@rubytech/create-maxy-code 0.1.429 → 0.1.432

package/payload/server/server.js

@@ -1383,9 +1383,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync35, existsSync as existsSync33, watchFile } from "fs";
+import { readFileSync as readFileSync35, existsSync as existsSync34, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { resolve as resolve33, join as join35, basename as basename13 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
@@ -1763,7 +1763,7 @@ async function ensureAuth() {
 }
 
 // server/routes/health.ts
-import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync9 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -3494,7 +3494,7 @@ function readAllConversations(platformAccountId) {
 var TAG7 = "[whatsapp-persist]";
 var sessionWriteLocks = /* @__PURE__ */ new Map();
 async function persistWhatsAppMessage(input) {
-  if (!input.body || !input.msgKeyId) return null;
+  if (!input.body && !input.attachmentId || !input.msgKeyId) return null;
   const messageId = `whatsapp-live:${input.accountId}:${input.remoteJid}:${input.msgKeyId}`;
   const canonicalRemoteJid = input.canonicalRemoteJid;
   const keyResolved = canonicalRemoteJid !== input.remoteJid ? "lid2pn" : "none";
@@ -3564,6 +3564,7 @@ async function persistWhatsAppMessage(input) {
       quotedId: input.quoted?.id ?? null,
       quotedSender: input.quoted?.sender ?? null,
       scope,
+      ...input.attachmentId ? { attachmentId: input.attachmentId } : {},
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const altDedupeRemoteJids = canonicalRemoteJid !== input.remoteJid ? [input.remoteJid] : [];
@@ -3781,554 +3782,945 @@ function isCustomerTurnSuppressed(role, managedService) {
 }
 
 // app/lib/whatsapp/inbound/media.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { writeFile, mkdir } from "fs/promises";
-import { join as join5 } from "path";
+import { randomUUID as randomUUID4, createHash } from "crypto";
+import { writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { join as join6 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
   normalizeMessageContent as normalizeMessageContent2
 } from "@whiskeysockets/baileys";
-var TAG9 = "[whatsapp:media]";
-var MEDIA_DIR = "/tmp/maxy-media";
-function mimeToExt(mimetype) {
-  const map = {
-    "image/jpeg": "jpg",
-    "image/png": "png",
-    "image/webp": "webp",
-    "image/gif": "gif",
-    "audio/ogg; codecs=opus": "ogg",
-    "audio/mpeg": "mp3",
-    "audio/mp4": "m4a",
-    "video/mp4": "mp4",
-    "application/pdf": "pdf",
-    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": "docx",
-    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "xlsx"
-  };
-  return map[mimetype] ?? mimetype.split("/").pop()?.replace(/[^a-z0-9]/gi, "") ?? "bin";
-}
-function getDownloadableContent(message) {
-  const msg = message;
-  if (msg.imageMessage) return { downloadable: msg.imageMessage, mediaType: "image" };
-  if (msg.videoMessage) return { downloadable: msg.videoMessage, mediaType: "video" };
-  if (msg.audioMessage) return { downloadable: msg.audioMessage, mediaType: "audio" };
-  if (msg.documentMessage) return { downloadable: msg.documentMessage, mediaType: "document" };
-  if (msg.stickerMessage) return { downloadable: msg.stickerMessage, mediaType: "sticker" };
-  return void 0;
+
+// app/lib/attachments.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdir, writeFile } from "fs/promises";
+import { realpathSync as realpathSync2, existsSync as existsSync4 } from "fs";
+import { resolve as resolve6, extname } from "path";
+
+// app/lib/data-path.ts
+import { realpathSync } from "fs";
+import { resolve as resolve5, normalize, sep as sep2, relative, basename, join as join5 } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "../platform");
+var DATA_ROOT = resolve5(PLATFORM_ROOT3, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve5(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["accounts"]);
+var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function crossesForeignAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
+  if (segs.length < 2) return false;
+  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
+  const owner = segs[1];
+  if (!ACCOUNT_UUID_RE.test(owner)) return false;
+  return owner !== accountId;
 }
-async function streamToBuffer(stream2) {
-  const chunks = [];
-  for await (const chunk of stream2) {
-    chunks.push(Buffer.from(chunk));
-  }
-  return Buffer.concat(chunks);
+function isWithinOwnAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
+  return segs.length >= 2 && segs[0] === "accounts" && segs[1] === accountId;
 }
-async function downloadInboundMedia(msg, sock, opts) {
-  const rawMessage = msg.message;
-  if (!rawMessage) return void 0;
-  const content = normalizeMessageContent2(rawMessage);
-  if (!content) return void 0;
-  const inner = content;
-  const mimetype = inner.imageMessage?.mimetype ?? inner.videoMessage?.mimetype ?? inner.audioMessage?.mimetype ?? inner.documentMessage?.mimetype ?? inner.stickerMessage?.mimetype ?? void 0;
-  if (!inner.imageMessage && !inner.videoMessage && !inner.audioMessage && !inner.documentMessage && !inner.stickerMessage) {
-    return void 0;
+function resolveUnderRoot(raw, rootAbs, rootLabel) {
+  const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
+  const absolute = resolve5(rootAbs, cleaned);
+  let rootReal;
+  try {
+    rootReal = realpathSync(rootAbs);
+  } catch (err) {
+    return {
+      ok: false,
+      status: 500,
+      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
+    };
   }
-  const maxBytes = opts?.maxBytes ?? 50 * 1024 * 1024;
+  let resolvedReal;
   try {
-    let buffer = await downloadMediaMessage(
-      msg,
-      "buffer",
-      {},
-      {
-        reuploadRequest: sock.updateMediaMessage,
-        logger: sock.logger
-      }
-    );
-    if (!buffer || buffer.length === 0) {
-      console.error(`${TAG9} primary download returned empty, trying direct fallback`);
-      const downloadable = getDownloadableContent(content);
-      if (downloadable) {
-        try {
-          const stream2 = await downloadContentFromMessage(downloadable.downloadable, downloadable.mediaType);
-          buffer = await streamToBuffer(stream2);
-        } catch (fallbackErr) {
-          console.error(`${TAG9} direct download fallback failed: ${String(fallbackErr)}`);
-        }
+    resolvedReal = realpathSync(absolute);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep2)) {
+        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
       }
+      return { ok: false, status: 404, error: "Not found" };
     }
-    if (!buffer || buffer.length === 0) {
-      console.error(`${TAG9} download failed: empty buffer for ${mimetype ?? "unknown"}`);
-      return void 0;
-    }
-    if (buffer.length > maxBytes) {
-      const sizeMB = (buffer.length / (1024 * 1024)).toFixed(1);
-      const limitMB = (maxBytes / (1024 * 1024)).toFixed(0);
-      console.error(`${TAG9} media too large type=${mimetype ?? "unknown"} size=${sizeMB}MB limit=${limitMB}MB`);
-      return void 0;
-    }
-    await mkdir(MEDIA_DIR, { recursive: true });
-    const ext = mimeToExt(mimetype ?? "application/octet-stream");
-    const filename = `${randomUUID3()}.${ext}`;
-    const filePath = join5(MEDIA_DIR, filename);
-    await writeFile(filePath, buffer);
-    const sizeKB = (buffer.length / 1024).toFixed(0);
-    console.error(`${TAG9} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
     return {
-      path: filePath,
-      mimetype: mimetype ?? "application/octet-stream",
-      size: buffer.length
+      ok: false,
+      status: 500,
+      error: err instanceof Error ? err.message : String(err)
     };
-  } catch (err) {
-    console.error(`${TAG9} media download failed type=${mimetype ?? "unknown"} error=${String(err)}`);
-    return void 0;
   }
+  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
+    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
+  }
+  const relPath = relative(rootReal, resolvedReal) || ".";
+  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
+}
+function resolveDataPath(raw) {
+  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
+}
+function resolveClaudeUploadsPath(raw) {
+  if (!CLAUDE_UPLOADS_ROOT) {
+    return { ok: false, status: 404, error: "Not found" };
+  }
+  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
+}
+function scratchpadTmpBase() {
+  return process.env.MAXY_SCRATCHPAD_BASE ?? "/tmp";
+}
+function sessionScratchpadRoot(projectDir, sessionId) {
+  const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
+  return join5(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
+}
+function resolveScratchpadPath(raw, scratchpadRootAbs) {
+  return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
 }
 
-// app/lib/whatsapp/inbound/debounce.ts
-var TAG10 = "[whatsapp:debounce]";
-var STT_TAG = "[whatsapp:stt-await]";
-function createInboundDebouncer(opts) {
-  const { debounceMs, buildKey, onFlush, onError } = opts;
-  const awaitTimeoutMs = opts.awaitTimeoutMs ?? 3e4;
-  const pending = /* @__PURE__ */ new Map();
-  const pendingAwaits = /* @__PURE__ */ new Map();
-  let destroyed = false;
-  async function flushKey(key) {
-    const awaiting = pendingAwaits.get(key);
-    if (awaiting) {
-      const start = Date.now();
-      try {
-        await Promise.race([
-          awaiting,
-          new Promise(
-            (_, reject) => setTimeout(() => reject(new Error("stt-await-timeout")), awaitTimeoutMs)
-          )
-        ]);
-        console.error(`${STT_TAG} resolved key=${key} waited_ms=${Date.now() - start}`);
-      } catch {
-        console.error(`${STT_TAG} timeout key=${key} waited_ms=${Date.now() - start}`);
-      }
-      pendingAwaits.delete(key);
-    }
-    const batch = pending.get(key);
-    if (!batch) return;
-    clearTimeout(batch.timer);
-    pending.delete(key);
-    const batchSize = batch.entries.length;
-    try {
-      console.error(`${TAG10} debounce flush key=${key} batchSize=${batchSize}`);
-      const result = onFlush(batch.entries);
-      if (result && typeof result.catch === "function") {
-        result.catch(onError);
-      }
-    } catch (err) {
-      onError(err);
+// app/lib/doc-to-text.ts
+import { unzipSync, strFromU8 } from "fflate";
+var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+var ODT = "application/vnd.oasis.opendocument.text";
+var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
+  DOCX,
+  ODT,
+  "text/rtf",
+  "application/rtf"
+]);
+function bareMime(mimeType) {
+  return mimeType.split(";")[0].trim().toLowerCase();
+}
+function unescapeXml(s) {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function unzipEntry(buffer, entry) {
+  const files = unzipSync(new Uint8Array(buffer));
+  const bytes = files[entry];
+  if (!bytes) throw new Error(`zip entry not found: ${entry}`);
+  return strFromU8(bytes);
+}
+function docxToText(buffer) {
+  const xml = unzipEntry(buffer, "word/document.xml");
+  const paras = [];
+  for (const p of xml.split("</w:p>")) {
+    const withBreaks = p.replace(/<w:tab\b[^>]*\/?>/g, "	").replace(/<w:br\b[^>]*\/?>/g, "\n");
+    let line = "";
+    for (const m of withBreaks.matchAll(/<w:t\b[^>]*>([\s\S]*?)<\/w:t>/g)) {
+      line += unescapeXml(m[1]);
     }
+    if (line.length > 0) paras.push(line);
   }
-  async function flush() {
-    const keys = Array.from(pending.keys());
-    await Promise.all(keys.map((key) => flushKey(key)));
-  }
-  function enqueue(msg) {
-    if (destroyed) return;
-    if (debounceMs <= 0) {
-      try {
-        const result = onFlush([msg]);
-        if (result && typeof result.catch === "function") {
-          result.catch(onError);
+  return paras.join("\n");
+}
+function odtToText(buffer) {
+  const xml = unzipEntry(buffer, "content.xml");
+  const body = xml.replace(/^[\s\S]*?<office:text\b[^>]*>/, "").replace(/<\/office:text>[\s\S]*$/, "");
+  const withBreaks = body.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	").replace(/<\/text:(?:p|h)>/g, "\n");
+  const stripped = withBreaks.replace(/<[^>]+>/g, "");
+  return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
+}
+var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
+function stripRtfDestinations(s) {
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (ch === "\\" && i + 1 < s.length) {
+      out += ch + s[i + 1];
+      i++;
+      continue;
+    }
+    if (ch === "{" && RTF_DROP_DEST.test(s.slice(i + 1))) {
+      let depth = 1;
+      let j = i + 1;
+      for (; j < s.length && depth > 0; j++) {
+        if (s[j] === "\\") {
+          j++;
+          continue;
         }
-      } catch (err) {
-        onError(err);
+        if (s[j] === "{") depth++;
+        else if (s[j] === "}") depth--;
       }
-      return;
+      i = j - 1;
+      continue;
     }
-    const key = buildKey(msg);
-    if (!key) {
-      try {
-        const result = onFlush([msg]);
-        if (result && typeof result.catch === "function") {
-          result.catch(onError);
-        }
-      } catch (err) {
-        onError(err);
-      }
-      return;
-    }
-    const existing = pending.get(key);
-    if (existing) {
-      existing.entries.push(msg);
-      clearTimeout(existing.timer);
-      existing.timer = setTimeout(() => {
-        flushKey(key).catch(onError);
-      }, debounceMs);
-    } else {
-      const timer2 = setTimeout(() => {
-        flushKey(key).catch(onError);
-      }, debounceMs);
-      pending.set(key, { entries: [msg], timer: timer2 });
-    }
-  }
-  function registerPending(key, promise) {
-    if (destroyed) return;
-    const existing = pendingAwaits.get(key);
-    if (existing) {
-      pendingAwaits.set(key, Promise.all([existing, promise]).then(() => {
-      }));
-    } else {
-      pendingAwaits.set(key, promise);
-    }
-    console.error(`${STT_TAG} pending key=${key}`);
-  }
-  async function destroy() {
-    if (destroyed) return;
-    destroyed = true;
-    await flush();
+    out += ch;
   }
-  return { enqueue, flush, destroy, registerPending };
+  return out;
 }
-
-// app/lib/whatsapp/inbound/combine-batch.ts
-function combineInboundBatch(entries) {
-  const last = entries[entries.length - 1];
-  const combinedText = entries.map((e) => e.text).filter(Boolean).join("\n");
-  const media = entries.flatMap((e) => e.media);
-  return { ...last, text: combinedText, media };
+function rtfToText(rtf) {
+  let s = stripRtfDestinations(rtf);
+  s = s.replace(/\\par[d]?\b/g, "\n").replace(/\\line\b/g, "\n").replace(/\\tab\b/g, "	");
+  s = s.replace(/\\'([0-9a-fA-F]{2})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)));
+  s = s.replace(/\\[a-zA-Z]+-?\d* ?/g, "");
+  s = s.replace(/\\([{}\\])/g, "$1").replace(/[{}]/g, "");
+  return s.replace(/[ \t]{2,}/g, " ").replace(/\n{3,}/g, "\n\n").trim();
+}
+function docToText(buffer, mimeType) {
+  const mime = bareMime(mimeType);
+  if (mime === DOCX) return docxToText(buffer);
+  if (mime === ODT) return odtToText(buffer);
+  if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
+  return null;
 }
 
-// app/lib/whatsapp/opening-hours.ts
-var TAG11 = "[whatsapp:hours]";
-async function isBusinessOpen(accountId) {
-  try {
-    const timezone = await resolveTimezone(accountId);
-    const now = /* @__PURE__ */ new Date();
-    const dayOfWeek = getDayOfWeek(now, timezone);
-    const previousDayOfWeek = getPreviousDayOfWeek(now, timezone);
-    const currentTime = getCurrentTime(now, timezone);
-    const session = getSession();
-    try {
-      const result = await session.run(
-        `MATCH (b:LocalBusiness {accountId: $accountId})
-         OPTIONAL MATCH (b)-[:HAS_HOURS]->(hours:OpeningHoursSpecification)
-         WHERE hours.dayOfWeek IN [$dayOfWeek, $previousDayOfWeek]
-         RETURN hours.dayOfWeek AS dayOfWeek, hours.opens AS opens, hours.closes AS closes`,
-        { accountId, dayOfWeek, previousDayOfWeek }
-      );
-      if (result.records.length === 0) {
-        console.error(`${TAG11} [${accountId}] business hours check: no opening hours configured, treating as open`);
-        return { open: true, reason: "no opening hours configured" };
-      }
-      const specs = result.records.filter((r) => r.get("opens") != null && r.get("closes") != null).map((r) => ({
-        day: String(r.get("dayOfWeek")).trim(),
-        opens: String(r.get("opens")).trim(),
-        closes: String(r.get("closes")).trim()
-      }));
-      if (specs.length === 0) {
-        console.error(`${TAG11} [${accountId}] business hours check: no opening hours configured, treating as open`);
-        return { open: true, reason: "no opening hours configured" };
-      }
-      for (const spec of specs) {
-        if (!spec.opens || !spec.closes || spec.opens === spec.closes) continue;
-        const isYesterday = spec.day === previousDayOfWeek;
-        if (isYesterday) {
-          if (spec.opens > spec.closes && currentTime < spec.closes) {
-            const hoursStr = `${spec.opens}-${spec.closes} (${spec.day})`;
-            console.error(
-              `${TAG11} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
-            );
-            return {
-              open: true,
-              reason: "within business hours",
-              dayOfWeek,
-              currentTime,
-              matchedHours: hoursStr
-            };
-          }
-        } else if (isTimeInRange(currentTime, spec.opens, spec.closes)) {
-          const hoursStr = `${spec.opens}-${spec.closes}`;
-          console.error(
-            `${TAG11} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
-          );
-          return {
-            open: true,
-            reason: "within business hours",
-            dayOfWeek,
-            currentTime,
-            matchedHours: hoursStr
-          };
-        }
-      }
-      const todaySpecs = specs.filter((s) => s.day === dayOfWeek);
-      const allHours = todaySpecs.map((s) => `${s.opens}-${s.closes}`).join(", ") || "none today";
-      console.error(
-        `${TAG11} [${accountId}] business hours check: closed (day=${dayOfWeek}, time=${currentTime}, hours=${allHours})`
-      );
-      return {
-        open: false,
-        reason: "outside business hours",
-        dayOfWeek,
-        currentTime,
-        matchedHours: allHours
-      };
-    } finally {
-      await session.close();
-    }
-  } catch (err) {
-    console.error(
-      `${TAG11} [${accountId}] business hours check failed, treating as open: ${err instanceof Error ? err.message : String(err)}`
+// app/lib/attachments.ts
+function uploadsDirFor(accountId, subPath, attachmentId) {
+  return subPath ? resolve6(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve6(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+}
+var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "application/pdf",
+  "text/plain",
+  "text/markdown",
+  "text/csv",
+  "text/html",
+  "text/calendar",
+  "application/zip",
+  "application/x-zip-compressed",
+  // Task 1347 — Word/OpenDocument/RTF text documents. The bytes are converted to
+  // a readable-text sibling at ingestion (writeAttachment → doc-to-text.ts)
+  // because the on-device Read tool cannot parse the binary containers. rtf is
+  // reported by browsers as either text/rtf or application/rtf.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.oasis.opendocument.text",
+  "text/rtf",
+  "application/rtf",
+  // Task 1240 — voice recordings persist as playable clips in the admin bubble.
+  // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
+  "audio/ogg",
+  "audio/opus",
+  "audio/webm",
+  "audio/mp4",
+  "audio/x-m4a",
+  "audio/mpeg",
+  "audio/wav",
+  "video/mp4"
+]);
+var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
+var MAX_FILES_PER_MESSAGE = 5;
+var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
+var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
+var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
+function assertSupportedMime(mimeType) {
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (!SUPPORTED_MIME_TYPES.has(bare)) {
+    throw new Error(
+      `Unsupported file type: "${mimeType}". Supported types: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
     );
-    return { open: true, reason: "hours check failed (treating as open)" };
   }
 }
-async function resolveTimezone(accountId) {
-  try {
-    const tz = await getUserTimezone(accountId);
-    if (tz) {
-      Intl.DateTimeFormat("en-US", { timeZone: tz });
-      return tz;
-    }
-  } catch {
+function isSupportedMime(mimeType) {
+  return SUPPORTED_MIME_TYPES.has(mimeType.split(";")[0].trim().toLowerCase());
+}
+async function storeMediaBuffer(accountId, attachmentId, filename, mimeType, buffer) {
+  assertSupportedMime(mimeType);
+  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `Media exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
+    );
   }
-  return Intl.DateTimeFormat().resolvedOptions().timeZone;
+  return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId, true);
 }
-function getDayOfWeek(date, timezone) {
-  return new Intl.DateTimeFormat("en-US", { weekday: "long", timeZone: timezone }).format(date);
+function attachmentExists(accountId, attachmentId) {
+  return existsSync4(resolve6(uploadsDirFor(accountId, "", attachmentId), `${attachmentId}.meta.json`));
 }
-function getPreviousDayOfWeek(date, timezone) {
-  const yesterday = new Date(date.getTime() - 24 * 60 * 60 * 1e3);
-  return getDayOfWeek(yesterday, timezone);
+async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId, skipDocToText = false) {
+  const attachmentId = explicitId ?? randomUUID3();
+  const dir = uploadsDirFor(accountId, subPath, attachmentId);
+  await mkdir(dir, { recursive: true });
+  const ext = extname(filename) || "";
+  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
+  const meta = {
+    attachmentId,
+    scope: subPath || accountId,
+    filename,
+    mimeType,
+    sizeBytes,
+    storedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeFile(storagePath, buffer);
+  await writeFile(metaPath, JSON.stringify(meta, null, 2));
+  let readableTextPath;
+  if (!skipDocToText && CONVERTIBLE_DOC_MIME.has(mimeType.split(";")[0].trim().toLowerCase())) {
+    const text = docToText(buffer, mimeType);
+    if (text) {
+      readableTextPath = resolve6(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
+      await writeFile(readableTextPath, text);
+    }
+  }
+  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
 }
-function getCurrentTime(date, timezone) {
-  const parts = new Intl.DateTimeFormat("en-US", {
-    hour: "2-digit",
-    minute: "2-digit",
-    hour12: false,
-    timeZone: timezone
-  }).formatToParts(date);
-  const hour = parts.find((p) => p.type === "hour")?.value ?? "00";
-  const minute = parts.find((p) => p.type === "minute")?.value ?? "00";
-  return `${hour}:${minute}`;
+async function storeAttachment(accountId, file) {
+  assertSupportedMime(file.type);
+  if (file.size > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  const buffer = Buffer.from(await file.arrayBuffer());
+  return writeAttachment(accountId, "", file.name, file.type, file.size, buffer);
 }
-function isTimeInRange(time, opens, closes) {
-  if (opens <= closes) {
-    return time >= opens && time < closes;
+async function storePublicAttachment(accountId, sessionId, file, buffer) {
+  assertSupportedMime(file.type);
+  if (file.size > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
+    );
   }
-  return time >= opens || time < closes;
+  return writeAttachment(accountId, `public/${sessionId}`, file.name, file.type, file.size, buffer);
 }
-
-// app/lib/stt/index.ts
-import { execFile } from "child_process";
-import { unlink, stat } from "fs/promises";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var TAG12 = "[stt]";
-var WHISPER_BINARY = process.env.WHISPER_BINARY ?? "/opt/whisper.cpp/build/bin/whisper-cli";
-var WHISPER_MODEL = process.env.WHISPER_MODEL ?? "/opt/whisper.cpp/models/ggml-base.bin";
-var WHISPER_TIMEOUT_MS = 20 * 60 * 1e3;
-var SPECIAL_TOKEN_RE = /\[_[A-Z]+(?:_\d+)?_?\]/g;
-function stripSpecialTokens(input) {
-  const matches = input.match(SPECIAL_TOKEN_RE);
-  const count = matches ? matches.length : 0;
-  if (!count) return { text: input, count: 0 };
-  const text = input.replace(SPECIAL_TOKEN_RE, "").replace(/[ \t]{2,}/g, " ").trim();
-  return { text, count };
+var MIME_BY_EXT = {
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".xml": "text/xml",
+  ".zip": "application/zip",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".rtf": "text/rtf",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".ics": "text/calendar"
+};
+function detectMimeType(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  return MIME_BY_EXT[ext] ?? "application/octet-stream";
 }
-async function transcribe(audioPath, mimetype) {
-  const startMs = Date.now();
-  let audioBytes = 0;
-  try {
-    const s = await stat(audioPath);
-    audioBytes = s.size;
-  } catch {
-    console.error(`${TAG12} failed: file not readable path=${audioPath}`);
-    return void 0;
+function validateFilePathInAccount(filePath, accountDir) {
+  const resolved = realpathSync2(filePath);
+  const accountResolved = realpathSync2(accountDir);
+  if (!resolved.startsWith(accountResolved + "/")) {
+    throw new Error(`File path is outside the account directory`);
   }
-  console.error(
-    `${TAG12} start provider=whisper-local audio_bytes=${audioBytes} mimetype=${mimetype} path=${audioPath}`
+  return resolved;
+}
+async function storeComponentArtefact(accountId, attachmentId, mimeType, content, filename) {
+  const buffer = Buffer.from(content, "utf-8");
+  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  const dir = uploadsDirFor(accountId, "", attachmentId);
+  await mkdir(dir, { recursive: true });
+  const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
+  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
+  const meta = {
+    attachmentId,
+    scope: accountId,
+    filename,
+    mimeType,
+    sizeBytes: buffer.byteLength,
+    storedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeFile(storagePath, buffer);
+  await writeFile(metaPath, JSON.stringify(meta, null, 2));
+  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes: buffer.byteLength };
+}
+
+// app/lib/whatsapp/inbound/media.ts
+var TAG9 = "[whatsapp:media]";
+var MEDIA_DIR = "/tmp/maxy-media";
+function deterministicAttachmentId(seed) {
+  const h = createHash("sha256").update(seed).digest("hex");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+var CACHE_RETAIN_MS = 5e3;
+var inflightDownloads = /* @__PURE__ */ new Map();
+function downloadInboundMediaBufferCached(msg, sock, opts) {
+  const key = msg.key.id ? `${msg.key.remoteJid ?? ""}:${msg.key.id}` : null;
+  if (!key) return downloadInboundMediaBuffer(msg, sock, opts);
+  const existing = inflightDownloads.get(key);
+  if (existing) return existing;
+  const p = downloadInboundMediaBuffer(msg, sock, opts);
+  inflightDownloads.set(key, p);
+  void p.then(
+    (res) => {
+      if (res === void 0) {
+        inflightDownloads.delete(key);
+      } else {
+        const t = setTimeout(() => inflightDownloads.delete(key), CACHE_RETAIN_MS);
+        t.unref?.();
+      }
+    },
+    () => inflightDownloads.delete(key)
+    // downloadInboundMediaBuffer never rejects, but be safe
   );
-  const wavPath = audioPath.replace(/\.[^.]+$/, "") + ".wav";
-  try {
-    await execFileAsync("ffmpeg", [
-      "-i",
-      audioPath,
-      "-ar",
-      "16000",
-      "-ac",
-      "1",
-      "-c:a",
-      "pcm_s16le",
-      "-y",
-      // overwrite without prompting
-      wavPath
-    ], { timeout: 3e4 });
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG12} failed: ffmpeg conversion error=${reason}`);
+  return p;
+}
+function mimeToExt(mimetype) {
+  const map = {
+    "image/jpeg": "jpg",
+    "image/png": "png",
+    "image/webp": "webp",
+    "image/gif": "gif",
+    "audio/ogg; codecs=opus": "ogg",
+    "audio/mpeg": "mp3",
+    "audio/mp4": "m4a",
+    "video/mp4": "mp4",
+    "application/pdf": "pdf",
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": "docx",
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": "xlsx"
+  };
+  return map[mimetype] ?? mimetype.split("/").pop()?.replace(/[^a-z0-9]/gi, "") ?? "bin";
+}
+function getDownloadableContent(message) {
+  const msg = message;
+  if (msg.imageMessage) return { downloadable: msg.imageMessage, mediaType: "image" };
+  if (msg.videoMessage) return { downloadable: msg.videoMessage, mediaType: "video" };
+  if (msg.audioMessage) return { downloadable: msg.audioMessage, mediaType: "audio" };
+  if (msg.documentMessage) return { downloadable: msg.documentMessage, mediaType: "document" };
+  if (msg.stickerMessage) return { downloadable: msg.stickerMessage, mediaType: "sticker" };
+  return void 0;
+}
+async function streamToBuffer(stream2) {
+  const chunks = [];
+  for await (const chunk of stream2) {
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+async function downloadInboundMediaBuffer(msg, sock, opts) {
+  const rawMessage = msg.message;
+  if (!rawMessage) return void 0;
+  const content = normalizeMessageContent2(rawMessage);
+  if (!content) return void 0;
+  const inner = content;
+  const mimetype = inner.imageMessage?.mimetype ?? inner.videoMessage?.mimetype ?? inner.audioMessage?.mimetype ?? inner.documentMessage?.mimetype ?? inner.stickerMessage?.mimetype ?? void 0;
+  if (!inner.imageMessage && !inner.videoMessage && !inner.audioMessage && !inner.documentMessage && !inner.stickerMessage) {
     return void 0;
   }
+  const maxBytes = opts?.maxBytes ?? 50 * 1024 * 1024;
   try {
-    const { stdout, stderr } = await execFileAsync(WHISPER_BINARY, [
-      "-m",
-      WHISPER_MODEL,
-      "-f",
-      wavPath,
-      "--no-timestamps",
-      "-l",
-      "auto"
-    ], { timeout: WHISPER_TIMEOUT_MS, maxBuffer: 10 * 1024 * 1024 });
-    const durationMs = Date.now() - startMs;
-    const { text, count: stripped } = stripSpecialTokens(stdout.trim());
-    if (!text) {
-      console.error(`${TAG12} failed: whisper returned empty output duration_ms=${durationMs}`);
+    let buffer = await downloadMediaMessage(
+      msg,
+      "buffer",
+      {},
+      {
+        reuploadRequest: sock.updateMediaMessage,
+        logger: sock.logger
+      }
+    );
+    if (!buffer || buffer.length === 0) {
+      console.error(`${TAG9} primary download returned empty, trying direct fallback`);
+      const downloadable = getDownloadableContent(content);
+      if (downloadable) {
+        try {
+          const stream2 = await downloadContentFromMessage(downloadable.downloadable, downloadable.mediaType);
+          buffer = await streamToBuffer(stream2);
+        } catch (fallbackErr) {
+          console.error(`${TAG9} direct download fallback failed: ${String(fallbackErr)}`);
+        }
+      }
+    }
+    if (!buffer || buffer.length === 0) {
+      console.error(`${TAG9} download failed: empty buffer for ${mimetype ?? "unknown"}`);
       return void 0;
     }
-    const langMatch = stderr.match(/auto-detected language:\s*(\w+)/);
-    const language = langMatch?.[1] ?? "unknown";
-    const words = text.split(/\s+/).filter(Boolean).length;
-    console.error(
-      `${TAG12} done provider=whisper-local duration_ms=${durationMs} words=${words} stripped=${stripped} lang=${language}`
-    );
-    return { text, language, durationMs };
+    if (buffer.length > maxBytes) {
+      const sizeMB = (buffer.length / (1024 * 1024)).toFixed(1);
+      const limitMB = (maxBytes / (1024 * 1024)).toFixed(0);
+      console.error(`${TAG9} media too large type=${mimetype ?? "unknown"} size=${sizeMB}MB limit=${limitMB}MB`);
+      return void 0;
+    }
+    return {
+      buffer,
+      mimetype: mimetype ?? "application/octet-stream",
+      filename: inner.documentMessage?.fileName ?? void 0
+    };
   } catch (err) {
-    const durationMs = Date.now() - startMs;
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG12} failed provider=whisper-local duration_ms=${durationMs} error=${reason}`);
+    console.error(`${TAG9} media download failed type=${mimetype ?? "unknown"} error=${String(err)}`);
     return void 0;
-  } finally {
-    unlink(wavPath).catch(() => {
-    });
-  }
-}
-
-// app/lib/whatsapp/reply-error.ts
-var WaReplyError = class extends Error {
-  terminal;
-  constructor(message, terminal) {
-    super(message);
-    this.name = "WaReplyError";
-    this.terminal = terminal;
-  }
-};
-
-// app/lib/whatsapp/manager.ts
-var TAG13 = "[whatsapp:manager]";
-var MAX_RECONNECT_ATTEMPTS = 10;
-var MESSAGE_STORE_MAX = 500;
-var connections = /* @__PURE__ */ new Map();
-var configDir = null;
-var whatsAppConfig = {};
-var onInboundMessage = null;
-var initialized = false;
-var messageStore = /* @__PURE__ */ new Map();
-function messageStoreKey(accountId, remoteJid) {
-  return `${accountId}:${remoteJid}`;
-}
-function storeMessage(storeKey, entry) {
-  let entries = messageStore.get(storeKey);
-  if (!entries) {
-    entries = [];
-    messageStore.set(storeKey, entries);
-  }
-  entries.push(entry);
-  if (entries.length > MESSAGE_STORE_MAX) {
-    const trimmed = entries.length - MESSAGE_STORE_MAX;
-    entries.splice(0, trimmed);
-    console.error(`${TAG13} message store trimmed for ${storeKey}: ${trimmed} oldest messages removed`);
   }
 }
-function deriveCacheKey(input) {
-  if (input.isOwnerMirror || input.agentType === "admin") {
-    return `whatsapp:${input.accountId}`;
-  }
-  if (input.isGroup) {
-    if (!input.groupJid) {
-      throw new Error(
-        `deriveCacheKey: isGroup=true requires groupJid (accountId=${input.accountId}, senderPhone=${input.senderPhone})`
-      );
+async function downloadInboundMedia(msg, sock, opts) {
+  const res = await downloadInboundMediaBufferCached(msg, sock, opts);
+  if (!res) return void 0;
+  await mkdir2(MEDIA_DIR, { recursive: true });
+  const ext = mimeToExt(res.mimetype);
+  const filePath = join6(MEDIA_DIR, `${randomUUID4()}.${ext}`);
+  await writeFile2(filePath, res.buffer);
+  const sizeKB = (res.buffer.length / 1024).toFixed(0);
+  console.error(`${TAG9} media downloaded type=${res.mimetype} size=${sizeKB}KB path=${filePath}`);
+  return { path: filePath, mimetype: res.mimetype, size: res.buffer.length };
+}
+async function storeInboundMediaServable(msg, sock, accountId, seed, opts) {
+  const attachmentId = deterministicAttachmentId(seed);
+  try {
+    if (attachmentExists(accountId, attachmentId)) return attachmentId;
+    const res = await downloadInboundMediaBufferCached(msg, sock, opts);
+    if (!res) {
+      console.error(`${TAG9} servable-store skip reason=no-buffer id=${attachmentId}`);
+      return null;
     }
-    return `whatsapp:${input.accountId}:group:${input.groupJid}`;
+    const filename = res.filename ?? `${attachmentId}.${mimeToExt(res.mimetype)}`;
+    await storeMediaBuffer(accountId, attachmentId, filename, res.mimetype, res.buffer);
+    console.error(`${TAG9} servable-store ok id=${attachmentId} mime=${res.mimetype} bytes=${res.buffer.length}`);
+    return attachmentId;
+  } catch (err) {
+    console.error(`${TAG9} servable-store FAIL id=${attachmentId} reason=${String(err).slice(0, 120)}`);
+    return null;
   }
-  return `whatsapp:${input.accountId}:${input.senderPhone}`;
-}
-function buildSelfChatDispatch(input) {
-  const senderPhone = input.selfPhone ?? "owner";
-  return {
-    accountId: input.accountId,
-    agentType: "admin",
-    senderPhone,
-    text: input.text,
-    isGroup: false,
-    reply: input.reply,
-    composing: input.composing,
-    cacheKey: deriveCacheKey({
-      agentType: "admin",
-      accountId: input.accountId,
-      senderPhone,
-      isGroup: false
-    }),
-    media: [],
-    // Self-chat is the owner: the session scopes to the house account (Task 1383).
-    effectiveAccountId: input.accountId
-  };
 }
-async function init(opts) {
-  if (initialized) {
-    console.error(`${TAG13} already initialized`);
-    return;
+
+// app/lib/whatsapp/inbound/debounce.ts
+var TAG10 = "[whatsapp:debounce]";
+var STT_TAG = "[whatsapp:stt-await]";
+function createInboundDebouncer(opts) {
+  const { debounceMs, buildKey, onFlush, onError } = opts;
+  const awaitTimeoutMs = opts.awaitTimeoutMs ?? 3e4;
+  const pending = /* @__PURE__ */ new Map();
+  const pendingAwaits = /* @__PURE__ */ new Map();
+  let destroyed = false;
+  async function flushKey(key) {
+    const awaiting = pendingAwaits.get(key);
+    if (awaiting) {
+      const start = Date.now();
+      try {
+        await Promise.race([
+          awaiting,
+          new Promise(
+            (_, reject) => setTimeout(() => reject(new Error("stt-await-timeout")), awaitTimeoutMs)
+          )
+        ]);
+        console.error(`${STT_TAG} resolved key=${key} waited_ms=${Date.now() - start}`);
+      } catch {
+        console.error(`${STT_TAG} timeout key=${key} waited_ms=${Date.now() - start}`);
+      }
+      pendingAwaits.delete(key);
+    }
+    const batch = pending.get(key);
+    if (!batch) return;
+    clearTimeout(batch.timer);
+    pending.delete(key);
+    const batchSize = batch.entries.length;
+    try {
+      console.error(`${TAG10} debounce flush key=${key} batchSize=${batchSize}`);
+      const result = onFlush(batch.entries);
+      if (result && typeof result.catch === "function") {
+        result.catch(onError);
+      }
+    } catch (err) {
+      onError(err);
+    }
   }
-  configDir = opts.configDir;
-  onInboundMessage = opts.onMessage;
-  loadConfig(opts.accountConfig);
-  const accountIds = listCredentialAccountIds(configDir);
-  if (accountIds.length === 0) {
-    console.error(`${TAG13} init: no stored WhatsApp credentials found`);
-    initialized = true;
-    return;
+  async function flush() {
+    const keys = Array.from(pending.keys());
+    await Promise.all(keys.map((key) => flushKey(key)));
   }
-  console.error(`${TAG13} init: found ${accountIds.length} credentialed account(s): ${accountIds.join(", ")}`);
-  initialized = true;
-  for (const accountId of accountIds) {
-    const accountCfg = whatsAppConfig.accounts?.[accountId];
-    if (accountCfg?.enabled === false) {
-      console.error(`${TAG13} skipping disabled account=${accountId}`);
-      continue;
+  function enqueue(msg) {
+    if (destroyed) return;
+    if (debounceMs <= 0) {
+      try {
+        const result = onFlush([msg]);
+        if (result && typeof result.catch === "function") {
+          result.catch(onError);
+        }
+      } catch (err) {
+        onError(err);
+      }
+      return;
+    }
+    const key = buildKey(msg);
+    if (!key) {
+      try {
+        const result = onFlush([msg]);
+        if (result && typeof result.catch === "function") {
+          result.catch(onError);
+        }
+      } catch (err) {
+        onError(err);
+      }
+      return;
+    }
+    const existing = pending.get(key);
+    if (existing) {
+      existing.entries.push(msg);
+      clearTimeout(existing.timer);
+      existing.timer = setTimeout(() => {
+        flushKey(key).catch(onError);
+      }, debounceMs);
+    } else {
+      const timer2 = setTimeout(() => {
+        flushKey(key).catch(onError);
+      }, debounceMs);
+      pending.set(key, { entries: [msg], timer: timer2 });
     }
-    startConnection(accountId).catch((err) => {
-      console.error(`${TAG13} failed to auto-start account=${accountId}: ${formatError(err)}`);
-    });
   }
-}
-async function startConnection(accountId) {
-  if (!configDir) throw new Error("WhatsApp manager not initialized");
-  const authDir = resolveAuthDir(configDir, accountId);
-  const hasAuth = await authExists(authDir);
-  if (!hasAuth) {
-    console.error(`${TAG13} no credentials for account=${accountId}`);
-    return;
+  function registerPending(key, promise) {
+    if (destroyed) return;
+    const existing = pendingAwaits.get(key);
+    if (existing) {
+      pendingAwaits.set(key, Promise.all([existing, promise]).then(() => {
+      }));
+    } else {
+      pendingAwaits.set(key, promise);
+    }
+    console.error(`${STT_TAG} pending key=${key}`);
   }
-  let platformAccountId;
+  async function destroy() {
+    if (destroyed) return;
+    destroyed = true;
+    await flush();
+  }
+  return { enqueue, flush, destroy, registerPending };
+}
+
+// app/lib/whatsapp/inbound/combine-batch.ts
+function combineInboundBatch(entries) {
+  const last = entries[entries.length - 1];
+  const combinedText = entries.map((e) => e.text).filter(Boolean).join("\n");
+  const media = entries.flatMap((e) => e.media);
+  return { ...last, text: combinedText, media };
+}
+
+// app/lib/whatsapp/opening-hours.ts
+var TAG11 = "[whatsapp:hours]";
+async function isBusinessOpen(accountId) {
   try {
-    platformAccountId = resolvePlatformAccountId();
-    console.error(
-      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId}`
-    );
+    const timezone = await resolveTimezone(accountId);
+    const now = /* @__PURE__ */ new Date();
+    const dayOfWeek = getDayOfWeek(now, timezone);
+    const previousDayOfWeek = getPreviousDayOfWeek(now, timezone);
+    const currentTime = getCurrentTime(now, timezone);
+    const session = getSession();
+    try {
+      const result = await session.run(
+        `MATCH (b:LocalBusiness {accountId: $accountId})
+         OPTIONAL MATCH (b)-[:HAS_HOURS]->(hours:OpeningHoursSpecification)
+         WHERE hours.dayOfWeek IN [$dayOfWeek, $previousDayOfWeek]
+         RETURN hours.dayOfWeek AS dayOfWeek, hours.opens AS opens, hours.closes AS closes`,
+        { accountId, dayOfWeek, previousDayOfWeek }
+      );
+      if (result.records.length === 0) {
+        console.error(`${TAG11} [${accountId}] business hours check: no opening hours configured, treating as open`);
+        return { open: true, reason: "no opening hours configured" };
+      }
+      const specs = result.records.filter((r) => r.get("opens") != null && r.get("closes") != null).map((r) => ({
+        day: String(r.get("dayOfWeek")).trim(),
+        opens: String(r.get("opens")).trim(),
+        closes: String(r.get("closes")).trim()
+      }));
+      if (specs.length === 0) {
+        console.error(`${TAG11} [${accountId}] business hours check: no opening hours configured, treating as open`);
+        return { open: true, reason: "no opening hours configured" };
+      }
+      for (const spec of specs) {
+        if (!spec.opens || !spec.closes || spec.opens === spec.closes) continue;
+        const isYesterday = spec.day === previousDayOfWeek;
+        if (isYesterday) {
+          if (spec.opens > spec.closes && currentTime < spec.closes) {
+            const hoursStr = `${spec.opens}-${spec.closes} (${spec.day})`;
+            console.error(
+              `${TAG11} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
+            );
+            return {
+              open: true,
+              reason: "within business hours",
+              dayOfWeek,
+              currentTime,
+              matchedHours: hoursStr
+            };
+          }
+        } else if (isTimeInRange(currentTime, spec.opens, spec.closes)) {
+          const hoursStr = `${spec.opens}-${spec.closes}`;
+          console.error(
+            `${TAG11} [${accountId}] business hours check: open (day=${dayOfWeek}, time=${currentTime}, hours=${hoursStr})`
+          );
+          return {
+            open: true,
+            reason: "within business hours",
+            dayOfWeek,
+            currentTime,
+            matchedHours: hoursStr
+          };
+        }
+      }
+      const todaySpecs = specs.filter((s) => s.day === dayOfWeek);
+      const allHours = todaySpecs.map((s) => `${s.opens}-${s.closes}`).join(", ") || "none today";
+      console.error(
+        `${TAG11} [${accountId}] business hours check: closed (day=${dayOfWeek}, time=${currentTime}, hours=${allHours})`
+      );
+      return {
+        open: false,
+        reason: "outside business hours",
+        dayOfWeek,
+        currentTime,
+        matchedHours: allHours
+      };
+    } finally {
+      await session.close();
+    }
   } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
     console.error(
-      `[whatsapp-persist] resolved-account-id FAIL waname=${accountId} reason=${reason}`
+      `${TAG11} [${accountId}] business hours check failed, treating as open: ${err instanceof Error ? err.message : String(err)}`
     );
-    throw err;
+    return { open: true, reason: "hours check failed (treating as open)" };
   }
-  await stopConnection(accountId);
-  const conn = {
-    accountId,
-    platformAccountId,
-    accountName: whatsAppConfig.accounts?.[accountId]?.name,
-    authDir,
-    sock: null,
-    connected: false,
-    selfPhone: null,
-    selfJid: null,
-    selfLid: null,
+}
+async function resolveTimezone(accountId) {
+  try {
+    const tz = await getUserTimezone(accountId);
+    if (tz) {
+      Intl.DateTimeFormat("en-US", { timeZone: tz });
+      return tz;
+    }
+  } catch {
+  }
+  return Intl.DateTimeFormat().resolvedOptions().timeZone;
+}
+function getDayOfWeek(date, timezone) {
+  return new Intl.DateTimeFormat("en-US", { weekday: "long", timeZone: timezone }).format(date);
+}
+function getPreviousDayOfWeek(date, timezone) {
+  const yesterday = new Date(date.getTime() - 24 * 60 * 60 * 1e3);
+  return getDayOfWeek(yesterday, timezone);
+}
+function getCurrentTime(date, timezone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    hour: "2-digit",
+    minute: "2-digit",
+    hour12: false,
+    timeZone: timezone
+  }).formatToParts(date);
+  const hour = parts.find((p) => p.type === "hour")?.value ?? "00";
+  const minute = parts.find((p) => p.type === "minute")?.value ?? "00";
+  return `${hour}:${minute}`;
+}
+function isTimeInRange(time, opens, closes) {
+  if (opens <= closes) {
+    return time >= opens && time < closes;
+  }
+  return time >= opens || time < closes;
+}
+
+// app/lib/stt/index.ts
+import { execFile } from "child_process";
+import { unlink, stat } from "fs/promises";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var TAG12 = "[stt]";
+var WHISPER_BINARY = process.env.WHISPER_BINARY ?? "/opt/whisper.cpp/build/bin/whisper-cli";
+var WHISPER_MODEL = process.env.WHISPER_MODEL ?? "/opt/whisper.cpp/models/ggml-base.bin";
+var WHISPER_TIMEOUT_MS = 20 * 60 * 1e3;
+var SPECIAL_TOKEN_RE = /\[_[A-Z]+(?:_\d+)?_?\]/g;
+function stripSpecialTokens(input) {
+  const matches = input.match(SPECIAL_TOKEN_RE);
+  const count = matches ? matches.length : 0;
+  if (!count) return { text: input, count: 0 };
+  const text = input.replace(SPECIAL_TOKEN_RE, "").replace(/[ \t]{2,}/g, " ").trim();
+  return { text, count };
+}
+async function transcribe(audioPath, mimetype) {
+  const startMs = Date.now();
+  let audioBytes = 0;
+  try {
+    const s = await stat(audioPath);
+    audioBytes = s.size;
+  } catch {
+    console.error(`${TAG12} failed: file not readable path=${audioPath}`);
+    return void 0;
+  }
+  console.error(
+    `${TAG12} start provider=whisper-local audio_bytes=${audioBytes} mimetype=${mimetype} path=${audioPath}`
+  );
+  const wavPath = audioPath.replace(/\.[^.]+$/, "") + ".wav";
+  try {
+    await execFileAsync("ffmpeg", [
+      "-i",
+      audioPath,
+      "-ar",
+      "16000",
+      "-ac",
+      "1",
+      "-c:a",
+      "pcm_s16le",
+      "-y",
+      // overwrite without prompting
+      wavPath
+    ], { timeout: 3e4 });
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG12} failed: ffmpeg conversion error=${reason}`);
+    return void 0;
+  }
+  try {
+    const { stdout, stderr } = await execFileAsync(WHISPER_BINARY, [
+      "-m",
+      WHISPER_MODEL,
+      "-f",
+      wavPath,
+      "--no-timestamps",
+      "-l",
+      "auto"
+    ], { timeout: WHISPER_TIMEOUT_MS, maxBuffer: 10 * 1024 * 1024 });
+    const durationMs = Date.now() - startMs;
+    const { text, count: stripped } = stripSpecialTokens(stdout.trim());
+    if (!text) {
+      console.error(`${TAG12} failed: whisper returned empty output duration_ms=${durationMs}`);
+      return void 0;
+    }
+    const langMatch = stderr.match(/auto-detected language:\s*(\w+)/);
+    const language = langMatch?.[1] ?? "unknown";
+    const words = text.split(/\s+/).filter(Boolean).length;
+    console.error(
+      `${TAG12} done provider=whisper-local duration_ms=${durationMs} words=${words} stripped=${stripped} lang=${language}`
+    );
+    return { text, language, durationMs };
+  } catch (err) {
+    const durationMs = Date.now() - startMs;
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(`${TAG12} failed provider=whisper-local duration_ms=${durationMs} error=${reason}`);
+    return void 0;
+  } finally {
+    unlink(wavPath).catch(() => {
+    });
+  }
+}
+
+// app/lib/whatsapp/reply-error.ts
+var WaReplyError = class extends Error {
+  terminal;
+  constructor(message, terminal) {
+    super(message);
+    this.name = "WaReplyError";
+    this.terminal = terminal;
+  }
+};
+
+// app/lib/whatsapp/manager.ts
+var TAG13 = "[whatsapp:manager]";
+var MAX_RECONNECT_ATTEMPTS = 10;
+var MESSAGE_STORE_MAX = 500;
+var connections = /* @__PURE__ */ new Map();
+var configDir = null;
+var whatsAppConfig = {};
+var onInboundMessage = null;
+var initialized = false;
+var messageStore = /* @__PURE__ */ new Map();
+function messageStoreKey(accountId, remoteJid) {
+  return `${accountId}:${remoteJid}`;
+}
+function storeMessage(storeKey, entry) {
+  let entries = messageStore.get(storeKey);
+  if (!entries) {
+    entries = [];
+    messageStore.set(storeKey, entries);
+  }
+  entries.push(entry);
+  if (entries.length > MESSAGE_STORE_MAX) {
+    const trimmed = entries.length - MESSAGE_STORE_MAX;
+    entries.splice(0, trimmed);
+    console.error(`${TAG13} message store trimmed for ${storeKey}: ${trimmed} oldest messages removed`);
+  }
+}
+function deriveCacheKey(input) {
+  if (input.isOwnerMirror || input.agentType === "admin") {
+    return `whatsapp:${input.accountId}`;
+  }
+  if (input.isGroup) {
+    if (!input.groupJid) {
+      throw new Error(
+        `deriveCacheKey: isGroup=true requires groupJid (accountId=${input.accountId}, senderPhone=${input.senderPhone})`
+      );
+    }
+    return `whatsapp:${input.accountId}:group:${input.groupJid}`;
+  }
+  return `whatsapp:${input.accountId}:${input.senderPhone}`;
+}
+function buildSelfChatDispatch(input) {
+  const senderPhone = input.selfPhone ?? "owner";
+  return {
+    accountId: input.accountId,
+    agentType: "admin",
+    senderPhone,
+    text: input.text,
+    isGroup: false,
+    reply: input.reply,
+    composing: input.composing,
+    cacheKey: deriveCacheKey({
+      agentType: "admin",
+      accountId: input.accountId,
+      senderPhone,
+      isGroup: false
+    }),
+    media: [],
+    // Self-chat is the owner: the session scopes to the house account (Task 1383).
+    effectiveAccountId: input.accountId
+  };
+}
+async function init(opts) {
+  if (initialized) {
+    console.error(`${TAG13} already initialized`);
+    return;
+  }
+  configDir = opts.configDir;
+  onInboundMessage = opts.onMessage;
+  loadConfig(opts.accountConfig);
+  const accountIds = listCredentialAccountIds(configDir);
+  if (accountIds.length === 0) {
+    console.error(`${TAG13} init: no stored WhatsApp credentials found`);
+    initialized = true;
+    return;
+  }
+  console.error(`${TAG13} init: found ${accountIds.length} credentialed account(s): ${accountIds.join(", ")}`);
+  initialized = true;
+  for (const accountId of accountIds) {
+    const accountCfg = whatsAppConfig.accounts?.[accountId];
+    if (accountCfg?.enabled === false) {
+      console.error(`${TAG13} skipping disabled account=${accountId}`);
+      continue;
+    }
+    startConnection(accountId).catch((err) => {
+      console.error(`${TAG13} failed to auto-start account=${accountId}: ${formatError(err)}`);
+    });
+  }
+}
+async function startConnection(accountId) {
+  if (!configDir) throw new Error("WhatsApp manager not initialized");
+  const authDir = resolveAuthDir(configDir, accountId);
+  const hasAuth = await authExists(authDir);
+  if (!hasAuth) {
+    console.error(`${TAG13} no credentials for account=${accountId}`);
+    return;
+  }
+  let platformAccountId;
+  try {
+    platformAccountId = resolvePlatformAccountId();
+    console.error(
+      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId}`
+    );
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    console.error(
+      `[whatsapp-persist] resolved-account-id FAIL waname=${accountId} reason=${reason}`
+    );
+    throw err;
+  }
+  await stopConnection(accountId);
+  const conn = {
+    accountId,
+    platformAccountId,
+    accountName: whatsAppConfig.accounts?.[accountId]?.name,
+    authDir,
+    sock: null,
+    connected: false,
+    selfPhone: null,
+    selfJid: null,
+    selfLid: null,
     reconnectAttempts: 0,
     abortController: new AbortController(),
     debouncer: null,
@@ -4375,9 +4767,12 @@ function getStatus() {
 function getSocket(accountId) {
   return connections.get(accountId)?.sock ?? null;
 }
+function findConnectionByKey(conns, accountId) {
+  return conns.find((c) => c.accountId === accountId) ?? conns.find((c) => c.platformAccountId === accountId);
+}
 function selectConnection(conns, accountId) {
   const presentKeys = conns.map((c) => c.accountId);
-  const conn = conns.find((c) => c.accountId === accountId) ?? conns.find((c) => c.platformAccountId === accountId);
+  const conn = findConnectionByKey(conns, accountId);
   if (!conn) return { ok: false, reason: "key-miss", presentKeys };
   if (!conn.sock) return { ok: false, reason: "disconnected", presentKeys };
   return { ok: true, sock: conn.sock, accountId: conn.accountId };
@@ -4385,6 +4780,13 @@ function selectConnection(conns, accountId) {
 function resolveSocket(accountId) {
   return selectConnection(Array.from(connections.values()), accountId);
 }
+function selectStoreAccountKey(conns, accountId) {
+  const conn = findConnectionByKey(conns, accountId);
+  return conn ? conn.platformAccountId : accountId;
+}
+function resolveReadStoreKey(accountId) {
+  return selectStoreAccountKey(Array.from(connections.values()), accountId);
+}
 function listConnectionPlatformAccountIds() {
   return [...connections.values()].map((conn) => conn.platformAccountId);
 }
@@ -4703,21 +5105,24 @@ function monitorInbound(conn) {
         if (!remoteJid || remoteJid === "status@broadcast") continue;
         if (!msg.message) continue;
         const extracted = extractMessage(msg);
-        if (extracted.text) {
+        const mediaServable = !!(extracted.mediaType && extracted.mimetype && isSupportedMime(extracted.mimetype));
+        if (extracted.text || mediaServable) {
           const isGroup = isGroupJid(remoteJid);
           const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
           const senderPhone = await resolveJidToE164(senderJid, conn.lidMapping) ?? senderJid;
           const ts = msg.messageTimestamp ? Number(msg.messageTimestamp) : Math.floor(Date.now() / 1e3);
           const storeKey = messageStoreKey(conn.platformAccountId, remoteJid);
-          storeMessage(storeKey, {
-            id: msg.key.id ?? `${remoteJid}-${ts}`,
-            sender: senderPhone,
-            senderName: msg.pushName ?? void 0,
-            body: extracted.text,
-            timestamp: ts,
-            fromMe: Boolean(msg.key.fromMe),
-            quoted: extracted.quotedMessage ? { id: extracted.quotedMessage.id, body: extracted.quotedMessage.text, sender: extracted.quotedMessage.sender } : void 0
-          });
+          if (extracted.text) {
+            storeMessage(storeKey, {
+              id: msg.key.id ?? `${remoteJid}-${ts}`,
+              sender: senderPhone,
+              senderName: msg.pushName ?? void 0,
+              body: extracted.text,
+              timestamp: ts,
+              fromMe: Boolean(msg.key.fromMe),
+              quoted: extracted.quotedMessage ? { id: extracted.quotedMessage.id, body: extracted.quotedMessage.text, sender: extracted.quotedMessage.sender } : void 0
+            });
+          }
           const entries = messageStore.get(storeKey);
           console.error(
             `${TAG13} stored message ${msg.key.id ?? "?"} for ${remoteJid} (type: ${upsert.type}, store size: ${entries?.length ?? 0}/${MESSAGE_STORE_MAX}) account=${conn.platformAccountId}`
@@ -4755,6 +5160,17 @@ function monitorInbound(conn) {
                 remoteJid,
                 conn.lidMapping
               );
+              let mediaAttachmentId;
+              if (mediaServable && !fromMe && conn.sock && upsert.type === "notify") {
+                const maxMb = whatsAppConfig.mediaMaxMb ?? 50;
+                mediaAttachmentId = await storeInboundMediaServable(
+                  msg,
+                  conn.sock,
+                  conn.platformAccountId,
+                  `whatsapp-live:${conn.accountId}:${canonicalRemoteJid}:${msg.key.id}`,
+                  { maxBytes: maxMb * 1024 * 1024 }
+                ) ?? void 0;
+              }
               await persistWhatsAppMessage({
                 accountId: conn.accountId,
                 platformAccountId: conn.platformAccountId,
@@ -4766,7 +5182,13 @@ function monitorInbound(conn) {
                 fromMe,
                 senderPhone,
                 selfPhone: conn.selfPhone,
-                body: extracted.text,
+                // A stored media message persists the human caption (or empty) plus
+                // the attachment id — the reader shows the inline media, never the
+                // synthetic `[document: …]` / `[sticker]` line. If the store failed
+                // (no id), fall back to the extracted text so a document/sticker
+                // still shows its placeholder rather than a blank bubble.
+                body: mediaAttachmentId ? extracted.caption ?? "" : extracted.text,
+                attachmentId: mediaAttachmentId,
                 timestamp: ts,
                 pushName: msg.pushName ?? void 0,
                 quoted: extracted.quotedMessage ? {
@@ -4884,868 +5306,543 @@ async function handleInboundMessage(conn, msg) {
         agentType: "admin",
         accountId: conn.accountId,
         senderPhone: senderPhone2,
-        isGroup: isGroup2,
-        groupJid: isGroup2 ? remoteJid : void 0,
-        isOwnerMirror: true
-      }),
-      media: [],
-      isOwnerMirror: true
-    });
-    return;
-  }
-  const extracted = extractMessage(msg);
-  if (!extracted.text && !extracted.mediaType) {
-    console.error(`${TAG13} drop: no text or media account=${conn.accountId} from=${remoteJid}`);
-    return;
-  }
-  let mediaResult;
-  if (extracted.mediaType && conn.sock) {
-    const maxMb = whatsAppConfig.mediaMaxMb ?? 50;
-    mediaResult = await downloadInboundMedia(msg, conn.sock, {
-      maxBytes: maxMb * 1024 * 1024
-    });
-    if (!mediaResult) {
-      console.error(`${TAG13} media download returned undefined account=${conn.accountId} type=${extracted.mediaType} from=${remoteJid}`);
-    }
-  }
-  const isGroup = isGroupJid(remoteJid);
-  const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
-  const senderPhone = await resolveJidToE164(senderJid, conn.lidMapping) ?? senderJid;
-  const lidCapture = lidCaptureFor(senderJid, senderPhone);
-  if (lidCapture) recordLidMapping(lidCapture.numericLid, lidCapture.e164);
-  const selfPhone = conn.selfPhone ?? "";
-  if (extracted.mediaType === "audio" && mediaResult?.path) {
-    const conversationKey = isGroup ? remoteJid : senderPhone;
-    const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
-    let resolvePending;
-    const sttPending = new Promise((resolve34) => {
-      resolvePending = resolve34;
-    });
-    if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
-    try {
-      const sttResult = await transcribe(mediaResult.path, mediaResult.mimetype);
-      if (sttResult?.text) {
-        extracted.text = sttResult.text;
-      }
-    } finally {
-      resolvePending();
-    }
-  }
-  let accessResult;
-  if (isGroup) {
-    accessResult = checkGroupAccess({ groupJid: remoteJid });
-  } else {
-    accessResult = await resolveDmAccess({
-      senderPhone,
-      selfPhone,
-      config: whatsAppConfig,
-      accountConfig: whatsAppConfig.accounts?.[conn.accountId],
-      accountId: conn.accountId,
-      isValidAccount: (id) => isValidAccountId(id),
-      resolvePersonByPhone
-    });
-  }
-  console.error(
-    `${TAG13} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
-  );
-  if (!accessResult.allowed && accessResult.reason === "account-manager-unresolved") {
-    console.error(
-      `[whatsapp-native] op=account-manager-reject senderId=${senderPhone} reason=unresolved-effective-account`
-    );
-  }
-  if (accessResult.allowed && accessResult.reason === "account-manager" && accessResult.effectiveAccountId === conn.accountId) {
-    console.error(
-      `[whatsapp-native] op=escalation-tripwire senderId=${senderPhone} reason=account-manager-routed-to-house effectiveAccount=${accessResult.effectiveAccountId}`
-    );
-    return;
-  }
-  if (!accessResult.allowed) return;
-  if (isCustomerTurnSuppressed(accessResult.agentType, isHouseManagedService())) {
-    console.error(
-      `[channel-house] op=inbound from=${senderPhone} accountId=${conn.platformAccountId} autoReply=suppressed`
-    );
-    return;
-  }
-  const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
-  if (sendReceipts && msg.key.id) {
-    sendReadReceipt(conn.sock, remoteJid, [msg.key.id], isGroup ? senderJid : void 0);
-  }
-  const reply = async (text) => {
-    if (isGroupJid(remoteJid)) {
-      console.error(`${TAG13} op=group-reply-blocked jid=${remoteJid}`);
-      throw new WaReplyError("group reply blocked \u2014 observe-only", false);
-    }
-    const currentSock = conn.sock;
-    if (!currentSock) {
-      const reason = conn.terminalReason;
-      throw new WaReplyError(reason ?? "WhatsApp disconnected \u2014 cannot reply", Boolean(reason));
-    }
-    await sendTextMessage(currentSock, remoteJid, text, { accountId: conn.accountId });
-  };
-  const composing = async () => {
-    const currentSock = conn.sock;
-    if (currentSock) await sendComposing(currentSock, remoteJid);
-  };
-  const cacheKey = deriveCacheKey({
-    agentType: accessResult.agentType,
-    accountId: conn.accountId,
-    senderPhone,
-    isGroup,
-    groupJid: isGroup ? remoteJid : void 0
-  });
-  conn.lastMessageAt = Date.now();
-  const payload = {
-    accountId: conn.accountId,
-    agentType: accessResult.agentType,
-    passive: accessResult.passive === true,
-    personId: accessResult.personId ?? null,
-    senderPhone,
-    text: extracted.text,
-    isGroup,
-    groupJid: isGroup ? remoteJid : void 0,
-    reply,
-    composing,
-    cacheKey,
-    media: mediaResult?.path ? [{ path: mediaResult.path, type: extracted.mediaType, mimetype: mediaResult.mimetype }] : [],
-    replyContext: extracted.quotedMessage,
-    // Task 1383 — the gate's single resolution feeds the spawn (house or the
-    // bound sub-account); the router never re-resolves.
-    effectiveAccountId: accessResult.effectiveAccountId
-  };
-  if (accessResult.agentType === "public") {
-    const hoursResult = await isBusinessOpen(conn.accountId);
-    if (!hoursResult.open) {
-      console.error(`${TAG13} [${conn.accountId}] dispatch skipped: business closed`);
-      const afterHoursMessage = whatsAppConfig.accounts?.[conn.accountId]?.afterHoursMessage ?? whatsAppConfig.afterHoursMessage;
-      if (afterHoursMessage) {
-        try {
-          await reply(afterHoursMessage);
-          console.error(`${TAG13} [${conn.accountId}] after-hours auto-reply sent to ${remoteJid}`);
-        } catch (err) {
-          console.error(
-            `${TAG13} [${conn.accountId}] after-hours auto-reply failed: ${err instanceof Error ? err.message : String(err)}`
-          );
-        }
-      }
-      return;
-    }
-  }
-  if (conn.debouncer) {
-    conn.debouncer.enqueue(payload);
-  } else {
-    onInboundMessage(payload);
-  }
-}
-
-// app/lib/vnc.ts
-import { spawnSync, execFileSync } from "child_process";
-import { createConnection } from "net";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve5 } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
-var VNC_SCRIPT = resolve5(PLATFORM_ROOT3, "scripts/vnc.sh");
-var displayMode = process.env.DISPLAY_MODE ?? "virtual";
-if (displayMode === "native") {
-  console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
-}
-function resolveBrowserTransport(req, remoteAddress) {
-  if (displayMode !== "native") return "vnc";
-  const xff = req.headers.get("x-forwarded-for") ?? void 0;
-  const client = resolveClientIp(remoteAddress ?? "127.0.0.1", xff);
-  const transport = client.kind !== "external" && !xff ? "native" : "vnc";
-  if (remoteAddress && remoteAddress !== "127.0.0.1" && remoteAddress !== "::1") {
-    const oldClient = resolveClientIp("127.0.0.1", xff);
-    const oldTransport = oldClient.kind !== "external" && !xff ? "native" : "vnc";
-    if (transport !== oldTransport) {
-      console.log(`[resolve-transport] remoteAddress="${remoteAddress}" transport="${transport}" (was: "${oldTransport}" with hardcoded loopback)`);
-    }
-  }
-  return transport;
-}
-var currentCdpDisplay = null;
-function discoverNativeDisplay() {
-  const fallback = { sessionType: "x11", display: ":0", waylandDisplay: "" };
-  try {
-    const listResult = spawnSync("loginctl", ["list-sessions", "--no-legend"], {
-      timeout: 5e3,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    if (listResult.status !== 0 || !listResult.stdout.trim()) {
-      vncLog("native-display-discovery", { action: "fallback", reason: "no-sessions" });
-      return fallback;
-    }
-    const sessionId = listResult.stdout.trim().split("\n")[0].trim().split(/\s+/)[0];
-    const typeResult = spawnSync("loginctl", ["show-session", sessionId, "-p", "Type", "--value"], {
-      timeout: 5e3,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const displayResult = spawnSync("loginctl", ["show-session", sessionId, "-p", "Display", "--value"], {
-      timeout: 5e3,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    const sessionType = typeResult.stdout?.trim() || "";
-    const sessionDisplay = displayResult.stdout?.trim() || ":0";
-    if (sessionType === "wayland") {
-      let waylandDisplay = "wayland-0";
-      const leaderResult = spawnSync("loginctl", ["show-session", sessionId, "-p", "Leader", "--value"], {
-        timeout: 5e3,
-        encoding: "utf8",
-        stdio: ["ignore", "pipe", "pipe"]
-      });
-      const leaderPid = leaderResult.stdout?.trim();
-      if (leaderPid) {
-        try {
-          const environ = readFileSync8(`/proc/${leaderPid}/environ`, "utf8");
-          const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
-          if (match) waylandDisplay = match.split("=")[1];
-        } catch {
-        }
-      }
-      const info2 = { sessionType: "wayland", display: sessionDisplay, waylandDisplay };
-      vncLog("native-display-discovery", {
-        action: "discovered",
-        session_type: "wayland",
-        display: sessionDisplay,
-        wayland_display: waylandDisplay
-      });
-      return info2;
-    }
-    const info = { sessionType: "x11", display: sessionDisplay, waylandDisplay: "" };
-    vncLog("native-display-discovery", {
-      action: "discovered",
-      session_type: sessionType || "unknown (defaulting to x11)",
-      display: sessionDisplay
-    });
-    return info;
-  } catch (err) {
-    vncLog("native-display-discovery", { action: "fallback", reason: "error", err: err.message });
-    return fallback;
-  }
-}
-function sleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
-}
-async function waitForPort(port2, timeoutMs = 12e3) {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    const ready = await new Promise((res) => {
-      const socket = createConnection(port2, "127.0.0.1");
-      socket.setTimeout(500);
-      socket.once("connect", () => {
-        socket.destroy();
-        res(true);
-      });
-      socket.once("error", () => {
-        socket.destroy();
-        res(false);
-      });
-      socket.once("timeout", () => {
-        socket.destroy();
-        res(false);
-      });
-    });
-    if (ready) return true;
-    await sleep(300);
-  }
-  return false;
-}
-function ensureLogDir() {
-  mkdirSync2(LOG_DIR, { recursive: true });
-}
-function logPath(name) {
-  return resolve5(LOG_DIR, `${name}.log`);
-}
-async function ensureVnc() {
-  if (process.platform !== "linux") {
-    vncLog("ensure-vnc", { action: "skipped", reason: "platform-not-linux", platform: process.platform });
-    return false;
-  }
-  const up = await waitForPort(RFB_PORT, 1e3);
-  if (up) return true;
-  vncLog("ensure-vnc", { action: "restart", reason: "x-down", rfb_port: RFB_PORT });
-  try {
-    execFileSync("bash", [VNC_SCRIPT, "start"], { timeout: 2e4 });
-  } catch (err) {
-    vncLog("ensure-vnc", { action: "restart-failed", err: err.message });
-    return false;
+        isGroup: isGroup2,
+        groupJid: isGroup2 ? remoteJid : void 0,
+        isOwnerMirror: true
+      }),
+      media: [],
+      isOwnerMirror: true
+    });
+    return;
   }
-  const ok = await waitForPort(RFB_PORT, 12e3);
-  vncLog("ensure-vnc", { action: "restart-complete", rfb_port: RFB_PORT, ok });
-  return ok;
-}
-async function ensureCdp(transport = "vnc") {
-  if (process.platform !== "linux") {
-    vncLog("ensure-cdp", { action: "skipped", reason: "platform-not-linux", platform: process.platform });
-    return false;
+  const extracted = extractMessage(msg);
+  if (!extracted.text && !extracted.mediaType) {
+    console.error(`${TAG13} drop: no text or media account=${conn.accountId} from=${remoteJid}`);
+    return;
   }
-  const targetSentinel = transport === "native" ? "native" : VNC_DISPLAY;
-  if (await waitForPort(CDP_PORT, 1e3)) {
-    if (currentCdpDisplay !== null && currentCdpDisplay !== targetSentinel) {
-      console.error(`[ensureCdp] Display switch: ${currentCdpDisplay} \u2192 ${targetSentinel}`);
-      vncLog("ensure-cdp", {
-        action: "display-switch",
-        transport,
-        from_display: currentCdpDisplay,
-        to_display: targetSentinel
-      });
-      killChromium();
-      await sleep(500);
-    } else {
-      return true;
+  let mediaResult;
+  if (extracted.mediaType && conn.sock) {
+    const maxMb = whatsAppConfig.mediaMaxMb ?? 50;
+    mediaResult = await downloadInboundMedia(msg, conn.sock, {
+      maxBytes: maxMb * 1024 * 1024
+    });
+    if (!mediaResult) {
+      console.error(`${TAG13} media download returned undefined account=${conn.accountId} type=${extracted.mediaType} from=${remoteJid}`);
     }
   }
-  const vncCommand = transport === "native" ? "start-chrome-native" : "start-chrome";
-  if (transport === "vnc") {
-    const xAlive = await waitForPort(RFB_PORT, 1e3);
-    if (!xAlive) {
-      console.error(`[ensureCdp] X server down on rfb=${RFB_PORT} \u2014 escalating to full VNC restart`);
-      vncLog("ensure-cdp", { action: "escalate-vnc-restart", reason: "x-down", transport, rfb_port: RFB_PORT });
-      const vncOk = await ensureVnc();
-      if (!vncOk) {
-        console.error("[ensureCdp] Full VNC restart failed \u2014 browser-specialist degraded");
-        vncLog("ensure-cdp", { action: "degraded", reason: "vnc-restart-failed", transport });
-        return false;
+  const isGroup = isGroupJid(remoteJid);
+  const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
+  const senderPhone = await resolveJidToE164(senderJid, conn.lidMapping) ?? senderJid;
+  const lidCapture = lidCaptureFor(senderJid, senderPhone);
+  if (lidCapture) recordLidMapping(lidCapture.numericLid, lidCapture.e164);
+  const selfPhone = conn.selfPhone ?? "";
+  if (extracted.mediaType === "audio" && mediaResult?.path) {
+    const conversationKey = isGroup ? remoteJid : senderPhone;
+    const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
+    let resolvePending;
+    const sttPending = new Promise((resolve34) => {
+      resolvePending = resolve34;
+    });
+    if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
+    try {
+      const sttResult = await transcribe(mediaResult.path, mediaResult.mimetype);
+      if (sttResult?.text) {
+        extracted.text = sttResult.text;
       }
-      const cdpOk2 = await waitForPort(CDP_PORT, 12e3);
-      if (cdpOk2) currentCdpDisplay = targetSentinel;
-      vncLog("ensure-cdp", { action: "post-vnc-restart", transport, cdp_port: CDP_PORT, ok: cdpOk2 });
-      return cdpOk2;
+    } finally {
+      resolvePending();
     }
   }
-  if (transport === "native") {
-    const nativeInfo = discoverNativeDisplay();
-    vncLog("ensure-cdp", {
-      action: "native-display-resolved",
-      transport,
-      session_type: nativeInfo.sessionType,
-      display: nativeInfo.display,
-      wayland_display: nativeInfo.waylandDisplay || void 0
+  let accessResult;
+  if (isGroup) {
+    accessResult = checkGroupAccess({ groupJid: remoteJid });
+  } else {
+    accessResult = await resolveDmAccess({
+      senderPhone,
+      selfPhone,
+      config: whatsAppConfig,
+      accountConfig: whatsAppConfig.accounts?.[conn.accountId],
+      accountId: conn.accountId,
+      isValidAccount: (id) => isValidAccountId(id),
+      resolvePersonByPhone
     });
   }
-  console.error(`[ensureCdp] Restarting Chrome (${vncCommand}) for transport=${transport}`);
-  vncLog("ensure-cdp", { action: `restart-${vncCommand}`, reason: "cdp-dead", transport });
-  try {
-    execFileSync("bash", [VNC_SCRIPT, vncCommand], { timeout: 2e4 });
-  } catch (err) {
-    vncLog("ensure-cdp", { action: "restart-chrome-failed", transport, err: err.message });
-    return false;
+  console.error(
+    `${TAG13} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (mediaResult ? ` mediaPath=${mediaResult.path}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
+  );
+  if (!accessResult.allowed && accessResult.reason === "account-manager-unresolved") {
+    console.error(
+      `[whatsapp-native] op=account-manager-reject senderId=${senderPhone} reason=unresolved-effective-account`
+    );
   }
-  const cdpOk = await waitForPort(CDP_PORT, 12e3);
-  if (cdpOk) currentCdpDisplay = targetSentinel;
-  vncLog("ensure-cdp", { action: "restart-chrome-complete", transport, sentinel: targetSentinel, cdp_port: CDP_PORT, ok: cdpOk });
-  return cdpOk;
-}
-function killChromium() {
-  spawnSync("pkill", ["-f", "chromium"], { stdio: "pipe" });
-}
-function writeChromiumWrapper() {
-  mkdirSync2(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve5(BIN_DIR, "chromium");
-  writeFileSync3(wrapperPath, `#!/bin/bash
-LOG="${LOG_DIR}/chromium.log"
-echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
-echo "  DISPLAY=$DISPLAY WAYLAND=$WAYLAND_DISPLAY XDG_SESSION_TYPE=$XDG_SESSION_TYPE" >> "$LOG"
-echo "  args: $*" >> "$LOG"
-
-# Check the brand's virtual display is up (Tasks 553 + 924 \u2014 per-brand
-# display + per-brand CDP port).
-if DISPLAY=${VNC_DISPLAY} xdpyinfo >/dev/null 2>&1; then
-  echo "  xdpyinfo ${VNC_DISPLAY} OK" >> "$LOG"
-else
-  echo "  xdpyinfo ${VNC_DISPLAY} FAILED \u2014 display not ready" >> "$LOG"
-fi
-
-# read the install-time-resolved non-snap Chromium binary path.
-# The installer (ensureNonSnapChromium + writeChromiumBinaryPathFile) writes
-# this file with the absolute path to either /usr/bin/chromium (Pi Bookworm:
-# real .deb) or /usr/bin/google-chrome-stable (Ubuntu Noble laptop: snap
-# replaced). Refusing the legacy probe loop closes the silent-fallback path
-# where /snap/bin/chromium would re-introduce the AppArmor SingletonLock
-# denial that triggered.
-PATH_FILE="${PLATFORM_ROOT3}/config/chromium-binary.path"
-if [ ! -r "$PATH_FILE" ]; then
-  echo "  ERROR: $PATH_FILE missing \u2014 re-run installer" >> "$LOG"
-  exit 1
-fi
-BIN="$(head -n1 "$PATH_FILE" | tr -d '[:space:]')"
-if [ -z "$BIN" ] || [ ! -x "$BIN" ]; then
-  echo "  ERROR: $PATH_FILE empty or non-executable: $BIN" >> "$LOG"
-  exit 1
-fi
-RESOLVED="$(readlink -f "$BIN" 2>/dev/null || echo "$BIN")"
-case ":$(echo "$RESOLVED" | tr '/' ':'):" in
-  *:snap:*)
-    echo "  ERROR: $BIN resolves to snap-confined $RESOLVED \u2014 re-run installer" >> "$LOG"
-    exit 1
-    ;;
-esac
-echo "  launching $BIN (realpath=$RESOLVED)" >> "$LOG"
-
-# nohup detaches chromium from this wrapper's process group so it outlives
-# claude auth login exiting (e.g. on timeout). --user-data-dir is brand-scoped
-# so a wrapper-spawned chromium attaches to the same per-brand
-# profile that vnc.sh's start_chrome targets \u2014 no shared cookies across brands.
-nohup "$BIN" \\
-  --user-data-dir=${CHROMIUM_PROFILE_DIR} \\
-  --no-sandbox \\
-  --test-type \\
-  --disable-dev-shm-usage \\
-  --disable-gpu \\
-  --password-store=basic \\
-  --use-mock-keychain \\
-  --ozone-platform=x11 \\
-  --no-first-run \\
-  --no-default-browser-check \\
-  --disable-session-crashed-bubble \\
-  --hide-crash-restore-bubble \\
-  --noerrdialogs \\
-  --window-size=1280,800 \\
-  --window-position=0,0 \\
-  "$@" >> "$LOG" 2>&1 &
-echo "  chromium PID: $!" >> "$LOG"
-`, { mode: 493 });
-  return wrapperPath;
-}
-function buildX11Env(chromiumWrapperPath, transport = "vnc") {
-  if (transport === "native") {
-    const nativeInfo = discoverNativeDisplay();
-    const env = {
-      ...process.env,
-      DISPLAY: nativeInfo.display,
-      BROWSER: chromiumWrapperPath,
-      PATH: `${BIN_DIR}:${process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}`
-    };
-    if (nativeInfo.sessionType === "wayland") {
-      env.WAYLAND_DISPLAY = nativeInfo.waylandDisplay;
-    } else {
-      env.WAYLAND_DISPLAY = "";
-    }
-    vncLog("build-x11-env", {
-      transport,
-      session_type: nativeInfo.sessionType,
-      display: nativeInfo.display,
-      wayland_display: env.WAYLAND_DISPLAY || void 0
-    });
-    return env;
+  if (accessResult.allowed && accessResult.reason === "account-manager" && accessResult.effectiveAccountId === conn.accountId) {
+    console.error(
+      `[whatsapp-native] op=escalation-tripwire senderId=${senderPhone} reason=account-manager-routed-to-house effectiveAccount=${accessResult.effectiveAccountId}`
+    );
+    return;
   }
-  return {
-    ...process.env,
-    DISPLAY: VNC_DISPLAY,
-    WAYLAND_DISPLAY: "",
-    XDG_SESSION_TYPE: "x11",
-    BROWSER: chromiumWrapperPath,
-    PATH: `${BIN_DIR}:${process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}`
-  };
-}
-
-// server/routes/health.ts
-function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve34) => {
-    const socket = createConnection2(port2, "127.0.0.1");
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => {
-      socket.destroy();
-      resolve34(true);
-    });
-    socket.once("error", () => {
-      socket.destroy();
-      resolve34(false);
-    });
-    socket.once("timeout", () => {
-      socket.destroy();
-      resolve34(false);
-    });
+  if (!accessResult.allowed) return;
+  if (isCustomerTurnSuppressed(accessResult.agentType, isHouseManagedService())) {
+    console.error(
+      `[channel-house] op=inbound from=${senderPhone} accountId=${conn.platformAccountId} autoReply=suppressed`
+    );
+    return;
+  }
+  const sendReceipts = whatsAppConfig.accounts?.[conn.accountId]?.sendReadReceipts ?? whatsAppConfig.sendReadReceipts ?? true;
+  if (sendReceipts && msg.key.id) {
+    sendReadReceipt(conn.sock, remoteJid, [msg.key.id], isGroup ? senderJid : void 0);
+  }
+  const reply = async (text) => {
+    if (isGroupJid(remoteJid)) {
+      console.error(`${TAG13} op=group-reply-blocked jid=${remoteJid}`);
+      throw new WaReplyError("group reply blocked \u2014 observe-only", false);
+    }
+    const currentSock = conn.sock;
+    if (!currentSock) {
+      const reason = conn.terminalReason;
+      throw new WaReplyError(reason ?? "WhatsApp disconnected \u2014 cannot reply", Boolean(reason));
+    }
+    await sendTextMessage(currentSock, remoteJid, text, { accountId: conn.accountId });
+  };
+  const composing = async () => {
+    const currentSock = conn.sock;
+    if (currentSock) await sendComposing(currentSock, remoteJid);
+  };
+  const cacheKey = deriveCacheKey({
+    agentType: accessResult.agentType,
+    accountId: conn.accountId,
+    senderPhone,
+    isGroup,
+    groupJid: isGroup ? remoteJid : void 0
   });
-}
-var app = new Hono();
-app.get("/", async (c) => {
-  const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
-  let pinConfigured = false;
-  try {
-    if (existsSync4(USERS_FILE)) {
-      const raw = readFileSync9(USERS_FILE, "utf-8").trim();
-      if (raw) {
-        const users = JSON.parse(raw);
-        pinConfigured = Array.isArray(users) && users.length > 0;
+  conn.lastMessageAt = Date.now();
+  const payload = {
+    accountId: conn.accountId,
+    agentType: accessResult.agentType,
+    passive: accessResult.passive === true,
+    personId: accessResult.personId ?? null,
+    senderPhone,
+    text: extracted.text,
+    isGroup,
+    groupJid: isGroup ? remoteJid : void 0,
+    reply,
+    composing,
+    cacheKey,
+    media: mediaResult?.path ? [{ path: mediaResult.path, type: extracted.mediaType, mimetype: mediaResult.mimetype }] : [],
+    replyContext: extracted.quotedMessage,
+    // Task 1383 — the gate's single resolution feeds the spawn (house or the
+    // bound sub-account); the router never re-resolves.
+    effectiveAccountId: accessResult.effectiveAccountId
+  };
+  if (accessResult.agentType === "public") {
+    const hoursResult = await isBusinessOpen(conn.accountId);
+    if (!hoursResult.open) {
+      console.error(`${TAG13} [${conn.accountId}] dispatch skipped: business closed`);
+      const afterHoursMessage = whatsAppConfig.accounts?.[conn.accountId]?.afterHoursMessage ?? whatsAppConfig.afterHoursMessage;
+      if (afterHoursMessage) {
+        try {
+          await reply(afterHoursMessage);
+          console.error(`${TAG13} [${conn.accountId}] after-hours auto-reply sent to ${remoteJid}`);
+        } catch (err) {
+          console.error(
+            `${TAG13} [${conn.accountId}] after-hours auto-reply failed: ${err instanceof Error ? err.message : String(err)}`
+          );
+        }
       }
+      return;
     }
-  } catch (err) {
-    console.error(`[health] users.json corrupt \u2014 reporting pin_configured=false: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  let authHealth;
-  try {
-    authHealth = await ensureAuth();
-  } catch {
-    authHealth = { status: "missing" };
   }
-  const claudeAuthenticated = authHealth.status === "ok" || authHealth.status === "expiring";
-  const vncRunning = await checkPort(WEBSOCKIFY_PORT);
-  let whatsappAccounts = [];
-  try {
-    whatsappAccounts = getStatus().map((a) => ({
-      accountId: a.accountId,
-      accountName: a.accountName ?? null,
-      connected: a.connected,
-      selfPhone: a.selfPhone ?? null,
-      reconnectAttempts: a.reconnectAttempts,
-      lastError: a.lastError ?? null,
-      sessionStuckReason: a.sessionStuckReason ?? null,
-      terminalReason: a.terminalReason ?? null
-    }));
-  } catch (err) {
-    console.error(`[health] failed to read WhatsApp status: ${err instanceof Error ? err.message : String(err)}`);
+  if (conn.debouncer) {
+    conn.debouncer.enqueue(payload);
+  } else {
+    onInboundMessage(payload);
   }
-  const whatsappAnyConnected = whatsappAccounts.some((a) => a.connected);
-  const whatsappAnyStuck = whatsappAccounts.some((a) => Boolean(a.sessionStuckReason));
-  const whatsappAnyTerminal = whatsappAccounts.some((a) => Boolean(a.terminalReason));
-  const account = resolveAccount();
-  const missingPlugins = findMissingPlugins(account?.config.enabledPlugins);
-  return c.json({
-    pin_configured: pinConfigured,
-    claude_authenticated: claudeAuthenticated,
-    vnc_running: vncRunning,
-    browser_transport: browserTransport,
-    auth_status: authHealth.status,
-    auth_expires_at: authHealth.expiresAt ?? null,
-    server_ip: getLanIp(),
-    missingPlugins,
-    whatsapp: {
-      any_connected: whatsappAnyConnected,
-      any_stuck: whatsappAnyStuck,
-      any_terminal: whatsappAnyTerminal,
-      accounts: whatsappAccounts
-    }
-  });
-});
-var health_default = app;
-
-// app/lib/attachments.ts
-import { randomUUID as randomUUID4 } from "crypto";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { realpathSync as realpathSync2 } from "fs";
-import { resolve as resolve7, extname } from "path";
-
-// app/lib/data-path.ts
-import { realpathSync } from "fs";
-import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join6 } from "path";
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "../platform");
-var DATA_ROOT = resolve6(PLATFORM_ROOT4, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve6(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
-var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["accounts"]);
-var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function crossesForeignAccountPartition(relPath, accountId) {
-  const segs = relPath.split("/").filter(Boolean);
-  if (segs.length < 2) return false;
-  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
-  const owner = segs[1];
-  if (!ACCOUNT_UUID_RE.test(owner)) return false;
-  return owner !== accountId;
 }
-function isWithinOwnAccountPartition(relPath, accountId) {
-  const segs = relPath.split("/").filter(Boolean);
-  return segs.length >= 2 && segs[0] === "accounts" && segs[1] === accountId;
+
+// app/lib/vnc.ts
+import { spawnSync, execFileSync } from "child_process";
+import { createConnection } from "net";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve7 } from "path";
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve7(process.cwd(), "..");
+var VNC_SCRIPT = resolve7(PLATFORM_ROOT4, "scripts/vnc.sh");
+var displayMode = process.env.DISPLAY_MODE ?? "virtual";
+if (displayMode === "native") {
+  console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
 }
-function resolveUnderRoot(raw, rootAbs, rootLabel) {
-  const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve6(rootAbs, cleaned);
-  let rootReal;
-  try {
-    rootReal = realpathSync(rootAbs);
-  } catch (err) {
-    return {
-      ok: false,
-      status: 500,
-      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
-    };
+function resolveBrowserTransport(req, remoteAddress) {
+  if (displayMode !== "native") return "vnc";
+  const xff = req.headers.get("x-forwarded-for") ?? void 0;
+  const client = resolveClientIp(remoteAddress ?? "127.0.0.1", xff);
+  const transport = client.kind !== "external" && !xff ? "native" : "vnc";
+  if (remoteAddress && remoteAddress !== "127.0.0.1" && remoteAddress !== "::1") {
+    const oldClient = resolveClientIp("127.0.0.1", xff);
+    const oldTransport = oldClient.kind !== "external" && !xff ? "native" : "vnc";
+    if (transport !== oldTransport) {
+      console.log(`[resolve-transport] remoteAddress="${remoteAddress}" transport="${transport}" (was: "${oldTransport}" with hardcoded loopback)`);
+    }
   }
-  let resolvedReal;
+  return transport;
+}
+var currentCdpDisplay = null;
+function discoverNativeDisplay() {
+  const fallback = { sessionType: "x11", display: ":0", waylandDisplay: "" };
   try {
-    resolvedReal = realpathSync(absolute);
-  } catch (err) {
-    const code = err.code;
-    if (code === "ENOENT") {
-      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep2)) {
-        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
+    const listResult = spawnSync("loginctl", ["list-sessions", "--no-legend"], {
+      timeout: 5e3,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (listResult.status !== 0 || !listResult.stdout.trim()) {
+      vncLog("native-display-discovery", { action: "fallback", reason: "no-sessions" });
+      return fallback;
+    }
+    const sessionId = listResult.stdout.trim().split("\n")[0].trim().split(/\s+/)[0];
+    const typeResult = spawnSync("loginctl", ["show-session", sessionId, "-p", "Type", "--value"], {
+      timeout: 5e3,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const displayResult = spawnSync("loginctl", ["show-session", sessionId, "-p", "Display", "--value"], {
+      timeout: 5e3,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    const sessionType = typeResult.stdout?.trim() || "";
+    const sessionDisplay = displayResult.stdout?.trim() || ":0";
+    if (sessionType === "wayland") {
+      let waylandDisplay = "wayland-0";
+      const leaderResult = spawnSync("loginctl", ["show-session", sessionId, "-p", "Leader", "--value"], {
+        timeout: 5e3,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      const leaderPid = leaderResult.stdout?.trim();
+      if (leaderPid) {
+        try {
+          const environ = readFileSync8(`/proc/${leaderPid}/environ`, "utf8");
+          const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
+          if (match) waylandDisplay = match.split("=")[1];
+        } catch {
+        }
       }
-      return { ok: false, status: 404, error: "Not found" };
+      const info2 = { sessionType: "wayland", display: sessionDisplay, waylandDisplay };
+      vncLog("native-display-discovery", {
+        action: "discovered",
+        session_type: "wayland",
+        display: sessionDisplay,
+        wayland_display: waylandDisplay
+      });
+      return info2;
     }
-    return {
-      ok: false,
-      status: 500,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
-    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
+    const info = { sessionType: "x11", display: sessionDisplay, waylandDisplay: "" };
+    vncLog("native-display-discovery", {
+      action: "discovered",
+      session_type: sessionType || "unknown (defaulting to x11)",
+      display: sessionDisplay
+    });
+    return info;
+  } catch (err) {
+    vncLog("native-display-discovery", { action: "fallback", reason: "error", err: err.message });
+    return fallback;
   }
-  const relPath = relative(rootReal, resolvedReal) || ".";
-  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
 }
-function resolveDataPath(raw) {
-  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
 }
-function resolveClaudeUploadsPath(raw) {
-  if (!CLAUDE_UPLOADS_ROOT) {
-    return { ok: false, status: 404, error: "Not found" };
+async function waitForPort(port2, timeoutMs = 12e3) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const ready = await new Promise((res) => {
+      const socket = createConnection(port2, "127.0.0.1");
+      socket.setTimeout(500);
+      socket.once("connect", () => {
+        socket.destroy();
+        res(true);
+      });
+      socket.once("error", () => {
+        socket.destroy();
+        res(false);
+      });
+      socket.once("timeout", () => {
+        socket.destroy();
+        res(false);
+      });
+    });
+    if (ready) return true;
+    await sleep(300);
   }
-  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
-}
-function scratchpadTmpBase() {
-  return process.env.MAXY_SCRATCHPAD_BASE ?? "/tmp";
-}
-function sessionScratchpadRoot(projectDir, sessionId) {
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
-  return join6(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
-}
-function resolveScratchpadPath(raw, scratchpadRootAbs) {
-  return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
-}
-
-// app/lib/doc-to-text.ts
-import { unzipSync, strFromU8 } from "fflate";
-var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
-var ODT = "application/vnd.oasis.opendocument.text";
-var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
-  DOCX,
-  ODT,
-  "text/rtf",
-  "application/rtf"
-]);
-function bareMime(mimeType) {
-  return mimeType.split(";")[0].trim().toLowerCase();
+  return false;
 }
-function unescapeXml(s) {
-  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+function ensureLogDir() {
+  mkdirSync2(LOG_DIR, { recursive: true });
 }
-function unzipEntry(buffer, entry) {
-  const files = unzipSync(new Uint8Array(buffer));
-  const bytes = files[entry];
-  if (!bytes) throw new Error(`zip entry not found: ${entry}`);
-  return strFromU8(bytes);
+function logPath(name) {
+  return resolve7(LOG_DIR, `${name}.log`);
 }
-function docxToText(buffer) {
-  const xml = unzipEntry(buffer, "word/document.xml");
-  const paras = [];
-  for (const p of xml.split("</w:p>")) {
-    const withBreaks = p.replace(/<w:tab\b[^>]*\/?>/g, "	").replace(/<w:br\b[^>]*\/?>/g, "\n");
-    let line = "";
-    for (const m of withBreaks.matchAll(/<w:t\b[^>]*>([\s\S]*?)<\/w:t>/g)) {
-      line += unescapeXml(m[1]);
-    }
-    if (line.length > 0) paras.push(line);
+async function ensureVnc() {
+  if (process.platform !== "linux") {
+    vncLog("ensure-vnc", { action: "skipped", reason: "platform-not-linux", platform: process.platform });
+    return false;
   }
-  return paras.join("\n");
-}
-function odtToText(buffer) {
-  const xml = unzipEntry(buffer, "content.xml");
-  const body = xml.replace(/^[\s\S]*?<office:text\b[^>]*>/, "").replace(/<\/office:text>[\s\S]*$/, "");
-  const withBreaks = body.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	").replace(/<\/text:(?:p|h)>/g, "\n");
-  const stripped = withBreaks.replace(/<[^>]+>/g, "");
-  return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
+  const up = await waitForPort(RFB_PORT, 1e3);
+  if (up) return true;
+  vncLog("ensure-vnc", { action: "restart", reason: "x-down", rfb_port: RFB_PORT });
+  try {
+    execFileSync("bash", [VNC_SCRIPT, "start"], { timeout: 2e4 });
+  } catch (err) {
+    vncLog("ensure-vnc", { action: "restart-failed", err: err.message });
+    return false;
+  }
+  const ok = await waitForPort(RFB_PORT, 12e3);
+  vncLog("ensure-vnc", { action: "restart-complete", rfb_port: RFB_PORT, ok });
+  return ok;
 }
-var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
-function stripRtfDestinations(s) {
-  let out = "";
-  for (let i = 0; i < s.length; i++) {
-    const ch = s[i];
-    if (ch === "\\" && i + 1 < s.length) {
-      out += ch + s[i + 1];
-      i++;
-      continue;
+async function ensureCdp(transport = "vnc") {
+  if (process.platform !== "linux") {
+    vncLog("ensure-cdp", { action: "skipped", reason: "platform-not-linux", platform: process.platform });
+    return false;
+  }
+  const targetSentinel = transport === "native" ? "native" : VNC_DISPLAY;
+  if (await waitForPort(CDP_PORT, 1e3)) {
+    if (currentCdpDisplay !== null && currentCdpDisplay !== targetSentinel) {
+      console.error(`[ensureCdp] Display switch: ${currentCdpDisplay} \u2192 ${targetSentinel}`);
+      vncLog("ensure-cdp", {
+        action: "display-switch",
+        transport,
+        from_display: currentCdpDisplay,
+        to_display: targetSentinel
+      });
+      killChromium();
+      await sleep(500);
+    } else {
+      return true;
     }
-    if (ch === "{" && RTF_DROP_DEST.test(s.slice(i + 1))) {
-      let depth = 1;
-      let j = i + 1;
-      for (; j < s.length && depth > 0; j++) {
-        if (s[j] === "\\") {
-          j++;
-          continue;
-        }
-        if (s[j] === "{") depth++;
-        else if (s[j] === "}") depth--;
+  }
+  const vncCommand = transport === "native" ? "start-chrome-native" : "start-chrome";
+  if (transport === "vnc") {
+    const xAlive = await waitForPort(RFB_PORT, 1e3);
+    if (!xAlive) {
+      console.error(`[ensureCdp] X server down on rfb=${RFB_PORT} \u2014 escalating to full VNC restart`);
+      vncLog("ensure-cdp", { action: "escalate-vnc-restart", reason: "x-down", transport, rfb_port: RFB_PORT });
+      const vncOk = await ensureVnc();
+      if (!vncOk) {
+        console.error("[ensureCdp] Full VNC restart failed \u2014 browser-specialist degraded");
+        vncLog("ensure-cdp", { action: "degraded", reason: "vnc-restart-failed", transport });
+        return false;
       }
-      i = j - 1;
-      continue;
+      const cdpOk2 = await waitForPort(CDP_PORT, 12e3);
+      if (cdpOk2) currentCdpDisplay = targetSentinel;
+      vncLog("ensure-cdp", { action: "post-vnc-restart", transport, cdp_port: CDP_PORT, ok: cdpOk2 });
+      return cdpOk2;
     }
-    out += ch;
   }
-  return out;
-}
-function rtfToText(rtf) {
-  let s = stripRtfDestinations(rtf);
-  s = s.replace(/\\par[d]?\b/g, "\n").replace(/\\line\b/g, "\n").replace(/\\tab\b/g, "	");
-  s = s.replace(/\\'([0-9a-fA-F]{2})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)));
-  s = s.replace(/\\[a-zA-Z]+-?\d* ?/g, "");
-  s = s.replace(/\\([{}\\])/g, "$1").replace(/[{}]/g, "");
-  return s.replace(/[ \t]{2,}/g, " ").replace(/\n{3,}/g, "\n\n").trim();
+  if (transport === "native") {
+    const nativeInfo = discoverNativeDisplay();
+    vncLog("ensure-cdp", {
+      action: "native-display-resolved",
+      transport,
+      session_type: nativeInfo.sessionType,
+      display: nativeInfo.display,
+      wayland_display: nativeInfo.waylandDisplay || void 0
+    });
+  }
+  console.error(`[ensureCdp] Restarting Chrome (${vncCommand}) for transport=${transport}`);
+  vncLog("ensure-cdp", { action: `restart-${vncCommand}`, reason: "cdp-dead", transport });
+  try {
+    execFileSync("bash", [VNC_SCRIPT, vncCommand], { timeout: 2e4 });
+  } catch (err) {
+    vncLog("ensure-cdp", { action: "restart-chrome-failed", transport, err: err.message });
+    return false;
+  }
+  const cdpOk = await waitForPort(CDP_PORT, 12e3);
+  if (cdpOk) currentCdpDisplay = targetSentinel;
+  vncLog("ensure-cdp", { action: "restart-chrome-complete", transport, sentinel: targetSentinel, cdp_port: CDP_PORT, ok: cdpOk });
+  return cdpOk;
 }
-function docToText(buffer, mimeType) {
-  const mime = bareMime(mimeType);
-  if (mime === DOCX) return docxToText(buffer);
-  if (mime === ODT) return odtToText(buffer);
-  if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
-  return null;
+function killChromium() {
+  spawnSync("pkill", ["-f", "chromium"], { stdio: "pipe" });
 }
+function writeChromiumWrapper() {
+  mkdirSync2(BIN_DIR, { recursive: true });
+  const wrapperPath = resolve7(BIN_DIR, "chromium");
+  writeFileSync3(wrapperPath, `#!/bin/bash
+LOG="${LOG_DIR}/chromium.log"
+echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
+echo "  DISPLAY=$DISPLAY WAYLAND=$WAYLAND_DISPLAY XDG_SESSION_TYPE=$XDG_SESSION_TYPE" >> "$LOG"
+echo "  args: $*" >> "$LOG"
 
-// app/lib/attachments.ts
-function uploadsDirFor(accountId, subPath, attachmentId) {
-  return subPath ? resolve7(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve7(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
-}
-var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp",
-  "application/pdf",
-  "text/plain",
-  "text/markdown",
-  "text/csv",
-  "text/html",
-  "text/calendar",
-  "application/zip",
-  "application/x-zip-compressed",
-  // Task 1347 — Word/OpenDocument/RTF text documents. The bytes are converted to
-  // a readable-text sibling at ingestion (writeAttachment → doc-to-text.ts)
-  // because the on-device Read tool cannot parse the binary containers. rtf is
-  // reported by browsers as either text/rtf or application/rtf.
-  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  "application/vnd.oasis.opendocument.text",
-  "text/rtf",
-  "application/rtf",
-  // Task 1240 — voice recordings persist as playable clips in the admin bubble.
-  // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
-  "audio/ogg",
-  "audio/opus",
-  "audio/webm",
-  "audio/mp4",
-  "audio/x-m4a",
-  "audio/mpeg",
-  "audio/wav",
-  "video/mp4"
-]);
-var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
-var MAX_FILES_PER_MESSAGE = 5;
-var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
-var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
-var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
-function assertSupportedMime(mimeType) {
-  const bare = mimeType.split(";")[0].trim().toLowerCase();
-  if (!SUPPORTED_MIME_TYPES.has(bare)) {
-    throw new Error(
-      `Unsupported file type: "${mimeType}". Supported types: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
-    );
-  }
+# Check the brand's virtual display is up (Tasks 553 + 924 \u2014 per-brand
+# display + per-brand CDP port).
+if DISPLAY=${VNC_DISPLAY} xdpyinfo >/dev/null 2>&1; then
+  echo "  xdpyinfo ${VNC_DISPLAY} OK" >> "$LOG"
+else
+  echo "  xdpyinfo ${VNC_DISPLAY} FAILED \u2014 display not ready" >> "$LOG"
+fi
+
+# read the install-time-resolved non-snap Chromium binary path.
+# The installer (ensureNonSnapChromium + writeChromiumBinaryPathFile) writes
+# this file with the absolute path to either /usr/bin/chromium (Pi Bookworm:
+# real .deb) or /usr/bin/google-chrome-stable (Ubuntu Noble laptop: snap
+# replaced). Refusing the legacy probe loop closes the silent-fallback path
+# where /snap/bin/chromium would re-introduce the AppArmor SingletonLock
+# denial that triggered.
+PATH_FILE="${PLATFORM_ROOT4}/config/chromium-binary.path"
+if [ ! -r "$PATH_FILE" ]; then
+  echo "  ERROR: $PATH_FILE missing \u2014 re-run installer" >> "$LOG"
+  exit 1
+fi
+BIN="$(head -n1 "$PATH_FILE" | tr -d '[:space:]')"
+if [ -z "$BIN" ] || [ ! -x "$BIN" ]; then
+  echo "  ERROR: $PATH_FILE empty or non-executable: $BIN" >> "$LOG"
+  exit 1
+fi
+RESOLVED="$(readlink -f "$BIN" 2>/dev/null || echo "$BIN")"
+case ":$(echo "$RESOLVED" | tr '/' ':'):" in
+  *:snap:*)
+    echo "  ERROR: $BIN resolves to snap-confined $RESOLVED \u2014 re-run installer" >> "$LOG"
+    exit 1
+    ;;
+esac
+echo "  launching $BIN (realpath=$RESOLVED)" >> "$LOG"
+
+# nohup detaches chromium from this wrapper's process group so it outlives
+# claude auth login exiting (e.g. on timeout). --user-data-dir is brand-scoped
+# so a wrapper-spawned chromium attaches to the same per-brand
+# profile that vnc.sh's start_chrome targets \u2014 no shared cookies across brands.
+nohup "$BIN" \\
+  --user-data-dir=${CHROMIUM_PROFILE_DIR} \\
+  --no-sandbox \\
+  --test-type \\
+  --disable-dev-shm-usage \\
+  --disable-gpu \\
+  --password-store=basic \\
+  --use-mock-keychain \\
+  --ozone-platform=x11 \\
+  --no-first-run \\
+  --no-default-browser-check \\
+  --disable-session-crashed-bubble \\
+  --hide-crash-restore-bubble \\
+  --noerrdialogs \\
+  --window-size=1280,800 \\
+  --window-position=0,0 \\
+  "$@" >> "$LOG" 2>&1 &
+echo "  chromium PID: $!" >> "$LOG"
+`, { mode: 493 });
+  return wrapperPath;
 }
-async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer) {
-  const attachmentId = randomUUID4();
-  const dir = uploadsDirFor(accountId, subPath, attachmentId);
-  await mkdir2(dir, { recursive: true });
-  const ext = extname(filename) || "";
-  const storagePath = resolve7(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve7(dir, `${attachmentId}.meta.json`);
-  const meta = {
-    attachmentId,
-    scope: subPath || accountId,
-    filename,
-    mimeType,
-    sizeBytes,
-    storedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await writeFile2(storagePath, buffer);
-  await writeFile2(metaPath, JSON.stringify(meta, null, 2));
-  let readableTextPath;
-  if (CONVERTIBLE_DOC_MIME.has(mimeType.split(";")[0].trim().toLowerCase())) {
-    const text = docToText(buffer, mimeType);
-    if (text) {
-      readableTextPath = resolve7(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
-      await writeFile2(readableTextPath, text);
+function buildX11Env(chromiumWrapperPath, transport = "vnc") {
+  if (transport === "native") {
+    const nativeInfo = discoverNativeDisplay();
+    const env = {
+      ...process.env,
+      DISPLAY: nativeInfo.display,
+      BROWSER: chromiumWrapperPath,
+      PATH: `${BIN_DIR}:${process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}`
+    };
+    if (nativeInfo.sessionType === "wayland") {
+      env.WAYLAND_DISPLAY = nativeInfo.waylandDisplay;
+    } else {
+      env.WAYLAND_DISPLAY = "";
     }
+    vncLog("build-x11-env", {
+      transport,
+      session_type: nativeInfo.sessionType,
+      display: nativeInfo.display,
+      wayland_display: env.WAYLAND_DISPLAY || void 0
+    });
+    return env;
   }
-  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
+  return {
+    ...process.env,
+    DISPLAY: VNC_DISPLAY,
+    WAYLAND_DISPLAY: "",
+    XDG_SESSION_TYPE: "x11",
+    BROWSER: chromiumWrapperPath,
+    PATH: `${BIN_DIR}:${process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}`
+  };
 }
-async function storeAttachment(accountId, file) {
-  assertSupportedMime(file.type);
-  if (file.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
-    );
-  }
-  const buffer = Buffer.from(await file.arrayBuffer());
-  return writeAttachment(accountId, "", file.name, file.type, file.size, buffer);
+
+// server/routes/health.ts
+function checkPort(port2, timeoutMs = 500) {
+  return new Promise((resolve34) => {
+    const socket = createConnection2(port2, "127.0.0.1");
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => {
+      socket.destroy();
+      resolve34(true);
+    });
+    socket.once("error", () => {
+      socket.destroy();
+      resolve34(false);
+    });
+    socket.once("timeout", () => {
+      socket.destroy();
+      resolve34(false);
+    });
+  });
 }
-async function storePublicAttachment(accountId, sessionId, file, buffer) {
-  assertSupportedMime(file.type);
-  if (file.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
-    );
+var app = new Hono();
+app.get("/", async (c) => {
+  const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
+  let pinConfigured = false;
+  try {
+    if (existsSync5(USERS_FILE)) {
+      const raw = readFileSync9(USERS_FILE, "utf-8").trim();
+      if (raw) {
+        const users = JSON.parse(raw);
+        pinConfigured = Array.isArray(users) && users.length > 0;
+      }
+    }
+  } catch (err) {
+    console.error(`[health] users.json corrupt \u2014 reporting pin_configured=false: ${err instanceof Error ? err.message : String(err)}`);
   }
-  return writeAttachment(accountId, `public/${sessionId}`, file.name, file.type, file.size, buffer);
-}
-var MIME_BY_EXT = {
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".xml": "text/xml",
-  ".zip": "application/zip",
-  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  ".odt": "application/vnd.oasis.opendocument.text",
-  ".rtf": "text/rtf",
-  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  ".ics": "text/calendar"
-};
-function detectMimeType(filePath) {
-  const ext = extname(filePath).toLowerCase();
-  return MIME_BY_EXT[ext] ?? "application/octet-stream";
-}
-function validateFilePathInAccount(filePath, accountDir) {
-  const resolved = realpathSync2(filePath);
-  const accountResolved = realpathSync2(accountDir);
-  if (!resolved.startsWith(accountResolved + "/")) {
-    throw new Error(`File path is outside the account directory`);
+  let authHealth;
+  try {
+    authHealth = await ensureAuth();
+  } catch {
+    authHealth = { status: "missing" };
   }
-  return resolved;
-}
-async function storeComponentArtefact(accountId, attachmentId, mimeType, content, filename) {
-  const buffer = Buffer.from(content, "utf-8");
-  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
-    );
+  const claudeAuthenticated = authHealth.status === "ok" || authHealth.status === "expiring";
+  const vncRunning = await checkPort(WEBSOCKIFY_PORT);
+  let whatsappAccounts = [];
+  try {
+    whatsappAccounts = getStatus().map((a) => ({
+      accountId: a.accountId,
+      accountName: a.accountName ?? null,
+      connected: a.connected,
+      selfPhone: a.selfPhone ?? null,
+      reconnectAttempts: a.reconnectAttempts,
+      lastError: a.lastError ?? null,
+      sessionStuckReason: a.sessionStuckReason ?? null,
+      terminalReason: a.terminalReason ?? null
+    }));
+  } catch (err) {
+    console.error(`[health] failed to read WhatsApp status: ${err instanceof Error ? err.message : String(err)}`);
   }
-  const dir = uploadsDirFor(accountId, "", attachmentId);
-  await mkdir2(dir, { recursive: true });
-  const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve7(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve7(dir, `${attachmentId}.meta.json`);
-  const meta = {
-    attachmentId,
-    scope: accountId,
-    filename,
-    mimeType,
-    sizeBytes: buffer.byteLength,
-    storedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await writeFile2(storagePath, buffer);
-  await writeFile2(metaPath, JSON.stringify(meta, null, 2));
-  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes: buffer.byteLength };
-}
+  const whatsappAnyConnected = whatsappAccounts.some((a) => a.connected);
+  const whatsappAnyStuck = whatsappAccounts.some((a) => Boolean(a.sessionStuckReason));
+  const whatsappAnyTerminal = whatsappAccounts.some((a) => Boolean(a.terminalReason));
+  const account = resolveAccount();
+  const missingPlugins = findMissingPlugins(account?.config.enabledPlugins);
+  return c.json({
+    pin_configured: pinConfigured,
+    claude_authenticated: claudeAuthenticated,
+    vnc_running: vncRunning,
+    browser_transport: browserTransport,
+    auth_status: authHealth.status,
+    auth_expires_at: authHealth.expiresAt ?? null,
+    server_ip: getLanIp(),
+    missingPlugins,
+    whatsapp: {
+      any_connected: whatsappAnyConnected,
+      any_stuck: whatsappAnyStuck,
+      any_terminal: whatsappAnyTerminal,
+      accounts: whatsappAccounts
+    }
+  });
+});
+var health_default = app;
 
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
@@ -6204,10 +6301,10 @@ ${result.result.text}` : result.result.text;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function adminSessionIdFor(accountId, senderId, personId) {
   const subject = personId && personId.length > 0 ? `person:${personId}` : senderId;
-  const b = createHash("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
+  const b = createHash2("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
   const v = Buffer.from(b);
   v[6] = v[6] & 15 | 64;
   v[8] = v[8] & 63 | 128;
@@ -6363,13 +6460,13 @@ async function sendTelegramText(botToken, chatId, text) {
 
 // server/routes/whatsapp.ts
 import { join as join10, resolve as resolve10 } from "path";
-import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync6 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync7 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
 import { resolve as resolve8, join as join8, dirname as dirname2, basename as basename2 } from "path";
 var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
@@ -6377,7 +6474,7 @@ function configPath(accountDir) {
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
-  if (!existsSync5(path2)) throw new Error(`account.json not found at ${path2}`);
+  if (!existsSync6(path2)) throw new Error(`account.json not found at ${path2}`);
   return JSON.parse(readFileSync10(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
@@ -6676,7 +6773,7 @@ function setPublicAgent(accountDir, slug) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
   const agentConfigPath = join8(accountDir, "agents", trimmed, "config.json");
-  if (!existsSync5(agentConfigPath)) {
+  if (!existsSync6(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
   try {
@@ -7638,13 +7735,13 @@ app2.post("/config", async (c) => {
       case "list-public-agents": {
         const agentsDir = resolve10(account.accountDir, "agents");
         const agents = [];
-        if (existsSync6(agentsDir)) {
+        if (existsSync7(agentsDir)) {
           try {
             const entries = readdirSync4(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
               const configPath2 = resolve10(agentsDir, entry.name, "config.json");
-              if (!existsSync6(configPath2)) continue;
+              if (!existsSync7(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
@@ -7788,9 +7885,10 @@ app2.get("/activity", (c) => {
 });
 app2.get("/conversations", (c) => {
   try {
-    const accountId = validateAccountId(c.req.query("accountId") ?? null);
-    const denial = callerScopeDenial(c, accountId);
+    const requestedAccountId = validateAccountId(c.req.query("accountId") ?? null);
+    const denial = callerScopeDenial(c, requestedAccountId);
     if (denial) return denial;
+    const accountId = resolveReadStoreKey(requestedAccountId);
     const jids = listConversationJids(accountId);
     const conversations = jids.map((jid) => {
       const messages = getMessages(accountId, jid);
@@ -7803,7 +7901,7 @@ app2.get("/conversations", (c) => {
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG21} conversations account=${accountId} storeKeyFound=${jids.length > 0} count=${conversations.length}`);
+    console.error(`${TAG21} conversations requested=${requestedAccountId} account=${accountId} storeKeyFound=${jids.length > 0} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
     console.error(`${TAG21} conversations error: ${String(err)}`);
@@ -7812,9 +7910,10 @@ app2.get("/conversations", (c) => {
 });
 app2.get("/messages", (c) => {
   try {
-    const accountId = validateAccountId(c.req.query("accountId") ?? null);
-    const denial = callerScopeDenial(c, accountId);
+    const requestedAccountId = validateAccountId(c.req.query("accountId") ?? null);
+    const denial = callerScopeDenial(c, requestedAccountId);
     if (denial) return denial;
+    const accountId = resolveReadStoreKey(requestedAccountId);
     const jid = c.req.query("jid");
     if (!jid) {
       return c.json({ error: "Missing required parameter: jid" }, 400);
@@ -7824,7 +7923,7 @@ app2.get("/messages", (c) => {
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
     const messages = getMessages(accountId, jid, effectiveLimit);
     const storeKeyFound = listConversationJids(accountId).length > 0;
-    console.error(`${TAG21} messages account=${accountId} jid=${jid} storeKeyFound=${storeKeyFound} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    console.error(`${TAG21} messages requested=${requestedAccountId} account=${accountId} jid=${jid} storeKeyFound=${storeKeyFound} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
     return c.json({ messages });
   } catch (err) {
     console.error(`${TAG21} messages error: ${String(err)}`);
@@ -7959,7 +8058,7 @@ app2.get("/group-info", async (c) => {
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync8, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
+import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync9, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
 import { basename as basename5, dirname as dirname4, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
@@ -8319,14 +8418,14 @@ app3.get("/", requireAdminSession, async (c) => {
 var sidebar_sessions_default = app3;
 
 // app/lib/admin-identity/pin-validator.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join12 } from "path";
 function hashPin(pin) {
-  return createHash2("sha256").update(pin).digest("hex");
+  return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
-  if (!existsSync7(usersFilePath)) return null;
+  if (!existsSync8(usersFilePath)) return null;
   const raw = readFileSync13(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -8481,14 +8580,14 @@ function joinTextBlocks(content) {
   }
   return parts.join("");
 }
-function assistantTurns(content, ts) {
+function assistantTurns(content, ts, promoteFinal = false) {
   if (!Array.isArray(content)) return [];
   const out = [];
   for (const block of content) {
     if (!block || typeof block !== "object") continue;
     const b = block;
     if (b.type === "text" && typeof b.text === "string") {
-      out.push({ kind: "agent-text", text: b.text, ts });
+      out.push(promoteFinal && b.text.trim().length > 0 ? { kind: "agent-webchat-final", text: b.text, ts } : { kind: "agent-text", text: b.text, ts });
     } else if (b.type === "tool_use" && (b.name === WA_REPLY_TOOL || b.name === WEBCHAT_REPLY_TOOL || b.name === CHANNEL_REPLY_TOOL)) {
       const text = b.input?.text;
       out.push({ kind: "agent-reply", text: typeof text === "string" ? text : "", ts });
@@ -8539,7 +8638,7 @@ function renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress) {
     out.push(operatorInboundTurn(u, ts));
   }
 }
-function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map()) {
+function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(), turnCtx = {}) {
   const out = [];
   for (const line of lines) {
     if (!line || line[0] !== "{") continue;
@@ -8562,23 +8661,31 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
         out.push({ kind: "agent-error", code, raw, ts });
         continue;
       }
-      out.push(...assistantTurns(msg?.content, ts));
+      const isEnd = msg?.stop_reason === "end_turn";
+      out.push(...assistantTurns(msg?.content, ts, isEnd && turnCtx.lastChannelSource === "webchat"));
       continue;
     }
     if (row.type === "queue-operation" && row.operation === "enqueue") {
       const content = asString(row.content);
-      if (content !== null && CHANNEL_WRAPPER2.test(content) && !isScheduleSource(content)) {
+      if (content !== null && CHANNEL_WRAPPER2.test(content)) {
         const u = unwrapChannel(content);
-        out.push(operatorInboundTurn(u, ts));
-        queuedPendingSuppress.set(u.text, (queuedPendingSuppress.get(u.text) ?? 0) + 1);
+        turnCtx.lastChannelSource = u.source;
+        if (!isScheduleSource(content)) {
+          out.push(operatorInboundTurn(u, ts));
+          queuedPendingSuppress.set(u.text, (queuedPendingSuppress.get(u.text) ?? 0) + 1);
+        }
       }
       continue;
     }
     if (row.type === "attachment") {
       const att = row.attachment;
       const isChannelQueued = att?.type === "queued_command" && att.isMeta === true && typeof att.origin === "object" && att.origin !== null && att.origin.kind === "channel" && typeof att.prompt === "string";
-      if (isChannelQueued && !isScheduleSource(att.prompt)) {
-        renderOrSuppressChannelInbound(unwrapChannel(att.prompt), ts, out, queuedPendingSuppress);
+      if (isChannelQueued) {
+        const u = unwrapChannel(att.prompt);
+        turnCtx.lastChannelSource = u.source;
+        if (!isScheduleSource(att.prompt)) {
+          renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress);
+        }
       }
       continue;
     }
@@ -8603,8 +8710,10 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
     // enqueue row AND this row both render and every channel message doubles.
     CHANNEL_WRAPPER2.test(text);
     if (isChannel) {
+      const u = unwrapChannel(text);
+      turnCtx.lastChannelSource = u.source;
       if (!isScheduleSource(text)) {
-        renderOrSuppressChannelInbound(unwrapChannel(text), ts, out, queuedPendingSuppress);
+        renderOrSuppressChannelInbound(u, ts, out, queuedPendingSuppress);
       }
     } else if (row.isMeta === true) {
       out.push({ kind: "harness-internal", text, ts });
@@ -9027,7 +9136,7 @@ data: ${JSON.stringify(turn)}
       const sessionKey = c.req.query("session_key") ?? "";
       const subagentsDir = resolve12(join14(projectDir, sessionId, "subagents"));
       console.log(
-        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync8(subagentsDir)}`
+        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync9(subagentsDir)}`
       );
       const actx = makeActivityCtx({
         subagentsDir,
@@ -9044,6 +9153,7 @@ data: ${JSON.stringify(obj)}
         log: (line) => console.log(line)
       });
       const queuedPendingSuppress = /* @__PURE__ */ new Map();
+      const turnCtx = {};
       const drain = () => {
         try {
           const { buf, end } = readFrom(jsonlPath, offset);
@@ -9051,7 +9161,7 @@ data: ${JSON.stringify(obj)}
           const { lines, nextOffset } = splitNewLines(buf, offset);
           offset = nextOffset;
           let n = 0;
-          for (const turn of parseTranscript(lines, queuedPendingSuppress)) {
+          for (const turn of parseTranscript(lines, queuedPendingSuppress, turnCtx)) {
             send(controller, enrichAdminAttachments(enrichDownloads(turn, scratchpadRoot)), offset);
             actx.lastParentTurns.push(turn);
             if (turn.kind === "agent-error") {
@@ -9071,7 +9181,7 @@ data: ${JSON.stringify(obj)}
           const { buf, end } = readFrom(jsonlPath, 0);
           offset = end;
           let n = 0;
-          for (const turn of parseTranscript(buf.toString("utf8").split("\n"), queuedPendingSuppress)) {
+          for (const turn of parseTranscript(buf.toString("utf8").split("\n"), queuedPendingSuppress, turnCtx)) {
             send(controller, enrichAdminAttachments(enrichDownloads(turn, scratchpadRoot)), offset);
             actx.lastParentTurns.push(turn);
             if (turn.kind === "agent-error") {
@@ -9133,7 +9243,7 @@ app4.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   if (!SESSION_ID_RE2.test(sessionId)) return c.json({ error: "bad session reference" }, 400);
   const dir = directiveStoreDir(sessionId);
-  if (!dir || !existsSync8(dir)) return c.json({ entries: [] });
+  if (!dir || !existsSync9(dir)) return c.json({ entries: [] });
   let names;
   try {
     names = readdirSync8(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
@@ -9191,14 +9301,22 @@ app4.get("/store-stream", requireAdminSession, (c) => {
   const connId = `${remoteJid.slice(0, 12)}-${process.hrtime.bigint().toString(36).slice(-6)}`;
   const startedAt = Date.now();
   const lastEventId = c.req.header("Last-Event-ID");
-  const toTurn = (r) => ({
-    kind: "whatsapp-persisted",
-    text: r.body,
-    ts: r.dateSent,
-    fromMe: r.fromMe,
-    senderName: r.senderName,
-    origin: r.origin
-  });
+  const uploadsBase = resolve12(DATA_ROOT, "accounts", accountId, "uploads");
+  const toTurn = (r) => {
+    const turn = {
+      kind: "whatsapp-persisted",
+      text: r.body,
+      ts: r.dateSent,
+      fromMe: r.fromMe,
+      senderName: r.senderName,
+      origin: r.origin
+    };
+    if (r.attachmentId) {
+      const meta = readAttachmentMeta(join14(uploadsBase, r.attachmentId));
+      if (meta) return { ...turn, attachments: [meta] };
+    }
+    return turn;
+  };
   const readable = new ReadableStream({
     start(controller) {
       const send = (turn, id) => {
@@ -9382,7 +9500,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
       return c.json({ error: `WhatsApp account "${accountId}" is registered but its socket is disconnected.` }, 503);
     }
     console.log(`${MANUAL_TAG} op=socket sendId=${sendId} accountId=${accountId} result=ok socketAccountId=${res.accountId}`);
-    const record = (waMessageId, body) => {
+    const record = (waMessageId, body, attachmentId) => {
       const nowIso = (/* @__PURE__ */ new Date()).toISOString();
       const rec = {
         messageId: `whatsapp-live:${res.accountId}:${remoteJid}:${waMessageId}`,
@@ -9398,11 +9516,15 @@ app4.post("/reply", requireAdminSession, async (c) => {
         quotedSender: null,
         scope: template.scope,
         origin: "operator-manual",
-        createdAt: nowIso
+        createdAt: nowIso,
+        // Task 1536 — a media send carries the servable attachment reference (the
+        // file already lives in the account's uploads store via storeAttachment),
+        // so the store reader renders it inline instead of a `[sent …]` text line.
+        ...attachmentId ? { attachmentId } : {}
       };
       appendMessage(accountId, rec);
       const present = readConversation(accountId, remoteJid).some((r) => r.messageId === rec.messageId);
-      console.log(`${MANUAL_TAG} op=recorded sendId=${sendId} waMessageId=${waMessageId} present=${present}`);
+      console.log(`${MANUAL_TAG} op=recorded sendId=${sendId} waMessageId=${waMessageId} present=${present} attachment=${attachmentId ? "yes" : "no"}`);
     };
     let sent = 0;
     if (text) {
@@ -9440,7 +9562,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
         mid = r.messageId;
       }
       console.log(`${MANUAL_TAG} op=sent sendId=${sendId} kind=${kind ?? "document"} idx=${i} waMessageId=${mid ?? ""}`);
-      if (mid) record(mid, `[sent ${stored.filename}]`);
+      if (mid) record(mid, "", stored.attachmentId);
       sent++;
     }
     exit("delivered");
@@ -9751,7 +9873,7 @@ var public_reader_default = app5;
 // server/routes/webchat.ts
 import { basename as basename7, dirname as dirname6 } from "path";
 import { join as join18 } from "path";
-import { existsSync as existsSync10, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync17, writeFileSync as writeFileSync5, renameSync as renameSync2 } from "fs";
@@ -9838,7 +9960,7 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readdirSync as readdirSync10, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync10, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join17 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -9859,7 +9981,7 @@ function createSidecarStore(config) {
       return { ok: true };
     } catch (error) {
       try {
-        if (existsSync9(tmp)) unlinkSync2(tmp);
+        if (existsSync10(tmp)) unlinkSync2(tmp);
       } catch {
       }
       return { ok: false, error };
@@ -9915,7 +10037,7 @@ function createSidecarStore(config) {
   function clear(sessionsDir, id) {
     const path2 = pathFor(sessionsDir, id);
     try {
-      if (existsSync9(path2)) {
+      if (existsSync10(path2)) {
         unlinkSync2(path2);
         return { ok: true, removed: true };
       }
@@ -9983,7 +10105,7 @@ function locateSidecar(sessionId) {
   }
   for (const slug of slugs) {
     const metaPath = join18(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync10(metaPath)) {
+    if (existsSync11(metaPath)) {
       const meta = readSidecarMeta(metaPath);
       return { channel: meta.channel, adminUserId: meta.adminUserId, accountId: meta.accountId };
     }
@@ -10578,7 +10700,7 @@ ${note}` : note;
 import { resolve as resolve14 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync12 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync20, readdirSync as readdirSync12 } from "fs";
 import { join as join19 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
@@ -10590,7 +10712,7 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync11(specialistsDir)) return { specialists: [], skipped: [] };
+  if (!existsSync12(specialistsDir)) return { specialists: [], skipped: [] };
   const entries = readdirSync12(specialistsDir);
   const specialists = [];
   const skipped = [];
@@ -10716,7 +10838,7 @@ var webchat_greeting_default = app6;
 // server/routes/telegram.ts
 import { homedir } from "os";
 import { resolve as resolve15, join as join20 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync21 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
@@ -10776,7 +10898,7 @@ var TAG23 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
   const brandPath = join20(platformRoot3, "config", "brand.json");
-  if (existsSync12(brandPath)) {
+  if (existsSync13(brandPath)) {
     try {
       return JSON.parse(readFileSync21(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
@@ -10797,7 +10919,7 @@ app7.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync12(sp)) {
+  if (!existsSync13(sp)) {
     console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
@@ -10865,7 +10987,7 @@ var telegram_default = app7;
 
 // server/routes/quickbooks.ts
 import { join as join21 } from "path";
-import { existsSync as existsSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
 var TAG24 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
@@ -10878,7 +11000,7 @@ function storePath(accountDir) {
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
-  if (!state || !STATE_RE.test(state) || !existsSync13(pendingPath(accountDir, state))) {
+  if (!state || !STATE_RE.test(state) || !existsSync14(pendingPath(accountDir, state))) {
     console.error(`${TAG24} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
@@ -10905,7 +11027,7 @@ async function completeConsent(args) {
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
-    if (!existsSync13(storePath(accountDir))) {
+    if (!existsSync14(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
     const store2 = JSON.parse(readFileSync22(storePath(accountDir), "utf-8"));
@@ -10973,8 +11095,8 @@ var quickbooks_default = app8;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync3 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync15, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
-import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync16, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
 function claudeBin() {
@@ -11111,7 +11233,7 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
 import { dirname as dirname7, join as join22 } from "path";
 function id8(value) {
   return value.slice(0, 8);
@@ -11152,7 +11274,7 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync14(input.usersFile)) {
+    if (existsSync15(input.usersFile)) {
       const raw = readFileSync23(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
@@ -11185,7 +11307,7 @@ function writeAdminEntry(input) {
   }
   try {
     const accountJsonPath = join22(input.accountDir, "account.json");
-    if (!existsSync14(accountJsonPath)) {
+    if (!existsSync15(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
     const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
@@ -11208,7 +11330,7 @@ function writeAdminEntry(input) {
 function computeAdminStoreDivergence(input) {
   const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync14(input.usersFile)) {
+  if (existsSync15(input.usersFile)) {
     try {
       const raw = readFileSync23(input.usersFile, "utf-8").trim();
       if (raw) {
@@ -11222,7 +11344,7 @@ function computeAdminStoreDivergence(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync14(input.accountsDir)) {
+  if (existsSync15(input.accountsDir)) {
     let entries;
     try {
       entries = readdirSync13(input.accountsDir);
@@ -11239,7 +11361,7 @@ function computeAdminStoreDivergence(input) {
         continue;
       }
       const accountJsonPath = join22(accountDir, "account.json");
-      if (!existsSync14(accountJsonPath)) continue;
+      if (!existsSync15(accountJsonPath)) continue;
       let admins = [];
       try {
         const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
@@ -11287,10 +11409,10 @@ function checkAdminAuthInvariant(input) {
 
 // server/routes/onboarding.ts
 function hashPin2(pin) {
-  return createHash3("sha256").update(pin).digest("hex");
+  return createHash4("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync15(USERS_FILE)) return null;
+  if (!existsSync16(USERS_FILE)) return null;
   const raw = readFileSync24(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -11350,7 +11472,7 @@ app9.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync15(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync16(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -11499,7 +11621,7 @@ app9.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync15(INSTALL_OWNER_FILE)) {
+    if (existsSync16(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -11647,7 +11769,7 @@ app9.put("/set-pin", requireAdminSession, async (c) => {
   console.log(`[set-pin] changed PIN in place: userId=${sessionUserId.slice(0, 8)}\u2026`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync15(INSTALL_OWNER_FILE)) {
+    if (existsSync16(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -11681,7 +11803,7 @@ ${body.newPin}
 var onboarding_default = app9;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync16, renameSync as renameSync8, statSync as statSync9 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync17, renameSync as renameSync8, statSync as statSync9 } from "fs";
 import { join as join24 } from "path";
 var CLIENT_ERRORS_LOG = join24(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -11731,7 +11853,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync16(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync17(CLIENT_ERRORS_LOG)) return;
     const stats = statSync9(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -12051,18 +12173,18 @@ app12.get("/", requireAdminSession, async (c) => {
 var accounts_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync18, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
 import { resolve as resolve16, basename as basename8 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { join as join25 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
     const fullPath = join25(dir, filename);
-    if (existsSync17(fullPath)) {
+    if (existsSync18(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -12190,7 +12312,7 @@ app13.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync18(dir)) continue;
+    if (!existsSync19(dir)) continue;
     let files;
     try {
       files = readdirSync14(dir).filter((f) => f.endsWith(".log"));
@@ -12242,7 +12364,7 @@ var claude_info_default = app14;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { resolve as resolve17 } from "path";
 var app15 = new Hono();
 var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -12265,12 +12387,12 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let accountId = pinnedAccountId;
   let dir = uploadsDirFor2(accountId, attachmentId);
-  let found = existsSync19(dir);
+  let found = existsSync20(dir);
   if (!found) {
     for (const candidate of listValidAccounts()) {
       if (candidate.accountId === pinnedAccountId) continue;
       const candidateDir = uploadsDirFor2(candidate.accountId, attachmentId);
-      if (existsSync19(candidateDir)) {
+      if (existsSync20(candidateDir)) {
         accountId = candidate.accountId;
         dir = candidateDir;
         found = true;
@@ -12285,7 +12407,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve17(dir, `${attachmentId}.meta.json`);
-  if (!existsSync19(metaPath)) {
+  if (!existsSync20(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -12313,13 +12435,13 @@ var attachment_default = app15;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve18 } from "path";
-import { readdirSync as readdirSync15, readFileSync as readFileSync26, existsSync as existsSync20, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync15, readFileSync as readFileSync26, existsSync as existsSync21, rmSync as rmSync2 } from "fs";
 var app16 = new Hono();
 app16.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve18(account.accountDir, "agents");
-  if (!existsSync20(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync21(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync15(agentsDir, { withFileTypes: true });
@@ -12327,7 +12449,7 @@ app16.get("/", (c) => {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve18(agentsDir, entry.name, "config.json");
-      if (!existsSync20(configPath2)) continue;
+      if (!existsSync21(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync26(configPath2, "utf-8"));
         agents.push({
@@ -12356,7 +12478,7 @@ app16.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync20(agentDir)) {
+  if (!existsSync21(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -12386,7 +12508,7 @@ app16.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync20(agentDir)) {
+  if (!existsSync21(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -12402,7 +12524,7 @@ var agents_default = app16;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, createWriteStream } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync6, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -12562,7 +12684,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync21(a.storagePath)) reason = "missing-file";
+    else if (!existsSync22(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -13088,7 +13210,7 @@ app17.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
 import { dirname as dirname9, resolve as resolve19, join as join26 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -13135,7 +13257,7 @@ function extractPluginToolDescriptions(pluginDir) {
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync22(path2)) continue;
+    if (!existsSync23(path2)) continue;
     try {
       raw = readFileSync27(path2, "utf-8");
       break;
@@ -13187,7 +13309,7 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve19(PLATFORM_ROOT, "plugins");
-  if (existsSync22(platformPlugins)) {
+  if (existsSync23(platformPlugins)) {
     for (const name of readdirSync16(platformPlugins)) {
       const dir = join26(platformPlugins, name);
       try {
@@ -13197,10 +13319,10 @@ function listPluginDirs() {
     }
   }
   const premiumRoot = resolve19(dirname9(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync22(premiumRoot)) {
+  if (existsSync23(premiumRoot)) {
     for (const bundle of readdirSync16(premiumRoot)) {
       const bundlePlugins = join26(premiumRoot, bundle, "plugins");
-      if (!existsSync22(bundlePlugins)) continue;
+      if (!existsSync23(bundlePlugins)) continue;
       try {
         for (const name of readdirSync16(bundlePlugins)) {
           const dir = join26(bundlePlugins, name);
@@ -13217,7 +13339,7 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync22(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync23(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync27(accountFile, "utf-8"));
     return new Set(
@@ -13228,7 +13350,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync22(path2)) return null;
+  if (!existsSync23(path2)) return null;
   let raw;
   try {
     raw = readFileSync27(path2, "utf-8");
@@ -13263,7 +13385,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync22(join26(dir, "mcp/dist/index.js")) || existsSync22(join26(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync23(join26(dir, "mcp/dist/index.js")) || existsSync23(join26(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -13290,7 +13412,7 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync22(specialistsDir)) return [];
+  if (!existsSync23(specialistsDir)) return [];
   let entries;
   try {
     entries = readdirSync16(specialistsDir);
@@ -13336,7 +13458,7 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync22(accountFile)) return [];
+  if (!existsSync23(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync27(accountFile, "utf-8");
@@ -13351,7 +13473,7 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve19(PLATFORM_ROOT, "plugins");
-  if (!existsSync22(pluginsDir)) return [];
+  if (!existsSync23(pluginsDir)) return [];
   let entries;
   try {
     entries = readdirSync16(pluginsDir);
@@ -13362,7 +13484,7 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve19(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync22(manifestPath)) continue;
+    if (!existsSync23(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync27(manifestPath, "utf-8");
@@ -13379,11 +13501,11 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync23, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync28 } from "fs";
 import { resolve as resolve20 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync23(statePath)) return null;
+  if (!existsSync24(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync28(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -13641,7 +13763,7 @@ app20.post("/", async (c) => {
 var events_default = app20;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync24 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync25 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
@@ -15004,7 +15126,7 @@ app21.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink2(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync24(tmpPath);
+    const tempRemoved = !existsSync25(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -15078,7 +15200,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink2(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync24(state.tmpPath);
+  const tempRemoved = !existsSync25(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -15488,7 +15610,7 @@ function applyBacklinkBoost(hits) {
 }
 
 // ../lib/graph-search/src/dedup.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var DEFAULT_LAYERS = [
   "nodeId",
   "slug",
@@ -15515,7 +15637,7 @@ function readContentHash(props) {
   const content = props["content"];
   const source = typeof compiled === "string" && compiled.length > 0 ? compiled : typeof content === "string" && content.length > 0 ? content : null;
   if (source === null) return null;
-  return createHash4("sha256").update(source).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(source).digest("hex").slice(0, 16);
 }
 function dedup(hits, layers = DEFAULT_LAYERS) {
   const sorted = [...hits].sort((a, b) => b.score - a.score);
@@ -17535,7 +17657,7 @@ var graph_default_view_default = app27;
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
 import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename11 } from "path";
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync26 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -17642,7 +17764,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync25(dir)) continue;
+    if (!existsSync26(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -17657,7 +17779,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync25(inp.overridePath)) {
+  if (existsSync26(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -17668,7 +17790,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync25(inp.bundledPath)) {
+  } else if (existsSync26(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -18271,12 +18393,12 @@ app36.get("/", async (c) => {
 var system_stats_default = app36;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync26, readFileSync as readFileSync29 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync29 } from "fs";
 import { resolve as resolve24, join as join29 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join29(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync26(brandJsonPath)) {
+if (existsSync27(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync29(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
@@ -18287,7 +18409,7 @@ var VERSION_FILE = resolve24(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync26(VERSION_FILE)) return "unknown";
+  if (!existsSync27(VERSION_FILE)) return "unknown";
   return readFileSync29(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -19064,7 +19186,7 @@ app44.post("/launch", requireAdminSession, async (c) => {
 var browser_default = app44;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync27 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 import { join as join31 } from "path";
 
 // server/lib/calendar-ics.ts
@@ -19536,7 +19658,7 @@ app45.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync27(join31(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync28(join31(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -20084,7 +20206,7 @@ app53.route("/request-magic-link", request_magic_link_default);
 var access_default = app53;
 
 // server/routes/sites.ts
-import { existsSync as existsSync28, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
 import { resolve as resolve26 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -20150,7 +20272,7 @@ app54.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync28(filePath) ? statSync12(filePath) : null;
+    stat8 = existsSync29(filePath) ? statSync12(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -20169,7 +20291,7 @@ app54.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync28(filePath)) {
+  if (!existsSync29(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -20300,7 +20422,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync29, readFileSync as readFileSync33 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync33 } from "fs";
 import { join as join32 } from "path";
 var cached = null;
 var cachedAttempted = false;
@@ -20310,7 +20432,7 @@ function readBrandConfig() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot3) return null;
   const brandPath = join32(platformRoot3, "config", "brand.json");
-  if (!existsSync29(brandPath)) return null;
+  if (!existsSync30(brandPath)) return null;
   try {
     cached = JSON.parse(readFileSync33(brandPath, "utf-8"));
     return cached;
@@ -20801,7 +20923,7 @@ var visitor_event_default = app57;
 
 // server/routes/session.ts
 import { resolve as resolve27 } from "path";
-import { existsSync as existsSync30, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync31, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
@@ -20885,7 +21007,7 @@ app58.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve27(account.accountDir, "agents", agentSlug);
-    if (!existsSync30(agentDir) || !existsSync30(resolve27(agentDir, "config.json"))) {
+    if (!existsSync31(agentDir) || !existsSync31(resolve27(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -21180,9 +21302,17 @@ function startTimeEntryCensus(openSession, opts = {}) {
   const intervalMs = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
   const horizonMs = opts.horizonMs ?? DEFAULT_HORIZON_MS;
   const tick = async () => {
-    const session = openSession();
+    let session;
+    try {
+      session = openSession();
+    } catch (err) {
+      console.error(`${TAG39} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      return;
+    }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
+    } catch (err) {
+      console.error(`${TAG39} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -21545,7 +21675,7 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 import { join as join33 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
@@ -21575,7 +21705,7 @@ async function writeRaw(path2, obj) {
     await rename3(tmp, path2);
   } catch (err) {
     try {
-      if (existsSync31(tmp)) await unlink3(tmp);
+      if (existsSync32(tmp)) await unlink3(tmp);
     } catch {
     }
     throw err;
@@ -22073,7 +22203,24 @@ function createWaChannelRoutes(deps) {
     if (typeof senderId !== "string" || typeof sessionId !== "string" || typeof replied !== "boolean") {
       return c.json({ error: "senderId, sessionId and replied required" }, 400);
     }
+    const interactive = body?.interactive === true;
+    const finalText = typeof body?.finalText === "string" ? body.finalText : "";
     const sid = sessionId.slice(0, 8);
+    const deliver = interactive && finalText.trim().length > 0;
+    if (deliver) {
+      const bytes = Buffer.byteLength(finalText, "utf8");
+      try {
+        await deps.sendOutbound(senderId, finalText);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(
+          `[whatsapp-native] op=turn-strand-anomaly senderId=${senderId} sessionId=${sid} interactive=yes bytes=${bytes} delivered=undelivered error=${message}`
+        );
+        return c.json({ ok: true, delivered: "undelivered" });
+      }
+      console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=${replied ? "yes" : "no"} delivered=fallback bytes=${bytes}`);
+      return c.json({ ok: true, delivered: "fallback" });
+    }
     if (replied) {
       console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=yes delivered=reply`);
       return c.json({ ok: true, delivered: "reply" });
@@ -22194,6 +22341,11 @@ var WaGateway = class {
     console.error(
       `[whatsapp-native] op=inbound senderId=${input.senderId} accountId=${input.accountId} bytes=${bytes} ${mediaField} source=${source} delivery=${willDeliverNow ? "immediate" : "queued"}`
     );
+    if (source === "schedule" && (hadSubscriber || this.spawning.has(input.senderId))) {
+      console.error(
+        `[whatsapp-native] op=coalesced-onto-live-session eventId=${input.scheduleProvenance?.eventId ?? "-"} senderId=${input.senderId} droppedSeat=${input.scheduledSessionId ?? "-"} reason=${hadSubscriber ? "live-subscriber" : "spawn-in-flight"}`
+      );
+    }
     if (!hadSubscriber && !this.spawning.has(input.senderId)) {
       this.spawning.add(input.senderId);
       console.error(`[whatsapp-native] op=spawn-trigger senderId=${input.senderId}`);
@@ -22500,17 +22652,20 @@ function createWebchatChannelRoutes(deps) {
     if (typeof key !== "string" || typeof sessionId !== "string" || typeof replied !== "boolean") {
       return c.json({ error: "key, sessionId and replied required" }, 400);
     }
+    const interactive = body?.interactive === true;
+    const finalBytes = typeof body?.finalBytes === "number" && Number.isFinite(body.finalBytes) ? body.finalBytes : 0;
     const k = key.slice(0, 8);
     const sid = sessionId.slice(0, 8);
+    if (interactive && finalBytes > 0) {
+      console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=${replied ? "yes" : "no"} delivered=fallback bytes=${finalBytes}`);
+      return c.json({ ok: true, delivered: "fallback" });
+    }
     if (replied) {
+      console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} delivered=reply`);
       return c.json({ ok: true, delivered: "reply" });
     }
-    const finalBytes = typeof body?.finalBytes === "number" && Number.isFinite(body.finalBytes) ? body.finalBytes : 0;
-    if (finalBytes <= 0) {
-      return c.json({ ok: true, delivered: "none" });
-    }
-    console.error(`[webchat-native] op=turn-undelivered channel=webchat key=${k} sessionId=${sid} bytes=${finalBytes}`);
-    return c.json({ ok: true, delivered: "undelivered" });
+    console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} delivered=none`);
+    return c.json({ ok: true, delivered: "none" });
   });
   return app61;
 }
@@ -23443,7 +23598,24 @@ function createTelegramChannelRoutes(deps) {
     if (typeof key !== "string" || typeof sessionId !== "string" || typeof replied !== "boolean") {
       return c.json({ error: "key, sessionId and replied required" }, 400);
     }
+    const interactive = body?.interactive === true;
+    const finalText = typeof body?.finalText === "string" ? body.finalText : "";
     const sid = sessionId.slice(0, 8);
+    const deliver = interactive && finalText.trim().length > 0;
+    if (deliver) {
+      const bytes = Buffer.byteLength(finalText, "utf8");
+      try {
+        await deps.sendOutbound(key, finalText);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(
+          `[telegram-native] op=turn-strand-anomaly key=${key} sessionId=${sid} interactive=yes bytes=${bytes} delivered=undelivered error=${message}`
+        );
+        return c.json({ ok: true, delivered: "undelivered" });
+      }
+      console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=${replied ? "yes" : "no"} delivered=fallback bytes=${bytes}`);
+      return c.json({ ok: true, delivered: "fallback" });
+    }
     if (replied) {
       console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=yes delivered=reply`);
       return c.json({ ok: true, delivered: "reply" });
@@ -23524,6 +23696,11 @@ var TelegramGateway = class {
     console.error(
       `[telegram-native] op=inbound key=${input.senderId} accountId=${input.accountId} botType=${input.role} bytes=${bytes} source=${source} delivery=${willDeliverNow ? "immediate" : "queued"}`
     );
+    if (source === "schedule" && (hadSubscriber || this.spawning.has(input.senderId))) {
+      console.error(
+        `[telegram-native] op=coalesced-onto-live-session eventId=${input.scheduleProvenance?.eventId ?? "-"} senderId=${input.senderId} droppedSeat=${input.scheduledSessionId ?? "-"} reason=${hadSubscriber ? "live-subscriber" : "spawn-in-flight"}`
+      );
+    }
     if (!hadSubscriber && !this.spawning.has(input.senderId)) {
       this.spawning.add(input.senderId);
       console.error(`[telegram-native] op=spawn-trigger key=${input.senderId} role=${input.role}`);
@@ -23977,8 +24154,8 @@ function broadcastAdminShutdown(reason) {
 }
 
 // ../lib/entitlement/src/index.ts
-import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync32, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
+import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
+import { existsSync as existsSync33, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
 import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -24027,7 +24204,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve32(brand.configDir, "entitlement.json");
-  if (!existsSync32(entitlementPath)) {
+  if (!existsSync33(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat8 = statSync13(entitlementPath);
@@ -24048,7 +24225,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
       reason: "pubkey-missing"
     });
   }
-  const pubkeyHash = createHash5("sha256").update(pubkeyPem).digest("hex");
+  const pubkeyHash = createHash6("sha256").update(pubkeyPem).digest("hex");
   if (pubkeyHash !== PUBKEY_SHA256) {
     return logResolved(anonymousFallback("pubkey-tamper"), {
       reason: "pubkey-tamper"
@@ -24219,10 +24396,10 @@ function clientFrom(c) {
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join35(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync33(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync34(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync33(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync34(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -24259,7 +24436,7 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join35(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync33(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync34(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync35(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -24344,7 +24521,7 @@ var waGateway = new WaGateway({
   },
   ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId, sessionIdOverride }) => {
     if (passive) {
-      const phoneHash = createHash6("sha256").update(senderId).digest("hex").slice(0, 12);
+      const phoneHash = createHash7("sha256").update(senderId).digest("hex").slice(0, 12);
       const prompt = (text ?? "").trim();
       if (prompt.length === 0) {
         console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=empty-text`);
@@ -24941,7 +25118,7 @@ app60.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync33(filePath)) {
+  if (!existsSync34(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -24971,7 +25148,7 @@ app60.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync33(filePath)) {
+  if (!existsSync34(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -24991,7 +25168,7 @@ app60.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync33(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync34(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -25020,7 +25197,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync33(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync34(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
@@ -25033,7 +25210,7 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
     const versionFile = join35(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync33(versionFile)) return "unknown";
+    if (!existsSync34(versionFile)) return "unknown";
     const content = readFileSync35(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -25097,7 +25274,7 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join35(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync33(cachePath)) return null;
+    if (!existsSync34(cachePath)) return null;
     return JSON.parse(readFileSync35(cachePath, "utf-8"));
   } catch {
     return null;
@@ -25324,7 +25501,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const reconcileScript = resolve33(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
-    if (!existsSync33(reconcileScript)) return;
+    if (!existsSync34(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -25348,7 +25525,7 @@ startTimeEntryCensus(() => getSession());
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
-    if (!existsSync33(auditScript)) return;
+    if (!existsSync34(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -25458,7 +25635,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync33(USERS_FILE)) {
+    if (!existsSync34(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -25491,7 +25668,7 @@ var adminUserReconcileTimer = setInterval(() => {
 if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer.unref();
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync33(USERS_FILE)) return 0;
+  if (!existsSync34(USERS_FILE)) return 0;
   const raw = readFileSync35(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);