@rubytech/create-maxy-code 0.1.431 → 0.1.432

package/payload/server/server.js

@@ -1383,9 +1383,9 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync35, existsSync as existsSync33, watchFile } from "fs";
+import { readFileSync as readFileSync35, existsSync as existsSync34, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 import { resolve as resolve33, join as join35, basename as basename13 } from "path";
 import { homedir as homedir3 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
@@ -1763,7 +1763,7 @@ async function ensureAuth() {
 }
 
 // server/routes/health.ts
-import { existsSync as existsSync4, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync9 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -3494,7 +3494,7 @@ function readAllConversations(platformAccountId) {
 var TAG7 = "[whatsapp-persist]";
 var sessionWriteLocks = /* @__PURE__ */ new Map();
 async function persistWhatsAppMessage(input) {
-  if (!input.body || !input.msgKeyId) return null;
+  if (!input.body && !input.attachmentId || !input.msgKeyId) return null;
   const messageId = `whatsapp-live:${input.accountId}:${input.remoteJid}:${input.msgKeyId}`;
   const canonicalRemoteJid = input.canonicalRemoteJid;
   const keyResolved = canonicalRemoteJid !== input.remoteJid ? "lid2pn" : "none";
@@ -3564,6 +3564,7 @@ async function persistWhatsAppMessage(input) {
       quotedId: input.quoted?.id ?? null,
       quotedSender: input.quoted?.sender ?? null,
       scope,
+      ...input.attachmentId ? { attachmentId: input.attachmentId } : {},
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const altDedupeRemoteJids = canonicalRemoteJid !== input.remoteJid ? [input.remoteJid] : [];
@@ -3781,16 +3782,385 @@ function isCustomerTurnSuppressed(role, managedService) {
 }
 
 // app/lib/whatsapp/inbound/media.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { writeFile, mkdir } from "fs/promises";
-import { join as join5 } from "path";
+import { randomUUID as randomUUID4, createHash } from "crypto";
+import { writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
+import { join as join6 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
   normalizeMessageContent as normalizeMessageContent2
 } from "@whiskeysockets/baileys";
+
+// app/lib/attachments.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { mkdir, writeFile } from "fs/promises";
+import { realpathSync as realpathSync2, existsSync as existsSync4 } from "fs";
+import { resolve as resolve6, extname } from "path";
+
+// app/lib/data-path.ts
+import { realpathSync } from "fs";
+import { resolve as resolve5, normalize, sep as sep2, relative, basename, join as join5 } from "path";
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "../platform");
+var DATA_ROOT = resolve5(PLATFORM_ROOT3, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve5(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["accounts"]);
+var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function crossesForeignAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
+  if (segs.length < 2) return false;
+  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
+  const owner = segs[1];
+  if (!ACCOUNT_UUID_RE.test(owner)) return false;
+  return owner !== accountId;
+}
+function isWithinOwnAccountPartition(relPath, accountId) {
+  const segs = relPath.split("/").filter(Boolean);
+  return segs.length >= 2 && segs[0] === "accounts" && segs[1] === accountId;
+}
+function resolveUnderRoot(raw, rootAbs, rootLabel) {
+  const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
+  const absolute = resolve5(rootAbs, cleaned);
+  let rootReal;
+  try {
+    rootReal = realpathSync(rootAbs);
+  } catch (err) {
+    return {
+      ok: false,
+      status: 500,
+      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  let resolvedReal;
+  try {
+    resolvedReal = realpathSync(absolute);
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep2)) {
+        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
+      }
+      return { ok: false, status: 404, error: "Not found" };
+    }
+    return {
+      ok: false,
+      status: 500,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  }
+  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
+    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
+  }
+  const relPath = relative(rootReal, resolvedReal) || ".";
+  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
+}
+function resolveDataPath(raw) {
+  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
+}
+function resolveClaudeUploadsPath(raw) {
+  if (!CLAUDE_UPLOADS_ROOT) {
+    return { ok: false, status: 404, error: "Not found" };
+  }
+  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
+}
+function scratchpadTmpBase() {
+  return process.env.MAXY_SCRATCHPAD_BASE ?? "/tmp";
+}
+function sessionScratchpadRoot(projectDir, sessionId) {
+  const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
+  return join5(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
+}
+function resolveScratchpadPath(raw, scratchpadRootAbs) {
+  return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
+}
+
+// app/lib/doc-to-text.ts
+import { unzipSync, strFromU8 } from "fflate";
+var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
+var ODT = "application/vnd.oasis.opendocument.text";
+var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
+  DOCX,
+  ODT,
+  "text/rtf",
+  "application/rtf"
+]);
+function bareMime(mimeType) {
+  return mimeType.split(";")[0].trim().toLowerCase();
+}
+function unescapeXml(s) {
+  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+}
+function unzipEntry(buffer, entry) {
+  const files = unzipSync(new Uint8Array(buffer));
+  const bytes = files[entry];
+  if (!bytes) throw new Error(`zip entry not found: ${entry}`);
+  return strFromU8(bytes);
+}
+function docxToText(buffer) {
+  const xml = unzipEntry(buffer, "word/document.xml");
+  const paras = [];
+  for (const p of xml.split("</w:p>")) {
+    const withBreaks = p.replace(/<w:tab\b[^>]*\/?>/g, "	").replace(/<w:br\b[^>]*\/?>/g, "\n");
+    let line = "";
+    for (const m of withBreaks.matchAll(/<w:t\b[^>]*>([\s\S]*?)<\/w:t>/g)) {
+      line += unescapeXml(m[1]);
+    }
+    if (line.length > 0) paras.push(line);
+  }
+  return paras.join("\n");
+}
+function odtToText(buffer) {
+  const xml = unzipEntry(buffer, "content.xml");
+  const body = xml.replace(/^[\s\S]*?<office:text\b[^>]*>/, "").replace(/<\/office:text>[\s\S]*$/, "");
+  const withBreaks = body.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	").replace(/<\/text:(?:p|h)>/g, "\n");
+  const stripped = withBreaks.replace(/<[^>]+>/g, "");
+  return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
+}
+var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
+function stripRtfDestinations(s) {
+  let out = "";
+  for (let i = 0; i < s.length; i++) {
+    const ch = s[i];
+    if (ch === "\\" && i + 1 < s.length) {
+      out += ch + s[i + 1];
+      i++;
+      continue;
+    }
+    if (ch === "{" && RTF_DROP_DEST.test(s.slice(i + 1))) {
+      let depth = 1;
+      let j = i + 1;
+      for (; j < s.length && depth > 0; j++) {
+        if (s[j] === "\\") {
+          j++;
+          continue;
+        }
+        if (s[j] === "{") depth++;
+        else if (s[j] === "}") depth--;
+      }
+      i = j - 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function rtfToText(rtf) {
+  let s = stripRtfDestinations(rtf);
+  s = s.replace(/\\par[d]?\b/g, "\n").replace(/\\line\b/g, "\n").replace(/\\tab\b/g, "	");
+  s = s.replace(/\\'([0-9a-fA-F]{2})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)));
+  s = s.replace(/\\[a-zA-Z]+-?\d* ?/g, "");
+  s = s.replace(/\\([{}\\])/g, "$1").replace(/[{}]/g, "");
+  return s.replace(/[ \t]{2,}/g, " ").replace(/\n{3,}/g, "\n\n").trim();
+}
+function docToText(buffer, mimeType) {
+  const mime = bareMime(mimeType);
+  if (mime === DOCX) return docxToText(buffer);
+  if (mime === ODT) return odtToText(buffer);
+  if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
+  return null;
+}
+
+// app/lib/attachments.ts
+function uploadsDirFor(accountId, subPath, attachmentId) {
+  return subPath ? resolve6(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve6(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
+}
+var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "application/pdf",
+  "text/plain",
+  "text/markdown",
+  "text/csv",
+  "text/html",
+  "text/calendar",
+  "application/zip",
+  "application/x-zip-compressed",
+  // Task 1347 — Word/OpenDocument/RTF text documents. The bytes are converted to
+  // a readable-text sibling at ingestion (writeAttachment → doc-to-text.ts)
+  // because the on-device Read tool cannot parse the binary containers. rtf is
+  // reported by browsers as either text/rtf or application/rtf.
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/vnd.oasis.opendocument.text",
+  "text/rtf",
+  "application/rtf",
+  // Task 1240 — voice recordings persist as playable clips in the admin bubble.
+  // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
+  "audio/ogg",
+  "audio/opus",
+  "audio/webm",
+  "audio/mp4",
+  "audio/x-m4a",
+  "audio/mpeg",
+  "audio/wav",
+  "video/mp4"
+]);
+var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
+var MAX_FILES_PER_MESSAGE = 5;
+var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
+var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
+var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
+function assertSupportedMime(mimeType) {
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (!SUPPORTED_MIME_TYPES.has(bare)) {
+    throw new Error(
+      `Unsupported file type: "${mimeType}". Supported types: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
+    );
+  }
+}
+function isSupportedMime(mimeType) {
+  return SUPPORTED_MIME_TYPES.has(mimeType.split(";")[0].trim().toLowerCase());
+}
+async function storeMediaBuffer(accountId, attachmentId, filename, mimeType, buffer) {
+  assertSupportedMime(mimeType);
+  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `Media exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId, true);
+}
+function attachmentExists(accountId, attachmentId) {
+  return existsSync4(resolve6(uploadsDirFor(accountId, "", attachmentId), `${attachmentId}.meta.json`));
+}
+async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId, skipDocToText = false) {
+  const attachmentId = explicitId ?? randomUUID3();
+  const dir = uploadsDirFor(accountId, subPath, attachmentId);
+  await mkdir(dir, { recursive: true });
+  const ext = extname(filename) || "";
+  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
+  const meta = {
+    attachmentId,
+    scope: subPath || accountId,
+    filename,
+    mimeType,
+    sizeBytes,
+    storedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeFile(storagePath, buffer);
+  await writeFile(metaPath, JSON.stringify(meta, null, 2));
+  let readableTextPath;
+  if (!skipDocToText && CONVERTIBLE_DOC_MIME.has(mimeType.split(";")[0].trim().toLowerCase())) {
+    const text = docToText(buffer, mimeType);
+    if (text) {
+      readableTextPath = resolve6(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
+      await writeFile(readableTextPath, text);
+    }
+  }
+  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
+}
+async function storeAttachment(accountId, file) {
+  assertSupportedMime(file.type);
+  if (file.size > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  const buffer = Buffer.from(await file.arrayBuffer());
+  return writeAttachment(accountId, "", file.name, file.type, file.size, buffer);
+}
+async function storePublicAttachment(accountId, sessionId, file, buffer) {
+  assertSupportedMime(file.type);
+  if (file.size > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  return writeAttachment(accountId, `public/${sessionId}`, file.name, file.type, file.size, buffer);
+}
+var MIME_BY_EXT = {
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".xml": "text/xml",
+  ".zip": "application/zip",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".odt": "application/vnd.oasis.opendocument.text",
+  ".rtf": "text/rtf",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".ics": "text/calendar"
+};
+function detectMimeType(filePath) {
+  const ext = extname(filePath).toLowerCase();
+  return MIME_BY_EXT[ext] ?? "application/octet-stream";
+}
+function validateFilePathInAccount(filePath, accountDir) {
+  const resolved = realpathSync2(filePath);
+  const accountResolved = realpathSync2(accountDir);
+  if (!resolved.startsWith(accountResolved + "/")) {
+    throw new Error(`File path is outside the account directory`);
+  }
+  return resolved;
+}
+async function storeComponentArtefact(accountId, attachmentId, mimeType, content, filename) {
+  const buffer = Buffer.from(content, "utf-8");
+  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
+    throw new Error(
+      `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
+    );
+  }
+  const dir = uploadsDirFor(accountId, "", attachmentId);
+  await mkdir(dir, { recursive: true });
+  const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
+  const storagePath = resolve6(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve6(dir, `${attachmentId}.meta.json`);
+  const meta = {
+    attachmentId,
+    scope: accountId,
+    filename,
+    mimeType,
+    sizeBytes: buffer.byteLength,
+    storedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await writeFile(storagePath, buffer);
+  await writeFile(metaPath, JSON.stringify(meta, null, 2));
+  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes: buffer.byteLength };
+}
+
+// app/lib/whatsapp/inbound/media.ts
 var TAG9 = "[whatsapp:media]";
 var MEDIA_DIR = "/tmp/maxy-media";
+function deterministicAttachmentId(seed) {
+  const h = createHash("sha256").update(seed).digest("hex");
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
+}
+var CACHE_RETAIN_MS = 5e3;
+var inflightDownloads = /* @__PURE__ */ new Map();
+function downloadInboundMediaBufferCached(msg, sock, opts) {
+  const key = msg.key.id ? `${msg.key.remoteJid ?? ""}:${msg.key.id}` : null;
+  if (!key) return downloadInboundMediaBuffer(msg, sock, opts);
+  const existing = inflightDownloads.get(key);
+  if (existing) return existing;
+  const p = downloadInboundMediaBuffer(msg, sock, opts);
+  inflightDownloads.set(key, p);
+  void p.then(
+    (res) => {
+      if (res === void 0) {
+        inflightDownloads.delete(key);
+      } else {
+        const t = setTimeout(() => inflightDownloads.delete(key), CACHE_RETAIN_MS);
+        t.unref?.();
+      }
+    },
+    () => inflightDownloads.delete(key)
+    // downloadInboundMediaBuffer never rejects, but be safe
+  );
+  return p;
+}
 function mimeToExt(mimetype) {
   const map = {
     "image/jpeg": "jpg",
@@ -3823,7 +4193,7 @@ async function streamToBuffer(stream2) {
   }
   return Buffer.concat(chunks);
 }
-async function downloadInboundMedia(msg, sock, opts) {
+async function downloadInboundMediaBuffer(msg, sock, opts) {
   const rawMessage = msg.message;
   if (!rawMessage) return void 0;
   const content = normalizeMessageContent2(rawMessage);
@@ -3866,23 +4236,45 @@ async function downloadInboundMedia(msg, sock, opts) {
       console.error(`${TAG9} media too large type=${mimetype ?? "unknown"} size=${sizeMB}MB limit=${limitMB}MB`);
       return void 0;
     }
-    await mkdir(MEDIA_DIR, { recursive: true });
-    const ext = mimeToExt(mimetype ?? "application/octet-stream");
-    const filename = `${randomUUID3()}.${ext}`;
-    const filePath = join5(MEDIA_DIR, filename);
-    await writeFile(filePath, buffer);
-    const sizeKB = (buffer.length / 1024).toFixed(0);
-    console.error(`${TAG9} media downloaded type=${mimetype ?? "unknown"} size=${sizeKB}KB path=${filePath}`);
     return {
-      path: filePath,
+      buffer,
       mimetype: mimetype ?? "application/octet-stream",
-      size: buffer.length
+      filename: inner.documentMessage?.fileName ?? void 0
     };
   } catch (err) {
     console.error(`${TAG9} media download failed type=${mimetype ?? "unknown"} error=${String(err)}`);
     return void 0;
   }
 }
+async function downloadInboundMedia(msg, sock, opts) {
+  const res = await downloadInboundMediaBufferCached(msg, sock, opts);
+  if (!res) return void 0;
+  await mkdir2(MEDIA_DIR, { recursive: true });
+  const ext = mimeToExt(res.mimetype);
+  const filePath = join6(MEDIA_DIR, `${randomUUID4()}.${ext}`);
+  await writeFile2(filePath, res.buffer);
+  const sizeKB = (res.buffer.length / 1024).toFixed(0);
+  console.error(`${TAG9} media downloaded type=${res.mimetype} size=${sizeKB}KB path=${filePath}`);
+  return { path: filePath, mimetype: res.mimetype, size: res.buffer.length };
+}
+async function storeInboundMediaServable(msg, sock, accountId, seed, opts) {
+  const attachmentId = deterministicAttachmentId(seed);
+  try {
+    if (attachmentExists(accountId, attachmentId)) return attachmentId;
+    const res = await downloadInboundMediaBufferCached(msg, sock, opts);
+    if (!res) {
+      console.error(`${TAG9} servable-store skip reason=no-buffer id=${attachmentId}`);
+      return null;
+    }
+    const filename = res.filename ?? `${attachmentId}.${mimeToExt(res.mimetype)}`;
+    await storeMediaBuffer(accountId, attachmentId, filename, res.mimetype, res.buffer);
+    console.error(`${TAG9} servable-store ok id=${attachmentId} mime=${res.mimetype} bytes=${res.buffer.length}`);
+    return attachmentId;
+  } catch (err) {
+    console.error(`${TAG9} servable-store FAIL id=${attachmentId} reason=${String(err).slice(0, 120)}`);
+    return null;
+  }
+}
 
 // app/lib/whatsapp/inbound/debounce.ts
 var TAG10 = "[whatsapp:debounce]";
@@ -4713,21 +5105,24 @@ function monitorInbound(conn) {
         if (!remoteJid || remoteJid === "status@broadcast") continue;
         if (!msg.message) continue;
         const extracted = extractMessage(msg);
-        if (extracted.text) {
+        const mediaServable = !!(extracted.mediaType && extracted.mimetype && isSupportedMime(extracted.mimetype));
+        if (extracted.text || mediaServable) {
           const isGroup = isGroupJid(remoteJid);
           const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
           const senderPhone = await resolveJidToE164(senderJid, conn.lidMapping) ?? senderJid;
           const ts = msg.messageTimestamp ? Number(msg.messageTimestamp) : Math.floor(Date.now() / 1e3);
           const storeKey = messageStoreKey(conn.platformAccountId, remoteJid);
-          storeMessage(storeKey, {
-            id: msg.key.id ?? `${remoteJid}-${ts}`,
-            sender: senderPhone,
-            senderName: msg.pushName ?? void 0,
-            body: extracted.text,
-            timestamp: ts,
-            fromMe: Boolean(msg.key.fromMe),
-            quoted: extracted.quotedMessage ? { id: extracted.quotedMessage.id, body: extracted.quotedMessage.text, sender: extracted.quotedMessage.sender } : void 0
-          });
+          if (extracted.text) {
+            storeMessage(storeKey, {
+              id: msg.key.id ?? `${remoteJid}-${ts}`,
+              sender: senderPhone,
+              senderName: msg.pushName ?? void 0,
+              body: extracted.text,
+              timestamp: ts,
+              fromMe: Boolean(msg.key.fromMe),
+              quoted: extracted.quotedMessage ? { id: extracted.quotedMessage.id, body: extracted.quotedMessage.text, sender: extracted.quotedMessage.sender } : void 0
+            });
+          }
           const entries = messageStore.get(storeKey);
           console.error(
             `${TAG13} stored message ${msg.key.id ?? "?"} for ${remoteJid} (type: ${upsert.type}, store size: ${entries?.length ?? 0}/${MESSAGE_STORE_MAX}) account=${conn.platformAccountId}`
@@ -4765,6 +5160,17 @@ function monitorInbound(conn) {
                 remoteJid,
                 conn.lidMapping
               );
+              let mediaAttachmentId;
+              if (mediaServable && !fromMe && conn.sock && upsert.type === "notify") {
+                const maxMb = whatsAppConfig.mediaMaxMb ?? 50;
+                mediaAttachmentId = await storeInboundMediaServable(
+                  msg,
+                  conn.sock,
+                  conn.platformAccountId,
+                  `whatsapp-live:${conn.accountId}:${canonicalRemoteJid}:${msg.key.id}`,
+                  { maxBytes: maxMb * 1024 * 1024 }
+                ) ?? void 0;
+              }
               await persistWhatsAppMessage({
                 accountId: conn.accountId,
                 platformAccountId: conn.platformAccountId,
@@ -4776,7 +5182,13 @@ function monitorInbound(conn) {
                 fromMe,
                 senderPhone,
                 selfPhone: conn.selfPhone,
-                body: extracted.text,
+                // A stored media message persists the human caption (or empty) plus
+                // the attachment id — the reader shows the inline media, never the
+                // synthetic `[document: …]` / `[sticker]` line. If the store failed
+                // (no id), fall back to the extracted text so a document/sticker
+                // still shows its placeholder rather than a blank bubble.
+                body: mediaAttachmentId ? extracted.caption ?? "" : extracted.text,
+                attachmentId: mediaAttachmentId,
                 timestamp: ts,
                 pushName: msg.pushName ?? void 0,
                 quoted: extracted.quotedMessage ? {
@@ -5051,9 +5463,9 @@ async function handleInboundMessage(conn, msg) {
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
 import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve5 } from "path";
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
-var VNC_SCRIPT = resolve5(PLATFORM_ROOT3, "scripts/vnc.sh");
+import { resolve as resolve7 } from "path";
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve7(process.cwd(), "..");
+var VNC_SCRIPT = resolve7(PLATFORM_ROOT4, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -5166,7 +5578,7 @@ function ensureLogDir() {
   mkdirSync2(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve5(LOG_DIR, `${name}.log`);
+  return resolve7(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   if (process.platform !== "linux") {
@@ -5253,7 +5665,7 @@ function killChromium() {
 }
 function writeChromiumWrapper() {
   mkdirSync2(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve5(BIN_DIR, "chromium");
+  const wrapperPath = resolve7(BIN_DIR, "chromium");
   writeFileSync3(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
@@ -5275,7 +5687,7 @@ fi
 # replaced). Refusing the legacy probe loop closes the silent-fallback path
 # where /snap/bin/chromium would re-introduce the AppArmor SingletonLock
 # denial that triggered.
-PATH_FILE="${PLATFORM_ROOT3}/config/chromium-binary.path"
+PATH_FILE="${PLATFORM_ROOT4}/config/chromium-binary.path"
 if [ ! -r "$PATH_FILE" ]; then
   echo "  ERROR: $PATH_FILE missing \u2014 re-run installer" >> "$LOG"
   exit 1
@@ -5330,432 +5742,107 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
     };
     if (nativeInfo.sessionType === "wayland") {
       env.WAYLAND_DISPLAY = nativeInfo.waylandDisplay;
-    } else {
-      env.WAYLAND_DISPLAY = "";
-    }
-    vncLog("build-x11-env", {
-      transport,
-      session_type: nativeInfo.sessionType,
-      display: nativeInfo.display,
-      wayland_display: env.WAYLAND_DISPLAY || void 0
-    });
-    return env;
-  }
-  return {
-    ...process.env,
-    DISPLAY: VNC_DISPLAY,
-    WAYLAND_DISPLAY: "",
-    XDG_SESSION_TYPE: "x11",
-    BROWSER: chromiumWrapperPath,
-    PATH: `${BIN_DIR}:${process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}`
-  };
-}
-
-// server/routes/health.ts
-function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve34) => {
-    const socket = createConnection2(port2, "127.0.0.1");
-    socket.setTimeout(timeoutMs);
-    socket.once("connect", () => {
-      socket.destroy();
-      resolve34(true);
-    });
-    socket.once("error", () => {
-      socket.destroy();
-      resolve34(false);
-    });
-    socket.once("timeout", () => {
-      socket.destroy();
-      resolve34(false);
-    });
-  });
-}
-var app = new Hono();
-app.get("/", async (c) => {
-  const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
-  let pinConfigured = false;
-  try {
-    if (existsSync4(USERS_FILE)) {
-      const raw = readFileSync9(USERS_FILE, "utf-8").trim();
-      if (raw) {
-        const users = JSON.parse(raw);
-        pinConfigured = Array.isArray(users) && users.length > 0;
-      }
-    }
-  } catch (err) {
-    console.error(`[health] users.json corrupt \u2014 reporting pin_configured=false: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  let authHealth;
-  try {
-    authHealth = await ensureAuth();
-  } catch {
-    authHealth = { status: "missing" };
-  }
-  const claudeAuthenticated = authHealth.status === "ok" || authHealth.status === "expiring";
-  const vncRunning = await checkPort(WEBSOCKIFY_PORT);
-  let whatsappAccounts = [];
-  try {
-    whatsappAccounts = getStatus().map((a) => ({
-      accountId: a.accountId,
-      accountName: a.accountName ?? null,
-      connected: a.connected,
-      selfPhone: a.selfPhone ?? null,
-      reconnectAttempts: a.reconnectAttempts,
-      lastError: a.lastError ?? null,
-      sessionStuckReason: a.sessionStuckReason ?? null,
-      terminalReason: a.terminalReason ?? null
-    }));
-  } catch (err) {
-    console.error(`[health] failed to read WhatsApp status: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  const whatsappAnyConnected = whatsappAccounts.some((a) => a.connected);
-  const whatsappAnyStuck = whatsappAccounts.some((a) => Boolean(a.sessionStuckReason));
-  const whatsappAnyTerminal = whatsappAccounts.some((a) => Boolean(a.terminalReason));
-  const account = resolveAccount();
-  const missingPlugins = findMissingPlugins(account?.config.enabledPlugins);
-  return c.json({
-    pin_configured: pinConfigured,
-    claude_authenticated: claudeAuthenticated,
-    vnc_running: vncRunning,
-    browser_transport: browserTransport,
-    auth_status: authHealth.status,
-    auth_expires_at: authHealth.expiresAt ?? null,
-    server_ip: getLanIp(),
-    missingPlugins,
-    whatsapp: {
-      any_connected: whatsappAnyConnected,
-      any_stuck: whatsappAnyStuck,
-      any_terminal: whatsappAnyTerminal,
-      accounts: whatsappAccounts
-    }
-  });
-});
-var health_default = app;
-
-// app/lib/attachments.ts
-import { randomUUID as randomUUID4 } from "crypto";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { realpathSync as realpathSync2 } from "fs";
-import { resolve as resolve7, extname } from "path";
-
-// app/lib/data-path.ts
-import { realpathSync } from "fs";
-import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join6 } from "path";
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "../platform");
-var DATA_ROOT = resolve6(PLATFORM_ROOT4, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve6(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
-var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["accounts"]);
-var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function crossesForeignAccountPartition(relPath, accountId) {
-  const segs = relPath.split("/").filter(Boolean);
-  if (segs.length < 2) return false;
-  if (!ACCOUNT_PARTITION_DIRS.has(segs[0])) return false;
-  const owner = segs[1];
-  if (!ACCOUNT_UUID_RE.test(owner)) return false;
-  return owner !== accountId;
-}
-function isWithinOwnAccountPartition(relPath, accountId) {
-  const segs = relPath.split("/").filter(Boolean);
-  return segs.length >= 2 && segs[0] === "accounts" && segs[1] === accountId;
-}
-function resolveUnderRoot(raw, rootAbs, rootLabel) {
-  const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve6(rootAbs, cleaned);
-  let rootReal;
-  try {
-    rootReal = realpathSync(rootAbs);
-  } catch (err) {
-    return {
-      ok: false,
-      status: 500,
-      error: `${rootLabel} not accessible: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  let resolvedReal;
-  try {
-    resolvedReal = realpathSync(absolute);
-  } catch (err) {
-    const code = err.code;
-    if (code === "ENOENT") {
-      if (absolute !== rootReal && !absolute.startsWith(rootReal + sep2)) {
-        return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: absolute };
-      }
-      return { ok: false, status: 404, error: "Not found" };
-    }
-    return {
-      ok: false,
-      status: 500,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  }
-  if (resolvedReal !== rootReal && !resolvedReal.startsWith(rootReal + sep2)) {
-    return { ok: false, status: 403, error: `Path escapes ${rootLabel}`, resolved: resolvedReal };
-  }
-  const relPath = relative(rootReal, resolvedReal) || ".";
-  return { ok: true, absolute: resolvedReal, dataRootReal: rootReal, relative: relPath };
-}
-function resolveDataPath(raw) {
-  return resolveUnderRoot(raw, DATA_ROOT, "DATA_ROOT");
-}
-function resolveClaudeUploadsPath(raw) {
-  if (!CLAUDE_UPLOADS_ROOT) {
-    return { ok: false, status: 404, error: "Not found" };
-  }
-  return resolveUnderRoot(raw, CLAUDE_UPLOADS_ROOT, "CLAUDE_UPLOADS_ROOT");
-}
-function scratchpadTmpBase() {
-  return process.env.MAXY_SCRATCHPAD_BASE ?? "/tmp";
-}
-function sessionScratchpadRoot(projectDir, sessionId) {
-  const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
-  return join6(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
-}
-function resolveScratchpadPath(raw, scratchpadRootAbs) {
-  return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
-}
-
-// app/lib/doc-to-text.ts
-import { unzipSync, strFromU8 } from "fflate";
-var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
-var ODT = "application/vnd.oasis.opendocument.text";
-var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
-  DOCX,
-  ODT,
-  "text/rtf",
-  "application/rtf"
-]);
-function bareMime(mimeType) {
-  return mimeType.split(";")[0].trim().toLowerCase();
-}
-function unescapeXml(s) {
-  return s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
-}
-function unzipEntry(buffer, entry) {
-  const files = unzipSync(new Uint8Array(buffer));
-  const bytes = files[entry];
-  if (!bytes) throw new Error(`zip entry not found: ${entry}`);
-  return strFromU8(bytes);
-}
-function docxToText(buffer) {
-  const xml = unzipEntry(buffer, "word/document.xml");
-  const paras = [];
-  for (const p of xml.split("</w:p>")) {
-    const withBreaks = p.replace(/<w:tab\b[^>]*\/?>/g, "	").replace(/<w:br\b[^>]*\/?>/g, "\n");
-    let line = "";
-    for (const m of withBreaks.matchAll(/<w:t\b[^>]*>([\s\S]*?)<\/w:t>/g)) {
-      line += unescapeXml(m[1]);
-    }
-    if (line.length > 0) paras.push(line);
-  }
-  return paras.join("\n");
-}
-function odtToText(buffer) {
-  const xml = unzipEntry(buffer, "content.xml");
-  const body = xml.replace(/^[\s\S]*?<office:text\b[^>]*>/, "").replace(/<\/office:text>[\s\S]*$/, "");
-  const withBreaks = body.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	").replace(/<\/text:(?:p|h)>/g, "\n");
-  const stripped = withBreaks.replace(/<[^>]+>/g, "");
-  return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
-}
-var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
-function stripRtfDestinations(s) {
-  let out = "";
-  for (let i = 0; i < s.length; i++) {
-    const ch = s[i];
-    if (ch === "\\" && i + 1 < s.length) {
-      out += ch + s[i + 1];
-      i++;
-      continue;
-    }
-    if (ch === "{" && RTF_DROP_DEST.test(s.slice(i + 1))) {
-      let depth = 1;
-      let j = i + 1;
-      for (; j < s.length && depth > 0; j++) {
-        if (s[j] === "\\") {
-          j++;
-          continue;
-        }
-        if (s[j] === "{") depth++;
-        else if (s[j] === "}") depth--;
-      }
-      i = j - 1;
-      continue;
+    } else {
+      env.WAYLAND_DISPLAY = "";
     }
-    out += ch;
+    vncLog("build-x11-env", {
+      transport,
+      session_type: nativeInfo.sessionType,
+      display: nativeInfo.display,
+      wayland_display: env.WAYLAND_DISPLAY || void 0
+    });
+    return env;
   }
-  return out;
-}
-function rtfToText(rtf) {
-  let s = stripRtfDestinations(rtf);
-  s = s.replace(/\\par[d]?\b/g, "\n").replace(/\\line\b/g, "\n").replace(/\\tab\b/g, "	");
-  s = s.replace(/\\'([0-9a-fA-F]{2})/g, (_m, h) => String.fromCharCode(parseInt(h, 16)));
-  s = s.replace(/\\[a-zA-Z]+-?\d* ?/g, "");
-  s = s.replace(/\\([{}\\])/g, "$1").replace(/[{}]/g, "");
-  return s.replace(/[ \t]{2,}/g, " ").replace(/\n{3,}/g, "\n\n").trim();
-}
-function docToText(buffer, mimeType) {
-  const mime = bareMime(mimeType);
-  if (mime === DOCX) return docxToText(buffer);
-  if (mime === ODT) return odtToText(buffer);
-  if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
-  return null;
+  return {
+    ...process.env,
+    DISPLAY: VNC_DISPLAY,
+    WAYLAND_DISPLAY: "",
+    XDG_SESSION_TYPE: "x11",
+    BROWSER: chromiumWrapperPath,
+    PATH: `${BIN_DIR}:${process.env.PATH ?? "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"}`
+  };
 }
 
-// app/lib/attachments.ts
-function uploadsDirFor(accountId, subPath, attachmentId) {
-  return subPath ? resolve7(DATA_ROOT, "accounts", accountId, "uploads", subPath, attachmentId) : resolve7(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
-}
-var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
-  "image/jpeg",
-  "image/png",
-  "image/gif",
-  "image/webp",
-  "application/pdf",
-  "text/plain",
-  "text/markdown",
-  "text/csv",
-  "text/html",
-  "text/calendar",
-  "application/zip",
-  "application/x-zip-compressed",
-  // Task 1347 — Word/OpenDocument/RTF text documents. The bytes are converted to
-  // a readable-text sibling at ingestion (writeAttachment → doc-to-text.ts)
-  // because the on-device Read tool cannot parse the binary containers. rtf is
-  // reported by browsers as either text/rtf or application/rtf.
-  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  "application/vnd.oasis.opendocument.text",
-  "text/rtf",
-  "application/rtf",
-  // Task 1240 — voice recordings persist as playable clips in the admin bubble.
-  // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
-  "audio/ogg",
-  "audio/opus",
-  "audio/webm",
-  "audio/mp4",
-  "audio/x-m4a",
-  "audio/mpeg",
-  "audio/wav",
-  "video/mp4"
-]);
-var MAX_FILE_SIZE_BYTES = 50 * 1024 * 1024;
-var MAX_FILES_PER_MESSAGE = 5;
-var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
-var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
-var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
-function assertSupportedMime(mimeType) {
-  const bare = mimeType.split(";")[0].trim().toLowerCase();
-  if (!SUPPORTED_MIME_TYPES.has(bare)) {
-    throw new Error(
-      `Unsupported file type: "${mimeType}". Supported types: ${[...SUPPORTED_MIME_TYPES].join(", ")}.`
-    );
-  }
+// server/routes/health.ts
+function checkPort(port2, timeoutMs = 500) {
+  return new Promise((resolve34) => {
+    const socket = createConnection2(port2, "127.0.0.1");
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => {
+      socket.destroy();
+      resolve34(true);
+    });
+    socket.once("error", () => {
+      socket.destroy();
+      resolve34(false);
+    });
+    socket.once("timeout", () => {
+      socket.destroy();
+      resolve34(false);
+    });
+  });
 }
-async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer) {
-  const attachmentId = randomUUID4();
-  const dir = uploadsDirFor(accountId, subPath, attachmentId);
-  await mkdir2(dir, { recursive: true });
-  const ext = extname(filename) || "";
-  const storagePath = resolve7(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve7(dir, `${attachmentId}.meta.json`);
-  const meta = {
-    attachmentId,
-    scope: subPath || accountId,
-    filename,
-    mimeType,
-    sizeBytes,
-    storedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await writeFile2(storagePath, buffer);
-  await writeFile2(metaPath, JSON.stringify(meta, null, 2));
-  let readableTextPath;
-  if (CONVERTIBLE_DOC_MIME.has(mimeType.split(";")[0].trim().toLowerCase())) {
-    const text = docToText(buffer, mimeType);
-    if (text) {
-      readableTextPath = resolve7(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
-      await writeFile2(readableTextPath, text);
+var app = new Hono();
+app.get("/", async (c) => {
+  const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
+  let pinConfigured = false;
+  try {
+    if (existsSync5(USERS_FILE)) {
+      const raw = readFileSync9(USERS_FILE, "utf-8").trim();
+      if (raw) {
+        const users = JSON.parse(raw);
+        pinConfigured = Array.isArray(users) && users.length > 0;
+      }
     }
+  } catch (err) {
+    console.error(`[health] users.json corrupt \u2014 reporting pin_configured=false: ${err instanceof Error ? err.message : String(err)}`);
   }
-  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
-}
-async function storeAttachment(accountId, file) {
-  assertSupportedMime(file.type);
-  if (file.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
-    );
-  }
-  const buffer = Buffer.from(await file.arrayBuffer());
-  return writeAttachment(accountId, "", file.name, file.type, file.size, buffer);
-}
-async function storePublicAttachment(accountId, sessionId, file, buffer) {
-  assertSupportedMime(file.type);
-  if (file.size > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `File "${file.name}" exceeds the 50 MB limit (${(file.size / 1024 / 1024).toFixed(1)} MB).`
-    );
-  }
-  return writeAttachment(accountId, `public/${sessionId}`, file.name, file.type, file.size, buffer);
-}
-var MIME_BY_EXT = {
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".html": "text/html",
-  ".htm": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".csv": "text/csv",
-  ".txt": "text/plain",
-  ".md": "text/markdown",
-  ".xml": "text/xml",
-  ".zip": "application/zip",
-  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  ".odt": "application/vnd.oasis.opendocument.text",
-  ".rtf": "text/rtf",
-  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  ".ics": "text/calendar"
-};
-function detectMimeType(filePath) {
-  const ext = extname(filePath).toLowerCase();
-  return MIME_BY_EXT[ext] ?? "application/octet-stream";
-}
-function validateFilePathInAccount(filePath, accountDir) {
-  const resolved = realpathSync2(filePath);
-  const accountResolved = realpathSync2(accountDir);
-  if (!resolved.startsWith(accountResolved + "/")) {
-    throw new Error(`File path is outside the account directory`);
+  let authHealth;
+  try {
+    authHealth = await ensureAuth();
+  } catch {
+    authHealth = { status: "missing" };
   }
-  return resolved;
-}
-async function storeComponentArtefact(accountId, attachmentId, mimeType, content, filename) {
-  const buffer = Buffer.from(content, "utf-8");
-  if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
-    throw new Error(
-      `Component artefact exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
-    );
+  const claudeAuthenticated = authHealth.status === "ok" || authHealth.status === "expiring";
+  const vncRunning = await checkPort(WEBSOCKIFY_PORT);
+  let whatsappAccounts = [];
+  try {
+    whatsappAccounts = getStatus().map((a) => ({
+      accountId: a.accountId,
+      accountName: a.accountName ?? null,
+      connected: a.connected,
+      selfPhone: a.selfPhone ?? null,
+      reconnectAttempts: a.reconnectAttempts,
+      lastError: a.lastError ?? null,
+      sessionStuckReason: a.sessionStuckReason ?? null,
+      terminalReason: a.terminalReason ?? null
+    }));
+  } catch (err) {
+    console.error(`[health] failed to read WhatsApp status: ${err instanceof Error ? err.message : String(err)}`);
   }
-  const dir = uploadsDirFor(accountId, "", attachmentId);
-  await mkdir2(dir, { recursive: true });
-  const ext = extname(filename) || (mimeType === "text/html" ? ".html" : ".md");
-  const storagePath = resolve7(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve7(dir, `${attachmentId}.meta.json`);
-  const meta = {
-    attachmentId,
-    scope: accountId,
-    filename,
-    mimeType,
-    sizeBytes: buffer.byteLength,
-    storedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await writeFile2(storagePath, buffer);
-  await writeFile2(metaPath, JSON.stringify(meta, null, 2));
-  return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes: buffer.byteLength };
-}
+  const whatsappAnyConnected = whatsappAccounts.some((a) => a.connected);
+  const whatsappAnyStuck = whatsappAccounts.some((a) => Boolean(a.sessionStuckReason));
+  const whatsappAnyTerminal = whatsappAccounts.some((a) => Boolean(a.terminalReason));
+  const account = resolveAccount();
+  const missingPlugins = findMissingPlugins(account?.config.enabledPlugins);
+  return c.json({
+    pin_configured: pinConfigured,
+    claude_authenticated: claudeAuthenticated,
+    vnc_running: vncRunning,
+    browser_transport: browserTransport,
+    auth_status: authHealth.status,
+    auth_expires_at: authHealth.expiresAt ?? null,
+    server_ip: getLanIp(),
+    missingPlugins,
+    whatsapp: {
+      any_connected: whatsappAnyConnected,
+      any_stuck: whatsappAnyStuck,
+      any_terminal: whatsappAnyTerminal,
+      accounts: whatsappAccounts
+    }
+  });
+});
+var health_default = app;
 
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
@@ -6214,10 +6301,10 @@ ${result.result.text}` : result.result.text;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function adminSessionIdFor(accountId, senderId, personId) {
   const subject = personId && personId.length > 0 ? `person:${personId}` : senderId;
-  const b = createHash("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
+  const b = createHash2("sha256").update(`${accountId}:admin:${subject}`).digest().subarray(0, 16);
   const v = Buffer.from(b);
   v[6] = v[6] & 15 | 64;
   v[8] = v[8] & 63 | 128;
@@ -6373,13 +6460,13 @@ async function sendTelegramText(botToken, chatId, text) {
 
 // server/routes/whatsapp.ts
 import { join as join10, resolve as resolve10 } from "path";
-import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync6 } from "fs";
+import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync7 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync5 } from "fs";
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
 import { resolve as resolve8, join as join8, dirname as dirname2, basename as basename2 } from "path";
 var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
@@ -6387,7 +6474,7 @@ function configPath(accountDir) {
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
-  if (!existsSync5(path2)) throw new Error(`account.json not found at ${path2}`);
+  if (!existsSync6(path2)) throw new Error(`account.json not found at ${path2}`);
   return JSON.parse(readFileSync10(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
@@ -6686,7 +6773,7 @@ function setPublicAgent(accountDir, slug) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
   const agentConfigPath = join8(accountDir, "agents", trimmed, "config.json");
-  if (!existsSync5(agentConfigPath)) {
+  if (!existsSync6(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
   try {
@@ -7648,13 +7735,13 @@ app2.post("/config", async (c) => {
       case "list-public-agents": {
         const agentsDir = resolve10(account.accountDir, "agents");
         const agents = [];
-        if (existsSync6(agentsDir)) {
+        if (existsSync7(agentsDir)) {
           try {
             const entries = readdirSync4(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
               const configPath2 = resolve10(agentsDir, entry.name, "config.json");
-              if (!existsSync6(configPath2)) continue;
+              if (!existsSync7(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
@@ -7971,7 +8058,7 @@ app2.get("/group-info", async (c) => {
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync8, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
+import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync9, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
 import { basename as basename5, dirname as dirname4, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
@@ -8331,14 +8418,14 @@ app3.get("/", requireAdminSession, async (c) => {
 var sidebar_sessions_default = app3;
 
 // app/lib/admin-identity/pin-validator.ts
-import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync7, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
 import { join as join12 } from "path";
 function hashPin(pin) {
-  return createHash2("sha256").update(pin).digest("hex");
+  return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
-  if (!existsSync7(usersFilePath)) return null;
+  if (!existsSync8(usersFilePath)) return null;
   const raw = readFileSync13(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -9049,7 +9136,7 @@ data: ${JSON.stringify(turn)}
       const sessionKey = c.req.query("session_key") ?? "";
       const subagentsDir = resolve12(join14(projectDir, sessionId, "subagents"));
       console.log(
-        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync8(subagentsDir)}`
+        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync9(subagentsDir)}`
       );
       const actx = makeActivityCtx({
         subagentsDir,
@@ -9156,7 +9243,7 @@ app4.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   if (!SESSION_ID_RE2.test(sessionId)) return c.json({ error: "bad session reference" }, 400);
   const dir = directiveStoreDir(sessionId);
-  if (!dir || !existsSync8(dir)) return c.json({ entries: [] });
+  if (!dir || !existsSync9(dir)) return c.json({ entries: [] });
   let names;
   try {
     names = readdirSync8(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
@@ -9214,14 +9301,22 @@ app4.get("/store-stream", requireAdminSession, (c) => {
   const connId = `${remoteJid.slice(0, 12)}-${process.hrtime.bigint().toString(36).slice(-6)}`;
   const startedAt = Date.now();
   const lastEventId = c.req.header("Last-Event-ID");
-  const toTurn = (r) => ({
-    kind: "whatsapp-persisted",
-    text: r.body,
-    ts: r.dateSent,
-    fromMe: r.fromMe,
-    senderName: r.senderName,
-    origin: r.origin
-  });
+  const uploadsBase = resolve12(DATA_ROOT, "accounts", accountId, "uploads");
+  const toTurn = (r) => {
+    const turn = {
+      kind: "whatsapp-persisted",
+      text: r.body,
+      ts: r.dateSent,
+      fromMe: r.fromMe,
+      senderName: r.senderName,
+      origin: r.origin
+    };
+    if (r.attachmentId) {
+      const meta = readAttachmentMeta(join14(uploadsBase, r.attachmentId));
+      if (meta) return { ...turn, attachments: [meta] };
+    }
+    return turn;
+  };
   const readable = new ReadableStream({
     start(controller) {
       const send = (turn, id) => {
@@ -9405,7 +9500,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
       return c.json({ error: `WhatsApp account "${accountId}" is registered but its socket is disconnected.` }, 503);
     }
     console.log(`${MANUAL_TAG} op=socket sendId=${sendId} accountId=${accountId} result=ok socketAccountId=${res.accountId}`);
-    const record = (waMessageId, body) => {
+    const record = (waMessageId, body, attachmentId) => {
       const nowIso = (/* @__PURE__ */ new Date()).toISOString();
       const rec = {
         messageId: `whatsapp-live:${res.accountId}:${remoteJid}:${waMessageId}`,
@@ -9421,11 +9516,15 @@ app4.post("/reply", requireAdminSession, async (c) => {
         quotedSender: null,
         scope: template.scope,
         origin: "operator-manual",
-        createdAt: nowIso
+        createdAt: nowIso,
+        // Task 1536 — a media send carries the servable attachment reference (the
+        // file already lives in the account's uploads store via storeAttachment),
+        // so the store reader renders it inline instead of a `[sent …]` text line.
+        ...attachmentId ? { attachmentId } : {}
       };
       appendMessage(accountId, rec);
       const present = readConversation(accountId, remoteJid).some((r) => r.messageId === rec.messageId);
-      console.log(`${MANUAL_TAG} op=recorded sendId=${sendId} waMessageId=${waMessageId} present=${present}`);
+      console.log(`${MANUAL_TAG} op=recorded sendId=${sendId} waMessageId=${waMessageId} present=${present} attachment=${attachmentId ? "yes" : "no"}`);
     };
     let sent = 0;
     if (text) {
@@ -9463,7 +9562,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
         mid = r.messageId;
       }
       console.log(`${MANUAL_TAG} op=sent sendId=${sendId} kind=${kind ?? "document"} idx=${i} waMessageId=${mid ?? ""}`);
-      if (mid) record(mid, `[sent ${stored.filename}]`);
+      if (mid) record(mid, "", stored.attachmentId);
       sent++;
     }
     exit("delivered");
@@ -9774,7 +9873,7 @@ var public_reader_default = app5;
 // server/routes/webchat.ts
 import { basename as basename7, dirname as dirname6 } from "path";
 import { join as join18 } from "path";
-import { existsSync as existsSync10, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync17, writeFileSync as writeFileSync5, renameSync as renameSync2 } from "fs";
@@ -9861,7 +9960,7 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readdirSync as readdirSync10, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync10, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join17 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -9882,7 +9981,7 @@ function createSidecarStore(config) {
       return { ok: true };
     } catch (error) {
       try {
-        if (existsSync9(tmp)) unlinkSync2(tmp);
+        if (existsSync10(tmp)) unlinkSync2(tmp);
       } catch {
       }
       return { ok: false, error };
@@ -9938,7 +10037,7 @@ function createSidecarStore(config) {
   function clear(sessionsDir, id) {
     const path2 = pathFor(sessionsDir, id);
     try {
-      if (existsSync9(path2)) {
+      if (existsSync10(path2)) {
         unlinkSync2(path2);
         return { ok: true, removed: true };
       }
@@ -10006,7 +10105,7 @@ function locateSidecar(sessionId) {
   }
   for (const slug of slugs) {
     const metaPath = join18(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync10(metaPath)) {
+    if (existsSync11(metaPath)) {
       const meta = readSidecarMeta(metaPath);
       return { channel: meta.channel, adminUserId: meta.adminUserId, accountId: meta.accountId };
     }
@@ -10601,7 +10700,7 @@ ${note}` : note;
 import { resolve as resolve14 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync11, readFileSync as readFileSync20, readdirSync as readdirSync12 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync20, readdirSync as readdirSync12 } from "fs";
 import { join as join19 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
@@ -10613,7 +10712,7 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync11(specialistsDir)) return { specialists: [], skipped: [] };
+  if (!existsSync12(specialistsDir)) return { specialists: [], skipped: [] };
   const entries = readdirSync12(specialistsDir);
   const specialists = [];
   const skipped = [];
@@ -10739,7 +10838,7 @@ var webchat_greeting_default = app6;
 // server/routes/telegram.ts
 import { homedir } from "os";
 import { resolve as resolve15, join as join20 } from "path";
-import { existsSync as existsSync12, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync21 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
@@ -10799,7 +10898,7 @@ var TAG23 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
   const brandPath = join20(platformRoot3, "config", "brand.json");
-  if (existsSync12(brandPath)) {
+  if (existsSync13(brandPath)) {
     try {
       return JSON.parse(readFileSync21(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
@@ -10820,7 +10919,7 @@ app7.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync12(sp)) {
+  if (!existsSync13(sp)) {
     console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
@@ -10888,7 +10987,7 @@ var telegram_default = app7;
 
 // server/routes/quickbooks.ts
 import { join as join21 } from "path";
-import { existsSync as existsSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
 var TAG24 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
@@ -10901,7 +11000,7 @@ function storePath(accountDir) {
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
-  if (!state || !STATE_RE.test(state) || !existsSync13(pendingPath(accountDir, state))) {
+  if (!state || !STATE_RE.test(state) || !existsSync14(pendingPath(accountDir, state))) {
     console.error(`${TAG24} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
@@ -10928,7 +11027,7 @@ async function completeConsent(args) {
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
-    if (!existsSync13(storePath(accountDir))) {
+    if (!existsSync14(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
     const store2 = JSON.parse(readFileSync22(storePath(accountDir), "utf-8"));
@@ -10996,8 +11095,8 @@ var quickbooks_default = app8;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync3 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync15, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
-import { createHash as createHash3, randomUUID as randomUUID7 } from "crypto";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync16, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
 function claudeBin() {
@@ -11134,7 +11233,7 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync14, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
 import { dirname as dirname7, join as join22 } from "path";
 function id8(value) {
   return value.slice(0, 8);
@@ -11175,7 +11274,7 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync14(input.usersFile)) {
+    if (existsSync15(input.usersFile)) {
       const raw = readFileSync23(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
@@ -11208,7 +11307,7 @@ function writeAdminEntry(input) {
   }
   try {
     const accountJsonPath = join22(input.accountDir, "account.json");
-    if (!existsSync14(accountJsonPath)) {
+    if (!existsSync15(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
     const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
@@ -11231,7 +11330,7 @@ function writeAdminEntry(input) {
 function computeAdminStoreDivergence(input) {
   const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync14(input.usersFile)) {
+  if (existsSync15(input.usersFile)) {
     try {
       const raw = readFileSync23(input.usersFile, "utf-8").trim();
       if (raw) {
@@ -11245,7 +11344,7 @@ function computeAdminStoreDivergence(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync14(input.accountsDir)) {
+  if (existsSync15(input.accountsDir)) {
     let entries;
     try {
       entries = readdirSync13(input.accountsDir);
@@ -11262,7 +11361,7 @@ function computeAdminStoreDivergence(input) {
         continue;
       }
       const accountJsonPath = join22(accountDir, "account.json");
-      if (!existsSync14(accountJsonPath)) continue;
+      if (!existsSync15(accountJsonPath)) continue;
       let admins = [];
       try {
         const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
@@ -11310,10 +11409,10 @@ function checkAdminAuthInvariant(input) {
 
 // server/routes/onboarding.ts
 function hashPin2(pin) {
-  return createHash3("sha256").update(pin).digest("hex");
+  return createHash4("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync15(USERS_FILE)) return null;
+  if (!existsSync16(USERS_FILE)) return null;
   const raw = readFileSync24(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -11373,7 +11472,7 @@ app9.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync15(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync16(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -11522,7 +11621,7 @@ app9.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync15(INSTALL_OWNER_FILE)) {
+    if (existsSync16(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -11670,7 +11769,7 @@ app9.put("/set-pin", requireAdminSession, async (c) => {
   console.log(`[set-pin] changed PIN in place: userId=${sessionUserId.slice(0, 8)}\u2026`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync15(INSTALL_OWNER_FILE)) {
+    if (existsSync16(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -11704,7 +11803,7 @@ ${body.newPin}
 var onboarding_default = app9;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync16, renameSync as renameSync8, statSync as statSync9 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync17, renameSync as renameSync8, statSync as statSync9 } from "fs";
 import { join as join24 } from "path";
 var CLIENT_ERRORS_LOG = join24(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -11754,7 +11853,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync16(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync17(CLIENT_ERRORS_LOG)) return;
     const stats = statSync9(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -12074,18 +12173,18 @@ app12.get("/", requireAdminSession, async (c) => {
 var accounts_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync18, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { existsSync as existsSync19, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
 import { resolve as resolve16, basename as basename8 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 import { join as join25 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
     const fullPath = join25(dir, filename);
-    if (existsSync17(fullPath)) {
+    if (existsSync18(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -12213,7 +12312,7 @@ app13.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync18(dir)) continue;
+    if (!existsSync19(dir)) continue;
     let files;
     try {
       files = readdirSync14(dir).filter((f) => f.endsWith(".log"));
@@ -12265,7 +12364,7 @@ var claude_info_default = app14;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync19 } from "fs";
+import { existsSync as existsSync20 } from "fs";
 import { resolve as resolve17 } from "path";
 var app15 = new Hono();
 var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -12288,12 +12387,12 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let accountId = pinnedAccountId;
   let dir = uploadsDirFor2(accountId, attachmentId);
-  let found = existsSync19(dir);
+  let found = existsSync20(dir);
   if (!found) {
     for (const candidate of listValidAccounts()) {
       if (candidate.accountId === pinnedAccountId) continue;
       const candidateDir = uploadsDirFor2(candidate.accountId, attachmentId);
-      if (existsSync19(candidateDir)) {
+      if (existsSync20(candidateDir)) {
         accountId = candidate.accountId;
         dir = candidateDir;
         found = true;
@@ -12308,7 +12407,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve17(dir, `${attachmentId}.meta.json`);
-  if (!existsSync19(metaPath)) {
+  if (!existsSync20(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -12336,13 +12435,13 @@ var attachment_default = app15;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve18 } from "path";
-import { readdirSync as readdirSync15, readFileSync as readFileSync26, existsSync as existsSync20, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync15, readFileSync as readFileSync26, existsSync as existsSync21, rmSync as rmSync2 } from "fs";
 var app16 = new Hono();
 app16.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve18(account.accountDir, "agents");
-  if (!existsSync20(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync21(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
     const entries = readdirSync15(agentsDir, { withFileTypes: true });
@@ -12350,7 +12449,7 @@ app16.get("/", (c) => {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve18(agentsDir, entry.name, "config.json");
-      if (!existsSync20(configPath2)) continue;
+      if (!existsSync21(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync26(configPath2, "utf-8"));
         agents.push({
@@ -12379,7 +12478,7 @@ app16.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync20(agentDir)) {
+  if (!existsSync21(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -12409,7 +12508,7 @@ app16.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync20(agentDir)) {
+  if (!existsSync21(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -12425,7 +12524,7 @@ var agents_default = app16;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync21, mkdirSync as mkdirSync6, createWriteStream } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync6, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -12585,7 +12684,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync21(a.storagePath)) reason = "missing-file";
+    else if (!existsSync22(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -13111,7 +13210,7 @@ app17.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync22, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
 import { dirname as dirname9, resolve as resolve19, join as join26 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -13158,7 +13257,7 @@ function extractPluginToolDescriptions(pluginDir) {
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync22(path2)) continue;
+    if (!existsSync23(path2)) continue;
     try {
       raw = readFileSync27(path2, "utf-8");
       break;
@@ -13210,7 +13309,7 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve19(PLATFORM_ROOT, "plugins");
-  if (existsSync22(platformPlugins)) {
+  if (existsSync23(platformPlugins)) {
     for (const name of readdirSync16(platformPlugins)) {
       const dir = join26(platformPlugins, name);
       try {
@@ -13220,10 +13319,10 @@ function listPluginDirs() {
     }
   }
   const premiumRoot = resolve19(dirname9(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync22(premiumRoot)) {
+  if (existsSync23(premiumRoot)) {
     for (const bundle of readdirSync16(premiumRoot)) {
       const bundlePlugins = join26(premiumRoot, bundle, "plugins");
-      if (!existsSync22(bundlePlugins)) continue;
+      if (!existsSync23(bundlePlugins)) continue;
       try {
         for (const name of readdirSync16(bundlePlugins)) {
           const dir = join26(bundlePlugins, name);
@@ -13240,7 +13339,7 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync22(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync23(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync27(accountFile, "utf-8"));
     return new Set(
@@ -13251,7 +13350,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync22(path2)) return null;
+  if (!existsSync23(path2)) return null;
   let raw;
   try {
     raw = readFileSync27(path2, "utf-8");
@@ -13286,7 +13385,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync22(join26(dir, "mcp/dist/index.js")) || existsSync22(join26(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync23(join26(dir, "mcp/dist/index.js")) || existsSync23(join26(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -13313,7 +13412,7 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync22(specialistsDir)) return [];
+  if (!existsSync23(specialistsDir)) return [];
   let entries;
   try {
     entries = readdirSync16(specialistsDir);
@@ -13359,7 +13458,7 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync22(accountFile)) return [];
+  if (!existsSync23(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync27(accountFile, "utf-8");
@@ -13374,7 +13473,7 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve19(PLATFORM_ROOT, "plugins");
-  if (!existsSync22(pluginsDir)) return [];
+  if (!existsSync23(pluginsDir)) return [];
   let entries;
   try {
     entries = readdirSync16(pluginsDir);
@@ -13385,7 +13484,7 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve19(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync22(manifestPath)) continue;
+    if (!existsSync23(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync27(manifestPath, "utf-8");
@@ -13402,11 +13501,11 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync23, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync28 } from "fs";
 import { resolve as resolve20 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync23(statePath)) return null;
+  if (!existsSync24(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync28(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -13664,7 +13763,7 @@ app20.post("/", async (c) => {
 var events_default = app20;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync24 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync25 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
@@ -15027,7 +15126,7 @@ app21.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink2(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync24(tmpPath);
+    const tempRemoved = !existsSync25(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -15101,7 +15200,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink2(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync24(state.tmpPath);
+  const tempRemoved = !existsSync25(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -15511,7 +15610,7 @@ function applyBacklinkBoost(hits) {
 }
 
 // ../lib/graph-search/src/dedup.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var DEFAULT_LAYERS = [
   "nodeId",
   "slug",
@@ -15538,7 +15637,7 @@ function readContentHash(props) {
   const content = props["content"];
   const source = typeof compiled === "string" && compiled.length > 0 ? compiled : typeof content === "string" && content.length > 0 ? content : null;
   if (source === null) return null;
-  return createHash4("sha256").update(source).digest("hex").slice(0, 16);
+  return createHash5("sha256").update(source).digest("hex").slice(0, 16);
 }
 function dedup(hits, layers = DEFAULT_LAYERS) {
   const sorted = [...hits].sort((a, b) => b.score - a.score);
@@ -17558,7 +17657,7 @@ var graph_default_view_default = app27;
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
 import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename11 } from "path";
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync26 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -17665,7 +17764,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync25(dir)) continue;
+    if (!existsSync26(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -17680,7 +17779,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync25(inp.overridePath)) {
+  if (existsSync26(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -17691,7 +17790,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync25(inp.bundledPath)) {
+  } else if (existsSync26(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -18294,12 +18393,12 @@ app36.get("/", async (c) => {
 var system_stats_default = app36;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync26, readFileSync as readFileSync29 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync29 } from "fs";
 import { resolve as resolve24, join as join29 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join29(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync26(brandJsonPath)) {
+if (existsSync27(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync29(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
@@ -18310,7 +18409,7 @@ var VERSION_FILE = resolve24(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync26(VERSION_FILE)) return "unknown";
+  if (!existsSync27(VERSION_FILE)) return "unknown";
   return readFileSync29(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -19087,7 +19186,7 @@ app44.post("/launch", requireAdminSession, async (c) => {
 var browser_default = app44;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync27 } from "fs";
+import { existsSync as existsSync28 } from "fs";
 import { join as join31 } from "path";
 
 // server/lib/calendar-ics.ts
@@ -19559,7 +19658,7 @@ app45.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync27(join31(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync28(join31(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -20107,7 +20206,7 @@ app53.route("/request-magic-link", request_magic_link_default);
 var access_default = app53;
 
 // server/routes/sites.ts
-import { existsSync as existsSync28, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
+import { existsSync as existsSync29, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
 import { resolve as resolve26 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -20173,7 +20272,7 @@ app54.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync28(filePath) ? statSync12(filePath) : null;
+    stat8 = existsSync29(filePath) ? statSync12(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -20192,7 +20291,7 @@ app54.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync28(filePath)) {
+  if (!existsSync29(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -20323,7 +20422,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync29, readFileSync as readFileSync33 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync33 } from "fs";
 import { join as join32 } from "path";
 var cached = null;
 var cachedAttempted = false;
@@ -20333,7 +20432,7 @@ function readBrandConfig() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot3) return null;
   const brandPath = join32(platformRoot3, "config", "brand.json");
-  if (!existsSync29(brandPath)) return null;
+  if (!existsSync30(brandPath)) return null;
   try {
     cached = JSON.parse(readFileSync33(brandPath, "utf-8"));
     return cached;
@@ -20824,7 +20923,7 @@ var visitor_event_default = app57;
 
 // server/routes/session.ts
 import { resolve as resolve27 } from "path";
-import { existsSync as existsSync30, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync31, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
@@ -20908,7 +21007,7 @@ app58.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve27(account.accountDir, "agents", agentSlug);
-    if (!existsSync30(agentDir) || !existsSync30(resolve27(agentDir, "config.json"))) {
+    if (!existsSync31(agentDir) || !existsSync31(resolve27(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -21203,9 +21302,17 @@ function startTimeEntryCensus(openSession, opts = {}) {
   const intervalMs = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
   const horizonMs = opts.horizonMs ?? DEFAULT_HORIZON_MS;
   const tick = async () => {
-    const session = openSession();
+    let session;
+    try {
+      session = openSession();
+    } catch (err) {
+      console.error(`${TAG39} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      return;
+    }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
+    } catch (err) {
+      console.error(`${TAG39} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -21568,7 +21675,7 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync31 } from "fs";
+import { existsSync as existsSync32 } from "fs";
 import { join as join33 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
@@ -21598,7 +21705,7 @@ async function writeRaw(path2, obj) {
     await rename3(tmp, path2);
   } catch (err) {
     try {
-      if (existsSync31(tmp)) await unlink3(tmp);
+      if (existsSync32(tmp)) await unlink3(tmp);
     } catch {
     }
     throw err;
@@ -24047,8 +24154,8 @@ function broadcastAdminShutdown(reason) {
 }
 
 // ../lib/entitlement/src/index.ts
-import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync32, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
+import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
+import { existsSync as existsSync33, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
 import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -24097,7 +24204,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve32(brand.configDir, "entitlement.json");
-  if (!existsSync32(entitlementPath)) {
+  if (!existsSync33(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat8 = statSync13(entitlementPath);
@@ -24118,7 +24225,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
       reason: "pubkey-missing"
     });
   }
-  const pubkeyHash = createHash5("sha256").update(pubkeyPem).digest("hex");
+  const pubkeyHash = createHash6("sha256").update(pubkeyPem).digest("hex");
   if (pubkeyHash !== PUBKEY_SHA256) {
     return logResolved(anonymousFallback("pubkey-tamper"), {
       reason: "pubkey-tamper"
@@ -24289,10 +24396,10 @@ function clientFrom(c) {
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
 var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join35(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync33(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync34(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync33(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync34(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -24329,7 +24436,7 @@ var brandLoginOpts = {
 var ALIAS_DOMAINS_PATH = join35(homedir3(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync33(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync34(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync35(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -24414,7 +24521,7 @@ var waGateway = new WaGateway({
   },
   ensureChannelSession: async ({ accountId, effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath, passive, text, msgId, sessionIdOverride }) => {
     if (passive) {
-      const phoneHash = createHash6("sha256").update(senderId).digest("hex").slice(0, 12);
+      const phoneHash = createHash7("sha256").update(senderId).digest("hex").slice(0, 12);
       const prompt = (text ?? "").trim();
       if (prompt.length === 0) {
         console.error(`[wa-passive] op=dropped account=${effectiveAccountId} phoneHash=${phoneHash} msgId=${msgId ?? "none"} reason=empty-text`);
@@ -25011,7 +25118,7 @@ app60.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync33(filePath)) {
+  if (!existsSync34(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -25041,7 +25148,7 @@ app60.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync33(filePath)) {
+  if (!existsSync34(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -25061,7 +25168,7 @@ app60.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync33(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync34(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -25090,7 +25197,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync33(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync34(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
@@ -25103,7 +25210,7 @@ function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
     const versionFile = join35(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync33(versionFile)) return "unknown";
+    if (!existsSync34(versionFile)) return "unknown";
     const content = readFileSync35(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -25167,7 +25274,7 @@ function loadBrandingCache(agentSlug) {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
     const cachePath = join35(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync33(cachePath)) return null;
+    if (!existsSync34(cachePath)) return null;
     return JSON.parse(readFileSync35(cachePath, "utf-8"));
   } catch {
     return null;
@@ -25394,7 +25501,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const reconcileScript = resolve33(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
-    if (!existsSync33(reconcileScript)) return;
+    if (!existsSync34(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -25418,7 +25525,7 @@ startTimeEntryCensus(() => getSession());
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
-    if (!existsSync33(auditScript)) return;
+    if (!existsSync34(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -25528,7 +25635,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync33(USERS_FILE)) {
+    if (!existsSync34(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -25561,7 +25668,7 @@ var adminUserReconcileTimer = setInterval(() => {
 if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer.unref();
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync33(USERS_FILE)) return 0;
+  if (!existsSync34(USERS_FILE)) return 0;
   const raw = readFileSync35(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);