone", agentType: "admin" };
+    return { allowed: true, reason: "self-phone", agentType: "admin", effectiveAccountId: accountId };
   }
   if (isAdminPhone(senderPhone, cfg.adminPhones)) {
-    return { allowed: true, reason: "admin-binding", agentType: "admin" };
+    return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
   }
-  if (managedAccountFor(cfg.accountManagers, senderPhone)) {
-    return { allowed: true, reason: "account-manager", agentType: "admin" };
+  const managedSub = managedAccountFor(cfg.accountManagers, senderPhone);
+  if (managedSub) {
+    if (params.isValidAccount && !params.isValidAccount(managedSub)) {
+      return { allowed: false, reason: "account-manager-unresolved", agentType: "admin" };
+    }
+    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managedSub };
   }
   switch (cfg.dmPolicy) {
     case "open":
-      return { allowed: true, reason: "dm-policy-open", agentType: "public" };
+      return { allowed: true, reason: "dm-policy-open", agentType: "public", effectiveAccountId: accountId };
     case "allowlist": {
       const inList = cfg.allowFrom.some((entry) => {
         if (entry === "*") return true;
         return phonesMatch(entry, senderPhone);
       });
       if (inList) {
-        return { allowed: true, reason: "allowlist-match", agentType: "public" };
+        return { allowed: true, reason: "allowlist-match", agentType: "public", effectiveAccountId: accountId };
       }
       return { allowed: false, reason: "not-in-allowlist", agentType: "public" };
     }
@@ -4100,7 +4104,9 @@ function buildSelfChatDispatch(input) {
       senderPhone,
       isGroup: false
     }),
-    media: []
+    media: [],
+    // Self-chat is the owner: the session scopes to the house account (Task 1383).
+    effectiveAccountId: input.accountId
   };
 }
 async function init(opts) {
@@ -4748,12 +4754,24 @@ async function handleInboundMessage(conn, msg) {
       config: whatsAppConfig,
       accountConfig: whatsAppConfig.accounts?.[conn.accountId],
       accountId: conn.accountId,
+      isValidAccount: (id) => listValidAccounts().some((a) => a.accountId === id),
       resolvePersonByPhone
     });
   }
   console.error(
     `${TAG13} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
   );
+  if (!accessResult.allowed && accessResult.reason === "account-manager-unresolved") {
+    console.error(
+      `[whatsapp-native] op=account-manager-reject senderId=${senderPhone} reason=unresolved-effective-account`
+    );
+  }
+  if (accessResult.allowed && accessResult.reason === "account-manager" && accessResult.effectiveAccountId === conn.accountId) {
+    console.error(
+      `[whatsapp-native] op=escalation-tripwire senderId=${senderPhone} reason=account-manager-routed-to-house effectiveAccount=${accessResult.effectiveAccountId}`
+    );
+    return;
+  }
   if (!accessResult.allowed) return;
   if (isCustomerTurnSuppressed(accessResult.agentType, isHouseManagedService())) {
     console.error(
@@ -4801,7 +4819,10 @@ async function handleInboundMessage(conn, msg) {
     composing,
     cacheKey,
     media: mediaResult?.path ? [{ path: mediaResult.path, type: extracted.mediaType, mimetype: mediaResult.mimetype }] : [],
-    replyContext: extracted.quotedMessage
+    replyContext: extracted.quotedMessage,
+    // Task 1383 — the gate's single resolution feeds the spawn (house or the
+    // bound sub-account); the router never re-resolves.
+    effectiveAccountId: accessResult.effectiveAccountId
   };
   if (accessResult.agentType === "public") {
     const hoursResult = await isBusinessOpen(conn.accountId);
@@ -6050,6 +6071,12 @@ function createScheduleInjectRoutes(deps) {
       try {
         await deps.waHandleInbound({
           accountId: houseAccountId,
+          // Task 1383 — the router (ensureChannelSession) no longer re-resolves
+          // the accountManagers map; it consumes this value. The scheduler
+          // supplies its own resolution (effectiveAccountFor, computed above) so
+          // a manager destination scopes the spawned session to the sub-account,
+          // exactly as a real inbound now does via the gate.
+          effectiveAccountId: effectiveAccount2,
           senderId: destination,
           role: "admin",
           personId: null,
@@ -6120,7 +6147,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
-import { resolve as resolve8, join as join8 } from "path";
+import { resolve as resolve8, join as join8, dirname as dirname2, basename as basename2 } from "path";
 var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve8(accountDir, "account.json");
@@ -6195,6 +6222,16 @@ function addAdminPhone(accountDir, phone) {
   }
   try {
     const config = readConfig(accountDir);
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
+    const socketOwner = resolveHouseOrSoleAccountId(dirname2(resolve8(accountDir)));
+    if (targetId !== socketOwner) {
+      console.error(`${TAG17} add-admin-phone rejected accountId=${targetId} reason=not-socket-account`);
+      return {
+        ok: false,
+        reason: "not-socket-account",
+        error: `${targetId} does not own the WhatsApp paired socket, so its admin phones are never consulted. To route a phone to a sub-account, bind it as an account manager (add-account-manager) instead.`
+      };
+    }
     if (!config.whatsapp || typeof config.whatsapp !== "object") {
       config.whatsapp = {};
     }
@@ -6270,6 +6307,44 @@ function readAdminPhones(accountDir) {
     return [];
   }
 }
+function purgeNonSocketAdminPhones(accountDir, socketOwnerId) {
+  try {
+    const config = readConfig(accountDir);
+    const wa = config.whatsapp;
+    if (!wa || typeof wa !== "object") return { removed: [] };
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
+    if (targetId === socketOwnerId) return { removed: [] };
+    const adminPhones = Array.isArray(wa.adminPhones) ? wa.adminPhones.filter((p) => typeof p === "string") : [];
+    if (adminPhones.length === 0) return { removed: [] };
+    delete wa.adminPhones;
+    writeConfig(accountDir, config);
+    for (const phone of adminPhones) {
+      console.error(`[admin-identity] op=purge-nonsocket-adminphone accountId=${targetId} phone=${phone} removed=true`);
+    }
+    return { removed: adminPhones };
+  } catch (err) {
+    console.error(`[admin-identity] purge-nonsocket-adminphone failed dir=${accountDir}: ${String(err)}`);
+    return { removed: [] };
+  }
+}
+function purgeNonSocketAdminPhonesAtBoot() {
+  let socketOwner;
+  try {
+    socketOwner = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch (err) {
+    console.error(`[admin-identity] purge-nonsocket-adminphone skipped \u2014 cannot resolve socket owner: ${String(err)}`);
+    return;
+  }
+  let accounts;
+  try {
+    accounts = listValidAccounts();
+  } catch {
+    return;
+  }
+  for (const acct of accounts) {
+    purgeNonSocketAdminPhones(acct.accountDir, socketOwner);
+  }
+}
 function setAccountManager(accountDir, phone, subAccountId) {
   const normalized = phone.trim();
   if (!E164_PATTERN.test(normalized)) {
@@ -6798,7 +6873,7 @@ function listActiveLoginAccountIds() {
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync3 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve9, basename as basename2 } from "path";
+import { resolve as resolve9, basename as basename3 } from "path";
 var TAG19 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -6853,7 +6928,7 @@ async function sendWhatsAppDocument(input) {
       error: `File exceeds 100 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename2(resolvedPath);
+  const filename = basename3(resolvedPath);
   const jid = normalizeJid2(to);
   const sock = getSocket(accountId);
   if (!sock) {
@@ -7142,7 +7217,8 @@ app2.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG21} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        const reasonTail = !result.ok && result.reason ? ` reason=${result.reason}` : "";
+        console.error(`${TAG21} config action=add-admin-phone accountId=${account.accountId} phone=${phone} ok=${result.ok}${reasonTail}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -7501,11 +7577,11 @@ var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync8, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname3, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
+import { basename as basename5, dirname as dirname4, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { basename as basename3, dirname as dirname2, join as join11, resolve as resolve11 } from "path";
+import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve11 } from "path";
 
 // app/lib/whatsapp-reader/select-sessions.ts
 function isReaderChannelSession(role, channel) {
@@ -7586,7 +7662,7 @@ function findSessionProjectDir(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
-    if (basename3(path2) === `${sessionId}.jsonl`) return dirname2(path2);
+    if (basename4(path2) === `${sessionId}.jsonl`) return dirname3(path2);
   }
   return null;
 }
@@ -8315,8 +8391,8 @@ app4.get("/conversations", requireAdminSession, async (c) => {
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
-    const sessionId = basename4(path2).replace(/\.jsonl$/, "");
-    const projectDir = dirname3(path2);
+    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
+    const projectDir = dirname4(path2);
     const meta = readSidecarMeta(join14(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
@@ -8846,7 +8922,7 @@ var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
 import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
-import { basename as basename5, dirname as dirname4, join as join15, resolve as resolve13, sep as sep4 } from "path";
+import { basename as basename6, dirname as dirname5, join as join15, resolve as resolve13, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -8921,8 +8997,8 @@ function enumeratePublicRows() {
   if (!cfg) return [];
   const rows = [];
   for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
-    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
-    const projectDir = dirname4(path2);
+    const sessionId = basename6(path2).replace(/\.jsonl$/, "");
+    const projectDir = dirname5(path2);
     const meta = readSidecarMeta(join15(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
@@ -9140,7 +9216,7 @@ app5.get("/attachment/:attachmentId", (c) => {
 var public_reader_default = app5;
 
 // server/routes/webchat.ts
-import { basename as basename6, dirname as dirname5 } from "path";
+import { basename as basename7, dirname as dirname6 } from "path";
 import { join as join18 } from "path";
 import { existsSync as existsSync10, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync3, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
@@ -9538,8 +9614,8 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   let best = null;
   for (const { path: path2, isSubagent, archived } of enumerateJsonls(join18(cfg, "projects"))) {
     if (isSubagent || archived) continue;
-    const id = basename6(path2).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join18(dirname5(path2), `${id}.meta.json`));
+    const id = basename7(path2).slice(0, -".jsonl".length);
+    const meta = readSidecarMeta(join18(dirname6(path2), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
@@ -9562,7 +9638,7 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
 function overrideKnownNonArchived(id) {
   const { projectDir } = locateSession(id);
   if (projectDir === null) return sessionSidecarExists(id);
-  return basename6(projectDir) !== "archive";
+  return basename7(projectDir) !== "archive";
 }
 function resolveCanonical(accountId, accountDir, requesterUserId, primaryUserId, scopeAccountId, multiAccount) {
   const bootstrapAccountId = scopeAccountId ?? accountId;
@@ -9930,8 +10006,8 @@ ${note}` : note;
     let projectDir = null;
     if (cfg) {
       for (const { path: path2 } of enumerateJsonls(join18(cfg, "projects"))) {
-        if (basename6(path2) === `${sessionId}.jsonl`) {
-          projectDir = dirname5(path2);
+        if (basename7(path2) === `${sessionId}.jsonl`) {
+          projectDir = dirname6(path2);
           break;
         }
       }
@@ -10369,7 +10445,7 @@ import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
-import { dirname as dirname6, join as join22 } from "path";
+import { dirname as dirname7, join as join22 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -10382,7 +10458,7 @@ function appendUsersAuditLine(audit, fields) {
   const line = `[users-audit] action=${fields.action} actor=${actor}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
 `;
   try {
-    mkdirSync5(dirname6(audit.logFile), { recursive: true, mode: 448 });
+    mkdirSync5(dirname7(audit.logFile), { recursive: true, mode: 448 });
     appendFileSync2(audit.logFile, line, { mode: 384 });
   } catch (err) {
     console.error(
@@ -10400,7 +10476,7 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync5(dirname6(filePath), { recursive: true });
+  mkdirSync5(dirname7(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync9(tempPath, contents, mode !== void 0 ? { mode } : void 0);
   renameSync5(tempPath, filePath);
@@ -11249,7 +11325,7 @@ var accounts_default = app12;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync18, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
-import { resolve as resolve16, basename as basename7 } from "path";
+import { resolve as resolve16, basename as basename8 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync17 } from "fs";
@@ -11281,7 +11357,7 @@ app13.get("/", async (c) => {
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename7(fileParam);
+    const safe = basename8(fileParam);
     const searched = [];
     for (const dir of logDirs) {
       const filePath = resolve16(dir, safe);
@@ -11351,7 +11427,7 @@ app13.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename7(hit.path);
+        const filename = basename8(hit.path);
         const buffer = readFileSync25(hit.path);
         const onDiskBytes = statSync10(hit.path).size;
         const headers = {
@@ -12285,7 +12361,7 @@ var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
-import { dirname as dirname7, resolve as resolve19, join as join25 } from "path";
+import { dirname as dirname8, resolve as resolve19, join as join25 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -12392,7 +12468,7 @@ function listPluginDirs() {
       }
     }
   }
-  const premiumRoot = resolve19(dirname7(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve19(dirname8(PLATFORM_ROOT), "premium-plugins");
   if (existsSync22(premiumRoot)) {
     for (const bundle of readdirSync16(premiumRoot)) {
       const bundlePlugins = join25(premiumRoot, bundle, "plugins");
@@ -12841,7 +12917,7 @@ import { createReadStream as createReadStream2, createWriteStream as createWrite
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
-import { basename as basename9, dirname as dirname8, join as join27, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
+import { basename as basename10, dirname as dirname9, join as join27, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -13159,7 +13235,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve21, relative as relative3, join as join26, basename as basename8, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve21, relative as relative3, join as join26, basename as basename9, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -13297,8 +13373,8 @@ async function extractFileContent(absolute) {
   }
 }
 async function readDisplayName(absolute) {
-  const dir = absolute.slice(0, absolute.length - basename8(absolute).length);
-  const base = basename8(absolute);
+  const dir = absolute.slice(0, absolute.length - basename9(absolute).length);
+  const base = basename9(absolute);
   const dot = base.lastIndexOf(".");
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
@@ -13436,7 +13512,7 @@ async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths
   return { kds, sections, chunks };
 }
 async function buildArtifact(accountId, wf, embed2) {
-  const name = basename8(wf.absolute);
+  const name = basename9(wf.absolute);
   const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
@@ -13966,7 +14042,7 @@ app21.get("/download", requireAdminSession, async (c) => {
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename9(absolute);
+    const filename = basename10(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -14071,7 +14147,7 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
       const info = await stat4(absolute);
       if (info.isDirectory()) {
         dirsWalked++;
-        const parentAbs = dirname8(absolute);
+        const parentAbs = dirname9(absolute);
         for await (const fileAbs of walkRegularFiles(absolute)) {
           const within = relative4(absolute, fileAbs).split(sep6).join("/");
           const fileRel = relPath === "" || relPath === "." ? within : `${relPath}/${within}`;
@@ -14082,7 +14158,7 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
           if (over) return over;
         }
       } else if (info.isFile()) {
-        const over = await addFile(absolute, info.size, basename9(absolute));
+        const over = await addFile(absolute, info.size, basename10(absolute));
         if (over) return over;
       } else {
         return c.json({ error: "Path is not a file or directory" }, 400);
@@ -14111,12 +14187,12 @@ function dataUploadCeiling() {
 }
 async function resolveUploadTarget(c, accountId, uid) {
   const rawName = c.req.query("filename") ?? "";
-  const safeName = basename9(rawName).replace(/[\0/\\]/g, "_");
+  const safeName = basename10(rawName).replace(/[\0/\\]/g, "_");
   if (!safeName) return { ok: false, status: 400, error: "filename query param required" };
   const rawRelpath = c.req.query("relpath") ?? "";
   const relpath = rawRelpath !== "" ? rawRelpath : null;
   const token = c.req.query("token") ?? "";
-  const finalName = relpath ? basename9(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
+  const finalName = relpath ? basename10(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
   const mimeType = (c.req.header("content-type") ?? "").split(";")[0].trim();
   if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
     console.error(`[data-upload] op=reject-mime uid=${uid} mime="${mimeType}" token=${token} rel="${relpath ?? ""}"`);
@@ -14125,7 +14201,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const rawDir = c.req.query("path") ?? "";
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
-  const relDir = relpath ? dirname8(relpath) : ".";
+  const relDir = relpath ? dirname9(relpath) : ".";
   const destRel = relDir === "." ? base.relative : join27(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
@@ -14486,7 +14562,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
-  const base = basename9(absolute);
+  const base = basename10(absolute);
   const protection = isProtectedFromDeletion(relPath);
   if (protection.protected) {
     console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
@@ -14502,7 +14578,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join27(dirname8(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join27(dirname9(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -14598,8 +14674,8 @@ app21.post("/rename", requireAdminSession, async (c) => {
     console.error(`[data] file-rename blocked path="${src.relative}" reason="protected"`);
     return c.json({ error: "Protected entry \u2014 refusing to rename" }, 403);
   }
-  const destAbs = resolve22(dirname8(src.absolute), newName);
-  const newRel = `${dirname8(src.relative)}/${newName}`.replace(/^\.\//, "");
+  const destAbs = resolve22(dirname9(src.absolute), newName);
+  const newRel = `${dirname9(src.relative)}/${newName}`.replace(/^\.\//, "");
   if (isProtectedFromRename(newRel)) {
     console.error(`[data] file-rename blocked path="${newRel}" reason="protected-target"`);
     return c.json({ error: "That name is reserved" }, 403);
@@ -16730,7 +16806,7 @@ var graph_default_view_default = app27;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
+import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename11 } from "path";
 import { existsSync as existsSync25 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -16783,7 +16859,7 @@ async function fetchAccountFileArtefacts(accountId) {
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
         id: `account-file:${relativePath}`,
-        name: displayName ?? basename10(relativePath),
+        name: displayName ?? basename11(relativePath),
         kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
@@ -19125,7 +19201,7 @@ var sites_default = app49;
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync32, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -19142,7 +19218,7 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync7(dirname9(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    mkdirSync7(dirname10(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
     writeFileSync11(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
@@ -20250,7 +20326,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname10, relative as relative6, resolve as resolve29 } from "path";
+import { dirname as dirname11, relative as relative6, resolve as resolve29 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -20282,7 +20358,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
     const newAbs = resolve29(destDir, suffix);
-    await mkdir5(dirname10(newAbs), { recursive: true });
+    await mkdir5(dirname11(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
     const oldRel = relative6(dataRoot, oldAbs);
@@ -21011,6 +21087,7 @@ var WaGateway = class {
       try {
         await this.deps.ensureChannelSession({
           accountId: input.accountId,
+          effectiveAccountId: input.effectiveAccountId,
           senderId: input.senderId,
           role: input.role ?? "admin",
           personId: input.personId ?? null,
@@ -22375,7 +22452,7 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync7 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve30, basename as basename11 } from "path";
+import { resolve as resolve30, basename as basename12 } from "path";
 var TAG36 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -22412,7 +22489,7 @@ async function sendTelegramDocument(input) {
       error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename11(resolvedPath);
+  const filename = basename12(resolvedPath);
   const buffer = Buffer.from(await readFile7(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
@@ -22705,6 +22782,10 @@ function findChannelAdminBindingDrift(adminPhones, admins, users) {
   }
   return drift;
 }
+function classifyAdminPhonesForAccount(isSocketOwner, adminPhones, admins, users) {
+  if (!isSocketOwner) return { nonSocketPhones: [...adminPhones], drift: [] };
+  return { nonSocketPhones: [], drift: findChannelAdminBindingDrift(adminPhones, admins, users) };
+}
 function warnOnChannelAdminBindingDrift() {
   let users;
   try {
@@ -22718,10 +22799,27 @@ function warnOnChannelAdminBindingDrift() {
   } catch {
     return;
   }
+  let socketOwner;
+  try {
+    socketOwner = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch {
+    socketOwner = null;
+  }
   const validAccountIds = accounts.map((a) => a.accountId);
   for (const acct of accounts) {
     const adminPhones = readAdminPhones(acct.accountDir);
-    const drift = findChannelAdminBindingDrift(adminPhones, acct.config.admins ?? [], users);
+    const isSocketOwner = socketOwner === null || acct.accountId === socketOwner;
+    const { nonSocketPhones, drift } = classifyAdminPhonesForAccount(
+      isSocketOwner,
+      adminPhones,
+      acct.config.admins ?? [],
+      users
+    );
+    for (const phone of nonSocketPhones) {
+      console.error(
+        `[admin-identity] adminphones-on-non-socket-account accountId=${acct.accountId} phone=${phone} count=${nonSocketPhones.length}`
+      );
+    }
     for (const d of drift) {
       const tail = d.reason === "userid-not-admin" ? ` userId=${d.userId}` : "";
       console.error(
@@ -23097,12 +23195,10 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, senderId, role, personId, gatewayUrl, serverPath }) => {
-    const houseDir = role === "admin" ? listValidAccounts().find((a) => a.accountId === accountId)?.accountDir ?? null : null;
-    const managed = houseDir ? managedAccountFor(readAccountManagers(houseDir), senderId) : null;
-    const effectiveAccountId = managed ?? accountId;
+  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath }) => {
     if (role === "admin") {
-      console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managed ?? "none"} effectiveAccount=${effectiveAccountId}`);
+      const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
+      console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
     const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
     const userId = role === "admin" ? resolveAdminUserId({ accountId: effectiveAccountId, senderPhone: senderId }) ?? void 0 : void 0;
@@ -24243,7 +24339,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename12(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename13(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -24263,6 +24359,7 @@ reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config, bootAccoun
 for (const acct of listValidAccounts()) {
   cleanupLeakedPremiumSubs(acct.accountDir, acct.config, acct.accountId);
 }
+purgeNonSocketAdminPhonesAtBoot();
 warnOnChannelAdminBindingDrift();
 var bootEnabled = Array.isArray(bootAccountConfig?.enabledPlugins) ? bootAccountConfig.enabledPlugins : [];
 var bootDelivered = [];
@@ -24322,6 +24419,10 @@ init({
       console.error(`[whatsapp:route] dropped reason=no-text-no-media senderId=${msg.senderPhone} mediaCount=${msg.media.length}`);
       return;
     }
+    if (!msg.effectiveAccountId) {
+      console.error(`[whatsapp:route] op=dropped reason=no-effective-account senderId=${msg.senderPhone}`);
+      return;
+    }
     if (decision.role === "public") {
       console.error(`[whatsapp:route] op=routed agentType=public personId=${decision.personId} senderId=${msg.senderPhone}`);
     }
@@ -24330,6 +24431,7 @@ init({
       });
       await waGateway.handleInbound({
         accountId: msg.accountId,
+        effectiveAccountId: msg.effectiveAccountId,
         senderId: msg.senderPhone,
         role: decision.role,
         personId: decision.personId,