@rubytech/create-maxy-code 0.1.388 → 0.1.391

package/payload/server/server.js

@@ -1623,8 +1623,9 @@ function startAuthHealthHeartbeat(intervalMs = 5 * 60 * 1e3) {
     try {
       const h = computeAuthHealth();
       const expiresIn = h.expiresAt != null ? Math.round((h.expiresAt - Date.now()) / 1e3) : null;
+      const store2 = process.platform === "darwin" ? "host-creds-file" : "file";
       console.log(
-        `[auth-health] brand=${BRAND_NAME} status=${h.status} expiresIn=${expiresIn != null ? expiresIn + "s" : "n/a"}`
+        `[auth-health] brand=${BRAND_NAME} store=${store2} status=${h.status} expiresIn=${expiresIn != null ? expiresIn + "s" : "n/a"}`
       );
       if (h.status === "dead") {
         console.log(`[auth-health] op=reauth-required status=dead`);
@@ -5740,8 +5741,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app56 = new Hono();
-  app56.post("/", async (c) => {
+  const app57 = new Hono();
+  app57.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -6004,7 +6005,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -6025,8 +6026,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app56 = new Hono();
-  app56.post("/", async (c) => {
+  const app57 = new Hono();
+  app57.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -6065,6 +6066,10 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG16} op=received eventId=${eventId} channel=${channel} destination=${destination} account=${houseAccountId}`);
     if (channel === "whatsapp") {
       const effectiveAccount2 = deps.effectiveAccountFor(houseAccountId, account.accountDir, destination);
+      if (effectiveAccount2 === null) {
+        console.error(`${TAG16} op=schedule-account-manager-reject eventId=${eventId} destination=${destination} reason=unresolved-effective-account`);
+        return c.json({ ok: false, error: "account-manager-unresolved" }, 403);
+      }
       console.error(`${TAG16} op=effective-account eventId=${eventId} effectiveAccount=${effectiveAccount2}`);
       const sessionId2 = adminSessionIdFor(effectiveAccount2, destination);
       const reply2 = (text) => deps.sendWhatsAppText(houseAccountId, destination, text);
@@ -6120,7 +6125,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/telegram/outbound/send-text.ts
@@ -6908,7 +6913,7 @@ async function sendWhatsAppDocument(input) {
     const accountResolved = realpathSync3(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
       const sanitised = filePath.replace(accountDir, "<account>/");
-      console.error(`${TAG19} document REJECTED path=${sanitised} reason=outside_account_directory`);
+      console.error(`${TAG19} document REJECTED path=${sanitised} reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
@@ -9674,8 +9679,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app56 = new Hono();
-  app56.post("/send", requireAdminSession, async (c) => {
+  const app57 = new Hono();
+  app57.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -9875,7 +9880,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app56.post("/interrupt", requireAdminSession, async (c) => {
+  app57.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -9903,7 +9908,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app56.post("/settings", requireAdminSession, async (c) => {
+  app57.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -9943,7 +9948,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app56.get("/session", requireAdminSession, async (c) => {
+  app57.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -10021,7 +10026,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app56.post("/permission-verdict", requireAdminSession, async (c) => {
+  app57.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -10038,7 +10043,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app56;
+  return app57;
 }
 
 // server/routes/webchat-greeting.ts
@@ -10443,6 +10448,21 @@ import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync2 } from "c
 import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync15, readFileSync as readFileSync24, unlinkSync as unlinkSync2 } from "fs";
 import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
 
+// app/lib/claude-spawn-env.ts
+var HOST_AUTH_REFRESH_TIMEOUT_MS = "30000";
+function hostCredsEnv(platform, credsFile) {
+  if (platform === "darwin" && credsFile) {
+    return {
+      CLAUDE_CODE_HOST_CREDS_FILE: credsFile,
+      CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS: HOST_AUTH_REFRESH_TIMEOUT_MS
+    };
+  }
+  return {};
+}
+function claudeBin() {
+  return process.env.CLAUDE_BIN ?? "claude";
+}
+
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync5, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
 import { dirname as dirname7, join as join22 } from "path";
@@ -10628,6 +10648,7 @@ function readUsersFile2() {
   if (!raw) return [];
   return JSON.parse(raw);
 }
+var darwinAuthChild = null;
 async function checkAuthStatus() {
   let status;
   try {
@@ -10673,7 +10694,11 @@ app9.post("/claude-auth", async (c) => {
     const start = Date.now();
     let logoutError = null;
     try {
-      execFileSync2("claude", ["auth", "logout"], { encoding: "utf-8", timeout: 8e3 });
+      execFileSync2(claudeBin(), ["auth", "logout"], {
+        env: { ...process.env, ...hostCredsEnv(process.platform, CLAUDE_CREDENTIALS_FILE) },
+        encoding: "utf-8",
+        timeout: 8e3
+      });
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
@@ -10686,6 +10711,22 @@ app9.post("/claude-auth", async (c) => {
     const authenticated = await checkAuthStatus();
     return c.json({ completed: authenticated, authenticated });
   }
+  if (body.action === "paste-code") {
+    const code = typeof body.code === "string" ? body.code : "";
+    const child = darwinAuthChild;
+    if (!child || !child.stdin || child.stdin.destroyed) {
+      console.log("[onboarding] op=claude-paste-code accepted=false reason=no-active-login");
+      return c.json({ accepted: false, error: "No active login to paste into. Start sign-in first." }, 400);
+    }
+    try {
+      child.stdin.write(code.trim() + "\n");
+    } catch (err) {
+      console.log(`[onboarding] op=claude-paste-code accepted=false reason=write-failed err=${err instanceof Error ? err.message : String(err)}`);
+      return c.json({ accepted: false, error: "Sign-in already finished or closed. Try again." }, 409);
+    }
+    console.log(`[onboarding] op=claude-paste-code accepted=true bytes=${code.trim().length}`);
+    return c.json({ accepted: true });
+  }
   if (body.action === "launch-browser") {
     if (transport === "vnc") {
       const vncReady = await ensureVnc();
@@ -10700,13 +10741,20 @@ app9.post("/claude-auth", async (c) => {
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   if (process.platform === "darwin") {
     vncLog("claude-auth", { action: "start", transport: "native", platform: "darwin" });
-    const claudeProc2 = spawn("claude", ["auth", "login"], {
-      stdio: ["ignore", "pipe", "pipe"]
+    const claudeProc2 = spawn(claudeBin(), ["auth", "login"], {
+      env: { ...process.env, ...hostCredsEnv(process.platform, CLAUDE_CREDENTIALS_FILE) },
+      stdio: ["pipe", "pipe", "pipe"]
     });
     claudeProc2.unref();
+    darwinAuthChild = claudeProc2;
+    claudeProc2.stdin?.on("error", () => {
+    });
     claudeProc2.stdout?.on("data", onClaudeOutput);
     claudeProc2.stderr?.on("data", onClaudeOutput);
-    claudeProc2.once("close", () => closeSync3(claudeAuthLogFd));
+    claudeProc2.once("close", () => {
+      closeSync3(claudeAuthLogFd);
+      if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
+    });
     return c.json({ started: true, transport: "native" });
   }
   if (transport === "vnc") {
@@ -11493,15 +11541,16 @@ var logs_default = app13;
 import { execFileSync as execFileSync3 } from "child_process";
 var app14 = new Hono();
 app14.get("/", (c) => {
+  const claudeEnv = { ...process.env, ...hostCredsEnv(process.platform, CLAUDE_CREDENTIALS_FILE) };
   let version = "unknown";
   try {
-    const raw = execFileSync3("claude", ["--version"], { encoding: "utf-8", timeout: 5e3 });
+    const raw = execFileSync3(claudeBin(), ["--version"], { env: claudeEnv, encoding: "utf-8", timeout: 5e3 });
     version = raw.trim().replace(" (Claude Code)", "");
   } catch {
   }
   let account = {};
   try {
-    const raw = execFileSync3("claude", ["auth", "status"], { encoding: "utf-8", timeout: 5e3 });
+    const raw = execFileSync3(claudeBin(), ["auth", "status"], { env: claudeEnv, encoding: "utf-8", timeout: 5e3 });
     account = JSON.parse(raw);
   } catch {
   }
@@ -17147,6 +17196,36 @@ app32.post("/", requireAdminSession, async (c) => {
 });
 var session_rename_default = app32;
 
+// server/routes/admin/session-usage.ts
+var app33 = new Hono();
+app33.get("/", requireAdminSession, async (c) => {
+  const sessionId = c.req.query("sessionId") ?? "";
+  if (!SESSION_ID_RE2.test(sessionId)) {
+    return c.json({ error: "sessionId must be a v4 UUID" }, 400);
+  }
+  let res;
+  try {
+    res = await fetch(`${managerBase("session-usage:wrapper")}/${sessionId}/metering`);
+  } catch (err) {
+    console.error(`[session-usage] sessionId=${sessionId.slice(0, 8)} manager-unreachable err=${err instanceof Error ? err.message : String(err)}`);
+    return c.json({ error: "manager-unreachable" }, 502);
+  }
+  if (res.status === 200) {
+    const summary = await res.json().catch(() => null);
+    if (!summary) {
+      console.error(`[session-usage] sessionId=${sessionId.slice(0, 8)} manager-bad-json`);
+      return c.json({ error: "manager-bad-json" }, 502);
+    }
+    return c.json(summary);
+  }
+  if (res.status === 404) {
+    return c.json({ error: "session-not-found" }, 404);
+  }
+  console.error(`[session-usage] sessionId=${sessionId.slice(0, 8)} manager-status=${res.status}`);
+  return c.json({ error: `manager-status-${res.status}` }, 502);
+});
+var session_usage_default = app33;
+
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID10 } from "crypto";
 var ACCOUNT_UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -17192,8 +17271,8 @@ function shapeWebchatResponse(sessionId, manager) {
   const landed = redirected ? manager.sessionId : sessionId;
   return { sessionId: landed, outcome, target: `/chat?session=${landed}` };
 }
-var app33 = new Hono();
-app33.post("/", requireAdminSession, async (c) => {
+var app34 = new Hono();
+app34.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17276,7 +17355,7 @@ app33.post("/", requireAdminSession, async (c) => {
   }
   return c.json(parsed ?? {});
 });
-var session_rc_spawn_default = app33;
+var session_rc_spawn_default = app34;
 
 // server/routes/admin/session-reseat.ts
 import { randomUUID as randomUUID11 } from "crypto";
@@ -17299,9 +17378,9 @@ function resolveReseatPlan(body, mintId = randomUUID11, adminUserId, authenticat
   if (authenticatedName) payload.authenticatedName = authenticatedName;
   return { sessionId, payload };
 }
-var app34 = new Hono();
+var app35 = new Hono();
 var reseatsInFlight = /* @__PURE__ */ new Set();
-app34.post("/", requireAdminSession, async (c) => {
+app35.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17389,7 +17468,7 @@ app34.post("/", requireAdminSession, async (c) => {
     reseatsInFlight.delete(fromSessionId);
   }
 });
-var session_reseat_default = app34;
+var session_reseat_default = app35;
 
 // server/routes/admin/system-stats.ts
 import { readFile as readFile5 } from "fs/promises";
@@ -17486,8 +17565,8 @@ async function sample() {
   if (process.platform === "linux") return sampleLinux();
   return sampleOsFallback();
 }
-var app35 = new Hono();
-app35.get("/", async (c) => {
+var app36 = new Hono();
+app36.get("/", async (c) => {
   const started = Date.now();
   if (!inflight) {
     inflight = sample().finally(() => {
@@ -17510,7 +17589,7 @@ app35.get("/", async (c) => {
     return c.json({ degraded: true, reason, sampledAtMs: Date.now() });
   }
 });
-var system_stats_default = app35;
+var system_stats_default = app36;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync26, readFileSync as readFileSync29 } from "fs";
@@ -17555,8 +17634,8 @@ async function probeConversationDb() {
     });
   }
 }
-var app36 = new Hono();
-app36.get("/", async (c) => {
+var app37 = new Hono();
+app37.get("/", async (c) => {
   const version = readVersion();
   const probe = await probeConversationDb();
   const uptimeMs = Date.now() - new Date(PROCESS_STARTED_AT).getTime();
@@ -17578,7 +17657,7 @@ app36.get("/", async (c) => {
     uptimeMs
   });
 });
-var health_default2 = app36;
+var health_default2 = app37;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID12 } from "crypto";
@@ -17804,8 +17883,8 @@ function buildInitialMessage(env) {
   }
   return header;
 }
-var app37 = new Hono();
-app37.post("/", requireAdminSession, async (c) => {
+var app38 = new Hono();
+app38.post("/", requireAdminSession, async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -17850,7 +17929,7 @@ app37.post("/", requireAdminSession, async (c) => {
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
-var linkedin_ingest_default = app37;
+var linkedin_ingest_default = app38;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
@@ -17892,8 +17971,8 @@ function pruneProperties(raw) {
   }
   return out;
 }
-var app38 = new Hono();
-app38.get("/", async (c) => {
+var app39 = new Hono();
+app39.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
     console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -17953,7 +18032,7 @@ app38.get("/", async (c) => {
     await session.close();
   }
 });
-var post_turn_context_default = app38;
+var post_turn_context_default = app39;
 
 // app/lib/slice-writes.ts
 import neo4j4 from "neo4j-driver";
@@ -18063,8 +18142,8 @@ var TAG29 = "[public-session-context]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app39 = new Hono();
-app39.get("/", async (c) => {
+var app40 = new Hono();
+app40.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
     console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18104,7 +18183,7 @@ app39.get("/", async (c) => {
     await session.close();
   }
 });
-var public_session_context_default = app39;
+var public_session_context_default = app40;
 
 // app/lib/webchat/gateway/instance.ts
 var instance2 = null;
@@ -18120,8 +18199,8 @@ var TAG30 = "[public-session-exit-route]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app40 = new Hono();
-app40.post("/", async (c) => {
+var app41 = new Hono();
+app41.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
     console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18153,15 +18232,15 @@ app40.post("/", async (c) => {
   gateway.handlePublicSessionExit(sessionId);
   return c.json({ ok: true });
 });
-var public_session_exit_default = app40;
+var public_session_exit_default = app41;
 
 // server/routes/admin/access-session-evict.ts
 var TAG31 = "[access-session-evict]";
 function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
-var app41 = new Hono();
-app41.post("/", async (c) => {
+var app42 = new Hono();
+app42.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr6(remoteAddr)) {
     console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18189,7 +18268,7 @@ app41.post("/", async (c) => {
   console.log(`${TAG31} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
-var access_session_evict_default = app41;
+var access_session_evict_default = app42;
 
 // server/routes/admin/enrol-person.ts
 var TAG32 = "[enrol]";
@@ -18197,8 +18276,8 @@ function isLoopbackAddr7(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var app42 = new Hono();
-app42.post("/", async (c) => {
+var app43 = new Hono();
+app43.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr7(remoteAddr)) {
     console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
@@ -18261,11 +18340,11 @@ app42.post("/", async (c) => {
   );
   return c.json({ personId, grant }, 200);
 });
-var enrol_person_default = app42;
+var enrol_person_default = app43;
 
 // server/routes/admin/browser.ts
-var app43 = new Hono();
-app43.post("/launch", requireAdminSession, async (c) => {
+var app44 = new Hono();
+app44.post("/launch", requireAdminSession, async (c) => {
   try {
     const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
     console.error(`[admin/browser/launch] op=request transport=${transport}`);
@@ -18293,7 +18372,7 @@ app43.post("/launch", requireAdminSession, async (c) => {
     );
   }
 });
-var browser_default = app43;
+var browser_default = app44;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync27 } from "fs";
@@ -18439,7 +18518,7 @@ function readAvailabilityConfig(accountDir) {
 }
 
 // server/routes/admin/calendar.ts
-var app44 = new Hono();
+var app45 = new Hono();
 function normalizeAttendees(raw) {
   if (!Array.isArray(raw)) return [];
   return raw.map((a) => {
@@ -18470,7 +18549,7 @@ function mapMeeting(r) {
     privateNote: r.get("privateNote")
   };
 }
-app44.get("/meetings", requireAdminSession, async (c) => {
+app45.get("/meetings", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18533,7 +18612,7 @@ function icsFilename(title) {
   const slug = (title ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
   return `${slug || "meeting"}.ics`;
 }
-app44.get("/meetings/:id/ics", requireAdminSession, async (c) => {
+app45.get("/meetings/:id/ics", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18591,7 +18670,7 @@ app44.get("/meetings/:id/ics", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.patch("/meetings/:id", requireAdminSession, async (c) => {
+app45.patch("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18635,7 +18714,7 @@ app44.patch("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
+app45.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18685,7 +18764,7 @@ app44.post("/meetings/:id/attendees", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
+app45.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18731,7 +18810,7 @@ app44.delete("/meetings/:id/attendees", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.delete("/meetings/:id", requireAdminSession, async (c) => {
+app45.delete("/meetings/:id", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
@@ -18761,7 +18840,7 @@ app44.delete("/meetings/:id", requireAdminSession, async (c) => {
     await session.close();
   }
 });
-app44.get("/booking-link", requireAdminSession, (c) => {
+app45.get("/booking-link", requireAdminSession, (c) => {
   try {
     const account = resolveAccount();
     if (!account) {
@@ -18784,53 +18863,54 @@ app44.get("/booking-link", requireAdminSession, (c) => {
     return c.json({ bookingDomain: null });
   }
 });
-var calendar_default = app44;
+var calendar_default = app45;
 
 // server/routes/admin/index.ts
-var app45 = new Hono();
-app45.route("/session", session_default);
-app45.route("/accounts", accounts_default);
-app45.route("/logs", logs_default);
-app45.route("/claude-info", claude_info_default);
-app45.route("/attachment", attachment_default);
-app45.route("/agents", agents_default);
-app45.route("/sessions", sessions_default);
-app45.route("/claude-sessions", claude_sessions_default);
-app45.route("/log-ingest", log_ingest_default);
-app45.route("/events", events_default);
-app45.route("/files", files_default);
-app45.route("/graph-search", graph_search_default);
-app45.route("/graph-subgraph", graph_subgraph_default);
-app45.route("/graph-delete", graph_delete_default);
-app45.route("/graph-restore", graph_restore_default);
-app45.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app45.route("/graph-default-view", graph_default_view_default);
-app45.route("/sidebar-artefacts", sidebar_artefacts_default);
-app45.route("/sidebar-sessions", sidebar_sessions_default);
-app45.route("/session-delete", session_delete_default);
-app45.route("/session-stop", session_stop_default);
-app45.route("/session-archive", session_archive_default);
-app45.route("/session-rename", session_rename_default);
-app45.route("/browser", browser_default);
-app45.route("/session-rc-spawn", session_rc_spawn_default);
-app45.route("/session-reseat", session_reseat_default);
-app45.route("/system-stats", system_stats_default);
-app45.route("/health-brand", health_default2);
-app45.route("/linkedin-ingest", linkedin_ingest_default);
-app45.route("/post-turn-context", post_turn_context_default);
-app45.route("/public-session-context", public_session_context_default);
-app45.route("/public-session-exit", public_session_exit_default);
-app45.route("/access-session-evict", access_session_evict_default);
-app45.route("/enrol-person", enrol_person_default);
-app45.route("/calendar", calendar_default);
-var admin_default = app45;
+var app46 = new Hono();
+app46.route("/session", session_default);
+app46.route("/accounts", accounts_default);
+app46.route("/logs", logs_default);
+app46.route("/claude-info", claude_info_default);
+app46.route("/attachment", attachment_default);
+app46.route("/agents", agents_default);
+app46.route("/sessions", sessions_default);
+app46.route("/claude-sessions", claude_sessions_default);
+app46.route("/log-ingest", log_ingest_default);
+app46.route("/events", events_default);
+app46.route("/files", files_default);
+app46.route("/graph-search", graph_search_default);
+app46.route("/graph-subgraph", graph_subgraph_default);
+app46.route("/graph-delete", graph_delete_default);
+app46.route("/graph-restore", graph_restore_default);
+app46.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app46.route("/graph-default-view", graph_default_view_default);
+app46.route("/sidebar-artefacts", sidebar_artefacts_default);
+app46.route("/sidebar-sessions", sidebar_sessions_default);
+app46.route("/session-delete", session_delete_default);
+app46.route("/session-stop", session_stop_default);
+app46.route("/session-archive", session_archive_default);
+app46.route("/session-rename", session_rename_default);
+app46.route("/session-usage", session_usage_default);
+app46.route("/browser", browser_default);
+app46.route("/session-rc-spawn", session_rc_spawn_default);
+app46.route("/session-reseat", session_reseat_default);
+app46.route("/system-stats", system_stats_default);
+app46.route("/health-brand", health_default2);
+app46.route("/linkedin-ingest", linkedin_ingest_default);
+app46.route("/post-turn-context", post_turn_context_default);
+app46.route("/public-session-context", public_session_context_default);
+app46.route("/public-session-exit", public_session_exit_default);
+app46.route("/access-session-evict", access_session_evict_default);
+app46.route("/enrol-person", enrol_person_default);
+app46.route("/calendar", calendar_default);
+var admin_default = app46;
 
 // server/routes/access/verify-token.ts
 var TAG33 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app46 = new Hono();
-app46.post("/", async (c) => {
+var app47 = new Hono();
+app47.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -18912,7 +18992,7 @@ app46.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app46;
+var verify_token_default = app47;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -18975,9 +19055,9 @@ async function sendMagicLinkEmail(payload) {
 
 // server/routes/access/request-magic-link.ts
 var TAG34 = "[access-request-link]";
-var app47 = new Hono();
+var app48 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app47.post("/", async (c) => {
+app48.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -19051,13 +19131,13 @@ app47.post("/", async (c) => {
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app47;
+var request_magic_link_default = app48;
 
 // server/routes/access/index.ts
-var app48 = new Hono();
-app48.route("/verify-token", verify_token_default);
-app48.route("/request-magic-link", request_magic_link_default);
-var access_default = app48;
+var app49 = new Hono();
+app49.route("/verify-token", verify_token_default);
+app49.route("/request-magic-link", request_magic_link_default);
+var access_default = app49;
 
 // server/routes/sites.ts
 import { existsSync as existsSync28, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
@@ -19092,8 +19172,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app49 = new Hono();
-app49.get("/:rel{.*}", (c) => {
+var app50 = new Hono();
+app50.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -19196,7 +19276,7 @@ app49.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app49;
+var sites_default = app50;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -19296,7 +19376,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app50 = new Hono();
+var app51 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -19341,17 +19421,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app50.options("/consent", (c) => {
+app51.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app50.options("/brand-config", (c) => {
+app51.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app50.post("/consent", async (c) => {
+app51.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -19391,7 +19471,7 @@ app50.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app50.get("/brand-config", (c) => {
+app51.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -19401,7 +19481,7 @@ app50.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app50;
+var visitor_consent_default = app51;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -19428,8 +19508,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app51 = new Hono();
-app51.get("/:slug/click", async (c) => {
+var app52 = new Hono();
+app52.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -19493,10 +19573,10 @@ app51.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app51;
+var listings_default = app52;
 
 // server/routes/visitor-event.ts
-var app52 = new Hono();
+var app53 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -19563,12 +19643,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app52.options("/event", (c) => {
+app53.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app52.post("/event", async (c) => {
+app53.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -19773,7 +19853,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app52;
+var visitor_event_default = app53;
 
 // server/routes/session.ts
 import { resolve as resolve27 } from "path";
@@ -19819,8 +19899,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app53 = new Hono();
-app53.post("/", async (c) => {
+var app54 = new Hono();
+app54.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -19967,7 +20047,7 @@ app53.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app53;
+var session_default2 = app54;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -20050,17 +20130,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app54 = new Hono();
+var app55 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app54.options("/free-busy", (c) => {
+app55.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app54.get("/free-busy", async (c) => {
+app55.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -20102,7 +20182,7 @@ app54.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app54;
+var calendar_public_default = app55;
 
 // app/lib/graph-health.ts
 var import_dist4 = __toESM(require_dist3(), 1);
@@ -20868,8 +20948,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app56 = new Hono();
-  app56.get("/wa-channel/inbound", (c) => {
+  const app57 = new Hono();
+  app57.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -20887,7 +20967,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app56.post("/wa-channel/reply", async (c) => {
+  app57.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -20908,7 +20988,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app56.post("/wa-channel/reply-document", async (c) => {
+  app57.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -20947,7 +21027,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app56.post("/wa-channel/ready", async (c) => {
+  app57.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -20956,7 +21036,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app56.post("/wa-channel/received", async (c) => {
+  app57.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -20966,7 +21046,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app56.post("/wa-channel/turn-end", async (c) => {
+  app57.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -20997,7 +21077,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=fallback bytes=${bytes}`);
     return c.json({ ok: true, delivered: "fallback" });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -21010,9 +21090,11 @@ var WaGateway = class {
   }
   hub = new InboundHub();
   replies = /* @__PURE__ */ new Map();
-  // Per-sender document-delivery context (the Baileys accountId), set on every
-  // inbound. Its presence is the reply-only guard: a sender with no inbound has
-  // no context, so a file reply to a cold recipient is refused.
+  // Per-sender document-delivery context, set on every inbound. Its presence is
+  // the reply-only guard: a sender with no inbound has no context, so a file
+  // reply to a cold recipient is refused. `accountId` is the Baileys socket
+  // owner (reply transport); `maxyAccountId` (Task 1390) is the sender's
+  // effective session account — the file-path validation scope.
   docContexts = /* @__PURE__ */ new Map();
   spawning = /* @__PURE__ */ new Set();
   seq = 0;
@@ -21067,7 +21149,7 @@ var WaGateway = class {
     const mediaField = openable.length > 0 ? `media=${openable.map((m) => m.type).join(",")} mediaPaths=${openable.map((m) => m.path).join(",")}` : input.media.some((m) => m.type === "audio") ? "media=audio mediaPath=transcribed" : "media=none";
     const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
-    this.docContexts.set(input.senderId, { accountId: input.accountId });
+    this.docContexts.set(input.senderId, { accountId: input.accountId, maxyAccountId: input.effectiveAccountId });
     this.hub.deliver(
       {
         senderId: input.senderId,
@@ -21110,7 +21192,7 @@ var WaGateway = class {
   async sendDocument(senderId, filePath, caption) {
     const ctx = this.docContexts.get(senderId);
     if (!ctx) throw new WaReplyError(`no conversation for sender ${senderId}`, false);
-    return this.deps.sendDocument({ senderId, accountId: ctx.accountId, filePath, caption });
+    return this.deps.sendDocument({ senderId, accountId: ctx.accountId, maxyAccountId: ctx.maxyAccountId, filePath, caption });
   }
 };
 
@@ -21299,8 +21381,8 @@ var InboundHub2 = class {
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app56 = new Hono();
-  app56.get("/webchat-channel/inbound", (c) => {
+  const app57 = new Hono();
+  app57.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -21318,7 +21400,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app56.post("/webchat-channel/reply", async (c) => {
+  app57.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -21328,7 +21410,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app56.post("/webchat-channel/connector-auth", async (c) => {
+  app57.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -21341,7 +21423,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app56.post("/webchat-channel/ready", async (c) => {
+  app57.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -21350,7 +21432,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app56.post("/webchat-channel/permission-request", async (c) => {
+  app57.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -21364,7 +21446,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app56.post("/webchat-channel/received", async (c) => {
+  app57.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -21374,7 +21456,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app56.post("/webchat-channel/turn-end", async (c) => {
+  app57.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -21394,7 +21476,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-undelivered channel=webchat key=${k} sessionId=${sid} bytes=${finalBytes}`);
     return c.json({ ok: true, delivered: "undelivered" });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -22023,17 +22105,8 @@ var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
-function makeWhatsAppSendFile(entry) {
+function makeWhatsAppSendFile(entry, maxyAccountId) {
   return async (filePath, caption) => {
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      console.error(
-        `${TAG35} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
-      );
-      return { ok: false, error: "account-unresolved" };
-    }
     const result = await sendWhatsAppDocument({
       to: entry.senderId,
       filePath,
@@ -22049,12 +22122,12 @@ function makeWhatsAppSendFile(entry) {
     return { ok: false, error: result.error };
   };
 }
-function makeWhatsAppFileDelivery(entry) {
+function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
     tag: TAG35,
     channel: "whatsapp",
-    sendFile: makeWhatsAppSendFile(entry)
+    sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
   let turnStartedAt = null;
   let routeCalls = [];
@@ -22138,7 +22211,7 @@ function startNativeFileFollower(input) {
   return startFollower({
     entry,
     tag: "[whatsapp-adaptor]",
-    fileDelivery: makeWhatsAppFileDelivery(entry),
+    fileDelivery: makeWhatsAppFileDelivery(entry, input.maxyAccountId),
     // A resumed session's JSONL already holds prior SendUserFile tool_uses;
     // suppress replay so historical files are not re-sent on attach.
     suppressResumeReplay: true,
@@ -22261,8 +22334,8 @@ var InboundHub3 = class {
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app56 = new Hono();
-  app56.get("/tg-channel/inbound", (c) => {
+  const app57 = new Hono();
+  app57.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -22280,7 +22353,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app56.post("/tg-channel/reply", async (c) => {
+  app57.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -22296,7 +22369,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app56.post("/tg-channel/ready", async (c) => {
+  app57.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -22305,7 +22378,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app56.post("/tg-channel/received", async (c) => {
+  app57.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -22315,7 +22388,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app56.post("/tg-channel/turn-end", async (c) => {
+  app57.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -22340,7 +22413,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-fallback key=${key} sessionId=${sid} bytes=${Buffer.byteLength(finalText, "utf8")}`);
     return c.json({ ok: true, delivered: "fallback" });
   });
-  return app56;
+  return app57;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -22469,7 +22542,7 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync7(filePath);
     const accountResolved = realpathSync7(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG36} document REJECTED reason=outside_account_directory`);
+      console.error(`${TAG36} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
@@ -22536,21 +22609,12 @@ function makeTelegramSendFile(entry) {
       console.error(`${TAG37} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      console.error(
-        `${TAG37} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
-      );
-      return { ok: false, error: "account-unresolved" };
-    }
     const result = await sendTelegramDocument({
       botToken,
       chatId: Number(entry.replyTarget),
       filePath,
       caption,
-      maxyAccountId,
+      maxyAccountId: entry.accountId,
       platformRoot: platformRoot2()
     });
     return result.ok ? { ok: true } : { ok: false, error: result.error };
@@ -23171,20 +23235,19 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app55 = new Hono();
+var app56 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var waGateway = new WaGateway({
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
   serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join34(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
-  // Task 751 — file delivery on the native channel: resolve the platform
-  // account + path validation here and funnel through the shared send core.
-  sendDocument: async ({ senderId, accountId, filePath, caption }) => {
-    let maxyAccountId;
-    try {
-      maxyAccountId = resolvePlatformAccountId();
-    } catch (err) {
-      return { ok: false, error: `account-unresolved: ${err instanceof Error ? err.message : String(err)}` };
-    }
+  // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
+  // path-validation scope) is the sender's effective SESSION account, resolved
+  // once at the inbound gate and threaded here via the gateway's per-sender doc
+  // context. For an account-manager that is the bound sub-account (where the
+  // session's files live); using the house account (resolvePlatformAccountId)
+  // rejected an in-account file as outside_account_directory. `accountId` stays
+  // the house Baileys socket (the reply transport, two-account invariant).
+  sendDocument: async ({ senderId, accountId, maxyAccountId, filePath, caption }) => {
     const result = await sendWhatsAppDocument({
       to: senderId,
       filePath,
@@ -23218,6 +23281,10 @@ var waGateway = new WaGateway({
       sessionId: req.sessionId,
       senderId,
       accountId,
+      // Task 1390 — the file-path validation scope is the sender's effective
+      // session account (the sub-account for an account-manager), not the house
+      // socket account. accountId stays the getSocket key.
+      maxyAccountId: effectiveAccountId,
       onClose: () => {
         if (nativeFileFollowers.get(senderId) === ac) nativeFileFollowers.delete(senderId);
       }
@@ -23225,7 +23292,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app55.route("/", waGateway.routes());
+app56.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
   gatewayUrl: webchatGatewayUrl(),
@@ -23308,7 +23375,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app55.route("/", webchatGateway.routes());
+app56.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -23341,7 +23408,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app55.route("/", telegramGateway.routes());
+app56.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -23360,21 +23427,26 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     const sent = await sendTelegramText(botToken, chatId, text);
     if (!sent.ok) throw new Error(sent.error ?? "telegram send failed");
   },
-  effectiveAccountFor: (accountId, accountDir, destination) => managedAccountFor(readAccountManagers(accountDir), destination) ?? accountId
+  effectiveAccountFor: (accountId, accountDir, destination) => {
+    const managedSub = managedAccountFor(readAccountManagers(accountDir), destination);
+    if (managedSub === null) return accountId;
+    if (!listValidAccounts().some((a) => a.accountId === managedSub)) return null;
+    return managedSub;
+  }
 });
-app55.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app55.use("*", clientIpMiddleware);
+app56.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app56.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path2) {
   return path2 === "/vnc-viewer.html" || path2.startsWith("/api/admin/attachment/") || path2.startsWith("/api/public-reader/attachment/") || path2 === "/api/admin/files/download";
 }
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -23392,7 +23464,7 @@ app55.use("*", async (c, next) => {
     });
   }
 });
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -23430,7 +23502,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app55.post("/__remote-auth/login", async (c) => {
+app56.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -23475,7 +23547,7 @@ app55.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app55.get("/__remote-auth/logout", (c) => {
+app56.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -23488,7 +23560,7 @@ app55.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app55.post("/__remote-auth/change-password", async (c) => {
+app56.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -23547,13 +23619,13 @@ app55.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app55.get("/__remote-auth/setup", (c) => {
+app56.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app55.post("/__remote-auth/set-initial-password", async (c) => {
+app56.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -23591,10 +23663,10 @@ app55.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app55.get("/api/remote-auth/status", (c) => {
+app56.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app55.post("/api/remote-auth/set-password", async (c) => {
+app56.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -23633,10 +23705,10 @@ app55.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app55.route("/api/_client-error", client_error_default);
+app56.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app55.use("*", async (c, next) => {
+app56.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -23680,26 +23752,26 @@ app55.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path2 }), 200);
 });
-app55.route("/api/health", health_default);
-app55.route("/api/chat", chatRoutes);
-app55.route("/api/whatsapp", whatsapp_default);
-app55.route("/api/whatsapp-reader", whatsapp_reader_default);
-app55.route("/api/public-reader", public_reader_default);
-app55.route("/api/webchat", createWebchatRoutes({
+app56.route("/api/health", health_default);
+app56.route("/api/chat", chatRoutes);
+app56.route("/api/whatsapp", whatsapp_default);
+app56.route("/api/whatsapp-reader", whatsapp_reader_default);
+app56.route("/api/public-reader", public_reader_default);
+app56.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app55.route("/api/webchat/greeting", webchat_greeting_default);
-app55.route("/api/telegram", telegram_default);
-app55.route("/api/quickbooks", quickbooks_default);
-app55.route("/api/onboarding", onboarding_default);
-app55.route("/api/admin", admin_default);
-app55.route("/api/access", access_default);
-app55.route("/api/session", session_default2);
-app55.route("/api/calendar", calendar_public_default);
+app56.route("/api/webchat/greeting", webchat_greeting_default);
+app56.route("/api/telegram", telegram_default);
+app56.route("/api/quickbooks", quickbooks_default);
+app56.route("/api/onboarding", onboarding_default);
+app56.route("/api/admin", admin_default);
+app56.route("/api/access", access_default);
+app56.route("/api/session", session_default2);
+app56.route("/api/calendar", calendar_public_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -23711,7 +23783,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app55.get("/agent-assets/:slug/:filename", (c) => {
+app56.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -23746,7 +23818,7 @@ app55.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app55.get("/generated/:filename", (c) => {
+app56.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -23776,10 +23848,10 @@ app55.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app55.route("/sites", sites_default);
-app55.route("/listings", listings_default);
-app55.route("/v", visitor_event_default);
-app55.route("/v", visitor_consent_default);
+app56.route("/sites", sites_default);
+app56.route("/listings", listings_default);
+app56.route("/v", visitor_event_default);
+app56.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -23934,7 +24006,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app55.get("/", (c) => {
+app56.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -23956,12 +24028,12 @@ app55.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app55.get("/public", (c) => {
+app56.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app55.get("/public-chat", (c) => {
+app56.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -23980,9 +24052,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app55.use("/vnc-viewer.html", logViewerFetch);
-app55.use("/vnc-popout.html", logViewerFetch);
-app55.get("/vnc-popout.html", (c) => {
+app56.use("/vnc-viewer.html", logViewerFetch);
+app56.use("/vnc-popout.html", logViewerFetch);
+app56.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync35(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -23995,7 +24067,7 @@ app55.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app55.post("/api/vnc/client-event", async (c) => {
+app56.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -24016,11 +24088,11 @@ app55.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app55.get("/g/:slug", (c) => {
+app56.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app55.get(pwa.manifestPath, (c) => {
+  app56.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -24036,7 +24108,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app55.get("/sw.js", (c) => {
+app56.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -24045,12 +24117,12 @@ app55.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app55.get("/graph", (c) => {
+app56.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app55.get("/chat", (c) => {
+app56.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -24059,22 +24131,22 @@ app55.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app55.get("/data", (c) => {
+app56.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app55.get("/calendar", (c) => {
+app56.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app55.get("/browser", (c) => {
+app56.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app55.get("/:slug", async (c, next) => {
+app56.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -24089,13 +24161,13 @@ app55.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app55.get("/favicon.ico", (c) => {
+  app56.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app55.use("/*", serveStatic({ root: "./public" }));
-app55.all("*", (c) => {
+app56.use("/*", serveStatic({ root: "./public" }));
+app56.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -24109,7 +24181,7 @@ app55.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app55.fetch, port, hostname });
+var httpServer = serve({ fetch: app56.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
   const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join34(__dirname, "..");
@@ -24209,7 +24281,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app55.routes ?? []) {
+  for (const r of app56.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });