@rubytech/create-maxy-code 0.1.388 → 0.1.391

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.d.ts

@@ -0,0 +1,11 @@
+/** Max time (ms) a spawned claude waits for the host to finish refreshing an
+ *  expiring token before erroring. The host heartbeat refreshes proactively
+ *  inside the 5-minute expiry window, so an in-flight refresh at spawn time is
+ *  rare; 30s is a generous ceiling that never wedges a spawn. */
+export declare const HOST_AUTH_REFRESH_TIMEOUT_MS = "30000";
+/** Mutate `env` in place to enable claude's host-managed credentials-file mode
+ *  when running on darwin, then return it. No-op on every other platform.
+ *  `claudeConfigDir` is the brand's `.claude` dir; the credentials file is its
+ *  `.credentials.json` child. */
+export declare function applyHostCredsEnv(env: NodeJS.ProcessEnv, claudeConfigDir: string, platform?: NodeJS.Platform): NodeJS.ProcessEnv;
+//# sourceMappingURL=claude-host-creds.d.ts.map

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-host-creds.d.ts","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAsBA;;;iEAGiE;AACjE,eAAO,MAAM,4BAA4B,UAAU,CAAA;AAEnD;;;iCAGiC;AACjC,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,eAAe,EAAE,MAAM,EACvB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,MAAM,CAAC,UAAU,CAMnB"}

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.js

@@ -0,0 +1,37 @@
+// Task 1395 gap 1 — macOS credential-store bridge.
+//
+// On macOS the `claude` CLI stores its OAuth token in the login Keychain,
+// while this platform reads and refreshes the token from a FILE
+// (`<CLAUDE_CONFIG_DIR>/.credentials.json`, the same path the UI server's
+// readCredentials()/writeOAuthCredentials() own). Left alone the two never
+// meet: auth-health reads an empty file and reports `missing` forever.
+//
+// `claude` exposes a host-managed credentials-file mode: point
+// CLAUDE_CODE_HOST_CREDS_FILE at that file and the spawned claude reads/writes
+// the token there instead of the Keychain, and — crucially — does NOT run its
+// own refresh, waiting up to CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS for the
+// host (this platform's auth-health heartbeat) to refresh an expiring token.
+// That keeps a single refresh owner and no double-refresh race.
+//
+// Darwin-only: on Linux `claude` already defaults to the same file under
+// CLAUDE_CONFIG_DIR, so setting host-creds mode there would needlessly switch
+// refresh ownership. The regression boundary is that Linux stays byte-for-byte
+// unchanged.
+import { join } from 'node:path';
+/** Max time (ms) a spawned claude waits for the host to finish refreshing an
+ *  expiring token before erroring. The host heartbeat refreshes proactively
+ *  inside the 5-minute expiry window, so an in-flight refresh at spawn time is
+ *  rare; 30s is a generous ceiling that never wedges a spawn. */
+export const HOST_AUTH_REFRESH_TIMEOUT_MS = '30000';
+/** Mutate `env` in place to enable claude's host-managed credentials-file mode
+ *  when running on darwin, then return it. No-op on every other platform.
+ *  `claudeConfigDir` is the brand's `.claude` dir; the credentials file is its
+ *  `.credentials.json` child. */
+export function applyHostCredsEnv(env, claudeConfigDir, platform = process.platform) {
+    if (platform === 'darwin' && claudeConfigDir) {
+        env.CLAUDE_CODE_HOST_CREDS_FILE = join(claudeConfigDir, '.credentials.json');
+        env.CLAUDE_CODE_HOST_AUTH_REFRESH_TIMEOUT_MS = HOST_AUTH_REFRESH_TIMEOUT_MS;
+    }
+    return env;
+}
+//# sourceMappingURL=claude-host-creds.js.map

package/payload/platform/services/claude-session-manager/dist/claude-host-creds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-host-creds.js","sourceRoot":"","sources":["../src/claude-host-creds.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,0EAA0E;AAC1E,gEAAgE;AAChE,0EAA0E;AAC1E,2EAA2E;AAC3E,uEAAuE;AACvE,EAAE;AACF,+DAA+D;AAC/D,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,8EAA8E;AAC9E,+EAA+E;AAC/E,aAAa;AAEb,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC;;;iEAGiE;AACjE,MAAM,CAAC,MAAM,4BAA4B,GAAG,OAAO,CAAA;AAEnD;;;iCAGiC;AACjC,MAAM,UAAU,iBAAiB,CAC/B,GAAsB,EACtB,eAAuB,EACvB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,IAAI,QAAQ,KAAK,QAAQ,IAAI,eAAe,EAAE,CAAC;QAC7C,GAAG,CAAC,2BAA2B,GAAG,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;QAC5E,GAAG,CAAC,wCAAwC,GAAG,4BAA4B,CAAA;IAC7E,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA4BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAgFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA6qFpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA6BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA4vFpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -27,7 +27,7 @@ import { buildWebchatChannelMcpServers, buildWebchatChannelArgv, webchatChannelM
 import { buildTelegramChannelMcpServers, buildTelegramChannelArgv, telegramChannelMcpConfigPath } from './telegram-channel-mcp.js';
 import { buildChannelMcpServers, buildChannelArgv, channelMcpConfigPath } from './channel-mcp.js';
 import { mergeTarget, isMultiTarget, targetKinds } from './channel-targets.js';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, createHash } from 'node:crypto';
 import { execFile, execFileSync } from 'node:child_process';
 import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
 import { runConnectorAuthLogin } from './connector-auth.js';
@@ -44,6 +44,7 @@ import { createRcChildLog } from './rc-child-log.js';
 // --append-system-prompt for channel-bound admin sessions.
 import { extractVoiceSection } from './system-prompt.js';
 import { readJsonlSession } from './jsonl-enumerator.js';
+import { computeMetering } from './session-metering.js';
 import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, slugForExistingJsonl, jsonlPathForSlug, sidecarPathForSlug, detectRemoteControlSlug, classifyBindBlocker, } from './jsonl-path.js';
 import { basename, dirname, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
@@ -54,6 +55,15 @@ const CHANNELS = ['browser', 'whatsapp', 'telegram', 'webchat', 'email'];
 // sessionId UUID (v4) minted by createNewAdminConversation in
 // platform/ui/app/lib/neo4j-store.ts.
 const UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+// Task 1392 — the WhatsApp-channel launch-param override. Every WhatsApp admin
+// session runs Sonnet 5 / effort max / bypass, overriding the Task 956 fixed admin
+// params (Opus 4.8 / medium, resolved from settings.json). Expressed as an explicit
+// constant set mirroring the rc-daemon `ADMIN_*` shape. Permission mode is already
+// bypassPermissions (settings.json), so only model + effort are asserted here. `max`
+// is session-only and invalid as a settings.json `effortLevel`, so it rides the
+// `--effort max` argv flag, not the inline settings.
+const WHATSAPP_ADMIN_MODEL = SONNET_MODEL;
+const WHATSAPP_ADMIN_EFFORT = 'max';
 function parseAboutOwner(raw) {
     if (!raw || typeof raw !== 'object')
         return undefined;
@@ -1402,6 +1412,37 @@ export function buildHttpApp(deps) {
         timed(deps.logger, 'GET', `/${id}/meta`, 200, Date.now() - start);
         return c.json(payload, 200);
     });
+    // Task 1384 — deterministic per-day usage & GBP cost for one session. Reads
+    // whichever location holds the JSONL (top level or archive subdir), runs the
+    // full-parse metering core (no AI), and returns the summary. The `op=surface`
+    // checksum lets the http and MCP callers be proven to agree on one session.
+    app.get('/:sessionId/metering', async (c) => {
+        const start = Date.now();
+        const id = c.req.param('sessionId');
+        if (!SESSION_ID_PATTERN.test(id)) {
+            timed(deps.logger, 'GET', `/${id}/metering`, 400, Date.now() - start);
+            return c.json({ error: 'invalid-session-id' }, 400);
+        }
+        const row = resolveRow(deps.watcher, id);
+        if (!row) {
+            timed(deps.logger, 'GET', `/${id}/metering`, 404, Date.now() - start);
+            return c.json({ error: 'session-not-found' }, 404);
+        }
+        const topJsonl = jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
+        const archivedJsonl = jsonlPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true });
+        const jsonlPath = existsSync(topJsonl) ? topJsonl : archivedJsonl;
+        if (!existsSync(jsonlPath)) {
+            timed(deps.logger, 'GET', `/${id}/metering`, 404, Date.now() - start);
+            return c.json({ error: 'session-not-found' }, 404);
+        }
+        const summary = await computeMetering(jsonlPath, { logger: deps.logger });
+        const checksum = createHash('sha256').update(JSON.stringify(summary)).digest('hex').slice(0, 16);
+        const bytes = statSync(jsonlPath).size;
+        deps.logger(`[metering] op=surface caller=http sessionId=${row.sessionId.slice(0, 8)} checksum=${checksum}`);
+        deps.logger(`[metering] op=http sessionId=${row.sessionId.slice(0, 8)} ms=${Date.now() - start} bytes=${bytes}`);
+        timed(deps.logger, 'GET', `/${id}/metering`, 200, Date.now() - start);
+        return c.json(summary, 200);
+    });
     app.post('/:sessionId/archive', async (c) => {
         const start = Date.now();
         const id = c.req.param('sessionId');
@@ -2394,6 +2435,28 @@ export function buildHttpApp(deps) {
         // ingest, public, specialist, channel cold-start) on the settings defaults
         // even if a future caller were to put model/effort on its body.
         const freshAdminLevers = mode === 'fresh' && rcRole === 'admin';
+        // Task 1392 — resolve whether this spawn runs under the WhatsApp Sonnet-5/max
+        // override, for BOTH the argv and the reported launch params below. Only
+        // sessions BORN under the override adopt it, so an existing Opus-born WhatsApp
+        // session finishes its life on Opus:
+        //   - fresh: a WhatsApp admin spawn (gateway body carries role:'admin',
+        //     channel:'whatsapp', and waChannel) is birthed under the override. The
+        //     channel gate matches exactly what the classification sidecar records
+        //     (`classifyChannel`), so the argv override and the born-stamp can never
+        //     disagree.
+        //   - resume: the override is inherited iff the session's classification
+        //     sidecar was stamped model=SONNET_MODEL at birth. A bare operator/PIN
+        //     resume omits role/channel/waChannel, so the sidecar — not the request
+        //     body — is the authoritative born-under-override signal (no other spawn
+        //     path stamps a WhatsApp-admin sidecar with a Sonnet model).
+        const whatsappResumeSidecar = mode === 'resume' && sessionId
+            ? readSidecar(sidecarPathForSessionId(effectiveAccountDir, sessionId), deps.logger).sidecar
+            : null;
+        const whatsappSonnetSpawn = mode === 'fresh'
+            ? rcRole === 'admin' && adminChannel === 'whatsapp' && waChannel !== undefined
+            : whatsappResumeSidecar?.role === 'admin' &&
+                whatsappResumeSidecar?.channel === 'whatsapp' &&
+                whatsappResumeSidecar?.model === WHATSAPP_ADMIN_MODEL;
         const argv = ['--remote-control'];
         // Task 945 — `name` is the row's display label, never a prompt. It must NOT
         // be pushed as a positional: the CLI treats a bare positional as the initial
@@ -2419,11 +2482,16 @@ export function buildHttpApp(deps) {
         }
         else if (sessionId) {
             argv.push(mode === 'resume' ? '--resume' : '--session-id', sessionId);
-            // Task 969 — a fresh new-session spawn (the /chat new-session popover)
-            // carries the picked model as the canonical --model flag. A resume keeps
-            // the model its JSONL already ran under, and an absent/invalid model
+            // Task 1392 — a WhatsApp admin session (fresh spawn or a resume born under
+            // the override) is pinned to Sonnet 5 on both branches, so the model holds
+            // for the session's whole life and cannot revert to the settings default.
+            // Task 969 — otherwise, a fresh new-session spawn (the /chat new-session
+            // popover) carries the picked model as the canonical --model flag. A resume
+            // keeps the model its JSONL already ran under, and an absent/invalid model
             // (reseatModel null) leaves the settings.json default model in force.
-            if (freshAdminLevers && reseatModel)
+            if (whatsappSonnetSpawn)
+                argv.push('--model', WHATSAPP_ADMIN_MODEL);
+            else if (freshAdminLevers && reseatModel)
                 argv.push('--model', reseatModel);
         }
         // Task 592 — per-spawn bypass-permissions waiver. The brand settings.json
@@ -2445,6 +2513,14 @@ export function buildHttpApp(deps) {
             if (reseatEffort)
                 inlineSettings.effortLevel = reseatEffort;
         }
+        else if (whatsappSonnetSpawn) {
+            // Task 1392 — WhatsApp admin effort is pinned to `max` on both the fresh
+            // spawn and every resume born under the override. `max` is session-only
+            // (invalid as a settings.json effortLevel), so it rides the --effort argv
+            // flag; asserting it on resume too stops the effort reverting to the
+            // settings default (medium) on the session's second turn.
+            argv.push('--effort', WHATSAPP_ADMIN_EFFORT);
+        }
         else if (freshAdminLevers && freshEffort) {
             if (freshEffort === 'max')
                 argv.push('--effort', 'max');
@@ -2731,11 +2807,21 @@ export function buildHttpApp(deps) {
         // Task 969 — a fresh new-session spawn carrying picked levers runs under
         // them too (not just a fork), so the sidecar + lifeline + the /chat params
         // row report the model/effort the session actually launched on.
-        const effectiveRcModel = (forkFromSessionId !== null || freshAdminLevers) && reseatModel ? reseatModel : resolveSettingsModel(deps.claudeConfigDir);
+        const effectiveRcModel = whatsappSonnetSpawn
+            ? WHATSAPP_ADMIN_MODEL
+            : (forkFromSessionId !== null || freshAdminLevers) && reseatModel
+                ? reseatModel
+                : resolveSettingsModel(deps.claudeConfigDir);
         // Task 970 — the fork path reports its 4-level effort; the fresh path reports
         // its 5-level pick (incl. `max`). Falls back to the settings-resolved effort
         // when neither path carries one (absent on a fork, invalid/absent on a fresh).
-        const pickedRcEffort = forkFromSessionId !== null ? reseatEffort : freshAdminLevers ? freshEffort : undefined;
+        const pickedRcEffort = whatsappSonnetSpawn
+            ? WHATSAPP_ADMIN_EFFORT
+            : forkFromSessionId !== null
+                ? reseatEffort
+                : freshAdminLevers
+                    ? freshEffort
+                    : undefined;
         const effectiveRcEffort = pickedRcEffort ?? resolveSettingsEffort(deps.claudeConfigDir);
         // Step 2 — the exact claude argv (the inner command). The systemd-run
         // wrap is composed by the spawnPty adapter; logging the inner argv
@@ -2859,7 +2945,11 @@ export function buildHttpApp(deps) {
                         // passes no --debug=auto-mode.
                         permissionMode: effectiveRcPermissionMode,
                         effectivePermissionMode: null,
-                        model: null,
+                        // Task 1392 — a fresh WhatsApp admin spawn stamps its Sonnet model
+                        // here so a later resume can read this marker back and re-assert the
+                        // override; every other spawn leaves this null (the wire `model`
+                        // still derives from the JSONL, per the sidecar field contract).
+                        model: whatsappSonnetSpawn ? WHATSAPP_ADMIN_MODEL : null,
                         hidden: false,
                         specialist: null,
                         scopeUnitToken: unitToken,