@rubytech/create-maxy-code 0.1.417 → 0.1.419

package/payload/server/server.js

@@ -116,8 +116,84 @@ import {
   __toESM
 } from "./chunk-PFF6I7KP.js";
 
-// ../lib/graph-trash/dist/index.js
+// ../lib/active-rules/dist/index.js
 var require_dist = __commonJS({
+  "../lib/active-rules/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ACTIVE_CANDIDATE_LIMIT = exports.ACTIVE_CANDIDATE_FLOOR = exports.INJECTION_RULE_CAP = exports.SAME_SUBJECT_COSINE = void 0;
+    exports.cosine = cosine;
+    exports.deconflictBySubject = deconflictBySubject;
+    exports.formatStandingRulesBlock = formatStandingRulesBlock2;
+    exports.queryActiveRuleCandidates = queryActiveRuleCandidates;
+    exports.activeRuleSet = activeRuleSet2;
+    exports.SAME_SUBJECT_COSINE = 0.85;
+    exports.INJECTION_RULE_CAP = 12;
+    exports.ACTIVE_CANDIDATE_FLOOR = 0.4;
+    exports.ACTIVE_CANDIDATE_LIMIT = 30;
+    function cosine(a, b) {
+      if (!a.length || !b.length || a.length !== b.length)
+        return 0;
+      let dot = 0;
+      let na = 0;
+      let nb = 0;
+      for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        na += a[i] * a[i];
+        nb += b[i] * b[i];
+      }
+      if (na === 0 || nb === 0)
+        return 0;
+      return dot / (Math.sqrt(na) * Math.sqrt(nb));
+    }
+    function deconflictBySubject(records, cosineThreshold = exports.SAME_SUBJECT_COSINE) {
+      const winners = [];
+      for (const r of records) {
+        const emb = r.embedding;
+        const isDup = Array.isArray(emb) && emb.length > 0 && winners.some((w) => Array.isArray(w.embedding) && w.embedding.length > 0 && cosine(emb, w.embedding) >= cosineThreshold);
+        if (!isDup)
+          winners.push(r);
+      }
+      return winners.map(({ embedding: _embedding, ...rest }) => rest);
+    }
+    function formatStandingRulesBlock2(rules, cap = exports.INJECTION_RULE_CAP) {
+      if (rules.length === 0)
+        return "";
+      const lines = rules.slice(0, cap).map((r) => `- ${r.value}`);
+      return `## Standing rules
+${lines.join("\n")}`;
+    }
+    async function queryActiveRuleCandidates(session, accountId) {
+      const result = await session.run(`
+    MATCH (pref:Preference {accountId: $accountId, scope: 'admin'})
+    WHERE NOT pref:Trashed AND pref.deletedAt IS NULL
+      AND coalesce(pref.notApplicable, false) = false
+      AND pref.confidence >= $floor
+    RETURN pref.preferenceId AS preferenceId, pref.category AS category,
+           pref.key AS key, pref.value AS value, pref.confidence AS confidence,
+           pref.observedAt AS observedAt, pref.embedding AS embedding
+    ORDER BY pref.confidence DESC, pref.observedAt DESC
+    LIMIT ${exports.ACTIVE_CANDIDATE_LIMIT}
+    `, { accountId, floor: exports.ACTIVE_CANDIDATE_FLOOR });
+      return result.records.map((r) => ({
+        preferenceId: r.get("preferenceId"),
+        category: r.get("category"),
+        key: r.get("key"),
+        value: r.get("value"),
+        confidence: r.get("confidence"),
+        observedAt: r.get("observedAt") ?? "",
+        embedding: r.get("embedding") ?? null
+      }));
+    }
+    async function activeRuleSet2(session, accountId, cap = exports.INJECTION_RULE_CAP) {
+      const candidates = await queryActiveRuleCandidates(session, accountId);
+      return deconflictBySubject(candidates).slice(0, cap);
+    }
+  }
+});
+
+// ../lib/graph-trash/dist/index.js
+var require_dist2 = __commonJS({
   "../lib/graph-trash/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -398,7 +474,7 @@ var require_dist = __commonJS({
 });
 
 // ../lib/graph-style/dist/index.js
-var require_dist2 = __commonJS({
+var require_dist3 = __commonJS({
   "../lib/graph-style/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -781,7 +857,7 @@ var require_conversation_provenance = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.injectConversationProvenance = injectConversationProvenance;
-    var index_js_1 = require_dist3();
+    var index_js_1 = require_dist4();
     async function injectConversationProvenance(params) {
       const { session, relationships, accountId, writeLabels, conversationNodeId, logNamespace, tool } = params;
       const original = [...relationships];
@@ -831,7 +907,7 @@ var require_conversation_provenance = __commonJS({
 });
 
 // ../lib/graph-write/dist/index.js
-var require_dist3 = __commonJS({
+var require_dist4 = __commonJS({
   "../lib/graph-write/dist/index.js"(exports) {
     "use strict";
     var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -1308,6 +1384,7 @@ var serveStatic = (options = { root: "" }) => {
 // server/index.ts
 import { readFileSync as readFileSync35, existsSync as existsSync33, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
+import { createHash as createHash6 } from "crypto";
 import { resolve as resolve33, join as join35, basename as basename13 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
@@ -1739,7 +1816,13 @@ var WhatsAppConfigSchema = z.object({
   accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional().describe("Per-account config keyed by account ID."),
   dmPolicy: DmPolicySchema.optional().default("disabled").describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
   adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone. Authoritative only on the account that owns the WhatsApp paired socket; a list on any other account is inert and purged at boot \u2014 use accountManagers for sub-account routing."),
-  accountManagers: z.record(z.string(), z.string()).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account UUID. A designated phone spawns an admin session scoped to that sub-account rather than the house. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones."),
+  accountManagers: z.record(
+    z.string(),
+    z.union([
+      z.string(),
+      z.object({ managesAccount: z.string(), mode: z.enum(["active", "passive"]).optional() })
+    ])
+  ).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account. The value is a bare sub-account UUID (mode 'active', the default: a full admin session) or { managesAccount, mode } where mode 'passive' selects a constrained requirement-intake spawn (only work-create, no reply). A bare string and an object without mode both resolve to 'active'. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones."),
   allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
   sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
   mediaMaxMb: z.number().int().positive().optional().default(50).describe("Maximum file size in MB for media the agent will download and process."),
@@ -2630,16 +2713,21 @@ function extractMessage(msg) {
 }
 
 // app/lib/whatsapp/managed-account.ts
+function normalizeEntry(v) {
+  return typeof v === "string" ? { account: v, mode: "active" } : { account: v.managesAccount, mode: v.mode ?? "active" };
+}
 function managedAccountFor(accountManagers, phone) {
-  for (const [managerPhone, subAccountId] of Object.entries(accountManagers)) {
-    if (subAccountId && phonesMatch(managerPhone, phone)) return subAccountId;
+  for (const [managerPhone, entry] of Object.entries(accountManagers)) {
+    const { account, mode } = normalizeEntry(entry);
+    if (account && phonesMatch(managerPhone, phone)) return { account, mode };
   }
   return null;
 }
 function managerPhonesForAccount(accountManagers, subAccountId) {
   const phones = [];
-  for (const [managerPhone, boundSub] of Object.entries(accountManagers)) {
-    if (boundSub && boundSub === subAccountId) phones.push(managerPhone);
+  for (const [managerPhone, entry] of Object.entries(accountManagers)) {
+    const { account } = normalizeEntry(entry);
+    if (account && account === subAccountId) phones.push(managerPhone);
   }
   return phones;
 }
@@ -2670,12 +2758,12 @@ function checkDmAccess(params) {
   if (isAdminPhone(senderPhone, cfg.adminPhones)) {
     return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
   }
-  const managedSub = managedAccountFor(cfg.accountManagers, senderPhone);
-  if (managedSub) {
-    if (params.isValidAccount && !params.isValidAccount(managedSub)) {
+  const managed = managedAccountFor(cfg.accountManagers, senderPhone);
+  if (managed) {
+    if (params.isValidAccount && !params.isValidAccount(managed.account)) {
       return { allowed: false, reason: "account-manager-unresolved", agentType: "admin" };
     }
-    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managedSub };
+    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managed.account, passive: managed.mode === "passive" };
   }
   switch (cfg.dmPolicy) {
     case "open":
@@ -4867,6 +4955,7 @@ async function handleInboundMessage(conn, msg) {
   const payload = {
     accountId: conn.accountId,
     agentType: accessResult.agentType,
+    passive: accessResult.passive === true,
     personId: accessResult.personId ?? null,
     senderPhone,
     text: extracted.text,
@@ -6192,6 +6281,9 @@ function createScheduleInjectRoutes(deps) {
   return app57;
 }
 
+// server/index.ts
+var import_dist8 = __toESM(require_dist(), 1);
+
 // app/lib/telegram/outbound/send-text.ts
 async function sendTelegramText(botToken, chatId, text) {
   try {
@@ -6414,7 +6506,7 @@ function purgeNonSocketAdminPhonesAtBoot() {
     purgeNonSocketAdminPhones(acct.accountDir, socketOwner);
   }
 }
-function setAccountManager(accountDir, phone, subAccountId) {
+function setAccountManager(accountDir, phone, subAccountId, mode = "active") {
   const normalized = phone.trim();
   if (!E164_PATTERN.test(normalized)) {
     return { ok: false, error: `Invalid phone format "${normalized}". Expected E.164 (e.g. +441234567890).` };
@@ -6448,7 +6540,7 @@ function setAccountManager(accountDir, phone, subAccountId) {
     if (!wa.accountManagers || typeof wa.accountManagers !== "object") {
       wa.accountManagers = {};
     }
-    wa.accountManagers[normalized] = sub;
+    wa.accountManagers[normalized] = mode === "passive" ? { managesAccount: sub, mode: "passive" } : sub;
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
@@ -6456,9 +6548,10 @@ function setAccountManager(accountDir, phone, subAccountId) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG17} bound account manager phone=${normalized} managesAccount=${sub}`);
+    console.error(`${TAG17} bound account manager phone=${normalized} managesAccount=${sub} mode=${mode}`);
     reloadManagerConfig(accountDir);
-    return { ok: true, message: `Bound ${normalized} as account manager for sub-account ${sub}. Their WhatsApp messages will reach that sub-account's admin agent; replies still go out over this account's WhatsApp device.` };
+    const behaviour = mode === "passive" ? `Their WhatsApp messages will each file one task scoped to that sub-account; the agent sends nothing back.` : `Their WhatsApp messages will reach that sub-account's admin agent; replies still go out over this account's WhatsApp device.`;
+    return { ok: true, message: `Bound ${normalized} as ${mode} account manager for sub-account ${sub}. ${behaviour}` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`${TAG17} setAccountManager failed: ${msg}`);
@@ -6503,6 +6596,12 @@ function readAccountManagers(accountDir) {
     const out = {};
     for (const [k, v] of Object.entries(wa.accountManagers)) {
       if (typeof v === "string") out[k] = v;
+      else if (v && typeof v === "object" && typeof v.managesAccount === "string") {
+        const obj = v;
+        const rawMode = obj.mode;
+        const mode = rawMode === void 0 ? void 0 : rawMode === "active" ? "active" : rawMode === "passive" ? "passive" : "passive";
+        out[k] = { managesAccount: obj.managesAccount, mode };
+      }
     }
     return out;
   } catch {
@@ -7272,7 +7371,7 @@ app2.post("/reconnect", async (c) => {
 app2.post("/config", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const { action, phone, slug, fields, accountId, managesAccount } = body;
+    const { action, phone, slug, fields, accountId, managesAccount, mode } = body;
     if (!action || typeof action !== "string") {
       return c.json({ ok: false, error: 'Missing required field "action".' }, 400);
     }
@@ -7310,8 +7409,9 @@ app2.post("/config", async (c) => {
         if (!managesAccount || typeof managesAccount !== "string") {
           return c.json({ ok: false, error: 'Missing required field "managesAccount" (the sub-account UUID this phone should manage).' }, 400);
         }
-        const result = setAccountManager(account.accountDir, phone, managesAccount);
-        console.error(`${TAG21} config action=add-account-manager phone=${phone} managesAccount=${managesAccount} ok=${result.ok}`);
+        const managerMode = mode === "passive" ? "passive" : "active";
+        const result = setAccountManager(account.accountDir, phone, managesAccount, managerMode);
+        console.error(`${TAG21} config action=add-account-manager phone=${phone} managesAccount=${managesAccount} mode=${managerMode} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-account-manager": {
@@ -15000,7 +15100,7 @@ app21.post("/rename", requireAdminSession, async (c) => {
 var files_default = app21;
 
 // ../lib/graph-search/src/index.ts
-var import_dist = __toESM(require_dist());
+var import_dist = __toESM(require_dist2());
 import { int } from "neo4j-driver";
 
 // ../lib/graph-search/src/rrf-fusion.ts
@@ -15898,8 +15998,8 @@ var graph_search_default = app22;
 import neo4j2 from "neo4j-driver";
 
 // app/lib/graph-labels.ts
-var import_dist2 = __toESM(require_dist2(), 1);
-var import_dist3 = __toESM(require_dist2(), 1);
+var import_dist2 = __toESM(require_dist3(), 1);
+var import_dist3 = __toESM(require_dist3(), 1);
 var HIDDEN_BY_DEFAULT_LABELS = Object.freeze(
   /* @__PURE__ */ new Set(["Chunk", "GraphPreference"])
 );
@@ -17950,7 +18050,10 @@ async function managerSpawn(opts) {
       visitorId: opts.visitorId,
       name: opts.name,
       webchatChannel: opts.webchatChannel,
-      previousContext: opts.previousContext
+      previousContext: opts.previousContext,
+      initialMessage: opts.initialMessage,
+      passive: opts.passive,
+      targetAccountId: opts.targetAccountId
     })
   }).catch((err) => ({ __throw: err instanceof Error ? err.message : String(err) }));
   if ("__throw" in res) {
@@ -20438,7 +20541,7 @@ app55.get("/free-busy", async (c) => {
 var calendar_public_default = app55;
 
 // app/lib/graph-health.ts
-var import_dist4 = __toESM(require_dist3(), 1);
+var import_dist4 = __toESM(require_dist4(), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 function renderLabelTop(rows) {
   return rows.map((b) => {
@@ -21050,6 +21153,9 @@ var InboundHub = class {
   }
 };
 
+// app/lib/whatsapp/gateway/wa-gateway.ts
+var import_dist5 = __toESM(require_dist(), 1);
+
 // node_modules/hono/dist/utils/stream.js
 var StreamingApi = class {
   writer;
@@ -21380,6 +21486,23 @@ var WaGateway = class {
   }
   /** Handle one inbound admin WhatsApp message. */
   async handleInbound(input) {
+    if (input.passive) {
+      const msgId = `wa-${++this.seq}`;
+      await this.deps.ensureChannelSession({
+        accountId: input.accountId,
+        effectiveAccountId: input.effectiveAccountId,
+        senderId: input.senderId,
+        // agentType stays 'admin'; the constraint rides the passive flag.
+        role: "admin",
+        personId: null,
+        gatewayUrl: this.deps.gatewayUrl,
+        serverPath: this.deps.serverPath,
+        passive: true,
+        text: input.text,
+        msgId
+      });
+      return;
+    }
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.senderId);
     const willDeliverNow = this.hub.isReady(input.senderId);
@@ -21388,13 +21511,22 @@ var WaGateway = class {
     const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
     this.docContexts.set(input.senderId, { accountId: input.accountId, maxyAccountId: input.effectiveAccountId });
+    let standingRules;
+    if (this.deps.fetchStandingRules) {
+      standingRules = await this.deps.fetchStandingRules(input.effectiveAccountId) || void 0;
+      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      console.error(
+        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} capped=${injected >= import_dist5.INJECTION_RULE_CAP}`
+      );
+    }
     this.hub.deliver(
       {
         senderId: input.senderId,
         text: input.text,
         waMessageId: `wa-${++this.seq}`,
         media: input.media,
-        source
+        source,
+        standingRules
       },
       Date.now()
     );
@@ -21455,8 +21587,8 @@ function buildWaSpawnRequest(input) {
 
 // app/lib/whatsapp/inbound/route-decision.ts
 function decideWaRoute(msg) {
-  if (msg.agentType === "admin") return { action: "route", role: "admin", personId: null };
-  if (msg.personId && msg.personId.length > 0) return { action: "route", role: "public", personId: msg.personId };
+  if (msg.agentType === "admin") return { action: "route", role: "admin", personId: null, passive: msg.passive === true };
+  if (msg.personId && msg.personId.length > 0) return { action: "route", role: "public", personId: msg.personId, passive: false };
   return { action: "drop", reason: "public-unresolved" };
 }
 
@@ -21617,6 +21749,9 @@ var InboundHub2 = class {
   }
 };
 
+// app/lib/webchat/gateway/webchat-gateway.ts
+var import_dist6 = __toESM(require_dist(), 1);
+
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
   const app57 = new Hono();
@@ -22051,8 +22186,16 @@ var WebchatGateway = class _WebchatGateway {
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.key);
     const willDeliverNow = this.hub.isReady(input.key);
+    let standingRules;
+    if (input.role === "admin" && this.deps.fetchStandingRules) {
+      standingRules = await this.deps.fetchStandingRules(input.accountId) || void 0;
+      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      console.error(
+        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
+      );
+    }
     this.hub.deliver(
-      { key: input.key, text: input.text, messageId: `wc-${++this.seq}` },
+      { key: input.key, text: input.text, messageId: `wc-${++this.seq}`, standingRules },
       Date.now()
     );
     if (willDeliverNow) this.lastDeliveredAt.set(input.key, Date.now());
@@ -22570,6 +22713,9 @@ var InboundHub3 = class {
   }
 };
 
+// app/lib/telegram/gateway/telegram-gateway.ts
+var import_dist7 = __toESM(require_dist(), 1);
+
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
   const app57 = new Hono();
@@ -22700,8 +22846,16 @@ var TelegramGateway = class {
     const willDeliverNow = this.hub.isReady(input.senderId);
     const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
+    let standingRules;
+    if (input.role === "admin" && this.deps.fetchStandingRules) {
+      standingRules = await this.deps.fetchStandingRules(input.accountId) || void 0;
+      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      console.error(
+        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
+      );
+    }
     this.hub.deliver(
-      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source },
+      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules },
       Date.now()
     );
     console.error(
@@ -23057,7 +23211,8 @@ async function firePublicSessionEndReview(input) {
 // app/lib/whatsapp/inbound/channel-admin-binding-drift.ts
 function findAccountManagerDrift(accountManagers, adminPhones, validAccountIds) {
   const drift = [];
-  for (const [phone, managesAccount] of Object.entries(accountManagers)) {
+  for (const [phone, entry] of Object.entries(accountManagers)) {
+    const managesAccount = typeof entry === "string" ? entry : entry.managesAccount;
     if (!validAccountIds.includes(managesAccount)) {
       drift.push({ phone, managesAccount, reason: "not-in-registry" });
     } else if (adminPhones.some((a) => phonesMatch(a, phone))) {
@@ -23466,7 +23621,22 @@ function isPublicHost(host) {
 }
 var app56 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
+async function fetchAccountStandingRules(accountId) {
+  const session = getSession();
+  try {
+    const rules = await (0, import_dist8.activeRuleSet)(session, accountId);
+    return (0, import_dist8.formatStandingRulesBlock)(rules);
+  } catch (err) {
+    console.error(
+      `[preference-inject] op=fetch-failed accountId=${accountId} error=${err instanceof Error ? err.message : String(err)}`
+    );
+    return "";
+  } finally {
+    await session.close();
+  }
+}
 var waGateway = new WaGateway({
+  fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
   serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
@@ -23487,7 +23657,30 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath }) => {
+  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId }) => {
+    if (passive) {
+      const phoneHash = createHash6("sha256").update(senderId).digest("hex").slice(0, 12);
+      const prompt = (text ?? "").trim();
+      if (prompt.length === 0) {
+        console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=empty-text`);
+        return;
+      }
+      console.error(`[wa-passive] op=dispatch account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"}`);
+      const result2 = await managerSpawn({
+        senderId,
+        role: "public",
+        channel: "whatsapp",
+        accountId: effectiveAccountId,
+        targetAccountId: effectiveAccountId,
+        agentSlug: "passive",
+        initialMessage: prompt,
+        passive: true
+      });
+      if ("error" in result2) {
+        console.error(`[wa-passive] op=dispatch-failed account=${effectiveAccountId} msgId=${msgId ?? "none"} error=${result2.error}`);
+      }
+      return;
+    }
     if (role === "admin") {
       const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
@@ -23524,6 +23717,7 @@ var waGateway = new WaGateway({
 app56.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
+  fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: webchatGatewayUrl(),
   serverPath: webchatServerPath(),
   ensureChannelSession: async ({ accountId, key, role, adminUserId, gatewayUrl, serverPath, sessionId, public: pub }) => {
@@ -23609,6 +23803,7 @@ webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
 var telegramGateway = new TelegramGateway({
+  fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
   ensureChannelSession: async ({ accountId, senderId, role, personId, chatId, gatewayUrl, serverPath }) => {
@@ -23663,10 +23858,11 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     if (!sent.ok) throw new Error(sent.error ?? "telegram send failed");
   },
   effectiveAccountFor: (accountId, accountDir, destination) => {
-    const managedSub = managedAccountFor(readAccountManagers(accountDir), destination);
-    if (managedSub === null) return accountId;
-    if (!isValidAccountId(managedSub)) return null;
-    return managedSub;
+    const managed = managedAccountFor(readAccountManagers(accountDir), destination);
+    if (managed === null) return accountId;
+    if (managed.mode === "passive") return null;
+    if (!isValidAccountId(managed.account)) return null;
+    return managed.account;
   }
 });
 app56.route("/api/channel/schedule-inject", scheduleInjectRoutes);
@@ -24716,7 +24912,7 @@ init({
       console.error(`[whatsapp:route] skipped reason=owner-mirror senderId=${msg.senderPhone}`);
       return;
     }
-    const decision = decideWaRoute(msg);
+    const decision = decideWaRoute({ agentType: msg.agentType, personId: msg.personId, passive: msg.passive });
     if (decision.action === "drop") {
       console.error(`[whatsapp:route] op=dropped reason=${decision.reason} senderId=${msg.senderPhone}`);
       return;
@@ -24734,7 +24930,7 @@ init({
       console.error(`[whatsapp:route] op=routed agentType=public personId=${decision.personId} senderId=${msg.senderPhone}`);
     }
     try {
-      void msg.composing().catch(() => {
+      if (!decision.passive) void msg.composing().catch(() => {
       });
       await waGateway.handleInbound({
         accountId: msg.accountId,
@@ -24742,6 +24938,9 @@ init({
         senderId: msg.senderPhone,
         role: decision.role,
         personId: decision.personId,
+        // Task 1483 — a passive account-manager inbound routes to a fresh
+        // constrained one-shot spawn instead of the shared rc-daemon path.
+        passive: decision.passive,
         text: msg.text,
         reply: msg.reply,
         media: msg.media