@rubytech/create-maxy-code 0.1.387 → 0.1.389

package/payload/server/server.js

@@ -1307,7 +1307,7 @@ var serveStatic = (options = { root: "" }) => {
 // server/index.ts
 import { readFileSync as readFileSync35, existsSync as existsSync33, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { resolve as resolve33, join as join34, basename as basename12 } from "path";
+import { resolve as resolve33, join as join34, basename as basename13 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1726,7 +1726,7 @@ var WhatsAppAccountSchema = z.object({
 var WhatsAppConfigSchema = z.object({
   accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional().describe("Per-account config keyed by account ID."),
   dmPolicy: DmPolicySchema.optional().default("disabled").describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
-  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone."),
+  adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone. Authoritative only on the account that owns the WhatsApp paired socket; a list on any other account is inert and purged at boot \u2014 use accountManagers for sub-account routing."),
   accountManagers: z.record(z.string(), z.string()).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account UUID. A designated phone spawns an admin session scoped to that sub-account rather than the house. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones."),
   allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
   sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
@@ -2628,27 +2628,31 @@ function isAdminPhone(phone, adminPhones) {
   return adminPhones.some((entry) => phonesMatch(entry, normalized));
 }
 function checkDmAccess(params) {
-  const { senderPhone, selfPhone } = params;
+  const { senderPhone, selfPhone, accountId } = params;
   const cfg = resolveAccountConfig(params.config, params.accountConfig);
   if (phonesMatch(senderPhone, selfPhone)) {
-    return { allowed: true, reason: "self-phone", agentType: "admin" };
+    return { allowed: true, reason: "self-phone", agentType: "admin", effectiveAccountId: accountId };
   }
   if (isAdminPhone(senderPhone, cfg.adminPhones)) {
-    return { allowed: true, reason: "admin-binding", agentType: "admin" };
+    return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
   }
-  if (managedAccountFor(cfg.accountManagers, senderPhone)) {
-    return { allowed: true, reason: "account-manager", agentType: "admin" };
+  const managedSub = managedAccountFor(cfg.accountManagers, senderPhone);
+  if (managedSub) {
+    if (params.isValidAccount && !params.isValidAccount(managedSub)) {
+      return { allowed: false, reason: "account-manager-unresolved", agentType: "admin" };
+    }
+    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managedSub };
   }
   switch (cfg.dmPolicy) {
     case "open":
-      return { allowed: true, reason: "dm-policy-open", agentType: "public" };
+      return { allowed: true, reason: "dm-policy-open", agentType: "public", effectiveAccountId: accountId };
     case "allowlist": {
       const inList = cfg.allowFrom.some((entry) => {
         if (entry === "*") return true;
         return phonesMatch(entry, senderPhone);
       });
       if (inList) {
-        return { allowed: true, reason: "allowlist-match", agentType: "public" };
+        return { allowed: true, reason: "allowlist-match", agentType: "public", effectiveAccountId: accountId };
       }
       return { allowed: false, reason: "not-in-allowlist", agentType: "public" };
     }
@@ -4100,7 +4104,9 @@ function buildSelfChatDispatch(input) {
       senderPhone,
       isGroup: false
     }),
-    media: []
+    media: [],
+    // Self-chat is the owner: the session scopes to the house account (Task 1383).
+    effectiveAccountId: input.accountId
   };
 }
 async function init(opts) {
@@ -4748,12 +4754,24 @@ async function handleInboundMessage(conn, msg) {
       config: whatsAppConfig,
       accountConfig: whatsAppConfig.accounts?.[conn.accountId],
       accountId: conn.accountId,
+      isValidAccount: (id) => listValidAccounts().some((a) => a.accountId === id),
       resolvePersonByPhone
     });
   }
   console.error(
     `${TAG13} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
   );
+  if (!accessResult.allowed && accessResult.reason === "account-manager-unresolved") {
+    console.error(
+      `[whatsapp-native] op=account-manager-reject senderId=${senderPhone} reason=unresolved-effective-account`
+    );
+  }
+  if (accessResult.allowed && accessResult.reason === "account-manager" && accessResult.effectiveAccountId === conn.accountId) {
+    console.error(
+      `[whatsapp-native] op=escalation-tripwire senderId=${senderPhone} reason=account-manager-routed-to-house effectiveAccount=${accessResult.effectiveAccountId}`
+    );
+    return;
+  }
   if (!accessResult.allowed) return;
   if (isCustomerTurnSuppressed(accessResult.agentType, isHouseManagedService())) {
     console.error(
@@ -4801,7 +4819,10 @@ async function handleInboundMessage(conn, msg) {
     composing,
     cacheKey,
     media: mediaResult?.path ? [{ path: mediaResult.path, type: extracted.mediaType, mimetype: mediaResult.mimetype }] : [],
-    replyContext: extracted.quotedMessage
+    replyContext: extracted.quotedMessage,
+    // Task 1383 — the gate's single resolution feeds the spawn (house or the
+    // bound sub-account); the router never re-resolves.
+    effectiveAccountId: accessResult.effectiveAccountId
   };
   if (accessResult.agentType === "public") {
     const hoursResult = await isBusinessOpen(conn.accountId);
@@ -5719,8 +5740,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app56 = new Hono();
-  app56.post("/", async (c) => {
+  const app57 = new Hono();
+  app57.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -5983,7 +6004,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -6004,8 +6025,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app56 = new Hono();
-  app56.post("/", async (c) => {
+  const app57 = new Hono();
+  app57.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -6044,12 +6065,22 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG16} op=received eventId=${eventId} channel=${channel} destination=${destination} account=${houseAccountId}`);
     if (channel === "whatsapp") {
       const effectiveAccount2 = deps.effectiveAccountFor(houseAccountId, account.accountDir, destination);
+      if (effectiveAccount2 === null) {
+        console.error(`${TAG16} op=schedule-account-manager-reject eventId=${eventId} destination=${destination} reason=unresolved-effective-account`);
+        return c.json({ ok: false, error: "account-manager-unresolved" }, 403);
+      }
       console.error(`${TAG16} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount2}`);
       const sessionId2 = adminSessionIdFor(effectiveAccount2, destination);
       const reply2 = (text) => deps.sendWhatsAppText(houseAccountId, destination, text);
       try {
         await deps.waHandleInbound({
           accountId: houseAccountId,
+          // Task 1383 — the router (ensureChannelSession) no longer re-resolves
+          // the accountManagers map; it consumes this value. The scheduler
+          // supplies its own resolution (effectiveAccountFor, computed above) so
+          // a manager destination scopes the spawned session to the sub-account,
+          // exactly as a real inbound now does via the gate.
+          effectiveAccountId: effectiveAccount2,
           senderId: destination,
           role: "admin",
           personId: null,
@@ -6093,7 +6124,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/telegram/outbound/send-text.ts
@@ -6120,7 +6151,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
-import { resolve as resolve8, join as join8 } from "path";
+import { resolve as resolve8, join as join8, dirname as dirname2, basename as basename2 } from "path";
 var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve8(accountDir, "account.json");
@@ -6195,6 +6226,16 @@ function addAdminPhone(accountDir, phone) {
   }
   try {
     const config = readConfig(accountDir);
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
+    const socketOwner = resolveHouseOrSoleAccountId(dirname2(resolve8(accountDir)));
+    if (targetId !== socketOwner) {
+      console.error(`${TAG17} add-admin-phone rejected accountId=${targetId} reason=not-socket-account`);
+      return {
+        ok: false,
+        reason: "not-socket-account",
+        error: `${targetId} does not own the WhatsApp paired socket, so its admin phones are never consulted. To route a phone to a sub-account, bind it as an account manager (add-account-manager) instead.`
+      };
+    }
     if (!config.whatsapp || typeof config.whatsapp !== "object") {
       config.whatsapp = {};
     }
@@ -6270,6 +6311,44 @@ function readAdminPhones(accountDir) {
     return [];
   }
 }
+function purgeNonSocketAdminPhones(accountDir, socketOwnerId) {
+  try {
+    const config = readConfig(accountDir);
+    const wa = config.whatsapp;
+    if (!wa || typeof wa !== "object") return { removed: [] };
+    const targetId = typeof config.accountId === "string" && config.accountId ? config.accountId : basename2(resolve8(accountDir));
+    if (targetId === socketOwnerId) return { removed: [] };
+    const adminPhones = Array.isArray(wa.adminPhones) ? wa.adminPhones.filter((p) => typeof p === "string") : [];
+    if (adminPhones.length === 0) return { removed: [] };
+    delete wa.adminPhones;
+    writeConfig(accountDir, config);
+    for (const phone of adminPhones) {
+      console.error(`[admin-identity] op=purge-nonsocket-adminphone accountId=${targetId} phone=${phone} removed=true`);
+    }
+    return { removed: adminPhones };
+  } catch (err) {
+    console.error(`[admin-identity] purge-nonsocket-adminphone failed dir=${accountDir}: ${String(err)}`);
+    return { removed: [] };
+  }
+}
+function purgeNonSocketAdminPhonesAtBoot() {
+  let socketOwner;
+  try {
+    socketOwner = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch (err) {
+    console.error(`[admin-identity] purge-nonsocket-adminphone skipped \u2014 cannot resolve socket owner: ${String(err)}`);
+    return;
+  }
+  let accounts;
+  try {
+    accounts = listValidAccounts();
+  } catch {
+    return;
+  }
+  for (const acct of accounts) {
+    purgeNonSocketAdminPhones(acct.accountDir, socketOwner);
+  }
+}
 function setAccountManager(accountDir, phone, subAccountId) {
   const normalized = phone.trim();
   if (!E164_PATTERN.test(normalized)) {
@@ -6798,7 +6877,7 @@ function listActiveLoginAccountIds() {
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync as realpathSync3 } from "fs";
 import { readFile, stat as stat2 } from "fs/promises";
-import { resolve as resolve9, basename as basename2 } from "path";
+import { resolve as resolve9, basename as basename3 } from "path";
 var TAG19 = "[whatsapp:outbound]";
 var WHATSAPP_DOCUMENT_MAX_BYTES = 100 * 1024 * 1024;
 var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
@@ -6833,7 +6912,7 @@ async function sendWhatsAppDocument(input) {
     const accountResolved = realpathSync3(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
       const sanitised = filePath.replace(accountDir, "<account>/");
-      console.error(`${TAG19} document REJECTED path=${sanitised} reason=outside_account_directory`);
+      console.error(`${TAG19} document REJECTED path=${sanitised} reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
@@ -6853,7 +6932,7 @@ async function sendWhatsAppDocument(input) {
       error: `File exceeds 100 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename2(resolvedPath);
+  const filename = basename3(resolvedPath);
   const jid = normalizeJid2(to);
   const sock = getSocket(accountId);
   if (!sock) {
@@ -7142,7 +7221,8 @@ app2.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG21} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        const reasonTail = !result.ok && result.reason ? ` reason=${result.reason}` : "";
+        console.error(`${TAG21} config action=add-admin-phone accountId=${account.accountId} phone=${phone} ok=${result.ok}${reasonTail}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -7501,11 +7581,11 @@ var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync8, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname3, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
+import { basename as basename5, dirname as dirname4, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { basename as basename3, dirname as dirname2, join as join11, resolve as resolve11 } from "path";
+import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve11 } from "path";
 
 // app/lib/whatsapp-reader/select-sessions.ts
 function isReaderChannelSession(role, channel) {
@@ -7586,7 +7666,7 @@ function findSessionProjectDir(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
-    if (basename3(path2) === `${sessionId}.jsonl`) return dirname2(path2);
+    if (basename4(path2) === `${sessionId}.jsonl`) return dirname3(path2);
   }
   return null;
 }
@@ -8315,8 +8395,8 @@ app4.get("/conversations", requireAdminSession, async (c) => {
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
-    const sessionId = basename4(path2).replace(/\.jsonl$/, "");
-    const projectDir = dirname3(path2);
+    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
+    const projectDir = dirname4(path2);
     const meta = readSidecarMeta(join14(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
@@ -8846,7 +8926,7 @@ var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
 import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
-import { basename as basename5, dirname as dirname4, join as join15, resolve as resolve13, sep as sep4 } from "path";
+import { basename as basename6, dirname as dirname5, join as join15, resolve as resolve13, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -8921,8 +9001,8 @@ function enumeratePublicRows() {
   if (!cfg) return [];
   const rows = [];
   for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
-    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
-    const projectDir = dirname4(path2);
+    const sessionId = basename6(path2).replace(/\.jsonl$/, "");
+    const projectDir = dirname5(path2);
     const meta = readSidecarMeta(join15(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
@@ -9140,7 +9220,7 @@ app5.get("/attachment/:attachmentId", (c) => {
 var public_reader_default = app5;
 
 // server/routes/webchat.ts
-import { basename as basename6, dirname as dirname5 } from "path";
+import { basename as basename7, dirname as dirname6 } from "path";
 import { join as join18 } from "path";
 import { existsSync as existsSync10, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync3, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
@@ -9538,8 +9618,8 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   let best = null;
   for (const { path: path2, isSubagent, archived } of enumerateJsonls(join18(cfg, "projects"))) {
     if (isSubagent || archived) continue;
-    const id = basename6(path2).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join18(dirname5(path2), `${id}.meta.json`));
+    const id = basename7(path2).slice(0, -".jsonl".length);
+    const meta = readSidecarMeta(join18(dirname6(path2), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
@@ -9562,7 +9642,7 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
 function overrideKnownNonArchived(id) {
   const { projectDir } = locateSession(id);
   if (projectDir === null) return sessionSidecarExists(id);
-  return basename6(projectDir) !== "archive";
+  return basename7(projectDir) !== "archive";
 }
 function resolveCanonical(accountId, accountDir, requesterUserId, primaryUserId, scopeAccountId, multiAccount) {
   const bootstrapAccountId = scopeAccountId ?? accountId;
@@ -9598,8 +9678,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app56 = new Hono();
-  app56.post("/send", requireAdminSession, async (c) => {
+  const app57 = new Hono();
+  app57.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -9799,7 +9879,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app56.post("/interrupt", requireAdminSession, async (c) => {
+  app57.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -9827,7 +9907,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app56.post("/settings", requireAdminSession, async (c) => {
+  app57.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -9867,7 +9947,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app56.get("/session", requireAdminSession, async (c) => {
+  app57.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -9930,8 +10010,8 @@ ${note}` : note;
     let projectDir = null;
     if (cfg) {
       for (const { path: path2 } of enumerateJsonls(join18(cfg, "projects"))) {
-        if (basename6(path2) === `${sessionId}.jsonl`) {
-          projectDir = dirname5(path2);
+        if (basename7(path2) === `${sessionId}.jsonl`) {
+          projectDir = dirname6(path2);
           break;
         }
       }
@@ -9945,7 +10025,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app56.post("/permission-verdict", requireAdminSession, async (c) => {
+  app57.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -9962,7 +10042,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app56;
+  return app57;
 }
 
 // server/routes/webchat-greeting.ts
@@ -10369,7 +10449,7 @@ import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
-import { dirname as dirname6, join as join22 } from "path";
+import { dirname as dirname7, join as join22 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -10382,7 +10462,7 @@ function appendUsersAuditLine(audit, fields) {
   const line = `[users-audit] action=${fields.action} actor=${actor}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
 `;
   try {
-    mkdirSync5(dirname6(audit.logFile), { recursive: true, mode: 448 });
+    mkdirSync5(dirname7(audit.logFile), { recursive: true, mode: 448 });
     appendFileSync2(audit.logFile, line, { mode: 384 });
   } catch (err) {
     console.error(
@@ -10400,7 +10480,7 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync5(dirname6(filePath), { recursive: true });
+  mkdirSync5(dirname7(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync9(tempPath, contents, mode !== void 0 ? { mode } : void 0);
   renameSync5(tempPath, filePath);
@@ -11249,7 +11329,7 @@ var accounts_default = app12;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync18, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
-import { resolve as resolve16, basename as basename7 } from "path";
+import { resolve as resolve16, basename as basename8 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync17 } from "fs";
@@ -11281,7 +11361,7 @@ app13.get("/", async (c) => {
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename7(fileParam);
+    const safe = basename8(fileParam);
     const searched = [];
     for (const dir of logDirs) {
       const filePath = resolve16(dir, safe);
@@ -11351,7 +11431,7 @@ app13.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename7(hit.path);
+        const filename = basename8(hit.path);
         const buffer = readFileSync25(hit.path);
         const onDiskBytes = statSync10(hit.path).size;
         const headers = {
@@ -12285,7 +12365,7 @@ var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
-import { dirname as dirname7, resolve as resolve19, join as join25 } from "path";
+import { dirname as dirname8, resolve as resolve19, join as join25 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -12392,7 +12472,7 @@ function listPluginDirs() {
       }
     }
   }
-  const premiumRoot = resolve19(dirname7(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve19(dirname8(PLATFORM_ROOT), "premium-plugins");
   if (existsSync22(premiumRoot)) {
     for (const bundle of readdirSync16(premiumRoot)) {
       const bundlePlugins = join25(premiumRoot, bundle, "plugins");
@@ -12841,7 +12921,7 @@ import { createReadStream as createReadStream2, createWriteStream as createWrite
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
-import { basename as basename9, dirname as dirname8, join as join27, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
+import { basename as basename10, dirname as dirname9, join as join27, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -13159,7 +13239,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve21, relative as relative3, join as join26, basename as basename8, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve21, relative as relative3, join as join26, basename as basename9, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -13297,8 +13377,8 @@ async function extractFileContent(absolute) {
   }
 }
 async function readDisplayName(absolute) {
-  const dir = absolute.slice(0, absolute.length - basename8(absolute).length);
-  const base = basename8(absolute);
+  const dir = absolute.slice(0, absolute.length - basename9(absolute).length);
+  const base = basename9(absolute);
   const dot = base.lastIndexOf(".");
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
@@ -13436,7 +13516,7 @@ async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths
   return { kds, sections, chunks };
 }
 async function buildArtifact(accountId, wf, embed2) {
-  const name = basename8(wf.absolute);
+  const name = basename9(wf.absolute);
   const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
@@ -13966,7 +14046,7 @@ app21.get("/download", requireAdminSession, async (c) => {
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename9(absolute);
+    const filename = basename10(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -14071,7 +14151,7 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
       const info = await stat4(absolute);
       if (info.isDirectory()) {
         dirsWalked++;
-        const parentAbs = dirname8(absolute);
+        const parentAbs = dirname9(absolute);
         for await (const fileAbs of walkRegularFiles(absolute)) {
           const within = relative4(absolute, fileAbs).split(sep6).join("/");
           const fileRel = relPath === "" || relPath === "." ? within : `${relPath}/${within}`;
@@ -14082,7 +14162,7 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
           if (over) return over;
         }
       } else if (info.isFile()) {
-        const over = await addFile(absolute, info.size, basename9(absolute));
+        const over = await addFile(absolute, info.size, basename10(absolute));
         if (over) return over;
       } else {
         return c.json({ error: "Path is not a file or directory" }, 400);
@@ -14111,12 +14191,12 @@ function dataUploadCeiling() {
 }
 async function resolveUploadTarget(c, accountId, uid) {
   const rawName = c.req.query("filename") ?? "";
-  const safeName = basename9(rawName).replace(/[\0/\\]/g, "_");
+  const safeName = basename10(rawName).replace(/[\0/\\]/g, "_");
   if (!safeName) return { ok: false, status: 400, error: "filename query param required" };
   const rawRelpath = c.req.query("relpath") ?? "";
   const relpath = rawRelpath !== "" ? rawRelpath : null;
   const token = c.req.query("token") ?? "";
-  const finalName = relpath ? basename9(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
+  const finalName = relpath ? basename10(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
   const mimeType = (c.req.header("content-type") ?? "").split(";")[0].trim();
   if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
     console.error(`[data-upload] op=reject-mime uid=${uid} mime="${mimeType}" token=${token} rel="${relpath ?? ""}"`);
@@ -14125,7 +14205,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const rawDir = c.req.query("path") ?? "";
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
-  const relDir = relpath ? dirname8(relpath) : ".";
+  const relDir = relpath ? dirname9(relpath) : ".";
   const destRel = relDir === "." ? base.relative : join27(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
@@ -14486,7 +14566,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
-  const base = basename9(absolute);
+  const base = basename10(absolute);
   const protection = isProtectedFromDeletion(relPath);
   if (protection.protected) {
     console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
@@ -14502,7 +14582,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join27(dirname8(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join27(dirname9(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -14598,8 +14678,8 @@ app21.post("/rename", requireAdminSession, async (c) => {
     console.error(`[data] file-rename blocked path="${src.relative}" reason="protected"`);
     return c.json({ error: "Protected entry \u2014 refusing to rename" }, 403);
   }
-  const destAbs = resolve22(dirname8(src.absolute), newName);
-  const newRel = `${dirname8(src.relative)}/${newName}`.replace(/^\.\//, "");
+  const destAbs = resolve22(dirname9(src.absolute), newName);
+  const newRel = `${dirname9(src.relative)}/${newName}`.replace(/^\.\//, "");
   if (isProtectedFromRename(newRel)) {
     console.error(`[data] file-rename blocked path="${newRel}" reason="protected-target"`);
     return c.json({ error: "That name is reserved" }, 403);
@@ -16730,7 +16810,7 @@ var graph_default_view_default = app27;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
+import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename11 } from "path";
 import { existsSync as existsSync25 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -16783,7 +16863,7 @@ async function fetchAccountFileArtefacts(accountId) {
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
         id: `account-file:${relativePath}`,
-        name: displayName ?? basename10(relativePath),
+        name: displayName ?? basename11(relativePath),
         kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
@@ -17071,6 +17151,36 @@ app32.post("/", requireAdminSession, async (c) => {
 });
 var session_rename_default = app32;
 
+// server/routes/admin/session-usage.ts
+var app33 = new Hono();
+app33.get("/", requireAdminSession, async (c) => {
+  const sessionId = c.req.query("sessionId") ?? "";
+  if (!SESSION_ID_RE2.test(sessionId)) {
+    return c.json({ error: "sessionId must be a v4 UUID" }, 400);
+  }
+  let res;
+  try {
+    res = await fetch(`${managerBase("session-usage:wrapper")}/${sessionId}/metering`);
+  } catch (err) {
+    console.error(`[session-usage] sessionId=${sessionId.slice(0, 8)} manager-unreachable err=${err instanceof Error ? err.message : String(err)}`);
+    return c.json({ error: "manager-unreachable" }, 502);
+  }
+  if (res.status === 200) {
+    const summary = await res.json().catch(() => null);
+    if (!summary) {
+      console.error(`[session-usage] sessionId=${sessionId.slice(0, 8)} manager-bad-json`);
+      return c.json({ error: "manager-bad-json" }, 502);
+    }
+    return c.json(summary);
+  }
+  if (res.status === 404) {
+    return c.json({ error: "session-not-found" }, 404);
+  }
+  console.error(`[session-usage] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
+  return c.json({ error: `manager-status-${res.status}` }, 502);
+});
+var session_usage_default = app33;
+
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID10 } from "crypto";
 var ACCOUNT_UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -17116,8 +17226,8 @@ function shapeWebchatResponse(sessionId, manager) {
   const landed = redirected ? manager.sessionId : sessionId;
   return { sessionId: landed, outcome, target: `/chat?session=${landed}` };
 }
-var app33 = new Hono();
-app33.post("/", requireAdminSession, async (c) => {
+var app34 = new Hono();
+app34.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17200,7 +17310,7 @@ app33.post("/", requireAdminSession, async (c) => {
   }
   return c.json(parsed ?? {});
 });
-var session_rc_spawn_default = app33;
+var session_rc_spawn_default = app34;
 
 // server/routes/admin/session-reseat.ts
 import { randomUUID as randomUUID11 } from "crypto";
@@ -17223,9 +17333,9 @@ function resolveReseatPlan(body, mintId = randomUUID11, adminUserId, authenticat
   if (authenticatedName) payload.authenticatedName = authenticatedName;
   return { sessionId, payload };
 }
-var app34 = new Hono();
+var app35 = new Hono();
 var reseatsInFlight = /* @__PURE__ */ new Set();
-app34.post("/", requireAdminSession, async (c) => {
+app35.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17313,7 +17423,7 @@ app34.post("/", requireAdminSession, async (c) => {
     reseatsInFlight.delete(fromSessionId);
   }
 });
-var session_reseat_default = app34;
+var session_reseat_default = app35;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile5 } from "fs/promises";
@@ -17410,8 +17520,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app35 = new Hono();
-app35.get("/", async (c) => {
+var app36 = new Hono();
+app36.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -17434,7 +17544,7 @@ app35.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app35;
+var system_stats_default = app36;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync26, readFileSync as readFileSync29 } from "fs";
@@ -17479,8 +17589,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app36 = new Hono();
-app36.get("/", async (c) => {
+var app37 = new Hono();
+app37.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -17502,7 +17612,7 @@ app36.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app36;
+var health_default2 = app37;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID12 } from "crypto";
@@ -17728,8 +17838,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app37 = new Hono();
-app37.post("/", requireAdminSession, async (c) => {
+var app38 = new Hono();
+app38.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17774,7 +17884,7 @@ app37.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
-var linkedin_ingest_default = app37;
+var linkedin_ingest_default = app38;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
@@ -17816,8 +17926,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app38 = new Hono();
-app38.get("/", async (c) => {
+var app39 = new Hono();
+app39.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -17877,7 +17987,7 @@ app38.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app38;
+var post_turn_context_default = app39;
 
 // app/lib/slice-writes.ts
 import neo4j4 from "neo4j-driver";
@@ -17987,8 +18097,8 @@ var TAG29 = "[public-session-context]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app39 = new Hono();
-app39.get("/", async (c) => {
+var app40 = new Hono();
+app40.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18028,7 +18138,7 @@ app39.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app39;
+var public_session_context_default = app40;
 
 // app/lib/webchat/gateway/instance.ts
 var instance2 = null;
@@ -18044,8 +18154,8 @@ var TAG30 = "[public-session-exit-route]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app40 = new Hono();
-app40.post("/", async (c) => {
+var app41 = new Hono();
+app41.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18077,15 +18187,15 @@ app40.post("/", async (c) => {
   gateway.handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app40;
+var public_session_exit_default = app41;
 
 // server/routes/admin/access-session-evict.ts
 var TAG31 = "[access-session-evict]";
 function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app41 = new Hono();
-app41.post("/", async (c) => {
+var app42 = new Hono();
+app42.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr6(remoteAddr)) {
     console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18113,7 +18223,7 @@ app41.post("/", async (c) => {
   console.log(`${TAG31} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app41;
+var access_session_evict_default = app42;
 
 // server/routes/admin/enrol-person.ts
 var TAG32 = "[enrol]";
@@ -18121,8 +18231,8 @@ function isLoopbackAddr7(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var app42 = new Hono();
-app42.post("/", async (c) => {
+var app43 = new Hono();
+app43.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr7(remoteAddr)) {
     console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18185,11 +18295,11 @@ app42.post("/", async (c) => {
   );
   return c.json({ personId, grant }, 200);
 });
-var enrol_person_default = app42;
+var enrol_person_default = app43;
 
 // server/routes/admin/browser.ts
-var app43 = new Hono();
-app43.post("/launch", requireAdminSession, async (c) => {
+var app44 = new Hono();
+app44.post("/launch", requireAdminSession, async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     console.error(`[admin/browser/launch] op=request transport=${transport}`);
@@ -18217,7 +18327,7 @@ app43.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app43;
+var browser_default = app44;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync27 } from "fs";
@@ -18363,7 +18473,7 @@ function readAvailabilityConfig(accountDir) {
 }
 
 // server/routes/admin/calendar.ts
-var app44 = new Hono();
+var app45 = new Hono();
 function normalizeAttendees(raw) {
   if (!Array.isArray(raw)) return [];
   return raw.map((a) => {
@@ -18394,7 +18504,7 @@ function mapMeeting(r) {
     privateNote: r.get("privateNote")
   };
 }
-app44.get("/meetings", requireAdminSession, async (c) => {
+app45.get("/meetings", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18457,7 +18567,7 @@ function icsFilename(title) {
   const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
   return `${slug || "meeting"}.ics`;
 }
-app44.get("/meetings/:id/ics", requireAdminSession, async (c) => {
+app45.get("/meetings/:id/ics", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18515,7 +18625,7 @@ app44.get("/meetings/:id/ics", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.patch("/meetings/:id", requireAdminSession, async (c) => {
+app45.patch("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18559,7 +18669,7 @@ app44.patch("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
+app45.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18609,7 +18719,7 @@ app44.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
+app45.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18655,7 +18765,7 @@ app44.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.delete("/meetings/:id", requireAdminSession, async (c) => {
+app45.delete("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18685,7 +18795,7 @@ app44.delete("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.get("/booking-link", requireAdminSession, (c) => {
+app45.get("/booking-link", requireAdminSession, (c) => {
   try {
     const account = resolveAccount();
     if (!account) {
@@ -18708,53 +18818,54 @@ app44.get("/booking-link", requireAdminSession, (c) => {
     return c.json({ bookingDomain: null });
   }
 });
-var calendar_default = app44;
+var calendar_default = app45;
 
 // server/routes/admin/index.ts
-var app45 = new Hono();
-app45.route("/session", session_default);
-app45.route("/accounts", accounts_default);
-app45.route("/logs", logs_default);
-app45.route("/claude-info", claude_info_default);
-app45.route("/attachment", attachment_default);
-app45.route("/agents", agents_default);
-app45.route("/sessions", sessions_default);
-app45.route("/claude-sessions", claude_sessions_default);
-app45.route("/log-ingest", log_ingest_default);
-app45.route("/events", events_default);
-app45.route("/files", files_default);
-app45.route("/graph-search", graph_search_default);
-app45.route("/graph-subgraph", graph_subgraph_default);
-app45.route("/graph-delete", graph_delete_default);
-app45.route("/graph-restore", graph_restore_default);
-app45.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app45.route("/graph-default-view", graph_default_view_default);
-app45.route("/sidebar-artefacts", sidebar_artefacts_default);
-app45.route("/sidebar-sessions", sidebar_sessions_default);
-app45.route("/session-delete", session_delete_default);
-app45.route("/session-stop", session_stop_default);
-app45.route("/session-archive", session_archive_default);
-app45.route("/session-rename", session_rename_default);
-app45.route("/browser", browser_default);
-app45.route("/session-rc-spawn", session_rc_spawn_default);
-app45.route("/session-reseat", session_reseat_default);
-app45.route("/system-stats", system_stats_default);
-app45.route("/health-brand", health_default2);
-app45.route("/linkedin-ingest", linkedin_ingest_default);
-app45.route("/post-turn-context", post_turn_context_default);
-app45.route("/public-session-context", public_session_context_default);
-app45.route("/public-session-exit", public_session_exit_default);
-app45.route("/access-session-evict", access_session_evict_default);
-app45.route("/enrol-person", enrol_person_default);
-app45.route("/calendar", calendar_default);
-var admin_default = app45;
+var app46 = new Hono();
+app46.route("/session", session_default);
+app46.route("/accounts", accounts_default);
+app46.route("/logs", logs_default);
+app46.route("/claude-info", claude_info_default);
+app46.route("/attachment", attachment_default);
+app46.route("/agents", agents_default);
+app46.route("/sessions", sessions_default);
+app46.route("/claude-sessions", claude_sessions_default);
+app46.route("/log-ingest", log_ingest_default);
+app46.route("/events", events_default);
+app46.route("/files", files_default);
+app46.route("/graph-search", graph_search_default);
+app46.route("/graph-subgraph", graph_subgraph_default);
+app46.route("/graph-delete", graph_delete_default);
+app46.route("/graph-restore", graph_restore_default);
+app46.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app46.route("/graph-default-view", graph_default_view_default);
+app46.route("/sidebar-artefacts", sidebar_artefacts_default);
+app46.route("/sidebar-sessions", sidebar_sessions_default);
+app46.route("/session-delete", session_delete_default);
+app46.route("/session-stop", session_stop_default);
+app46.route("/session-archive", session_archive_default);
+app46.route("/session-rename", session_rename_default);
+app46.route("/session-usage", session_usage_default);
+app46.route("/browser", browser_default);
+app46.route("/session-rc-spawn", session_rc_spawn_default);
+app46.route("/session-reseat", session_reseat_default);
+app46.route("/system-stats", system_stats_default);
+app46.route("/health-brand", health_default2);
+app46.route("/linkedin-ingest", linkedin_ingest_default);
+app46.route("/post-turn-context", post_turn_context_default);
+app46.route("/public-session-context", public_session_context_default);
+app46.route("/public-session-exit", public_session_exit_default);
+app46.route("/access-session-evict", access_session_evict_default);
+app46.route("/enrol-person", enrol_person_default);
+app46.route("/calendar", calendar_default);
+var admin_default = app46;
 
 // server/routes/access/verify-token.ts
 var TAG33 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app46 = new Hono();
-app46.post("/", async (c) => {
+var app47 = new Hono();
+app47.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -18836,7 +18947,7 @@ app46.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app46;
+var verify_token_default = app47;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -18899,9 +19010,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG34 = "[access-request-link]";
-var app47 = new Hono();
+var app48 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app47.post("/", async (c) => {
+app48.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -18975,13 +19086,13 @@ app47.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app47;
+var request_magic_link_default = app48;
 
 // server/routes/access/index.ts
-var app48 = new Hono();
-app48.route("/verify-token", verify_token_default);
-app48.route("/request-magic-link", request_magic_link_default);
-var access_default = app48;
+var app49 = new Hono();
+app49.route("/verify-token", verify_token_default);
+app49.route("/request-magic-link", request_magic_link_default);
+var access_default = app49;
 
 // server/routes/sites.ts
 import { existsSync as existsSync28, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
@@ -19016,8 +19127,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app49 = new Hono();
-app49.get("/:rel{.*}", (c) => {
+var app50 = new Hono();
+app50.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -19120,12 +19231,12 @@ app49.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app49;
+var sites_default = app50;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync32, writeFileSync as writeFileSync11 } from "fs";
-import { dirname as dirname9 } from "path";
+import { dirname as dirname10 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
 var DEFAULT_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
@@ -19142,7 +19253,7 @@ function getSecret() {
   }
   const fresh = randomBytes(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync7(dirname9(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    mkdirSync7(dirname10(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
     writeFileSync11(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
@@ -19220,7 +19331,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app50 = new Hono();
+var app51 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -19265,17 +19376,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app50.options("/consent", (c) => {
+app51.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app50.options("/brand-config", (c) => {
+app51.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app50.post("/consent", async (c) => {
+app51.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -19315,7 +19426,7 @@ app50.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app50.get("/brand-config", (c) => {
+app51.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -19325,7 +19436,7 @@ app50.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app50;
+var visitor_consent_default = app51;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -19352,8 +19463,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app51 = new Hono();
-app51.get("/:slug/click", async (c) => {
+var app52 = new Hono();
+app52.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -19417,10 +19528,10 @@ app51.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app51;
+var listings_default = app52;
 
 // server/routes/visitor-event.ts
-var app52 = new Hono();
+var app53 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -19487,12 +19598,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app52.options("/event", (c) => {
+app53.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app52.post("/event", async (c) => {
+app53.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -19697,7 +19808,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app52;
+var visitor_event_default = app53;
 
 // server/routes/session.ts
 import { resolve as resolve27 } from "path";
@@ -19743,8 +19854,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app53 = new Hono();
-app53.post("/", async (c) => {
+var app54 = new Hono();
+app54.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -19891,7 +20002,7 @@ app53.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app53;
+var session_default2 = app54;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -19974,17 +20085,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app54 = new Hono();
+var app55 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app54.options("/free-busy", (c) => {
+app55.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app54.get("/free-busy", async (c) => {
+app55.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -20026,7 +20137,7 @@ app54.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app54;
+var calendar_public_default = app55;
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist3(), 1);
@@ -20250,7 +20361,7 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname10, relative as relative6, resolve as resolve29 } from "path";
+import { dirname as dirname11, relative as relative6, resolve as resolve29 } from "path";
 var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
@@ -20282,7 +20393,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
     const newAbs = resolve29(destDir, suffix);
-    await mkdir5(dirname10(newAbs), { recursive: true });
+    await mkdir5(dirname11(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
     const oldRel = relative6(dataRoot, oldAbs);
@@ -20792,8 +20903,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app56 = new Hono();
-  app56.get("/wa-channel/inbound", (c) => {
+  const app57 = new Hono();
+  app57.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -20811,7 +20922,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app56.post("/wa-channel/reply", async (c) => {
+  app57.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -20832,7 +20943,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app56.post("/wa-channel/reply-document", async (c) => {
+  app57.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -20871,7 +20982,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app56.post("/wa-channel/ready", async (c) => {
+  app57.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -20880,7 +20991,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app56.post("/wa-channel/received", async (c) => {
+  app57.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -20890,7 +21001,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app56.post("/wa-channel/turn-end", async (c) => {
+  app57.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -20921,7 +21032,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=fallback bytes=${bytes}`);
     return c.json({ ok: true, delivered: "fallback" });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -20934,9 +21045,11 @@ var WaGateway = class {
   }
   hub = new InboundHub();
   replies = /* @__PURE__ */ new Map();
-  // Per-sender document-delivery context (the Baileys accountId), set on every
-  // inbound. Its presence is the reply-only guard: a sender with no inbound has
-  // no context, so a file reply to a cold recipient is refused.
+  // Per-sender document-delivery context, set on every inbound. Its presence is
+  // the reply-only guard: a sender with no inbound has no context, so a file
+  // reply to a cold recipient is refused. `accountId` is the Baileys socket
+  // owner (reply transport); `maxyAccountId` (Task 1390) is the sender's
+  // effective session account — the file-path validation scope.
   docContexts = /* @__PURE__ */ new Map();
   spawning = /* @__PURE__ */ new Set();
   seq = 0;
@@ -20991,7 +21104,7 @@ var WaGateway = class {
     const mediaField = openable.length > 0 ? `media=${openable.map((m) => m.type).join(",")} mediaPaths=${openable.map((m) => m.path).join(",")}` : input.media.some((m) => m.type === "audio") ? "media=audio mediaPath=transcribed" : "media=none";
     const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
-    this.docContexts.set(input.senderId, { accountId: input.accountId });
+    this.docContexts.set(input.senderId, { accountId: input.accountId, maxyAccountId: input.effectiveAccountId });
     this.hub.deliver(
       {
         senderId: input.senderId,
@@ -21011,6 +21124,7 @@ var WaGateway = class {
       try {
         await this.deps.ensureChannelSession({
           accountId: input.accountId,
+          effectiveAccountId: input.effectiveAccountId,
           senderId: input.senderId,
           role: input.role ?? "admin",
           personId: input.personId ?? null,
@@ -21033,7 +21147,7 @@ var WaGateway = class {
   async sendDocument(senderId, filePath, caption) {
     const ctx = this.docContexts.get(senderId);
     if (!ctx) throw new WaReplyError(`no conversation for sender ${senderId}`, false);
-    return this.deps.sendDocument({ senderId, accountId: ctx.accountId, filePath, caption });
+    return this.deps.sendDocument({ senderId, accountId: ctx.accountId, maxyAccountId: ctx.maxyAccountId, filePath, caption });
   }
 };
 
@@ -21222,8 +21336,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app56 = new Hono();
-  app56.get("/webchat-channel/inbound", (c) => {
+  const app57 = new Hono();
+  app57.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -21241,7 +21355,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app56.post("/webchat-channel/reply", async (c) => {
+  app57.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -21251,7 +21365,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app56.post("/webchat-channel/connector-auth", async (c) => {
+  app57.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -21264,7 +21378,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app56.post("/webchat-channel/ready", async (c) => {
+  app57.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -21273,7 +21387,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app56.post("/webchat-channel/permission-request", async (c) => {
+  app57.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -21287,7 +21401,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app56.post("/webchat-channel/received", async (c) => {
+  app57.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -21297,7 +21411,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app56.post("/webchat-channel/turn-end", async (c) => {
+  app57.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -21317,7 +21431,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-undelivered channel=webchat key=${k} sessionId=${sid} bytes=${finalBytes}`);
     return c.json({ ok: true, delivered: "undelivered" });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -21946,17 +22060,8 @@ var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
-function makeWhatsAppSendFile(entry) {
+function makeWhatsAppSendFile(entry, maxyAccountId) {
   return async (filePath, caption) => {
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      console.error(
-        `${TAG35} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
-      );
-      return { ok: false, error: "account-unresolved" };
-    }
     const result = await sendWhatsAppDocument({
       to: entry.senderId,
       filePath,
@@ -21972,12 +22077,12 @@ function makeWhatsAppSendFile(entry) {
     return { ok: false, error: result.error };
   };
 }
-function makeWhatsAppFileDelivery(entry) {
+function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
     tag: TAG35,
     channel: "whatsapp",
-    sendFile: makeWhatsAppSendFile(entry)
+    sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
   let turnStartedAt = null;
   let routeCalls = [];
@@ -22061,7 +22166,7 @@ function startNativeFileFollower(input) {
   return startFollower({
     entry,
     tag: "[whatsapp-adaptor]",
-    fileDelivery: makeWhatsAppFileDelivery(entry),
+    fileDelivery: makeWhatsAppFileDelivery(entry, input.maxyAccountId),
     // A resumed session's JSONL already holds prior SendUserFile tool_uses;
     // suppress replay so historical files are not re-sent on attach.
     suppressResumeReplay: true,
@@ -22184,8 +22289,8 @@ var InboundHub3 = class {
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app56 = new Hono();
-  app56.get("/tg-channel/inbound", (c) => {
+  const app57 = new Hono();
+  app57.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -22203,7 +22308,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app56.post("/tg-channel/reply", async (c) => {
+  app57.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -22219,7 +22324,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app56.post("/tg-channel/ready", async (c) => {
+  app57.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -22228,7 +22333,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app56.post("/tg-channel/received", async (c) => {
+  app57.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -22238,7 +22343,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app56.post("/tg-channel/turn-end", async (c) => {
+  app57.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -22263,7 +22368,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-fallback key=${key} sessionId=${sid} bytes=${Buffer.byteLength(finalText, "utf8")}`);
     return c.json({ ok: true, delivered: "fallback" });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -22375,7 +22480,7 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync7 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve30, basename as basename11 } from "path";
+import { resolve as resolve30, basename as basename12 } from "path";
 var TAG36 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -22392,7 +22497,7 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync7(filePath);
     const accountResolved = realpathSync7(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG36} document REJECTED reason=outside_account_directory`);
+      console.error(`${TAG36} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
@@ -22412,7 +22517,7 @@ async function sendTelegramDocument(input) {
       error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename11(resolvedPath);
+  const filename = basename12(resolvedPath);
   const buffer = Buffer.from(await readFile7(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
@@ -22459,21 +22564,12 @@ function makeTelegramSendFile(entry) {
       console.error(`${TAG37} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      console.error(
-        `${TAG37} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
-      );
-      return { ok: false, error: "account-unresolved" };
-    }
     const result = await sendTelegramDocument({
       botToken,
       chatId: Number(entry.replyTarget),
       filePath,
       caption,
-      maxyAccountId,
+      maxyAccountId: entry.accountId,
       platformRoot: platformRoot2()
     });
     return result.ok ? { ok: true } : { ok: false, error: result.error };
@@ -22705,6 +22801,10 @@ function findChannelAdminBindingDrift(adminPhones, admins, users) {
   }
   return drift;
 }
+function classifyAdminPhonesForAccount(isSocketOwner, adminPhones, admins, users) {
+  if (!isSocketOwner) return { nonSocketPhones: [...adminPhones], drift: [] };
+  return { nonSocketPhones: [], drift: findChannelAdminBindingDrift(adminPhones, admins, users) };
+}
 function warnOnChannelAdminBindingDrift() {
   let users;
   try {
@@ -22718,10 +22818,27 @@ function warnOnChannelAdminBindingDrift() {
   } catch {
     return;
   }
+  let socketOwner;
+  try {
+    socketOwner = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch {
+    socketOwner = null;
+  }
   const validAccountIds = accounts.map((a) => a.accountId);
   for (const acct of accounts) {
     const adminPhones = readAdminPhones(acct.accountDir);
-    const drift = findChannelAdminBindingDrift(adminPhones, acct.config.admins ?? [], users);
+    const isSocketOwner = socketOwner === null || acct.accountId === socketOwner;
+    const { nonSocketPhones, drift } = classifyAdminPhonesForAccount(
+      isSocketOwner,
+      adminPhones,
+      acct.config.admins ?? [],
+      users
+    );
+    for (const phone of nonSocketPhones) {
+      console.error(
+        `[admin-identity] adminphones-on-non-socket-account accountId=${acct.accountId} phone=${phone} count=${nonSocketPhones.length}`
+      );
+    }
     for (const d of drift) {
       const tail = d.reason === "userid-not-admin" ? ` userId=${d.userId}` : "";
       console.error(
@@ -23073,20 +23190,19 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app55 = new Hono();
+var app56 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
   serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join34(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
-  // Task 751 — file delivery on the native channel: resolve the platform
-  // account + path validation here and funnel through the shared send core.
-  sendDocument: async ({ senderId, accountId, filePath, caption }) => {
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      return { ok: false, error: `account-unresolved: ${err instanceof Error ? err.message : String(err)}` };
-    }
+  // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
+  // path-validation scope) is the sender's effective SESSION account, resolved
+  // once at the inbound gate and threaded here via the gateway's per-sender doc
+  // context. For an account-manager that is the bound sub-account (where the
+  // session's files live); using the house account (resolvePlatformAccountId)
+  // rejected an in-account file as outside_account_directory. `accountId` stays
+  // the house Baileys socket (the reply transport, two-account invariant).
+  sendDocument: async ({ senderId, accountId, maxyAccountId, filePath, caption }) => {
     const result = await sendWhatsAppDocument({
       to: senderId,
       filePath,
@@ -23097,12 +23213,10 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, senderId, role, personId, gatewayUrl, serverPath }) => {
-    const houseDir = role === "admin" ? listValidAccounts().find((a) => a.accountId === accountId)?.accountDir ?? null : null;
-    const managed = houseDir ? managedAccountFor(readAccountManagers(houseDir), senderId) : null;
-    const effectiveAccountId = managed ?? accountId;
+  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath }) => {
     if (role === "admin") {
-      console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managed ?? "none"} effectiveAccount=${effectiveAccountId}`);
+      const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
+      console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
     const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
     const userId = role === "admin" ? resolveAdminUserId({ accountId: effectiveAccountId, senderPhone: senderId }) ?? void 0 : void 0;
@@ -23122,6 +23236,10 @@ var waGateway = new WaGateway({
       sessionId: req.sessionId,
       senderId,
       accountId,
+      // Task 1390 — the file-path validation scope is the sender's effective
+      // session account (the sub-account for an account-manager), not the house
+      // socket account. accountId stays the getSocket key.
+      maxyAccountId: effectiveAccountId,
       onClose: () => {
         if (nativeFileFollowers.get(senderId) === ac) nativeFileFollowers.delete(senderId);
       }
@@ -23129,7 +23247,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app55.route("/", waGateway.routes());
+app56.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
   gatewayUrl: webchatGatewayUrl(),
@@ -23212,7 +23330,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app55.route("/", webchatGateway.routes());
+app56.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -23245,7 +23363,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app55.route("/", telegramGateway.routes());
+app56.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -23264,21 +23382,26 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     const sent = await sendTelegramText(botToken, chatId, text);
     if (!sent.ok) throw new Error(sent.error ?? "telegram send failed");
   },
-  effectiveAccountFor: (accountId, accountDir, destination) => managedAccountFor(readAccountManagers(accountDir), destination) ?? accountId
+  effectiveAccountFor: (accountId, accountDir, destination) => {
+    const managedSub = managedAccountFor(readAccountManagers(accountDir), destination);
+    if (managedSub === null) return accountId;
+    if (!listValidAccounts().some((a) => a.accountId === managedSub)) return null;
+    return managedSub;
+  }
 });
-app55.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app55.use("*", clientIpMiddleware);
+app56.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app56.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path2) {
   return path2 === "/vnc-viewer.html" || path2.startsWith("/api/admin/attachment/") || path2.startsWith("/api/public-reader/attachment/") || path2 === "/api/admin/files/download";
 }
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -23296,7 +23419,7 @@ app55.use("*", async (c, next) => {
     });
   }
 });
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -23334,7 +23457,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app55.post("/__remote-auth/login", async (c) => {
+app56.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -23379,7 +23502,7 @@ app55.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app55.get("/__remote-auth/logout", (c) => {
+app56.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -23392,7 +23515,7 @@ app55.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app55.post("/__remote-auth/change-password", async (c) => {
+app56.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -23451,13 +23574,13 @@ app55.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app55.get("/__remote-auth/setup", (c) => {
+app56.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app55.post("/__remote-auth/set-initial-password", async (c) => {
+app56.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -23495,10 +23618,10 @@ app55.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app55.get("/api/remote-auth/status", (c) => {
+app56.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app55.post("/api/remote-auth/set-password", async (c) => {
+app56.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -23537,10 +23660,10 @@ app55.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app55.route("/api/_client-error", client_error_default);
+app56.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -23584,26 +23707,26 @@ app55.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path2 }), 200);
 });
-app55.route("/api/health", health_default);
-app55.route("/api/chat", chatRoutes);
-app55.route("/api/whatsapp", whatsapp_default);
-app55.route("/api/whatsapp-reader", whatsapp_reader_default);
-app55.route("/api/public-reader", public_reader_default);
-app55.route("/api/webchat", createWebchatRoutes({
+app56.route("/api/health", health_default);
+app56.route("/api/chat", chatRoutes);
+app56.route("/api/whatsapp", whatsapp_default);
+app56.route("/api/whatsapp-reader", whatsapp_reader_default);
+app56.route("/api/public-reader", public_reader_default);
+app56.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app55.route("/api/webchat/greeting", webchat_greeting_default);
-app55.route("/api/telegram", telegram_default);
-app55.route("/api/quickbooks", quickbooks_default);
-app55.route("/api/onboarding", onboarding_default);
-app55.route("/api/admin", admin_default);
-app55.route("/api/access", access_default);
-app55.route("/api/session", session_default2);
-app55.route("/api/calendar", calendar_public_default);
+app56.route("/api/webchat/greeting", webchat_greeting_default);
+app56.route("/api/telegram", telegram_default);
+app56.route("/api/quickbooks", quickbooks_default);
+app56.route("/api/onboarding", onboarding_default);
+app56.route("/api/admin", admin_default);
+app56.route("/api/access", access_default);
+app56.route("/api/session", session_default2);
+app56.route("/api/calendar", calendar_public_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -23615,7 +23738,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app55.get("/agent-assets/:slug/:filename", (c) => {
+app56.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -23650,7 +23773,7 @@ app55.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app55.get("/generated/:filename", (c) => {
+app56.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -23680,10 +23803,10 @@ app55.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app55.route("/sites", sites_default);
-app55.route("/listings", listings_default);
-app55.route("/v", visitor_event_default);
-app55.route("/v", visitor_consent_default);
+app56.route("/sites", sites_default);
+app56.route("/listings", listings_default);
+app56.route("/v", visitor_event_default);
+app56.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -23838,7 +23961,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app55.get("/", (c) => {
+app56.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -23860,12 +23983,12 @@ app55.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app55.get("/public", (c) => {
+app56.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app55.get("/public-chat", (c) => {
+app56.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -23884,9 +24007,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app55.use("/vnc-viewer.html", logViewerFetch);
-app55.use("/vnc-popout.html", logViewerFetch);
-app55.get("/vnc-popout.html", (c) => {
+app56.use("/vnc-viewer.html", logViewerFetch);
+app56.use("/vnc-popout.html", logViewerFetch);
+app56.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync35(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -23899,7 +24022,7 @@ app55.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app55.post("/api/vnc/client-event", async (c) => {
+app56.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -23920,11 +24043,11 @@ app55.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app55.get("/g/:slug", (c) => {
+app56.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app55.get(pwa.manifestPath, (c) => {
+  app56.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -23940,7 +24063,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app55.get("/sw.js", (c) => {
+app56.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -23949,12 +24072,12 @@ app55.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app55.get("/graph", (c) => {
+app56.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app55.get("/chat", (c) => {
+app56.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -23963,22 +24086,22 @@ app55.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app55.get("/data", (c) => {
+app56.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app55.get("/calendar", (c) => {
+app56.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app55.get("/browser", (c) => {
+app56.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app55.get("/:slug", async (c, next) => {
+app56.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -23993,13 +24116,13 @@ app55.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app55.get("/favicon.ico", (c) => {
+  app56.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app55.use("/*", serveStatic({ root: "./public" }));
-app55.all("*", (c) => {
+app56.use("/*", serveStatic({ root: "./public" }));
+app56.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -24013,7 +24136,7 @@ app55.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app55.fetch, port, hostname });
+var httpServer = serve({ fetch: app56.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join34(__dirname, "..");
@@ -24113,7 +24236,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app55.routes ?? []) {
+  for (const r of app56.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -24243,7 +24366,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename12(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename13(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -24263,6 +24386,7 @@ reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config, bootAccoun
 for (const acct of listValidAccounts()) {
   cleanupLeakedPremiumSubs(acct.accountDir, acct.config, acct.accountId);
 }
+purgeNonSocketAdminPhonesAtBoot();
 warnOnChannelAdminBindingDrift();
 var bootEnabled = Array.isArray(bootAccountConfig?.enabledPlugins) ? bootAccountConfig.enabledPlugins : [];
 var bootDelivered = [];
@@ -24322,6 +24446,10 @@ init({
       console.error(`[whatsapp:route] dropped reason=no-text-no-media senderId=${msg.senderPhone} mediaCount=${msg.media.length}`);
       return;
     }
+    if (!msg.effectiveAccountId) {
+      console.error(`[whatsapp:route] op=dropped reason=no-effective-account senderId=${msg.senderPhone}`);
+      return;
+    }
     if (decision.role === "public") {
       console.error(`[whatsapp:route] op=routed agentType=public personId=${decision.personId} senderId=${msg.senderPhone}`);
     }
@@ -24330,6 +24458,7 @@ init({
       });
       await waGateway.handleInbound({
         accountId: msg.accountId,
+        effectiveAccountId: msg.effectiveAccountId,
         senderId: msg.senderPhone,
         role: decision.role,
         personId: decision.personId,