@rubytech/create-maxy-code 0.1.417 → 0.1.423

package/payload/server/server.js

@@ -116,8 +116,84 @@ import {
   __toESM
 } from "./chunk-PFF6I7KP.js";
 
-// ../lib/graph-trash/dist/index.js
+// ../lib/active-rules/dist/index.js
 var require_dist = __commonJS({
+  "../lib/active-rules/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ACTIVE_CANDIDATE_LIMIT = exports.ACTIVE_CANDIDATE_FLOOR = exports.INJECTION_RULE_CAP = exports.SAME_SUBJECT_COSINE = void 0;
+    exports.cosine = cosine;
+    exports.deconflictBySubject = deconflictBySubject;
+    exports.formatStandingRulesBlock = formatStandingRulesBlock2;
+    exports.queryActiveRuleCandidates = queryActiveRuleCandidates;
+    exports.activeRuleSet = activeRuleSet2;
+    exports.SAME_SUBJECT_COSINE = 0.85;
+    exports.INJECTION_RULE_CAP = 12;
+    exports.ACTIVE_CANDIDATE_FLOOR = 0.4;
+    exports.ACTIVE_CANDIDATE_LIMIT = 30;
+    function cosine(a, b) {
+      if (!a.length || !b.length || a.length !== b.length)
+        return 0;
+      let dot = 0;
+      let na = 0;
+      let nb = 0;
+      for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        na += a[i] * a[i];
+        nb += b[i] * b[i];
+      }
+      if (na === 0 || nb === 0)
+        return 0;
+      return dot / (Math.sqrt(na) * Math.sqrt(nb));
+    }
+    function deconflictBySubject(records, cosineThreshold = exports.SAME_SUBJECT_COSINE) {
+      const winners = [];
+      for (const r of records) {
+        const emb = r.embedding;
+        const isDup = Array.isArray(emb) && emb.length > 0 && winners.some((w) => Array.isArray(w.embedding) && w.embedding.length > 0 && cosine(emb, w.embedding) >= cosineThreshold);
+        if (!isDup)
+          winners.push(r);
+      }
+      return winners.map(({ embedding: _embedding, ...rest }) => rest);
+    }
+    function formatStandingRulesBlock2(rules, cap = exports.INJECTION_RULE_CAP) {
+      if (rules.length === 0)
+        return "";
+      const lines = rules.slice(0, cap).map((r) => `- ${r.value}`);
+      return `## Standing rules
+${lines.join("\n")}`;
+    }
+    async function queryActiveRuleCandidates(session, accountId) {
+      const result = await session.run(`
+    MATCH (pref:Preference {accountId: $accountId, scope: 'admin'})
+    WHERE NOT pref:Trashed AND pref.deletedAt IS NULL
+      AND coalesce(pref.notApplicable, false) = false
+      AND pref.confidence >= $floor
+    RETURN pref.preferenceId AS preferenceId, pref.category AS category,
+           pref.key AS key, pref.value AS value, pref.confidence AS confidence,
+           pref.observedAt AS observedAt, pref.embedding AS embedding
+    ORDER BY pref.confidence DESC, pref.observedAt DESC
+    LIMIT ${exports.ACTIVE_CANDIDATE_LIMIT}
+    `, { accountId, floor: exports.ACTIVE_CANDIDATE_FLOOR });
+      return result.records.map((r) => ({
+        preferenceId: r.get("preferenceId"),
+        category: r.get("category"),
+        key: r.get("key"),
+        value: r.get("value"),
+        confidence: r.get("confidence"),
+        observedAt: r.get("observedAt") ?? "",
+        embedding: r.get("embedding") ?? null
+      }));
+    }
+    async function activeRuleSet2(session, accountId, cap = exports.INJECTION_RULE_CAP) {
+      const candidates = await queryActiveRuleCandidates(session, accountId);
+      return deconflictBySubject(candidates).slice(0, cap);
+    }
+  }
+});
+
+// ../lib/graph-trash/dist/index.js
+var require_dist2 = __commonJS({
   "../lib/graph-trash/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -398,7 +474,7 @@ var require_dist = __commonJS({
 });
 
 // ../lib/graph-style/dist/index.js
-var require_dist2 = __commonJS({
+var require_dist3 = __commonJS({
   "../lib/graph-style/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -781,7 +857,7 @@ var require_conversation_provenance = __commonJS({
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.injectConversationProvenance = injectConversationProvenance;
-    var index_js_1 = require_dist3();
+    var index_js_1 = require_dist4();
     async function injectConversationProvenance(params) {
       const { session, relationships, accountId, writeLabels, conversationNodeId, logNamespace, tool } = params;
       const original = [...relationships];
@@ -831,7 +907,7 @@ var require_conversation_provenance = __commonJS({
 });
 
 // ../lib/graph-write/dist/index.js
-var require_dist3 = __commonJS({
+var require_dist4 = __commonJS({
   "../lib/graph-write/dist/index.js"(exports) {
     "use strict";
     var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
@@ -1308,6 +1384,7 @@ var serveStatic = (options = { root: "" }) => {
 // server/index.ts
 import { readFileSync as readFileSync35, existsSync as existsSync33, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
+import { createHash as createHash6 } from "crypto";
 import { resolve as resolve33, join as join35, basename as basename13 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
@@ -1739,7 +1816,13 @@ var WhatsAppConfigSchema = z.object({
   accounts: z.record(z.string(), WhatsAppAccountSchema.optional()).optional().describe("Per-account config keyed by account ID."),
   dmPolicy: DmPolicySchema.optional().default("disabled").describe("Who can message your public agent via WhatsApp DM. 'Open' lets anyone message. 'Allowlist' restricts to approved phone numbers. 'Disabled' blocks all public messages."),
   adminPhones: z.array(z.string()).optional().describe("Phone numbers (E.164) that route to the admin agent. Managed via add-admin-phone / remove-admin-phone. Authoritative only on the account that owns the WhatsApp paired socket; a list on any other account is inert and purged at boot \u2014 use accountManagers for sub-account routing."),
-  accountManagers: z.record(z.string(), z.string()).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account UUID. A designated phone spawns an admin session scoped to that sub-account rather than the house. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones."),
+  accountManagers: z.record(
+    z.string(),
+    z.union([
+      z.string(),
+      z.object({ managesAccount: z.string(), mode: z.enum(["active", "passive"]).optional() })
+    ])
+  ).optional().describe("Account-manager bindings: E.164 phone \u2192 sub-account. The value is a bare sub-account UUID (mode 'active', the default: a full admin session) or { managesAccount, mode } where mode 'passive' selects a constrained requirement-intake spawn (only work-create, no reply). A bare string and an object without mode both resolve to 'active'. Managed via add-account-manager / remove-account-manager. A phone here must not also be in adminPhones."),
   allowFrom: z.array(z.string()).optional().describe("Phone numbers allowed to message the public agent when DM policy is 'allowlist'. Add '*' for open access. Does not affect admin routing \u2014 use adminPhones for that."),
   sendReadReceipts: z.boolean().optional().default(true).describe("Whether to send read receipts (blue ticks) when messages are received. Disabling may feel less responsive but preserves privacy."),
   mediaMaxMb: z.number().int().positive().optional().default(50).describe("Maximum file size in MB for media the agent will download and process."),
@@ -2630,16 +2713,21 @@ function extractMessage(msg) {
 }
 
 // app/lib/whatsapp/managed-account.ts
+function normalizeEntry(v) {
+  return typeof v === "string" ? { account: v, mode: "active" } : { account: v.managesAccount, mode: v.mode ?? "active" };
+}
 function managedAccountFor(accountManagers, phone) {
-  for (const [managerPhone, subAccountId] of Object.entries(accountManagers)) {
-    if (subAccountId && phonesMatch(managerPhone, phone)) return subAccountId;
+  for (const [managerPhone, entry] of Object.entries(accountManagers)) {
+    const { account, mode } = normalizeEntry(entry);
+    if (account && phonesMatch(managerPhone, phone)) return { account, mode };
   }
   return null;
 }
 function managerPhonesForAccount(accountManagers, subAccountId) {
   const phones = [];
-  for (const [managerPhone, boundSub] of Object.entries(accountManagers)) {
-    if (boundSub && boundSub === subAccountId) phones.push(managerPhone);
+  for (const [managerPhone, entry] of Object.entries(accountManagers)) {
+    const { account } = normalizeEntry(entry);
+    if (account && account === subAccountId) phones.push(managerPhone);
   }
   return phones;
 }
@@ -2670,12 +2758,12 @@ function checkDmAccess(params) {
   if (isAdminPhone(senderPhone, cfg.adminPhones)) {
     return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
   }
-  const managedSub = managedAccountFor(cfg.accountManagers, senderPhone);
-  if (managedSub) {
-    if (params.isValidAccount && !params.isValidAccount(managedSub)) {
+  const managed = managedAccountFor(cfg.accountManagers, senderPhone);
+  if (managed) {
+    if (params.isValidAccount && !params.isValidAccount(managed.account)) {
       return { allowed: false, reason: "account-manager-unresolved", agentType: "admin" };
     }
-    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managedSub };
+    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managed.account, passive: managed.mode === "passive" };
   }
   switch (cfg.dmPolicy) {
     case "open":
@@ -2918,6 +3006,22 @@ async function resolvePersonByPhone(accountId, phone) {
     await session.close();
   }
 }
+async function ensureManagerPerson(accountId, phone) {
+  const session = getSession2();
+  const normalized = normalizeE164(phone) || phone;
+  try {
+    const result = await session.run(
+      `MERGE (p:Person {accountId: $accountId, phone: $phone})
+       ON CREATE SET p.source = 'wa-passive-manager'
+       RETURN elementId(p) AS personId`,
+      { accountId, phone: normalized }
+    );
+    if (result.records.length === 0) return null;
+    return result.records[0].get("personId");
+  } finally {
+    await session.close();
+  }
+}
 async function enrolPerson(input) {
   const session = getSession2();
   const sliceToken = randomUUID2();
@@ -4867,6 +4971,7 @@ async function handleInboundMessage(conn, msg) {
   const payload = {
     accountId: conn.accountId,
     agentType: accessResult.agentType,
+    passive: accessResult.passive === true,
     personId: accessResult.personId ?? null,
     senderPhone,
     text: extracted.text,
@@ -6192,6 +6297,9 @@ function createScheduleInjectRoutes(deps) {
   return app57;
 }
 
+// server/index.ts
+var import_dist8 = __toESM(require_dist(), 1);
+
 // app/lib/telegram/outbound/send-text.ts
 async function sendTelegramText(botToken, chatId, text) {
   try {
@@ -6414,7 +6522,7 @@ function purgeNonSocketAdminPhonesAtBoot() {
     purgeNonSocketAdminPhones(acct.accountDir, socketOwner);
   }
 }
-function setAccountManager(accountDir, phone, subAccountId) {
+function setAccountManager(accountDir, phone, subAccountId, mode = "active") {
   const normalized = phone.trim();
   if (!E164_PATTERN.test(normalized)) {
     return { ok: false, error: `Invalid phone format "${normalized}". Expected E.164 (e.g. +441234567890).` };
@@ -6448,7 +6556,7 @@ function setAccountManager(accountDir, phone, subAccountId) {
     if (!wa.accountManagers || typeof wa.accountManagers !== "object") {
       wa.accountManagers = {};
     }
-    wa.accountManagers[normalized] = sub;
+    wa.accountManagers[normalized] = mode === "passive" ? { managesAccount: sub, mode: "passive" } : sub;
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
@@ -6456,9 +6564,10 @@ function setAccountManager(accountDir, phone, subAccountId) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG17} bound account manager phone=${normalized} managesAccount=${sub}`);
+    console.error(`${TAG17} bound account manager phone=${normalized} managesAccount=${sub} mode=${mode}`);
     reloadManagerConfig(accountDir);
-    return { ok: true, message: `Bound ${normalized} as account manager for sub-account ${sub}. Their WhatsApp messages will reach that sub-account's admin agent; replies still go out over this account's WhatsApp device.` };
+    const behaviour = mode === "passive" ? `Their WhatsApp messages will each file one task scoped to that sub-account; the agent sends nothing back.` : `Their WhatsApp messages will reach that sub-account's admin agent; replies still go out over this account's WhatsApp device.`;
+    return { ok: true, message: `Bound ${normalized} as ${mode} account manager for sub-account ${sub}. ${behaviour}` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     console.error(`${TAG17} setAccountManager failed: ${msg}`);
@@ -6503,6 +6612,12 @@ function readAccountManagers(accountDir) {
     const out = {};
     for (const [k, v] of Object.entries(wa.accountManagers)) {
       if (typeof v === "string") out[k] = v;
+      else if (v && typeof v === "object" && typeof v.managesAccount === "string") {
+        const obj = v;
+        const rawMode = obj.mode;
+        const mode = rawMode === void 0 ? void 0 : rawMode === "active" ? "active" : rawMode === "passive" ? "passive" : "passive";
+        out[k] = { managesAccount: obj.managesAccount, mode };
+      }
     }
     return out;
   } catch {
@@ -7189,9 +7304,103 @@ function reconcileCredsOnDisk(opts) {
   return entries;
 }
 
+// app/lib/whatsapp-reader/select-sessions.ts
+function isReaderChannelSession(role, channel) {
+  return role === "admin" && (channel === "whatsapp" || channel === "telegram") || role === "public" && (channel === "whatsapp" || channel === "webchat");
+}
+function selectReaderChannelSessions(rows) {
+  return rows.filter((r) => isReaderChannelSession(r.role, r.channel)).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).map((r) => ({
+    sessionId: r.sessionId,
+    projectDir: r.projectDir,
+    title: r.title,
+    senderId: r.senderId,
+    startedAt: r.startedAt,
+    channel: r.channel,
+    role: r.role,
+    operatorName: null,
+    whatsappName: null,
+    lastMessageAt: r.lastMessageAt,
+    modelGated: r.modelGated,
+    model: r.model,
+    source: "session"
+  }));
+}
+function conversationCounterpartyPhone(remoteJid, earliestSenderTelephone) {
+  if (remoteJid.endsWith("@g.us")) return null;
+  if (remoteJid.endsWith("@s.whatsapp.net")) return jidToE164(remoteJid) ?? earliestSenderTelephone;
+  return earliestSenderTelephone;
+}
+function counterpartyBoundToSubAccount(managerPhones, counterpartyPhone) {
+  return counterpartyPhone != null && managerPhones.some((mp) => phonesMatch(mp, counterpartyPhone));
+}
+function buildStoreConversationRows(accountId, summaries) {
+  const rows = [];
+  for (const [remoteJid, { first, last, firstNamedSender }] of summaries) {
+    const scope = last.scope;
+    const senderTelephone = conversationCounterpartyPhone(remoteJid, first.senderTelephone);
+    rows.push({
+      sessionId: "",
+      projectDir: "",
+      title: remoteJid,
+      senderId: senderTelephone,
+      startedAt: first.dateSent,
+      channel: "whatsapp",
+      role: scope === "admin" ? "admin" : "public",
+      operatorName: null,
+      whatsappName: firstNamedSender,
+      lastMessageAt: last.dateSent,
+      modelGated: false,
+      model: null,
+      source: "store",
+      accountId,
+      remoteJid,
+      scope
+    });
+  }
+  return rows.sort((a, b) => (b.lastMessageAt ?? "").localeCompare(a.lastMessageAt ?? ""));
+}
+
+// app/lib/whatsapp/sub-account-recall.ts
+function resolveStoreProjection(params) {
+  const { requestedAccountId, houseId, validAccountIds, houseAccountManagers } = params;
+  const requestedIsValid = validAccountIds.includes(requestedAccountId);
+  const isSubAccount = houseId !== null && validAccountIds.length > 1 && requestedIsValid && requestedAccountId !== houseId;
+  if (!isSubAccount) return { storeAccountId: requestedAccountId, managerPhones: null };
+  return {
+    storeAccountId: houseId,
+    managerPhones: managerPhonesForAccount(houseAccountManagers, requestedAccountId)
+  };
+}
+function filterConversationsForSubAccount(conversations, managerPhones) {
+  const out = /* @__PURE__ */ new Map();
+  for (const [remoteJid, msgs] of conversations) {
+    const counterparty = conversationCounterpartyPhone(remoteJid, msgs[0]?.senderTelephone ?? "");
+    if (counterpartyBoundToSubAccount(managerPhones, counterparty)) out.set(remoteJid, msgs);
+  }
+  return out;
+}
+
 // server/routes/whatsapp.ts
 var TAG21 = "[whatsapp:api]";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
+function projectionFor(requestedAccountId) {
+  const validAccounts = listValidAccounts();
+  if (validAccounts.length <= 1) return { storeAccountId: requestedAccountId, managerPhones: null };
+  let houseId = null;
+  try {
+    houseId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch {
+    houseId = null;
+  }
+  const houseAccount = houseId ? validAccounts.find((a) => a.accountId === houseId) : void 0;
+  const houseAccountManagers = houseAccount ? readAccountManagers(houseAccount.accountDir) : {};
+  return resolveStoreProjection({
+    requestedAccountId,
+    houseId,
+    validAccountIds: validAccounts.map((a) => a.accountId),
+    houseAccountManagers
+  });
+}
 var app2 = new Hono();
 app2.get("/status", (c) => {
   try {
@@ -7272,7 +7481,7 @@ app2.post("/reconnect", async (c) => {
 app2.post("/config", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const { action, phone, slug, fields, accountId, managesAccount } = body;
+    const { action, phone, slug, fields, accountId, managesAccount, mode } = body;
     if (!action || typeof action !== "string") {
       return c.json({ ok: false, error: 'Missing required field "action".' }, 400);
     }
@@ -7310,8 +7519,9 @@ app2.post("/config", async (c) => {
         if (!managesAccount || typeof managesAccount !== "string") {
           return c.json({ ok: false, error: 'Missing required field "managesAccount" (the sub-account UUID this phone should manage).' }, 400);
         }
-        const result = setAccountManager(account.accountDir, phone, managesAccount);
-        console.error(`${TAG21} config action=add-account-manager phone=${phone} managesAccount=${managesAccount} ok=${result.ok}`);
+        const managerMode = mode === "passive" ? "passive" : "active";
+        const result = setAccountManager(account.accountDir, phone, managesAccount, managerMode);
+        console.error(`${TAG21} config action=add-account-manager phone=${phone} managesAccount=${managesAccount} mode=${managerMode} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-account-manager": {
@@ -7539,8 +7749,11 @@ app2.get("/conversation-graph-state", async (c) => {
     const accountIdQuery = c.req.query("accountId");
     const t0 = Date.now();
     if (!directCacheKey && !jid) {
-      const accountId2 = validateAccountId(accountIdQuery ?? null);
-      const conversations = readAllConversations(accountId2);
+      const requestedAccountId = validateAccountId(accountIdQuery ?? null);
+      const projection2 = projectionFor(requestedAccountId);
+      const managerPhonesBound = projection2.managerPhones?.length ?? 0;
+      const allConversations = readAllConversations(projection2.storeAccountId);
+      const conversations = projection2.managerPhones ? filterConversationsForSubAccount(allConversations, projection2.managerPhones) : allConversations;
       const rows2 = [];
       const nameCache = /* @__PURE__ */ new Map();
       let unresolvedSenders = 0;
@@ -7552,7 +7765,7 @@ app2.get("/conversation-graph-state", async (c) => {
             if (!nameCache.has(m.senderTelephone)) {
               const result = await session.run(
                 `MATCH (p:Person {telephone: $telephone, accountId: $accountId}) RETURN p.givenName AS givenName, p.familyName AS familyName`,
-                { telephone: m.senderTelephone, accountId: accountId2 }
+                { telephone: m.senderTelephone, accountId: projection2.storeAccountId }
               );
               const rec = result.records[0];
               const resolved = rec ? [rec.get("givenName"), rec.get("familyName")].filter(Boolean).join(" ") || null : null;
@@ -7574,8 +7787,8 @@ app2.get("/conversation-graph-state", async (c) => {
         if (session) await session.close();
       }
       const ms2 = Date.now() - t0;
-      console.error(`[mcp:whatsapp] tool=whatsapp-conversation-graph-state mode=all-senders accountId=${accountId2} rows=${rows2.length} unresolvedSenders=${unresolvedSenders} ms=${ms2}`);
-      return c.json({ accountId: accountId2, rows: rows2, unresolvedSenders, ms: ms2 });
+      console.error(`[whatsapp-read-tool] op=query scope=${requestedAccountId} storeAccount=${projection2.storeAccountId} managerPhonesBound=${managerPhonesBound} resultCount=${rows2.length} unresolvedSenders=${unresolvedSenders} ms=${ms2}`);
+      return c.json({ accountId: requestedAccountId, rows: rows2, unresolvedSenders, ms: ms2, managerPhonesBound });
     }
     let remoteJid;
     let accountId;
@@ -7590,7 +7803,13 @@ app2.get("/conversation-graph-state", async (c) => {
     accountId = validateAccountId(accountIdQuery ?? null);
     remoteJid = jid;
     cacheKey = isGroupJid(remoteJid) ? deriveCacheKey({ agentType: "public", accountId, senderPhone: "", isGroup: true, groupJid: remoteJid }) : deriveCacheKey({ agentType: "public", accountId, senderPhone: remoteJid.replace(/^(\d+)(?::\d+)?@s\.whatsapp\.net$/i, "$1"), isGroup: false });
-    const messages = readConversation(accountId, remoteJid);
+    const projection = projectionFor(accountId);
+    const storeMessages = readConversation(projection.storeAccountId, remoteJid);
+    const counterpartyBound = projection.managerPhones == null || counterpartyBoundToSubAccount(
+      projection.managerPhones,
+      conversationCounterpartyPhone(remoteJid, storeMessages[0]?.senderTelephone ?? "")
+    );
+    const messages = counterpartyBound ? storeMessages : [];
     const sessionId = messages[0]?.sessionId ?? null;
     const rows = messages.map((m) => ({
       messageId: m.messageId,
@@ -7600,12 +7819,12 @@ app2.get("/conversation-graph-state", async (c) => {
       body: m.body
     }));
     const ms = Date.now() - t0;
-    console.error(`[mcp:whatsapp] tool=whatsapp-conversation-graph-state cacheKey=${cacheKey} graphRows=${rows.length} sessionId=${sessionId ?? "null"} ms=${ms}`);
+    console.error(`[whatsapp-read-tool] op=query mode=single scope=${accountId} storeAccount=${projection.storeAccountId} graphRows=${rows.length} sessionId=${sessionId ?? "null"} ms=${ms}`);
     return c.json({
       cacheKey,
       sessionId,
       graphRows: rows,
-      cypher: `on-disk read: ~/.<brand>/data/whatsapp-messages/${accountId}/${remoteJid}.jsonl`,
+      cypher: `on-disk read: ~/.<brand>/data/whatsapp-messages/${projection.storeAccountId}/${remoteJid}.jsonl`,
       ms
     });
   } catch (err) {
@@ -7655,57 +7874,6 @@ import { basename as basename5, dirname as dirname4, isAbsolute, join as join14,
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
 import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve11 } from "path";
-
-// app/lib/whatsapp-reader/select-sessions.ts
-function isReaderChannelSession(role, channel) {
-  return role === "admin" && (channel === "whatsapp" || channel === "telegram") || role === "public" && (channel === "whatsapp" || channel === "webchat");
-}
-function selectReaderChannelSessions(rows) {
-  return rows.filter((r) => isReaderChannelSession(r.role, r.channel)).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).map((r) => ({
-    sessionId: r.sessionId,
-    projectDir: r.projectDir,
-    title: r.title,
-    senderId: r.senderId,
-    startedAt: r.startedAt,
-    channel: r.channel,
-    role: r.role,
-    operatorName: null,
-    whatsappName: null,
-    lastMessageAt: r.lastMessageAt,
-    modelGated: r.modelGated,
-    model: r.model,
-    source: "session"
-  }));
-}
-function buildStoreConversationRows(accountId, summaries) {
-  const rows = [];
-  for (const [remoteJid, { first, last, firstNamedSender }] of summaries) {
-    const scope = last.scope;
-    const isGroup = remoteJid.endsWith("@g.us");
-    const senderTelephone = isGroup ? null : remoteJid.endsWith("@s.whatsapp.net") ? jidToE164(remoteJid) ?? first.senderTelephone : first.senderTelephone;
-    rows.push({
-      sessionId: "",
-      projectDir: "",
-      title: remoteJid,
-      senderId: senderTelephone,
-      startedAt: first.dateSent,
-      channel: "whatsapp",
-      role: scope === "admin" ? "admin" : "public",
-      operatorName: null,
-      whatsappName: firstNamedSender,
-      lastMessageAt: last.dateSent,
-      modelGated: false,
-      model: null,
-      source: "store",
-      accountId,
-      remoteJid,
-      scope
-    });
-  }
-  return rows.sort((a, b) => (b.lastMessageAt ?? "").localeCompare(a.lastMessageAt ?? ""));
-}
-
-// server/routes/admin/sidebar-sessions.ts
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 function lastAssistantModel(body) {
   const lines = body.split("\n");
@@ -8179,7 +8347,7 @@ function unwrapChannel(text) {
   }
   return source ? { text: inner, source } : { text: inner };
 }
-var COMPOSED_ADMIN_FRAME = /^## Context\n([\s\S]*)\n\n## Instruction\n[\s\S]*$/;
+var COMPOSED_ADMIN_FRAME = /^(?:## Standing rules\n[\s\S]*?\n\n)?## Context\n([\s\S]*)\n\n## Instruction\n[\s\S]*$/;
 var UPLOAD_ANNOTATION = /(?:\n\n)?\[The operator uploaded \d+ file\(s\): [\s\S]*\]$/;
 function rawFromComposedAdminFrame(text) {
   const context = text.match(COMPOSED_ADMIN_FRAME)?.[1];
@@ -8546,7 +8714,7 @@ app4.get("/conversations", requireAdminSession, async (c) => {
       managerPhonesBound = managerPhones.length;
       if (managerPhones.length > 0) {
         managedRows = buildStoreConversationRows(houseId, readConversationSummaries(houseId)).filter(
-          (r) => r.senderId != null && managerPhones.some((mp) => phonesMatch(mp, r.senderId))
+          (r) => counterpartyBoundToSubAccount(managerPhones, r.senderId)
         );
       }
     }
@@ -15000,7 +15168,7 @@ app21.post("/rename", requireAdminSession, async (c) => {
 var files_default = app21;
 
 // ../lib/graph-search/src/index.ts
-var import_dist = __toESM(require_dist());
+var import_dist = __toESM(require_dist2());
 import { int } from "neo4j-driver";
 
 // ../lib/graph-search/src/rrf-fusion.ts
@@ -15898,8 +16066,8 @@ var graph_search_default = app22;
 import neo4j2 from "neo4j-driver";
 
 // app/lib/graph-labels.ts
-var import_dist2 = __toESM(require_dist2(), 1);
-var import_dist3 = __toESM(require_dist2(), 1);
+var import_dist2 = __toESM(require_dist3(), 1);
+var import_dist3 = __toESM(require_dist3(), 1);
 var HIDDEN_BY_DEFAULT_LABELS = Object.freeze(
   /* @__PURE__ */ new Set(["Chunk", "GraphPreference"])
 );
@@ -17950,7 +18118,10 @@ async function managerSpawn(opts) {
       visitorId: opts.visitorId,
       name: opts.name,
       webchatChannel: opts.webchatChannel,
-      previousContext: opts.previousContext
+      previousContext: opts.previousContext,
+      initialMessage: opts.initialMessage,
+      passive: opts.passive,
+      targetAccountId: opts.targetAccountId
     })
   }).catch((err) => ({ __throw: err instanceof Error ? err.message : String(err) }));
   if ("__throw" in res) {
@@ -20438,7 +20609,7 @@ app55.get("/free-busy", async (c) => {
 var calendar_public_default = app55;
 
 // app/lib/graph-health.ts
-var import_dist4 = __toESM(require_dist3(), 1);
+var import_dist4 = __toESM(require_dist4(), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 function renderLabelTop(rows) {
   return rows.map((b) => {
@@ -21050,6 +21221,9 @@ var InboundHub = class {
   }
 };
 
+// app/lib/whatsapp/gateway/wa-gateway.ts
+var import_dist5 = __toESM(require_dist(), 1);
+
 // node_modules/hono/dist/utils/stream.js
 var StreamingApi = class {
   writer;
@@ -21380,6 +21554,23 @@ var WaGateway = class {
   }
   /** Handle one inbound admin WhatsApp message. */
   async handleInbound(input) {
+    if (input.passive) {
+      const msgId = `wa-${++this.seq}`;
+      await this.deps.ensureChannelSession({
+        accountId: input.accountId,
+        effectiveAccountId: input.effectiveAccountId,
+        senderId: input.senderId,
+        // agentType stays 'admin'; the constraint rides the passive flag.
+        role: "admin",
+        personId: null,
+        gatewayUrl: this.deps.gatewayUrl,
+        serverPath: this.deps.serverPath,
+        passive: true,
+        text: input.text,
+        msgId
+      });
+      return;
+    }
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.senderId);
     const willDeliverNow = this.hub.isReady(input.senderId);
@@ -21388,13 +21579,22 @@ var WaGateway = class {
     const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
     this.docContexts.set(input.senderId, { accountId: input.accountId, maxyAccountId: input.effectiveAccountId });
+    let standingRules;
+    if (this.deps.fetchStandingRules) {
+      standingRules = await this.deps.fetchStandingRules(input.effectiveAccountId) || void 0;
+      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      console.error(
+        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} capped=${injected >= import_dist5.INJECTION_RULE_CAP}`
+      );
+    }
     this.hub.deliver(
       {
         senderId: input.senderId,
         text: input.text,
         waMessageId: `wa-${++this.seq}`,
         media: input.media,
-        source
+        source,
+        standingRules
       },
       Date.now()
     );
@@ -21455,8 +21655,8 @@ function buildWaSpawnRequest(input) {
 
 // app/lib/whatsapp/inbound/route-decision.ts
 function decideWaRoute(msg) {
-  if (msg.agentType === "admin") return { action: "route", role: "admin", personId: null };
-  if (msg.personId && msg.personId.length > 0) return { action: "route", role: "public", personId: msg.personId };
+  if (msg.agentType === "admin") return { action: "route", role: "admin", personId: null, passive: msg.passive === true };
+  if (msg.personId && msg.personId.length > 0) return { action: "route", role: "public", personId: msg.personId, passive: false };
   return { action: "drop", reason: "public-unresolved" };
 }
 
@@ -21617,6 +21817,9 @@ var InboundHub2 = class {
   }
 };
 
+// app/lib/webchat/gateway/webchat-gateway.ts
+var import_dist6 = __toESM(require_dist(), 1);
+
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
   const app57 = new Hono();
@@ -22051,8 +22254,16 @@ var WebchatGateway = class _WebchatGateway {
     const bytes = Buffer.byteLength(input.text, "utf8");
     const hadSubscriber = this.hub.hasSubscriber(input.key);
     const willDeliverNow = this.hub.isReady(input.key);
+    let standingRules;
+    if (input.role === "admin" && this.deps.fetchStandingRules) {
+      standingRules = await this.deps.fetchStandingRules(input.accountId) || void 0;
+      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      console.error(
+        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
+      );
+    }
     this.hub.deliver(
-      { key: input.key, text: input.text, messageId: `wc-${++this.seq}` },
+      { key: input.key, text: input.text, messageId: `wc-${++this.seq}`, standingRules },
       Date.now()
     );
     if (willDeliverNow) this.lastDeliveredAt.set(input.key, Date.now());
@@ -22570,6 +22781,9 @@ var InboundHub3 = class {
   }
 };
 
+// app/lib/telegram/gateway/telegram-gateway.ts
+var import_dist7 = __toESM(require_dist(), 1);
+
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
   const app57 = new Hono();
@@ -22700,8 +22914,16 @@ var TelegramGateway = class {
     const willDeliverNow = this.hub.isReady(input.senderId);
     const source = input.source ?? "user";
     this.replies.set(input.senderId, input.reply);
+    let standingRules;
+    if (input.role === "admin" && this.deps.fetchStandingRules) {
+      standingRules = await this.deps.fetchStandingRules(input.accountId) || void 0;
+      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      console.error(
+        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
+      );
+    }
     this.hub.deliver(
-      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source },
+      { key: input.senderId, text: input.text, messageId: `tg-${++this.seq}`, source, standingRules },
       Date.now()
     );
     console.error(
@@ -23057,7 +23279,8 @@ async function firePublicSessionEndReview(input) {
 // app/lib/whatsapp/inbound/channel-admin-binding-drift.ts
 function findAccountManagerDrift(accountManagers, adminPhones, validAccountIds) {
   const drift = [];
-  for (const [phone, managesAccount] of Object.entries(accountManagers)) {
+  for (const [phone, entry] of Object.entries(accountManagers)) {
+    const managesAccount = typeof entry === "string" ? entry : entry.managesAccount;
     if (!validAccountIds.includes(managesAccount)) {
       drift.push({ phone, managesAccount, reason: "not-in-registry" });
     } else if (adminPhones.some((a) => phonesMatch(a, phone))) {
@@ -23466,7 +23689,42 @@ function isPublicHost(host) {
 }
 var app56 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
+async function fetchAccountStandingRules(accountId) {
+  const session = getSession();
+  try {
+    const rules = await (0, import_dist8.activeRuleSet)(session, accountId);
+    return (0, import_dist8.formatStandingRulesBlock)(rules);
+  } catch (err) {
+    console.error(
+      `[preference-inject] op=fetch-failed accountId=${accountId} error=${err instanceof Error ? err.message : String(err)}`
+    );
+    return "";
+  } finally {
+    await session.close();
+  }
+}
+async function recordPassiveDispatch(input) {
+  const session = getSession();
+  try {
+    await session.run(
+      `CREATE (d:PassiveDispatch {
+         accountId: $accountId,
+         sessionId: $sessionId,
+         msgId: $msgId,
+         dispatchedAt: $dispatchedAt
+       })`,
+      { ...input, dispatchedAt: (/* @__PURE__ */ new Date()).toISOString() }
+    );
+  } catch (err) {
+    console.error(
+      `[wa-passive] op=ledger-write-failed account=${input.accountId} sessionId=${input.sessionId} error=${err instanceof Error ? err.message : String(err)}`
+    );
+  } finally {
+    await session.close();
+  }
+}
 var waGateway = new WaGateway({
+  fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
   serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
@@ -23487,7 +23745,50 @@ var waGateway = new WaGateway({
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
-  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath }) => {
+  ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId }) => {
+    if (passive) {
+      const phoneHash = createHash6("sha256").update(senderId).digest("hex").slice(0, 12);
+      const prompt = (text ?? "").trim();
+      if (prompt.length === 0) {
+        console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=empty-text`);
+        return;
+      }
+      let raisedByPersonId;
+      try {
+        raisedByPersonId = await ensureManagerPerson(effectiveAccountId, senderId) ?? void 0;
+      } catch (err) {
+        console.error(`[wa-passive] op=raised-by-error account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} error=${err instanceof Error ? err.message : String(err)}`);
+      }
+      if (!raisedByPersonId) {
+        console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=raised-by-unresolved`);
+        return;
+      }
+      console.error(`[wa-passive] op=dispatch account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} raisedBy=${raisedByPersonId}`);
+      const result2 = await managerSpawn({
+        senderId,
+        role: "public",
+        channel: "whatsapp",
+        accountId: effectiveAccountId,
+        targetAccountId: effectiveAccountId,
+        agentSlug: "passive",
+        initialMessage: prompt,
+        passive: true,
+        // Task 1493 — the manager's elementId rides the personId field
+        // end-to-end (managerSpawn → /public-spawn → spawn args → work env as
+        // RAISED_BY_PERSON_ID). It is also this passive session's identity.
+        personId: raisedByPersonId
+      });
+      if ("error" in result2) {
+        console.error(`[wa-passive] op=dispatch-failed account=${effectiveAccountId} msgId=${msgId ?? "none"} error=${result2.error}`);
+        return;
+      }
+      await recordPassiveDispatch({
+        accountId: effectiveAccountId,
+        sessionId: result2.sessionId,
+        msgId: msgId ?? ""
+      });
+      return;
+    }
     if (role === "admin") {
       const managesAccount = effectiveAccountId !== accountId ? effectiveAccountId : "none";
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
@@ -23524,6 +23825,7 @@ var waGateway = new WaGateway({
 app56.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
+  fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: webchatGatewayUrl(),
   serverPath: webchatServerPath(),
   ensureChannelSession: async ({ accountId, key, role, adminUserId, gatewayUrl, serverPath, sessionId, public: pub }) => {
@@ -23609,6 +23911,7 @@ webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
 var telegramGateway = new TelegramGateway({
+  fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: telegramGatewayUrl(),
   serverPath: telegramServerPath(),
   ensureChannelSession: async ({ accountId, senderId, role, personId, chatId, gatewayUrl, serverPath }) => {
@@ -23663,10 +23966,11 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     if (!sent.ok) throw new Error(sent.error ?? "telegram send failed");
   },
   effectiveAccountFor: (accountId, accountDir, destination) => {
-    const managedSub = managedAccountFor(readAccountManagers(accountDir), destination);
-    if (managedSub === null) return accountId;
-    if (!isValidAccountId(managedSub)) return null;
-    return managedSub;
+    const managed = managedAccountFor(readAccountManagers(accountDir), destination);
+    if (managed === null) return accountId;
+    if (managed.mode === "passive") return null;
+    if (!isValidAccountId(managed.account)) return null;
+    return managed.account;
   }
 });
 app56.route("/api/channel/schedule-inject", scheduleInjectRoutes);
@@ -24716,7 +25020,7 @@ init({
       console.error(`[whatsapp:route] skipped reason=owner-mirror senderId=${msg.senderPhone}`);
       return;
     }
-    const decision = decideWaRoute(msg);
+    const decision = decideWaRoute({ agentType: msg.agentType, personId: msg.personId, passive: msg.passive });
     if (decision.action === "drop") {
       console.error(`[whatsapp:route] op=dropped reason=${decision.reason} senderId=${msg.senderPhone}`);
       return;
@@ -24734,7 +25038,7 @@ init({
       console.error(`[whatsapp:route] op=routed agentType=public personId=${decision.personId} senderId=${msg.senderPhone}`);
     }
     try {
-      void msg.composing().catch(() => {
+      if (!decision.passive) void msg.composing().catch(() => {
       });
       await waGateway.handleInbound({
         accountId: msg.accountId,
@@ -24742,6 +25046,9 @@ init({
         senderId: msg.senderPhone,
         role: decision.role,
         personId: decision.personId,
+        // Task 1483 — a passive account-manager inbound routes to a fresh
+        // constrained one-shot spawn instead of the shared rc-daemon path.
+        passive: decision.passive,
         text: msg.text,
         reply: msg.reply,
         media: msg.media