@rubytech/create-maxy-code 0.1.435 → 0.1.437

package/payload/server/server.js

@@ -78,7 +78,7 @@ import {
   persistMessage,
   preloadEmbedModel,
   projectAgent,
-  reconcileEnabledPlugins,
+  reconcileEnabledPluginsForAccounts,
   recordFailedAttempt,
   registerSession,
   renameConversation,
@@ -112,7 +112,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-DAYMXQG2.js";
+} from "./chunk-LMLVOZ6G.js";
 import {
   __commonJS,
   __toESM
@@ -127,8 +127,10 @@ var require_dist = __commonJS({
     exports.cosine = cosine;
     exports.deconflictBySubject = deconflictBySubject;
     exports.formatStandingRulesBlock = formatStandingRulesBlock2;
+    exports.resolveOwnerUserId = resolveOwnerUserId;
     exports.queryActiveRuleCandidates = queryActiveRuleCandidates;
-    exports.activeRuleSet = activeRuleSet2;
+    exports.resolveActiveRules = resolveActiveRules2;
+    exports.activeRuleSet = activeRuleSet;
     exports.SAME_SUBJECT_COSINE = 0.85;
     exports.INJECTION_RULE_CAP = 12;
     exports.ACTIVE_CANDIDATE_FLOOR = 0.4;
@@ -165,9 +167,20 @@ var require_dist = __commonJS({
       return `## Standing rules
 ${lines.join("\n")}`;
     }
-    async function queryActiveRuleCandidates(session, accountId) {
+    async function resolveOwnerUserId(session, accountId) {
+      const res = await session.run(`
+    MATCH (au:AdminUser {accountId: $accountId, role: 'owner'})
+    RETURN au.userId AS userId
+    ORDER BY au.createdAt ASC
+    LIMIT 1
+    `, { accountId });
+      const rec = res.records[0];
+      const userId = rec ? rec.get("userId") : null;
+      return typeof userId === "string" && userId.length > 0 ? userId : null;
+    }
+    async function queryOwnerCandidates(session, accountId, ownerUserId) {
       const result = await session.run(`
-    MATCH (pref:Preference {accountId: $accountId, scope: 'admin'})
+    MATCH (up:UserProfile {accountId: $accountId, userId: $ownerUserId})-[:HAS_PREFERENCE]->(pref:Preference {scope: 'admin'})
     WHERE NOT pref:Trashed AND pref.deletedAt IS NULL
       AND coalesce(pref.notApplicable, false) = false
       AND pref.confidence >= $floor
@@ -176,7 +189,7 @@ ${lines.join("\n")}`;
            pref.observedAt AS observedAt, pref.embedding AS embedding
     ORDER BY pref.confidence DESC, pref.observedAt DESC
     LIMIT ${exports.ACTIVE_CANDIDATE_LIMIT}
-    `, { accountId, floor: exports.ACTIVE_CANDIDATE_FLOOR });
+    `, { accountId, ownerUserId, floor: exports.ACTIVE_CANDIDATE_FLOOR });
       return result.records.map((r) => ({
         preferenceId: r.get("preferenceId"),
         category: r.get("category"),
@@ -187,9 +200,27 @@ ${lines.join("\n")}`;
         embedding: r.get("embedding") ?? null
       }));
     }
-    async function activeRuleSet2(session, accountId, cap = exports.INJECTION_RULE_CAP) {
-      const candidates = await queryActiveRuleCandidates(session, accountId);
-      return deconflictBySubject(candidates).slice(0, cap);
+    async function resolveCandidates(session, accountId) {
+      let ownerUserId;
+      try {
+        ownerUserId = await resolveOwnerUserId(session, accountId);
+      } catch {
+        return { candidates: [], ownerUserId: null, source: "owner-error" };
+      }
+      if (!ownerUserId)
+        return { candidates: [], ownerUserId: null, source: "no-owner" };
+      const candidates = await queryOwnerCandidates(session, accountId, ownerUserId);
+      return { candidates, ownerUserId, source: "owner" };
+    }
+    async function queryActiveRuleCandidates(session, accountId) {
+      return (await resolveCandidates(session, accountId)).candidates;
+    }
+    async function resolveActiveRules2(session, accountId, cap = exports.INJECTION_RULE_CAP) {
+      const { candidates, ownerUserId, source } = await resolveCandidates(session, accountId);
+      return { rules: deconflictBySubject(candidates).slice(0, cap), ownerUserId, source };
+    }
+    async function activeRuleSet(session, accountId, cap = exports.INJECTION_RULE_CAP) {
+      return (await resolveActiveRules2(session, accountId, cap)).rules;
     }
   }
 });
@@ -1384,11 +1415,11 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync35, existsSync as existsSync34, watchFile } from "fs";
+import { readFileSync as readFileSync35, existsSync as existsSync35, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve33, join as join35, basename as basename13 } from "path";
-import { homedir as homedir3 } from "os";
+import { resolve as resolve33, join as join36, basename as basename12 } from "path";
+import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
 // app/lib/pwa.ts
@@ -6137,8 +6168,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app61 = new Hono();
-  app61.post("/", async (c) => {
+  const app62 = new Hono();
+  app62.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -6401,7 +6432,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app61;
+  return app62;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -6436,8 +6467,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app61 = new Hono();
-  app61.post("/", async (c) => {
+  const app62 = new Hono();
+  app62.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -6541,7 +6572,7 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG16} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app61;
+  return app62;
 }
 
 // server/index.ts
@@ -7562,6 +7593,9 @@ function reconcileCredsOnDisk(opts) {
 function isReaderChannelSession(role, channel) {
   return role === "admin" && (channel === "whatsapp" || channel === "telegram") || role === "public" && (channel === "whatsapp" || channel === "webchat");
 }
+function isSessionListExcluded(role, channel) {
+  return role === "public" && channel === "webchat";
+}
 function selectReaderChannelSessions(rows) {
   return rows.filter((r) => isReaderChannelSession(r.role, r.channel)).sort((a, b) => b.startedAt.localeCompare(a.startedAt)).map((r) => ({
     sessionId: r.sessionId,
@@ -8162,12 +8196,37 @@ app2.get("/group-info", async (c) => {
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync9, readdirSync as readdirSync8, realpathSync as realpathSync4 } from "fs";
-import { basename as basename5, dirname as dirname4, isAbsolute, join as join14, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
+import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync10, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
+import { basename as basename4, dirname as dirname4, isAbsolute, join as join15, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
+
+// server/routes/admin/sidebar-sessions.ts
+import { readdirSync as readdirSync6, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
+import { dirname as dirname3, join as join12, resolve as resolve11 } from "path";
+
+// ../services/claude-session-manager/src/jsonl-path.ts
+import { existsSync as existsSync8, readdirSync as readdirSync5 } from "fs";
+import { homedir } from "os";
+import { join as join11 } from "path";
+function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
+  const projectsRoot = join11(claudeConfigDir2, "projects");
+  if (!existsSync8(projectsRoot)) return null;
+  let slugs;
+  try {
+    slugs = readdirSync5(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+  } catch {
+    return null;
+  }
+  const basename13 = `${sessionId}.jsonl`;
+  for (const slug of slugs) {
+    const live = join11(projectsRoot, slug, basename13);
+    if (existsSync8(live)) return live;
+    const archived = join11(projectsRoot, slug, "archive", basename13);
+    if (existsSync8(archived)) return archived;
+  }
+  return null;
+}
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync3 } from "fs";
-import { basename as basename4, dirname as dirname3, join as join11, resolve as resolve11 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 function lastAssistantModel(body) {
   const lines = body.split("\n");
@@ -8196,25 +8255,23 @@ function claudeConfigDir() {
 function findSessionProjectDir(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  for (const { path: path2 } of enumerateJsonls(join11(cfg, "projects"))) {
-    if (basename4(path2) === `${sessionId}.jsonl`) return dirname3(path2);
-  }
-  return null;
+  const jsonlPath = findExistingJsonlForSessionId(cfg, sessionId);
+  return jsonlPath ? dirname3(jsonlPath) : null;
 }
 function enumerateJsonls(projectsRoot) {
   const out = [];
   let slugs;
   try {
-    slugs = readdirSync5(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync6(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (err) {
     if (err.code === "ENOENT") return out;
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join11(projectsRoot, slug);
+    const slugDir = join12(projectsRoot, slug);
     let entries;
     try {
-      entries = readdirSync5(slugDir, { withFileTypes: true });
+      entries = readdirSync6(slugDir, { withFileTypes: true });
     } catch (err) {
       const code = err.code ?? "unknown";
       console.error(`[admin-sessions-list] slug-skipped slug=${slug} code=${code}`);
@@ -8222,12 +8279,12 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join11(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join12(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join11(slugDir, entry.name);
+        const subDir = join12(slugDir, entry.name);
         let subEntries;
         try {
-          subEntries = readdirSync5(subDir, { withFileTypes: true });
+          subEntries = readdirSync6(subDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] subagents-skipped slug=${slug} code=${code}`);
@@ -8235,14 +8292,14 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join11(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join12(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join11(slugDir, entry.name);
+        const archiveDir = join12(slugDir, entry.name);
         let archiveEntries;
         try {
-          archiveEntries = readdirSync5(archiveDir, { withFileTypes: true });
+          archiveEntries = readdirSync6(archiveDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] archive-skipped slug=${slug} code=${code}`);
@@ -8250,7 +8307,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join11(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join12(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -8283,7 +8340,7 @@ async function fetchLiveSessions() {
 function loadUserTitles(accountDir) {
   const out = /* @__PURE__ */ new Map();
   if (!accountDir) return out;
-  const path2 = join11(accountDir, "session-titles.json");
+  const path2 = join12(accountDir, "session-titles.json");
   let raw;
   try {
     raw = readFileSync12(path2, "utf8");
@@ -8410,7 +8467,7 @@ app3.get("/", requireAdminSession, async (c) => {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return c.json({ sessions: [], accountId: scopeAccountId });
   }
-  const projectsRoot = join11(configDir2, "projects");
+  const projectsRoot = join12(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
   const accountDir = scopeAccountId ? resolve11(ACCOUNTS_DIR, scopeAccountId) : null;
@@ -8420,7 +8477,10 @@ app3.get("/", requireAdminSession, async (c) => {
   let liveCount = 0;
   let subagentCount = 0;
   let archivedCount = 0;
-  let excludedChannelCount = 0;
+  let excludedPublicWebchatCount = 0;
+  const channelInList = { whatsapp: 0, telegram: 0, webchat: 0 };
+  const KNOWN_CHANNELS = /* @__PURE__ */ new Set(["browser", "whatsapp", "telegram", "webchat", "email"]);
+  let unknownChannelCount = 0;
   let untaggedCount = 0;
   const titleSourceCounts = { user: 0, ai: 0, "first-message": 0, prefix: 0 };
   const personIdBySession = /* @__PURE__ */ new Map();
@@ -8447,14 +8507,14 @@ app3.get("/", requireAdminSession, async (c) => {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join11(projectDir, `${sessionId}.meta.json`);
+    const metaPath = join12(projectDir, `${sessionId}.meta.json`);
     const { bridgeIds, role, channel: sidecarChannel, personId, adminUserId, accountId: rowAccountId } = readSidecarMeta(metaPath);
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
       if (rowAccountId !== scopeAccountId) continue;
     }
-    if (isReaderChannelSession(role, sidecarChannel)) {
-      excludedChannelCount += 1;
+    if (isSessionListExcluded(role, sidecarChannel)) {
+      excludedPublicWebchatCount += 1;
       continue;
     }
     if (personId) personIdBySession.set(sessionId, personId);
@@ -8472,11 +8532,20 @@ app3.get("/", requireAdminSession, async (c) => {
       projectDir,
       bridgeIds,
       archived,
-      channel: resolved.channel,
+      // Task 1566 — the row's channel is the authoritative `.meta.json` sidecar
+      // value (whatsapp/telegram/webchat/browser/null), which drives the client
+      // row colour and glyph. The JSONL-envelope channel (`resolved.channel`) is
+      // no longer the row channel: it is null for browser/CLI rows and can
+      // diverge from the sidecar (e.g. an ai-titled channel row).
+      channel: sidecarChannel,
       personName: null,
       model: lastAssistantModel(body),
       accountId: rowAccountId
     });
+    if (sidecarChannel === "whatsapp") channelInList.whatsapp += 1;
+    else if (sidecarChannel === "telegram") channelInList.telegram += 1;
+    else if (sidecarChannel === "webchat") channelInList.webchat += 1;
+    if (sidecarChannel !== null && !KNOWN_CHANNELS.has(sidecarChannel)) unknownChannelCount += 1;
     if (live) liveCount += 1;
     if (isSubagent) subagentCount += 1;
     if (archived) archivedCount += 1;
@@ -8509,7 +8578,7 @@ app3.get("/", requireAdminSession, async (c) => {
   }
   rows.sort((a, b) => a.startedAt < b.startedAt ? 1 : -1);
   console.log(
-    `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} archived=${archivedCount} excludedChannel=${excludedChannelCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} personNames=${personNameCount} adminNames=${adminNameCount} accountId=${scopeAccountId ? scopeAccountId.slice(0, 8) : "unset"}`
+    `[admin-sessions-list] rows=${rows.length} live=${liveCount} subagents=${subagentCount} archived=${archivedCount} channelInList=whatsapp:${channelInList.whatsapp},telegram:${channelInList.telegram},webchat:${channelInList.webchat} unknownChannel=${unknownChannelCount} excludedPublicWebchat=${excludedPublicWebchatCount} titles user=${titleSourceCounts.user} ai=${titleSourceCounts.ai} first=${titleSourceCounts["first-message"]} prefix=${titleSourceCounts.prefix} personNames=${personNameCount} adminNames=${adminNameCount} accountId=${scopeAccountId ? scopeAccountId.slice(0, 8) : "unset"}`
   );
   console.log(
     `[admin-sessions-list] accountId=${scopeAccountId ? scopeAccountId.slice(0, 8) : "unset"} scope=${multiAccount ? "scoped" : "all"} rows=${rows.length}`
@@ -8523,13 +8592,13 @@ var sidebar_sessions_default = app3;
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync13, readdirSync as readdirSync6, statSync as statSync4 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync4 } from "fs";
+import { join as join13 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
-  if (!existsSync8(usersFilePath)) return null;
+  if (!existsSync9(usersFilePath)) return null;
   const raw = readFileSync13(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -8829,8 +8898,8 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync7 } from "fs";
-import { join as join13 } from "path";
+import { readFileSync as readFileSync14, readdirSync as readdirSync8 } from "fs";
+import { join as join14 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -8843,7 +8912,7 @@ function adminAttachmentIds(text) {
 function adminAttachmentsFromText(text, uploadsBase) {
   const out = [];
   for (const id of adminAttachmentIds(text)) {
-    const meta = readAttachmentMeta(join13(uploadsBase, id));
+    const meta = readAttachmentMeta(join14(uploadsBase, id));
     if (meta) out.push(meta);
   }
   return out;
@@ -8851,7 +8920,7 @@ function adminAttachmentsFromText(text, uploadsBase) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync14(join13(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync14(join14(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -8874,13 +8943,13 @@ function readAttachmentMeta(dir) {
 function listSessionAttachmentsInDir(dir) {
   let entries;
   try {
-    entries = readdirSync7(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync8(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
   const sidecars = [];
   for (const name of entries) {
-    const sidecar = readSidecar(join13(dir, name), name);
+    const sidecar = readSidecar(join14(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
   sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
@@ -8945,14 +9014,14 @@ app4.get("/conversations", requireAdminSession, async (c) => {
   }
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join14(cfg, "projects");
+  const projectsRoot = join15(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path2 } of enumerateJsonls(projectsRoot)) {
-    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
+    const sessionId = basename4(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname4(path2);
-    const meta = readSidecarMeta(join14(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join15(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
       if (meta.accountId === null) sessionRowsExcludedUntagged += 1;
@@ -9132,7 +9201,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync15(join14(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync15(join15(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -9155,7 +9224,7 @@ function runActivityTick(c) {
   c.parentGrewThisTick = false;
   let names = [];
   try {
-    names = readdirSync8(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
+    names = readdirSync9(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
   } catch {
   }
   const entries = [];
@@ -9164,7 +9233,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync5(join14(c.subagentsDir, name));
+      const st = statSync5(join15(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -9209,11 +9278,11 @@ app4.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve12(join14(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve12(join15(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve12(join14(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve12(join15(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep3)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -9238,9 +9307,9 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve12(join14(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve12(join15(projectDir, sessionId, "subagents"));
       console.log(
-        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync9(subagentsDir)}`
+        `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync10(subagentsDir)}`
       );
       const actx = makeActivityCtx({
         subagentsDir,
@@ -9347,10 +9416,10 @@ app4.get("/directives", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   if (!SESSION_ID_RE2.test(sessionId)) return c.json({ error: "bad session reference" }, 400);
   const dir = directiveStoreDir(sessionId);
-  if (!dir || !existsSync9(dir)) return c.json({ entries: [] });
+  if (!dir || !existsSync10(dir)) return c.json({ entries: [] });
   let names;
   try {
-    names = readdirSync8(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
+    names = readdirSync9(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
   } catch {
     return c.json({ entries: [] });
   }
@@ -9360,7 +9429,7 @@ app4.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync5(join14(dir, name)).size;
+      len = statSync5(join15(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -9375,7 +9444,7 @@ app4.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path2 = resolve12(join14(dir, name));
+  const path2 = resolve12(join15(dir, name));
   if (!path2.startsWith(dir + sep3)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -9429,7 +9498,7 @@ app4.get("/store-stream", requireAdminSession, (c) => {
       console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q}`);
     }
     if (r.attachmentId) {
-      const meta = readAttachmentMeta(join14(uploadsBase, r.attachmentId));
+      const meta = readAttachmentMeta(join15(uploadsBase, r.attachmentId));
       if (meta) return { ...turn, attachments: [meta] };
     }
     return turn;
@@ -9644,7 +9713,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
       }
       if (size > MAX_FILE_BYTES) {
         exit("rejected");
-        return c.json({ error: `"${basename5(absolute)}" exceeds the 50 MB limit` }, 400);
+        return c.json({ error: `"${basename4(absolute)}" exceeds the 50 MB limit` }, 400);
       }
       const mime = detectMimeType(absolute);
       if (!isMimeAdmitted(mime, SUPPORTED_MIME_SET)) {
@@ -9736,7 +9805,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
     }
     for (let i = 0; i < resolvedRefs.length; i++) {
       const { absolute, mime } = resolvedRefs[i];
-      const file = new File([readFileSync15(absolute)], basename5(absolute), { type: mime });
+      const file = new File([readFileSync15(absolute)], basename4(absolute), { type: mime });
       const out = await sendStagedFile(file, `ref=${i}`);
       if (!out.ok) {
         exit("error");
@@ -9755,8 +9824,8 @@ app4.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
-import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync9 } from "fs";
-import { basename as basename6, dirname as dirname5, join as join15, resolve as resolve13, sep as sep4 } from "path";
+import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync10 } from "fs";
+import { basename as basename5, dirname as dirname5, join as join16, resolve as resolve13, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -9830,10 +9899,10 @@ function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path2 } of enumerateJsonls(join15(cfg, "projects"))) {
-    const sessionId = basename6(path2).replace(/\.jsonl$/, "");
+  for (const { path: path2 } of enumerateJsonls(join16(cfg, "projects"))) {
+    const sessionId = basename5(path2).replace(/\.jsonl$/, "");
     const projectDir = dirname5(path2);
-    const meta = readSidecarMeta(join15(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join16(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -9909,15 +9978,15 @@ app5.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve13(join15(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve13(join16(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve13(join15(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve13(join16(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep4)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join15(projectDir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join16(projectDir, `${sessionId}.meta.json`));
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
@@ -10030,7 +10099,7 @@ app5.get("/attachment/:attachmentId", (c) => {
   let dataFile;
   let buffer;
   try {
-    dataFile = readdirSync9(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
+    dataFile = readdirSync10(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
     if (!dataFile) throw new Error("no data file");
     buffer = readFileSync16(resolve13(dir, dataFile));
   } catch {
@@ -10050,17 +10119,17 @@ app5.get("/attachment/:attachmentId", (c) => {
 var public_reader_default = app5;
 
 // server/routes/webchat.ts
-import { basename as basename7, dirname as dirname6 } from "path";
-import { join as join18 } from "path";
-import { existsSync as existsSync11, readdirSync as readdirSync11, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename6, dirname as dirname6 } from "path";
+import { join as join19 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync12, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync17, writeFileSync as writeFileSync5, renameSync as renameSync2 } from "fs";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join16(accountDir, FILE);
+  return join17(accountDir, FILE);
 }
 function readRaw(accountDir) {
   try {
@@ -10139,8 +10208,8 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync as readdirSync10, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync11, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { join as join18 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -10148,7 +10217,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join17(sessionsDir, `${id}${suffix}`);
+    return join18(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync3(sessionsDir, { recursive: true });
@@ -10160,7 +10229,7 @@ function createSidecarStore(config) {
       return { ok: true };
     } catch (error) {
       try {
-        if (existsSync10(tmp)) unlinkSync2(tmp);
+        if (existsSync11(tmp)) unlinkSync2(tmp);
       } catch {
       }
       return { ok: false, error };
@@ -10185,14 +10254,14 @@ function createSidecarStore(config) {
   function readAll(sessionsDir, onSkip) {
     let names;
     try {
-      names = readdirSync10(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+      names = readdirSync11(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
     } catch {
       return [];
     }
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path2 = join17(sessionsDir, name);
+      const path2 = join18(sessionsDir, name);
       let raw;
       try {
         raw = readFileSync18(path2, "utf8");
@@ -10216,7 +10285,7 @@ function createSidecarStore(config) {
   function clear(sessionsDir, id) {
     const path2 = pathFor(sessionsDir, id);
     try {
-      if (existsSync10(path2)) {
+      if (existsSync11(path2)) {
         unlinkSync2(path2);
         return { ok: true, removed: true };
       }
@@ -10269,22 +10338,22 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const dir = findSessionProjectDir(sessionId);
   if (!dir) return { projectDir: null, channel: null, accountId: null };
-  const meta = readSidecarMeta(join18(dir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join19(dir, `${sessionId}.meta.json`));
   return { projectDir: dir, channel: meta.channel, accountId: meta.accountId };
 }
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join18(cfg, "projects");
+  const projectsRoot = join19(cfg, "projects");
   let slugs;
   try {
-    slugs = readdirSync11(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync12(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join18(projectsRoot, slug, `${sessionId}.meta.json`);
-    if (existsSync11(metaPath)) {
+    const metaPath = join19(projectsRoot, slug, `${sessionId}.meta.json`);
+    if (existsSync12(metaPath)) {
       const meta = readSidecarMeta(metaPath);
       return { channel: meta.channel, adminUserId: meta.adminUserId, accountId: meta.accountId };
     }
@@ -10296,7 +10365,7 @@ function readTargetOwner(sessionId) {
   if (sidecar !== null) return { found: true, owner: sidecar.adminUserId };
   const { projectDir } = locateSession(sessionId);
   if (projectDir !== null) {
-    return { found: true, owner: readSidecarMeta(join18(projectDir, `${sessionId}.meta.json`)).adminUserId };
+    return { found: true, owner: readSidecarMeta(join19(projectDir, `${sessionId}.meta.json`)).adminUserId };
   }
   return { found: false, owner: null };
 }
@@ -10310,7 +10379,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync7(join18(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync7(join19(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -10446,10 +10515,10 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path2, isSubagent, archived } of enumerateJsonls(join18(cfg, "projects"))) {
+  for (const { path: path2, isSubagent, archived } of enumerateJsonls(join19(cfg, "projects"))) {
     if (isSubagent || archived) continue;
-    const id = basename7(path2).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join18(dirname6(path2), `${id}.meta.json`));
+    const id = basename6(path2).slice(0, -".jsonl".length);
+    const meta = readSidecarMeta(join19(dirname6(path2), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
@@ -10472,7 +10541,7 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
 function overrideKnownNonArchived(id) {
   const { projectDir } = locateSession(id);
   if (projectDir === null) return sessionSidecarExists(id);
-  return basename7(projectDir) !== "archive";
+  return basename6(projectDir) !== "archive";
 }
 function resolveCanonical(accountId, accountDir, requesterUserId, primaryUserId, scopeAccountId, multiAccount) {
   const bootstrapAccountId = scopeAccountId ?? accountId;
@@ -10508,8 +10577,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app61 = new Hono();
-  app61.post("/send", requireAdminSession, async (c) => {
+  const app62 = new Hono();
+  app62.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -10709,7 +10778,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app61.post("/interrupt", requireAdminSession, async (c) => {
+  app62.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -10737,7 +10806,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app61.post("/settings", requireAdminSession, async (c) => {
+  app62.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -10759,7 +10828,7 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join18(account.accountDir, "account.json");
+    const accountJsonPath = join19(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync19(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
@@ -10777,7 +10846,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app61.get("/session", requireAdminSession, async (c) => {
+  app62.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -10807,7 +10876,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join18(cfg2, "sessions"),
+            join19(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -10839,15 +10908,15 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path2 } of enumerateJsonls(join18(cfg, "projects"))) {
-        if (basename7(path2) === `${sessionId}.jsonl`) {
+      for (const { path: path2 } of enumerateJsonls(join19(cfg, "projects"))) {
+        if (basename6(path2) === `${sessionId}.jsonl`) {
           projectDir = dirname6(path2);
           break;
         }
       }
     }
     if (source === "latest" && requesterUserId !== null) {
-      const owner = readSidecarMeta(join18(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
+      const owner = readSidecarMeta(join19(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
       if (owner !== null && owner !== requesterUserId && requesterUserId !== primaryUserId) {
         console.error(`[webchat:inbound] op=session-resolve-foreign key=${sessionId.slice(0, 8)} owner=${owner.slice(0, 8)} requester=${requesterUserId.slice(0, 8)}`);
       }
@@ -10855,7 +10924,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app61.post("/permission-verdict", requireAdminSession, async (c) => {
+  app62.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -10872,15 +10941,15 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app61;
+  return app62;
 }
 
 // server/routes/webchat-greeting.ts
 import { resolve as resolve14 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync12, readFileSync as readFileSync20, readdirSync as readdirSync12 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync20, readdirSync as readdirSync13 } from "fs";
+import { join as join20 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -10891,15 +10960,15 @@ function field(fm, name) {
   return value || null;
 }
 function readSpecialistRoster(specialistsDir) {
-  if (!existsSync12(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync12(specialistsDir);
+  if (!existsSync13(specialistsDir)) return { specialists: [], skipped: [] };
+  const entries = readdirSync13(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync20(join19(specialistsDir, file), "utf-8");
+      raw = readFileSync20(join20(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -11015,9 +11084,9 @@ function r2n(value) {
 var webchat_greeting_default = app6;
 
 // server/routes/telegram.ts
-import { homedir } from "os";
-import { resolve as resolve15, join as join20 } from "path";
-import { existsSync as existsSync13, readFileSync as readFileSync21 } from "fs";
+import { homedir as homedir2 } from "os";
+import { resolve as resolve15, join as join21 } from "path";
+import { existsSync as existsSync14, readFileSync as readFileSync21 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
@@ -11076,8 +11145,8 @@ function routeTelegramUpdate(input) {
 var TAG23 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? resolve15(process.cwd(), "..");
-  const brandPath = join20(platformRoot3, "config", "brand.json");
-  if (existsSync13(brandPath)) {
+  const brandPath = join21(platformRoot3, "config", "brand.json");
+  if (existsSync14(brandPath)) {
     try {
       return JSON.parse(readFileSync21(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
@@ -11087,7 +11156,7 @@ function configDirName() {
 }
 function secretPath(botType) {
   const filename = botType === "admin" ? ".telegram-admin-webhook-secret" : ".telegram-webhook-secret";
-  return resolve15(homedir(), configDirName(), filename);
+  return resolve15(homedir2(), configDirName(), filename);
 }
 var app7 = new Hono();
 app7.post("/", async (c) => {
@@ -11098,7 +11167,7 @@ app7.post("/", async (c) => {
     return c.json({ ok: false }, 400);
   }
   const sp = secretPath(botType);
-  if (!existsSync13(sp)) {
+  if (!existsSync14(sp)) {
     console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
@@ -11165,21 +11234,21 @@ app7.post("/", async (c) => {
 var telegram_default = app7;
 
 // server/routes/quickbooks.ts
-import { join as join21 } from "path";
-import { existsSync as existsSync14, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
+import { join as join22 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
 var TAG24 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join21(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join22(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join21(accountDir, "secrets", "quickbooks.json");
+  return join22(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
   const state = args.state;
-  if (!state || !STATE_RE.test(state) || !existsSync14(pendingPath(accountDir, state))) {
+  if (!state || !STATE_RE.test(state) || !existsSync15(pendingPath(accountDir, state))) {
     console.error(`${TAG24} op=callback state=${state ?? ""} stateValid=false realmId=${realmId ?? ""}`);
     return { ok: false, status: 400, message: "Invalid or unknown authorization state.", stateValid: false };
   }
@@ -11206,7 +11275,7 @@ async function completeConsent(args) {
     if (!code || !realmId) {
       return { ok: false, status: 400, message: "Missing code or realmId in the callback.", stateValid: true };
     }
-    if (!existsSync14(storePath(accountDir))) {
+    if (!existsSync15(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
     const store2 = JSON.parse(readFileSync22(storePath(accountDir), "utf-8"));
@@ -11241,7 +11310,7 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync4(join21(accountDir, "secrets"), { recursive: true });
+    mkdirSync4(join22(accountDir, "secrets"), { recursive: true });
     writeFileSync8(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
     const persisted = JSON.parse(readFileSync22(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=${persisted}`);
@@ -11274,7 +11343,7 @@ var quickbooks_default = app8;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync3 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync16, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync17, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
@@ -11283,7 +11352,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname8, join as join23 } from "path";
+import { dirname as dirname8, join as join24 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -11412,8 +11481,8 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync15, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync13, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
-import { dirname as dirname7, join as join22 } from "path";
+import { existsSync as existsSync16, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync14, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
+import { dirname as dirname7, join as join23 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -11453,7 +11522,7 @@ function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync15(input.usersFile)) {
+    if (existsSync16(input.usersFile)) {
       const raw = readFileSync23(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
@@ -11485,8 +11554,8 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join22(input.accountDir, "account.json");
-    if (!existsSync15(accountJsonPath)) {
+    const accountJsonPath = join23(input.accountDir, "account.json");
+    if (!existsSync16(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
     const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
@@ -11509,7 +11578,7 @@ function writeAdminEntry(input) {
 function computeAdminStoreDivergence(input) {
   const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync15(input.usersFile)) {
+  if (existsSync16(input.usersFile)) {
     try {
       const raw = readFileSync23(input.usersFile, "utf-8").trim();
       if (raw) {
@@ -11523,24 +11592,24 @@ function computeAdminStoreDivergence(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync15(input.accountsDir)) {
+  if (existsSync16(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync13(input.accountsDir);
+      entries = readdirSync14(input.accountsDir);
     } catch (err) {
       result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join22(input.accountsDir, entry);
+      const accountDir = join23(input.accountsDir, entry);
       try {
         if (!statSync8(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join22(accountDir, "account.json");
-      if (!existsSync15(accountJsonPath)) continue;
+      const accountJsonPath = join23(accountDir, "account.json");
+      if (!existsSync16(accountJsonPath)) continue;
       let admins = [];
       try {
         const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
@@ -11591,7 +11660,7 @@ function hashPin2(pin) {
   return createHash4("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync16(USERS_FILE)) return null;
+  if (!existsSync17(USERS_FILE)) return null;
   const raw = readFileSync24(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
@@ -11651,7 +11720,7 @@ app9.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync16(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync17(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -11717,7 +11786,7 @@ app9.post("/claude-auth", async (c) => {
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync10(join23(dirname8(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync10(join24(dirname8(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -11800,7 +11869,7 @@ app9.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync16(INSTALL_OWNER_FILE)) {
+    if (existsSync17(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -11948,7 +12017,7 @@ app9.put("/set-pin", requireAdminSession, async (c) => {
   console.log(`[set-pin] changed PIN in place: userId=${sessionUserId.slice(0, 8)}\u2026`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync16(INSTALL_OWNER_FILE)) {
+    if (existsSync17(INSTALL_OWNER_FILE)) {
       try {
         const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
@@ -11982,9 +12051,9 @@ ${body.newPin}
 var onboarding_default = app9;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync17, renameSync as renameSync8, statSync as statSync9 } from "fs";
-import { join as join24 } from "path";
-var CLIENT_ERRORS_LOG = join24(LOG_DIR, "client-errors.log");
+import { appendFileSync as appendFileSync3, existsSync as existsSync18, renameSync as renameSync8, statSync as statSync9 } from "fs";
+import { join as join25 } from "path";
+var CLIENT_ERRORS_LOG = join25(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -12032,7 +12101,7 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync17(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync18(CLIENT_ERRORS_LOG)) return;
     const stats = statSync9(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
     renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
@@ -12352,18 +12421,18 @@ app12.get("/", requireAdminSession, async (c) => {
 var accounts_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync19, readdirSync as readdirSync14, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
-import { resolve as resolve16, basename as basename8 } from "path";
+import { existsSync as existsSync20, readdirSync as readdirSync15, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { resolve as resolve16, basename as basename7 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync18 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync19 } from "fs";
+import { join as join26 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join25(dir, filename);
-    if (existsSync18(fullPath)) {
+    const fullPath = join26(dir, filename);
+    if (existsSync19(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -12385,7 +12454,7 @@ app13.get("/", async (c) => {
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
   if (fileParam) {
-    const safe = basename8(fileParam);
+    const safe = basename7(fileParam);
     const searched = [];
     for (const dir of logDirs) {
       const filePath = resolve16(dir, safe);
@@ -12455,7 +12524,7 @@ app13.get("/", async (c) => {
     if (hit) {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
-        const filename = basename8(hit.path);
+        const filename = basename7(hit.path);
         const buffer = readFileSync25(hit.path);
         const onDiskBytes = statSync10(hit.path).size;
         const headers = {
@@ -12491,10 +12560,10 @@ app13.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync19(dir)) continue;
+    if (!existsSync20(dir)) continue;
     let files;
     try {
-      files = readdirSync14(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync15(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
@@ -12543,7 +12612,7 @@ var claude_info_default = app14;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 import { resolve as resolve17 } from "path";
 var app15 = new Hono();
 var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -12566,12 +12635,12 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let accountId = pinnedAccountId;
   let dir = uploadsDirFor2(accountId, attachmentId);
-  let found = existsSync20(dir);
+  let found = existsSync21(dir);
   if (!found) {
     for (const candidate of listValidAccounts()) {
       if (candidate.accountId === pinnedAccountId) continue;
       const candidateDir = uploadsDirFor2(candidate.accountId, attachmentId);
-      if (existsSync20(candidateDir)) {
+      if (existsSync21(candidateDir)) {
         accountId = candidate.accountId;
         dir = candidateDir;
         found = true;
@@ -12586,7 +12655,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve17(dir, `${attachmentId}.meta.json`);
-  if (!existsSync20(metaPath)) {
+  if (!existsSync21(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -12614,21 +12683,21 @@ var attachment_default = app15;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve18 } from "path";
-import { readdirSync as readdirSync15, readFileSync as readFileSync26, existsSync as existsSync21, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync16, readFileSync as readFileSync26, existsSync as existsSync22, rmSync as rmSync2 } from "fs";
 var app16 = new Hono();
 app16.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve18(account.accountDir, "agents");
-  if (!existsSync21(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync22(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync15(agentsDir, { withFileTypes: true });
+    const entries = readdirSync16(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve18(agentsDir, entry.name, "config.json");
-      if (!existsSync21(configPath2)) continue;
+      if (!existsSync22(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync26(configPath2, "utf-8"));
         agents.push({
@@ -12657,7 +12726,7 @@ app16.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync21(agentDir)) {
+  if (!existsSync22(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -12687,7 +12756,7 @@ app16.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve18(account.accountDir, "agents", slug);
-  if (!existsSync21(agentDir)) {
+  if (!existsSync22(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -12703,7 +12772,7 @@ var agents_default = app16;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync22, mkdirSync as mkdirSync6, createWriteStream } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync6, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -12841,7 +12910,7 @@ var replayJsonl = (..._args) => null;
 var resolveJsonlPath = (..._args) => null;
 
 // server/routes/admin/sessions.ts
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 
 // app/lib/claude-agent/component-attachment.ts
 var pickComponentBytes = (..._args) => null;
@@ -12863,7 +12932,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync22(a.storagePath)) reason = "missing-file";
+    else if (!existsSync23(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -13156,7 +13225,7 @@ app17.post("/:id/resume", async (c) => {
     return c.json({ error: "Failed to load conversation messages" }, 500);
   }
   if (persistedAgentSessionId) {
-    const jsonlPath = resolveJsonlPath(homedir2(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
+    const jsonlPath = resolveJsonlPath(homedir3(), resolvePath(ACCOUNTS_DIR, accountId), persistedAgentSessionId);
     const replay = replayJsonl(jsonlPath);
     jsonlMissing = replay.jsonlMissing;
     jsonlMalformedLines = replay.malformedLines;
@@ -13389,8 +13458,8 @@ app17.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync23, readFileSync as readFileSync27, readdirSync as readdirSync16, statSync as statSync11 } from "fs";
-import { dirname as dirname9, resolve as resolve19, join as join26 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync27, readdirSync as readdirSync17, statSync as statSync11 } from "fs";
+import { dirname as dirname9, resolve as resolve19, join as join27 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -13431,12 +13500,12 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join26(pluginDir, "mcp/dist/index.js"),
-    join26(pluginDir, "mcp/src/index.ts")
+    join27(pluginDir, "mcp/dist/index.js"),
+    join27(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path2 of candidates) {
-    if (!existsSync23(path2)) continue;
+    if (!existsSync24(path2)) continue;
     try {
       raw = readFileSync27(path2, "utf-8");
       break;
@@ -13488,9 +13557,9 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve19(PLATFORM_ROOT, "plugins");
-  if (existsSync23(platformPlugins)) {
-    for (const name of readdirSync16(platformPlugins)) {
-      const dir = join26(platformPlugins, name);
+  if (existsSync24(platformPlugins)) {
+    for (const name of readdirSync17(platformPlugins)) {
+      const dir = join27(platformPlugins, name);
       try {
         if (statSync11(dir).isDirectory()) out.set(name, dir);
       } catch {
@@ -13498,13 +13567,13 @@ function listPluginDirs() {
     }
   }
   const premiumRoot = resolve19(dirname9(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync23(premiumRoot)) {
-    for (const bundle of readdirSync16(premiumRoot)) {
-      const bundlePlugins = join26(premiumRoot, bundle, "plugins");
-      if (!existsSync23(bundlePlugins)) continue;
+  if (existsSync24(premiumRoot)) {
+    for (const bundle of readdirSync17(premiumRoot)) {
+      const bundlePlugins = join27(premiumRoot, bundle, "plugins");
+      if (!existsSync24(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync16(bundlePlugins)) {
-          const dir = join26(bundlePlugins, name);
+        for (const name of readdirSync17(bundlePlugins)) {
+          const dir = join27(bundlePlugins, name);
           try {
             if (statSync11(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -13518,7 +13587,7 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync23(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync24(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync27(accountFile, "utf-8"));
     return new Set(
@@ -13529,7 +13598,7 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path2) {
-  if (!existsSync23(path2)) return null;
+  if (!existsSync24(path2)) return null;
   let raw;
   try {
     raw = readFileSync27(path2, "utf-8");
@@ -13547,7 +13616,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join26(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join27(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -13564,7 +13633,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync23(join26(dir, "mcp/dist/index.js")) || existsSync23(join26(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync24(join27(dir, "mcp/dist/index.js")) || existsSync24(join27(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -13574,7 +13643,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join26(dir, relPath);
+      const skillPath = join27(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -13591,10 +13660,10 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync23(specialistsDir)) return [];
+  if (!existsSync24(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync16(specialistsDir);
+    entries = readdirSync17(specialistsDir);
   } catch {
     return [];
   }
@@ -13618,7 +13687,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join26(specialistsDir, file));
+    const fm = readFrontmatter(join27(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -13637,7 +13706,7 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync23(accountFile)) return [];
+  if (!existsSync24(accountFile)) return [];
   let enabled;
   try {
     const raw = readFileSync27(accountFile, "utf-8");
@@ -13652,10 +13721,10 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve19(PLATFORM_ROOT, "plugins");
-  if (!existsSync23(pluginsDir)) return [];
+  if (!existsSync24(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync16(pluginsDir);
+    entries = readdirSync17(pluginsDir);
   } catch {
     return [];
   }
@@ -13663,7 +13732,7 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve19(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync23(manifestPath)) continue;
+    if (!existsSync24(manifestPath)) continue;
     let manifest;
     try {
       manifest = readFileSync27(manifestPath, "utf-8");
@@ -13680,11 +13749,11 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync24, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync28 } from "fs";
 import { resolve as resolve20 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync24(statePath)) return null;
+  if (!existsSync25(statePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync28(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
@@ -13909,18 +13978,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app20 = new Hono();
 app20.post("/", async (c) => {
-  const TAG44 = "[admin:events]";
+  const TAG45 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG44} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG45} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG44} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG45} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -13942,11 +14011,11 @@ app20.post("/", async (c) => {
 var events_default = app20;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync25 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync26 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
-import { basename as basename10, dirname as dirname10, join as join28, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname10, join as join29, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -14264,7 +14333,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve21, relative as relative3, join as join27, basename as basename9, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve21, relative as relative3, join as join28, basename as basename8, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -14346,7 +14415,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join27(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join28(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -14402,13 +14471,13 @@ async function extractFileContent(absolute) {
   }
 }
 async function readDisplayName(absolute) {
-  const dir = absolute.slice(0, absolute.length - basename9(absolute).length);
-  const base = basename9(absolute);
+  const dir = absolute.slice(0, absolute.length - basename8(absolute).length);
+  const base = basename8(absolute);
   const dot = base.lastIndexOf(".");
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join27(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join28(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -14429,7 +14498,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join27(root, entry.name);
+    const abs = join28(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -14541,7 +14610,7 @@ async function cascadeTrashLinkedKnowledgeDocs(session, accountId, relativePaths
   return { kds, sections, chunks };
 }
 async function buildArtifact(accountId, wf, embed2) {
-  const name = basename9(wf.absolute);
+  const name = basename8(wf.absolute);
   const { content, route } = await extractFileContent(wf.absolute);
   const displayName = await readDisplayName(wf.absolute);
   const embedInput = `${name}
@@ -14785,7 +14854,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join28(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join29(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -14823,7 +14892,7 @@ async function readAccountNames() {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join28(absolute, entry.name), entry.name);
+    const meta = await readMeta(join29(absolute, entry.name), entry.name);
     if (meta?.filename) {
       entry.displayName = meta.filename;
       entry.mimeType = meta.mimeType;
@@ -14987,7 +15056,7 @@ app21.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join28(absolute, name);
+        const entryPath = join29(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -15040,7 +15109,7 @@ app21.get("/download", requireAdminSession, async (c) => {
       console.error(`[data] op=scratchpad-no-session sessionId="${sessionId.slice(0, 8)}\u2026"`);
       return c.json({ error: "Not found" }, 404);
     }
-    const meta = readSidecarMeta(join28(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join29(projectDir, `${sessionId}.meta.json`));
     if (!meta.accountId || meta.accountId !== accountId) {
       console.error(`[data] account-scope-blocked root="scratchpad" sessionId="${sessionId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
@@ -15071,7 +15140,7 @@ app21.get("/download", requireAdminSession, async (c) => {
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
-    const filename = basename10(absolute);
+    const filename = basename9(absolute);
     const mimeType = detectMimeType(absolute);
     const nodeStream = createReadStream2(absolute);
     const webStream = Readable2.toWeb(nodeStream);
@@ -15127,7 +15196,7 @@ async function* walkRegularFiles(dirAbsolute) {
   const dirents = await readdir3(dirAbsolute, { withFileTypes: true });
   for (const d of dirents) {
     if (d.isSymbolicLink()) continue;
-    const child = join28(dirAbsolute, d.name);
+    const child = join29(dirAbsolute, d.name);
     if (d.isDirectory()) {
       yield* walkRegularFiles(child);
       continue;
@@ -15187,7 +15256,7 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
           if (over) return over;
         }
       } else if (info.isFile()) {
-        const over = await addFile(absolute, info.size, basename10(absolute));
+        const over = await addFile(absolute, info.size, basename9(absolute));
         if (over) return over;
       } else {
         return c.json({ error: "Path is not a file or directory" }, 400);
@@ -15216,12 +15285,12 @@ function dataUploadCeiling() {
 }
 async function resolveUploadTarget(c, accountId, uid) {
   const rawName = c.req.query("filename") ?? "";
-  const safeName = basename10(rawName).replace(/[\0/\\]/g, "_");
+  const safeName = basename9(rawName).replace(/[\0/\\]/g, "_");
   if (!safeName) return { ok: false, status: 400, error: "filename query param required" };
   const rawRelpath = c.req.query("relpath") ?? "";
   const relpath = rawRelpath !== "" ? rawRelpath : null;
   const token = c.req.query("token") ?? "";
-  const finalName = relpath ? basename10(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
+  const finalName = relpath ? basename9(relpath).replace(/[\0/\\]/g, "_") : `${Date.now()}-${safeName}`;
   const mimeType = (c.req.header("content-type") ?? "").split(";")[0].trim();
   if (!SUPPORTED_MIME_TYPES.has(mimeType)) {
     console.error(`[data-upload] op=reject-mime uid=${uid} mime="${mimeType}" token=${token} rel="${relpath ?? ""}"`);
@@ -15231,7 +15300,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
   const relDir = relpath ? dirname10(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join28(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join29(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 404, error: "Not found" };
@@ -15305,7 +15374,7 @@ app21.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink2(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync25(tmpPath);
+    const tempRemoved = !existsSync26(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -15379,7 +15448,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink2(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync25(state.tmpPath);
+  const tempRemoved = !existsSync26(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -15591,7 +15660,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     console.error(`[data] account-scope-blocked endpoint="DELETE /api/admin/files" path="${relPath}" account=${accountId.slice(0, 8)}\u2026`);
     return c.json({ error: "Not found" }, 404);
   }
-  const base = basename10(absolute);
+  const base = basename9(absolute);
   const protection = isProtectedFromDeletion(relPath);
   if (protection.protected) {
     console.error(`[data] file-delete blocked path="${relPath}" reason="protected" rule="${protection.rule}"`);
@@ -15607,7 +15676,7 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join28(dirname10(absolute), `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join29(dirname10(absolute), `${stem}.meta.json`) : null;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -17835,8 +17904,8 @@ var graph_default_view_default = app27;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename11 } from "path";
-import { existsSync as existsSync26 } from "fs";
+import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
+import { existsSync as existsSync27 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -17888,7 +17957,7 @@ async function fetchAccountFileArtefacts(accountId) {
       const modifiedAt = r.get("modifiedAt") ?? "";
       return {
         id: `account-file:${relativePath}`,
-        name: displayName ?? basename11(relativePath),
+        name: displayName ?? basename10(relativePath),
         kind: "account-file",
         updatedAt: modifiedAt,
         mimeType,
@@ -17943,7 +18012,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync26(dir)) continue;
+    if (!existsSync27(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -17958,7 +18027,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync26(inp.overridePath)) {
+  if (existsSync27(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -17969,7 +18038,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync26(inp.bundledPath)) {
+  } else if (existsSync27(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -18572,12 +18641,12 @@ app36.get("/", async (c) => {
 var system_stats_default = app36;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync27, readFileSync as readFileSync29 } from "fs";
-import { resolve as resolve24, join as join29 } from "path";
+import { existsSync as existsSync28, readFileSync as readFileSync29 } from "fs";
+import { resolve as resolve24, join as join30 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join29(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync27(brandJsonPath)) {
+var brandJsonPath = join30(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync28(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync29(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
@@ -18588,7 +18657,7 @@ var VERSION_FILE = resolve24(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync27(VERSION_FILE)) return "unknown";
+  if (!existsSync28(VERSION_FILE)) return "unknown";
   return readFileSync29(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
@@ -19365,8 +19434,8 @@ app44.post("/launch", requireAdminSession, async (c) => {
 var browser_default = app44;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync28 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync29 } from "fs";
+import { join as join32 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -19466,7 +19535,7 @@ function countVEvents(ics) {
 
 // server/lib/calendar-availability.ts
 import { readFileSync as readFileSync30 } from "fs";
-import { join as join30 } from "path";
+import { join as join31 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -19475,7 +19544,7 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path2 = join30(accountDir, AVAILABILITY_FILENAME);
+  const path2 = join31(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
     raw = readFileSync30(path2, "utf-8");
@@ -19837,7 +19906,7 @@ app45.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync28(join31(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync29(join32(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -19932,7 +20001,6 @@ var tasks_list_default = app46;
 
 // server/routes/admin/task-timer-start.ts
 import { randomUUID as randomUUID13 } from "crypto";
-import neo4j5 from "neo4j-driver";
 var TAG34 = "[task-timer]";
 var app47 = new Hono();
 app47.post("/", requireAdminSession, async (c) => {
@@ -19959,30 +20027,17 @@ app47.post("/", requireAdminSession, async (c) => {
       return c.json({ error: "task-not-found" }, 404);
     }
     const open = await session.run(
-      `MATCH (te:TimeEntry {accountId: $accountId}) WHERE te.endedAt IS NULL
-       RETURN te.entryId AS entryId, te.taskId AS taskId, te.startedAt AS startedAt
+      `MATCH (te:TimeEntry {accountId: $accountId, taskId: $taskId}) WHERE te.endedAt IS NULL
+       RETURN te.entryId AS entryId, te.startedAt AS startedAt
        ORDER BY te.startedAt LIMIT 1`,
-      { accountId }
+      { accountId, taskId }
     );
     const priorEntryId = open.records[0]?.get("entryId");
-    const priorTaskId = open.records[0]?.get("taskId");
     const priorStartedAt = open.records[0]?.get("startedAt");
-    console.log(`${TAG34} op=start taskId=${taskId} accountId=${accountId} priorOpen=${priorTaskId ?? "none"}`);
-    if (priorEntryId && priorTaskId === taskId) {
+    if (priorEntryId) {
+      console.log(`${TAG34} op=start taskId=${taskId} accountId=${accountId} result=already-running`);
       return c.json({ ok: true, running: true, entryId: priorEntryId, startedAt: priorStartedAt });
     }
-    if (priorEntryId && priorStartedAt && priorTaskId) {
-      const seconds = secondsBetween(priorStartedAt, now);
-      await session.run(
-        `MATCH (te:TimeEntry {entryId: $priorEntryId}) WHERE te.endedAt IS NULL
-         SET te.endedAt = $now, te.seconds = $seconds
-         WITH te
-         MATCH (t:Task {taskId: $priorTaskId, accountId: $accountId})
-         SET t.secondsLogged = coalesce(t.secondsLogged, 0) + $seconds`,
-        { priorEntryId, priorTaskId, accountId, now, seconds: neo4j5.int(seconds) }
-      );
-      console.log(`${TAG34} op=autostop taskId=${priorTaskId} entryId=${priorEntryId} seconds=${seconds}`);
-    }
     const entryId = randomUUID13();
     await session.run(
       `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
@@ -20002,7 +20057,7 @@ app47.post("/", requireAdminSession, async (c) => {
 var task_timer_start_default = app47;
 
 // server/routes/admin/task-timer-stop.ts
-import neo4j6 from "neo4j-driver";
+import neo4j5 from "neo4j-driver";
 var TAG35 = "[task-timer]";
 var app48 = new Hono();
 app48.post("/", requireAdminSession, async (c) => {
@@ -20045,18 +20100,21 @@ app48.post("/", requireAdminSession, async (c) => {
        WITH te
        MATCH (t:Task {taskId: $taskId, accountId: $accountId})
        SET t.secondsLogged = coalesce(t.secondsLogged, 0) + $seconds`,
-      { entryId, taskId, accountId, now, seconds: neo4j6.int(seconds) }
+      { entryId, taskId, accountId, now, seconds: neo4j5.int(seconds) }
     );
     const verify = await session.run(
       `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
        OPTIONAL MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId}) WHERE te.endedAt IS NOT NULL
-       RETURN coalesce(sum(te.seconds), 0) AS sumEntries, coalesce(t.secondsLogged, 0) AS secondsLogged`,
+       WITH t, coalesce(sum(te.seconds), 0) AS sumEntries
+       OPTIONAL MATCH (ta:TimeAdjustment {taskId: $taskId, accountId: $accountId})
+       RETURN sumEntries, coalesce(sum(ta.delta), 0) AS sumAdjustments, coalesce(t.secondsLogged, 0) AS secondsLogged`,
       { taskId, accountId }
     );
     const sumEntries = toNum(verify.records[0]?.get("sumEntries"));
+    const sumAdjustments = toNum(verify.records[0]?.get("sumAdjustments"));
     const secondsLogged = toNum(verify.records[0]?.get("secondsLogged"));
     console.log(`${TAG35} op=stop taskId=${taskId} entryId=${entryId} seconds=${seconds} totalAfter=${secondsLogged}`);
-    console.log(`${TAG35} op=persisted taskId=${taskId} entryId=${entryId} sumEntries=${sumEntries} secondsLogged=${secondsLogged}`);
+    console.log(`${TAG35} op=persisted taskId=${taskId} entryId=${entryId} sumEntries=${sumEntries} sumAdjustments=${sumAdjustments} secondsLogged=${secondsLogged}`);
     return c.json({ ok: true, running: false, seconds, secondsLogged });
   } catch (err) {
     console.error(`${TAG35} op=stop error="${err instanceof Error ? err.message : String(err)}"`);
@@ -20106,56 +20164,137 @@ app49.post("/", requireAdminSession, async (c) => {
 });
 var task_complete_default = app49;
 
-// server/routes/admin/index.ts
+// server/routes/admin/task-time-adjust.ts
+import { randomUUID as randomUUID14 } from "crypto";
+import neo4j6 from "neo4j-driver";
+var TAG37 = "[task-time-adjust]";
 var app50 = new Hono();
-app50.route("/session", session_default);
-app50.route("/accounts", accounts_default);
-app50.route("/logs", logs_default);
-app50.route("/claude-info", claude_info_default);
-app50.route("/attachment", attachment_default);
-app50.route("/agents", agents_default);
-app50.route("/sessions", sessions_default);
-app50.route("/claude-sessions", claude_sessions_default);
-app50.route("/log-ingest", log_ingest_default);
-app50.route("/events", events_default);
-app50.route("/files", files_default);
-app50.route("/graph-search", graph_search_default);
-app50.route("/graph-subgraph", graph_subgraph_default);
-app50.route("/graph-delete", graph_delete_default);
-app50.route("/graph-restore", graph_restore_default);
-app50.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app50.route("/graph-default-view", graph_default_view_default);
-app50.route("/sidebar-artefacts", sidebar_artefacts_default);
-app50.route("/sidebar-sessions", sidebar_sessions_default);
-app50.route("/session-delete", session_delete_default);
-app50.route("/session-stop", session_stop_default);
-app50.route("/session-archive", session_archive_default);
-app50.route("/session-rename", session_rename_default);
-app50.route("/session-usage", session_usage_default);
-app50.route("/browser", browser_default);
-app50.route("/session-rc-spawn", session_rc_spawn_default);
-app50.route("/session-reseat", session_reseat_default);
-app50.route("/system-stats", system_stats_default);
-app50.route("/health-brand", health_default2);
-app50.route("/linkedin-ingest", linkedin_ingest_default);
-app50.route("/post-turn-context", post_turn_context_default);
-app50.route("/public-session-context", public_session_context_default);
-app50.route("/public-session-exit", public_session_exit_default);
-app50.route("/access-session-evict", access_session_evict_default);
-app50.route("/enrol-person", enrol_person_default);
-app50.route("/calendar", calendar_default);
-app50.route("/tasks-list", tasks_list_default);
-app50.route("/task-timer-start", task_timer_start_default);
-app50.route("/task-timer-stop", task_timer_stop_default);
-app50.route("/task-complete", task_complete_default);
-var admin_default = app50;
+app50.post("/", requireAdminSession, async (c) => {
+  const cacheKey = c.var.cacheKey;
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return c.json({ error: "Account not found for session" }, 401);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    console.error(`${TAG37} op=reject reason=bad-json`);
+    return c.json({ error: "invalid-json" }, 400);
+  }
+  const taskId = typeof body.taskId === "string" ? body.taskId : "";
+  if (!taskId) {
+    console.error(`${TAG37} op=reject reason=no-task`);
+    return c.json({ error: "taskId required" }, 400);
+  }
+  const newSeconds = body.newSeconds;
+  if (typeof newSeconds !== "number" || !Number.isInteger(newSeconds) || newSeconds < 0) {
+    console.error(`${TAG37} op=reject reason=invalid-seconds taskId=${taskId} accountId=${accountId}`);
+    return c.json({ error: "newSeconds must be a non-negative integer" }, 400);
+  }
+  const adjustmentId = randomUUID14();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  console.log(`${TAG37} op=request adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId} newSeconds=${newSeconds}`);
+  const session = getSession();
+  try {
+    const guard = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       OPTIONAL MATCH (te:TimeEntry {taskId: $taskId, accountId: $accountId}) WHERE te.endedAt IS NULL
+       RETURN t.taskId AS taskId, count(te) AS openCount, coalesce(t.secondsLogged, 0) AS previousSeconds`,
+      { taskId, accountId }
+    );
+    if (guard.records.length === 0) {
+      console.error(`${TAG37} op=reject reason=no-task adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId}`);
+      return c.json({ error: "task-not-found" }, 404);
+    }
+    const openCount = toNum(guard.records[0].get("openCount"));
+    if (openCount > 0) {
+      console.error(`${TAG37} op=reject reason=running adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId}`);
+      return c.json({ error: "task-timer-running" }, 409);
+    }
+    const previousSeconds = toNum(guard.records[0].get("previousSeconds"));
+    const delta = newSeconds - previousSeconds;
+    const write = await session.run(
+      `MATCH (t:Task {taskId: $taskId, accountId: $accountId})
+       CREATE (ta:TimeAdjustment {
+         adjustmentId: $adjustmentId, taskId: $taskId, accountId: $accountId, at: $now,
+         previousSeconds: $previousSeconds, newSeconds: $newSeconds, delta: $delta,
+         sourceSessionKey: $sourceSessionKey
+       })
+       SET t.secondsLogged = $newSeconds
+       RETURN coalesce(t.secondsLogged, 0) AS secondsLoggedAfter`,
+      {
+        taskId,
+        accountId,
+        adjustmentId,
+        now,
+        previousSeconds: neo4j6.int(previousSeconds),
+        newSeconds: neo4j6.int(newSeconds),
+        delta: neo4j6.int(delta),
+        sourceSessionKey: cacheKey
+      }
+    );
+    const secondsLoggedAfter = toNum(write.records[0]?.get("secondsLoggedAfter"));
+    console.log(`${TAG37} op=persisted adjustmentId=${adjustmentId} previousSeconds=${previousSeconds} newSeconds=${newSeconds} delta=${delta} secondsLoggedAfter=${secondsLoggedAfter}`);
+    return c.json({ ok: true, secondsLogged: secondsLoggedAfter });
+  } catch (err) {
+    console.error(`${TAG37} op=error adjustmentId=${adjustmentId} taskId=${taskId} error="${err instanceof Error ? err.message : String(err)}"`);
+    return c.json({ error: "task-time-adjust-failed" }, 500);
+  } finally {
+    await session.close();
+  }
+});
+var task_time_adjust_default = app50;
+
+// server/routes/admin/index.ts
+var app51 = new Hono();
+app51.route("/session", session_default);
+app51.route("/accounts", accounts_default);
+app51.route("/logs", logs_default);
+app51.route("/claude-info", claude_info_default);
+app51.route("/attachment", attachment_default);
+app51.route("/agents", agents_default);
+app51.route("/sessions", sessions_default);
+app51.route("/claude-sessions", claude_sessions_default);
+app51.route("/log-ingest", log_ingest_default);
+app51.route("/events", events_default);
+app51.route("/files", files_default);
+app51.route("/graph-search", graph_search_default);
+app51.route("/graph-subgraph", graph_subgraph_default);
+app51.route("/graph-delete", graph_delete_default);
+app51.route("/graph-restore", graph_restore_default);
+app51.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app51.route("/graph-default-view", graph_default_view_default);
+app51.route("/sidebar-artefacts", sidebar_artefacts_default);
+app51.route("/sidebar-sessions", sidebar_sessions_default);
+app51.route("/session-delete", session_delete_default);
+app51.route("/session-stop", session_stop_default);
+app51.route("/session-archive", session_archive_default);
+app51.route("/session-rename", session_rename_default);
+app51.route("/session-usage", session_usage_default);
+app51.route("/browser", browser_default);
+app51.route("/session-rc-spawn", session_rc_spawn_default);
+app51.route("/session-reseat", session_reseat_default);
+app51.route("/system-stats", system_stats_default);
+app51.route("/health-brand", health_default2);
+app51.route("/linkedin-ingest", linkedin_ingest_default);
+app51.route("/post-turn-context", post_turn_context_default);
+app51.route("/public-session-context", public_session_context_default);
+app51.route("/public-session-exit", public_session_exit_default);
+app51.route("/access-session-evict", access_session_evict_default);
+app51.route("/enrol-person", enrol_person_default);
+app51.route("/calendar", calendar_default);
+app51.route("/tasks-list", tasks_list_default);
+app51.route("/task-timer-start", task_timer_start_default);
+app51.route("/task-timer-stop", task_timer_stop_default);
+app51.route("/task-complete", task_complete_default);
+app51.route("/task-time-adjust", task_time_adjust_default);
+var admin_default = app51;
 
 // server/routes/access/verify-token.ts
-var TAG37 = "[access-verify]";
+var TAG38 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app51 = new Hono();
-app51.post("/", async (c) => {
+var app52 = new Hono();
+app52.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -20170,39 +20309,39 @@ app51.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG37} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG38} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG37} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG38} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -20218,12 +20357,12 @@ app51.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG37} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG38} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -20237,7 +20376,7 @@ app51.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app51;
+var verify_token_default = app52;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -20299,10 +20438,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG38 = "[access-request-link]";
-var app52 = new Hono();
+var TAG39 = "[access-request-link]";
+var app53 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app52.post("/", async (c) => {
+app53.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -20316,18 +20455,18 @@ app52.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG38} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG39} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG38} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG39} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG38} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG39} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -20335,7 +20474,7 @@ app52.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG38} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG39} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -20367,25 +20506,25 @@ app52.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG38} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG39} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG38} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG39} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app52;
+var request_magic_link_default = app53;
 
 // server/routes/access/index.ts
-var app53 = new Hono();
-app53.route("/verify-token", verify_token_default);
-app53.route("/request-magic-link", request_magic_link_default);
-var access_default = app53;
+var app54 = new Hono();
+app54.route("/verify-token", verify_token_default);
+app54.route("/request-magic-link", request_magic_link_default);
+var access_default = app54;
 
 // server/routes/sites.ts
-import { existsSync as existsSync29, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
 import { resolve as resolve26 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -20417,8 +20556,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app54 = new Hono();
-app54.get("/:rel{.*}", (c) => {
+var app55 = new Hono();
+app55.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -20451,7 +20590,7 @@ app54.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync29(filePath) ? statSync12(filePath) : null;
+    stat8 = existsSync30(filePath) ? statSync12(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -20470,7 +20609,7 @@ app54.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync29(filePath)) {
+  if (!existsSync30(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -20521,7 +20660,7 @@ app54.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app54;
+var sites_default = app55;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -20601,8 +20740,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync30, readFileSync as readFileSync33 } from "fs";
-import { join as join32 } from "path";
+import { existsSync as existsSync31, readFileSync as readFileSync33 } from "fs";
+import { join as join33 } from "path";
 var cached = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -20610,8 +20749,8 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot3) return null;
-  const brandPath = join32(platformRoot3, "config", "brand.json");
-  if (!existsSync30(brandPath)) return null;
+  const brandPath = join33(platformRoot3, "config", "brand.json");
+  if (!existsSync31(brandPath)) return null;
   try {
     cached = JSON.parse(readFileSync33(brandPath, "utf-8"));
     return cached;
@@ -20621,7 +20760,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app55 = new Hono();
+var app56 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -20666,17 +20805,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app55.options("/consent", (c) => {
+app56.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app55.options("/brand-config", (c) => {
+app56.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app55.post("/consent", async (c) => {
+app56.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -20716,7 +20855,7 @@ app55.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app55.get("/brand-config", (c) => {
+app56.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -20726,7 +20865,7 @@ app55.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app55;
+var visitor_consent_default = app56;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -20753,8 +20892,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app56 = new Hono();
-app56.get("/:slug/click", async (c) => {
+var app57 = new Hono();
+app57.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -20818,10 +20957,10 @@ app56.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app56;
+var listings_default = app57;
 
 // server/routes/visitor-event.ts
-var app57 = new Hono();
+var app58 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -20888,12 +21027,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app57.options("/event", (c) => {
+app58.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app57.post("/event", async (c) => {
+app58.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -21098,11 +21237,11 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app57;
+var visitor_event_default = app58;
 
 // server/routes/session.ts
 import { resolve as resolve27 } from "path";
-import { existsSync as existsSync31, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync32, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
@@ -21144,8 +21283,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app58 = new Hono();
-app58.post("/", async (c) => {
+var app59 = new Hono();
+app59.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -21186,7 +21325,7 @@ app58.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve27(account.accountDir, "agents", agentSlug);
-    if (!existsSync31(agentDir) || !existsSync31(resolve27(agentDir, "config.json"))) {
+    if (!existsSync32(agentDir) || !existsSync32(resolve27(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -21292,7 +21431,7 @@ app58.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app58;
+var session_default2 = app59;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -21375,17 +21514,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app59 = new Hono();
+var app60 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app59.options("/free-busy", (c) => {
+app60.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app59.get("/free-busy", async (c) => {
+app60.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -21427,10 +21566,10 @@ app59.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app59;
+var calendar_public_default = app60;
 
 // app/lib/timeentry-census.ts
-var TAG39 = "[timeentry-census]";
+var TAG40 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -21440,9 +21579,9 @@ function reconcileTimeEntries(rows, now, horizonMs) {
     perAccount.set(e.accountId, (perAccount.get(e.accountId) ?? 0) + 1);
   }
   const maxOpenPerAccount = perAccount.size === 0 ? 0 : Math.max(...perAccount.values());
-  const driftTasks = rows.taskSums.filter((t) => t.secondsLogged !== t.sumEntries).length;
+  const driftTasks = rows.taskSums.filter((t) => t.secondsLogged !== t.sumEntries + (t.sumAdjustments ?? 0)).length;
   const oldestOpenAgeMin = Math.floor(oldestOpenAgeMs / 6e4);
-  const alarm = oldestOpenAgeMs > horizonMs || maxOpenPerAccount > 1 || driftTasks > 0;
+  const alarm = oldestOpenAgeMs > horizonMs || driftTasks > 0;
   return { openEntries, oldestOpenAgeMin, maxOpenPerAccount, driftTasks, alarm };
 }
 async function runTimeEntryCensusOnce(session, now, horizonMs) {
@@ -21458,20 +21597,24 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
     const sumRes = await session.run(
       `MATCH (t:Task) WHERE t.secondsLogged IS NOT NULL
        OPTIONAL MATCH (te:TimeEntry {taskId: t.taskId}) WHERE te.endedAt IS NOT NULL
-       RETURN t.taskId AS taskId, coalesce(t.secondsLogged, 0) AS secondsLogged, coalesce(sum(te.seconds), 0) AS sumEntries`
+       WITH t, coalesce(sum(te.seconds), 0) AS sumEntries
+       OPTIONAL MATCH (ta:TimeAdjustment {taskId: t.taskId})
+       RETURN t.taskId AS taskId, coalesce(t.secondsLogged, 0) AS secondsLogged,
+              sumEntries, coalesce(sum(ta.delta), 0) AS sumAdjustments`
     );
     const taskSums = sumRes.records.map((r) => ({
       taskId: r.get("taskId") ?? "",
       secondsLogged: toNum(r.get("secondsLogged")),
-      sumEntries: toNum(r.get("sumEntries"))
+      sumEntries: toNum(r.get("sumEntries")),
+      sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG39} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG40} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG39} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG40} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -21485,13 +21628,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG39} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG40} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG39} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG40} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -21854,8 +21997,8 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync32 } from "fs";
-import { join as join33 } from "path";
+import { existsSync as existsSync33 } from "fs";
+import { join as join34 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -21884,7 +22027,7 @@ async function writeRaw(path2, obj) {
     await rename3(tmp, path2);
   } catch (err) {
     try {
-      if (existsSync32(tmp)) await unlink3(tmp);
+      if (existsSync33(tmp)) await unlink3(tmp);
     } catch {
     }
     throw err;
@@ -21900,7 +22043,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join33(projectsRoot, slug.name);
+    const slugDir = join34(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -21909,9 +22052,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join33(slugDir, entry.name));
+        out.push(join34(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join33(slugDir, entry.name);
+        const subDir = join34(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -21919,7 +22062,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join33(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join34(subDir, s.name));
         }
       }
     }
@@ -21931,7 +22074,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join33(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join34(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -22276,8 +22419,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app61 = new Hono();
-  app61.get("/wa-channel/inbound", (c) => {
+  const app62 = new Hono();
+  app62.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -22295,7 +22438,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app61.post("/wa-channel/reply", async (c) => {
+  app62.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -22316,7 +22459,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app61.post("/wa-channel/reply-document", async (c) => {
+  app62.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -22355,7 +22498,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app61.post("/wa-channel/ready", async (c) => {
+  app62.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -22364,7 +22507,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app61.post("/wa-channel/received", async (c) => {
+  app62.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -22374,7 +22517,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app61.post("/wa-channel/turn-end", async (c) => {
+  app62.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -22407,7 +22550,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app61;
+  return app62;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -22499,10 +22642,12 @@ var WaGateway = class {
     this.docContexts.set(input.senderId, { accountId: input.accountId, maxyAccountId: input.effectiveAccountId });
     let standingRules;
     if (this.deps.fetchStandingRules) {
-      standingRules = await this.deps.fetchStandingRules(input.effectiveAccountId) || void 0;
-      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      const res = await this.deps.fetchStandingRules(input.effectiveAccountId);
+      standingRules = res.block || void 0;
+      const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
+      const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} capped=${injected >= import_dist5.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist5.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -22748,8 +22893,8 @@ var import_dist6 = __toESM(require_dist(), 1);
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app61 = new Hono();
-  app61.get("/webchat-channel/inbound", (c) => {
+  const app62 = new Hono();
+  app62.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -22767,7 +22912,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app61.post("/webchat-channel/reply", async (c) => {
+  app62.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -22777,7 +22922,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app61.post("/webchat-channel/connector-auth", async (c) => {
+  app62.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -22790,7 +22935,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app61.post("/webchat-channel/ready", async (c) => {
+  app62.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -22799,7 +22944,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app61.post("/webchat-channel/permission-request", async (c) => {
+  app62.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -22813,7 +22958,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app61.post("/webchat-channel/received", async (c) => {
+  app62.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -22823,7 +22968,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app61.post("/webchat-channel/turn-end", async (c) => {
+  app62.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -22846,7 +22991,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app61;
+  return app62;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -23185,10 +23330,12 @@ var WebchatGateway = class _WebchatGateway {
     const willDeliverNow = this.hub.isReady(input.key);
     let standingRules;
     if (input.role === "admin" && this.deps.fetchStandingRules) {
-      standingRules = await this.deps.fetchStandingRules(input.accountId) || void 0;
-      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      const res = await this.deps.fetchStandingRules(input.accountId);
+      standingRules = res.block || void 0;
+      const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
+      const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -23477,7 +23624,7 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG40 = "[whatsapp-adaptor]";
+var TAG41 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot() {
@@ -23495,7 +23642,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG40} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG41} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -23503,7 +23650,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG40,
+    tag: TAG41,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -23538,7 +23685,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG40} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG41} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -23715,8 +23862,8 @@ var import_dist7 = __toESM(require_dist(), 1);
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app61 = new Hono();
-  app61.get("/tg-channel/inbound", (c) => {
+  const app62 = new Hono();
+  app62.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -23734,7 +23881,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app61.post("/tg-channel/reply", async (c) => {
+  app62.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -23750,7 +23897,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app61.post("/tg-channel/ready", async (c) => {
+  app62.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -23759,7 +23906,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app61.post("/tg-channel/received", async (c) => {
+  app62.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -23769,7 +23916,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app61.post("/tg-channel/turn-end", async (c) => {
+  app62.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -23802,7 +23949,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app61;
+  return app62;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -23862,10 +24009,12 @@ var TelegramGateway = class {
     this.replies.set(input.senderId, input.reply);
     let standingRules;
     if (input.role === "admin" && this.deps.fetchStandingRules) {
-      standingRules = await this.deps.fetchStandingRules(input.accountId) || void 0;
-      const injected = standingRules ? (standingRules.match(/^- /gm) ?? []).length : 0;
+      const res = await this.deps.fetchStandingRules(input.accountId);
+      standingRules = res.block || void 0;
+      const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
+      const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -23929,8 +24078,8 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync7 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve30, basename as basename12 } from "path";
-var TAG41 = "[telegram:outbound]";
+import { resolve as resolve30, basename as basename11 } from "path";
+var TAG42 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot3 } = input;
@@ -23946,16 +24095,16 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync7(filePath);
     const accountResolved = realpathSync7(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG41} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG42} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG41} document ENOENT path=${filePath}`);
+      console.error(`${TAG42} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG41} document path error: ${String(err)}`);
+    console.error(`${TAG42} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat7(resolvedPath);
@@ -23966,7 +24115,7 @@ async function sendTelegramDocument(input) {
       error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
     };
   }
-  const filename = basename12(resolvedPath);
+  const filename = basename11(resolvedPath);
   const buffer = Buffer.from(await readFile7(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
@@ -23988,13 +24137,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG41} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG42} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG42 = "[telegram:outbound]";
+var TAG43 = "[telegram:outbound]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -24006,11 +24155,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG42} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG43} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG42} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG43} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -24027,7 +24176,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG42,
+    tag: TAG43,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -24067,17 +24216,17 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve31, join as join34 } from "path";
+import { resolve as resolve31, join as join35 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join34(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
-import { randomUUID as randomUUID14 } from "crypto";
-var TAG43 = "[public-session-review]";
+import { randomUUID as randomUUID15 } from "crypto";
+var TAG44 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -24104,7 +24253,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG43} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG44} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -24128,7 +24277,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG43} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG44} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -24136,7 +24285,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG43} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG44} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -24164,8 +24313,8 @@ function composeInitialMessage(input) {
   ].join("\n");
 }
 async function dispatchReviewer(input, initialMessage) {
-  const sessionId = randomUUID14();
-  console.log(`${TAG43} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  const sessionId = randomUUID15();
+  console.log(`${TAG44} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -24185,21 +24334,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG44} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG44} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG44} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -24213,19 +24362,19 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG44} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG44} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG43} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG44} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
@@ -24334,7 +24483,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync33, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
 import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -24383,7 +24532,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve32(brand.configDir, "entitlement.json");
-  if (!existsSync33(entitlementPath)) {
+  if (!existsSync34(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat8 = statSync13(entitlementPath);
@@ -24573,12 +24722,12 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join35(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join36(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync34(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync35(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync34(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
     const parsed = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
@@ -24612,10 +24761,10 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join35(homedir3(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join36(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync34(ALIAS_DOMAINS_PATH)) return null;
+    if (!existsSync35(ALIAS_DOMAINS_PATH)) return null;
     const parsed = JSON.parse(readFileSync35(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
@@ -24640,18 +24789,18 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app60 = new Hono();
+var app61 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
   const session = getSession();
   try {
-    const rules = await (0, import_dist8.activeRuleSet)(session, accountId);
-    return (0, import_dist8.formatStandingRulesBlock)(rules);
+    const res = await (0, import_dist8.resolveActiveRules)(session, accountId);
+    return { block: (0, import_dist8.formatStandingRulesBlock)(res.rules), ownerUserId: res.ownerUserId, source: res.source };
   } catch (err) {
     console.error(
       `[preference-inject] op=fetch-failed accountId=${accountId} error=${err instanceof Error ? err.message : String(err)}`
     );
-    return "";
+    return { block: "", ownerUserId: null, source: "fetch-error" };
   } finally {
     await session.close();
   }
@@ -24679,7 +24828,7 @@ async function recordPassiveDispatch(input) {
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -24694,7 +24843,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, ".."))
+      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -24775,7 +24924,7 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app60.route("/", waGateway.routes());
+app61.route("/", waGateway.routes());
 waGateway.startSweeper();
 var webchatGateway = new WebchatGateway({
   fetchStandingRules: fetchAccountStandingRules,
@@ -24859,7 +25008,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app60.route("/", webchatGateway.routes());
+app61.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -24893,7 +25042,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app60.route("/", telegramGateway.routes());
+app61.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -24926,19 +25075,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app60.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app60.use("*", clientIpMiddleware);
+app61.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app61.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path2) {
   return path2 === "/vnc-viewer.html" || path2.startsWith("/api/admin/attachment/") || path2.startsWith("/api/public-reader/attachment/") || path2 === "/api/admin/files/download";
 }
-app60.use("*", async (c, next) => {
+app61.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app60.use("*", async (c, next) => {
+app61.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -24956,7 +25105,7 @@ app60.use("*", async (c, next) => {
     });
   }
 });
-app60.use("*", async (c, next) => {
+app61.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -24994,7 +25143,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app60.post("/__remote-auth/login", async (c) => {
+app61.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -25039,7 +25188,7 @@ app60.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app60.get("/__remote-auth/logout", (c) => {
+app61.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -25052,7 +25201,7 @@ app60.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app60.post("/__remote-auth/change-password", async (c) => {
+app61.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -25111,13 +25260,13 @@ app60.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app60.get("/__remote-auth/setup", (c) => {
+app61.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app60.post("/__remote-auth/set-initial-password", async (c) => {
+app61.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -25155,10 +25304,10 @@ app60.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app60.get("/api/remote-auth/status", (c) => {
+app61.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app60.post("/api/remote-auth/set-password", async (c) => {
+app61.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -25197,10 +25346,10 @@ app60.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app60.route("/api/_client-error", client_error_default);
+app61.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app60.use("*", async (c, next) => {
+app61.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -25244,26 +25393,26 @@ app60.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path2 }), 200);
 });
-app60.route("/api/health", health_default);
-app60.route("/api/chat", chatRoutes);
-app60.route("/api/whatsapp", whatsapp_default);
-app60.route("/api/whatsapp-reader", whatsapp_reader_default);
-app60.route("/api/public-reader", public_reader_default);
-app60.route("/api/webchat", createWebchatRoutes({
+app61.route("/api/health", health_default);
+app61.route("/api/chat", chatRoutes);
+app61.route("/api/whatsapp", whatsapp_default);
+app61.route("/api/whatsapp-reader", whatsapp_reader_default);
+app61.route("/api/public-reader", public_reader_default);
+app61.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app60.route("/api/webchat/greeting", webchat_greeting_default);
-app60.route("/api/telegram", telegram_default);
-app60.route("/api/quickbooks", quickbooks_default);
-app60.route("/api/onboarding", onboarding_default);
-app60.route("/api/admin", admin_default);
-app60.route("/api/access", access_default);
-app60.route("/api/session", session_default2);
-app60.route("/api/calendar", calendar_public_default);
+app61.route("/api/webchat/greeting", webchat_greeting_default);
+app61.route("/api/telegram", telegram_default);
+app61.route("/api/quickbooks", quickbooks_default);
+app61.route("/api/onboarding", onboarding_default);
+app61.route("/api/admin", admin_default);
+app61.route("/api/access", access_default);
+app61.route("/api/session", session_default2);
+app61.route("/api/calendar", calendar_public_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -25275,7 +25424,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app60.get("/agent-assets/:slug/:filename", (c) => {
+app61.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -25297,7 +25446,7 @@ app60.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync34(filePath)) {
+  if (!existsSync35(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -25310,7 +25459,7 @@ app60.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app60.get("/generated/:filename", (c) => {
+app61.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -25327,7 +25476,7 @@ app60.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync34(filePath)) {
+  if (!existsSync35(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
@@ -25340,14 +25489,14 @@ app60.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app60.route("/sites", sites_default);
-app60.route("/listings", listings_default);
-app60.route("/v", visitor_event_default);
-app60.route("/v", visitor_consent_default);
+app61.route("/sites", sites_default);
+app61.route("/listings", listings_default);
+app61.route("/v", visitor_event_default);
+app61.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync34(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
     const fullBrand = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
@@ -25376,7 +25525,7 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync34(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync35(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
@@ -25388,8 +25537,8 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join35(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync34(versionFile)) return "unknown";
+    const versionFile = join36(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync35(versionFile)) return "unknown";
     const content = readFileSync35(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
@@ -25448,12 +25597,12 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join35(homedir3(), BRAND.configDir);
+  const configDir2 = join36(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join35(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync34(cachePath)) return null;
+    const cachePath = join36(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync35(cachePath)) return null;
     return JSON.parse(readFileSync35(cachePath, "utf-8"));
   } catch {
     return null;
@@ -25498,7 +25647,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app60.get("/", (c) => {
+app61.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -25520,12 +25669,12 @@ app60.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app60.get("/public", (c) => {
+app61.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app60.get("/public-chat", (c) => {
+app61.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -25544,9 +25693,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app60.use("/vnc-viewer.html", logViewerFetch);
-app60.use("/vnc-popout.html", logViewerFetch);
-app60.get("/vnc-popout.html", (c) => {
+app61.use("/vnc-viewer.html", logViewerFetch);
+app61.use("/vnc-popout.html", logViewerFetch);
+app61.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync35(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -25559,7 +25708,7 @@ app60.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app60.post("/api/vnc/client-event", async (c) => {
+app61.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -25580,11 +25729,11 @@ app60.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app60.get("/g/:slug", (c) => {
+app61.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app60.get(pwa.manifestPath, (c) => {
+  app61.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -25600,7 +25749,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app60.get("/sw.js", (c) => {
+app61.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -25609,12 +25758,12 @@ app60.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app60.get("/graph", (c) => {
+app61.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app60.get("/chat", (c) => {
+app61.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -25623,27 +25772,27 @@ app60.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app60.get("/data", (c) => {
+app61.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app60.get("/tasks", (c) => {
+app61.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app60.get("/calendar", (c) => {
+app61.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app60.get("/browser", (c) => {
+app61.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app60.get("/:slug", async (c, next) => {
+app61.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -25658,13 +25807,13 @@ app60.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app60.get("/favicon.ico", (c) => {
+  app61.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app60.use("/*", serveStatic({ root: "./public" }));
-app60.all("*", (c) => {
+app61.use("/*", serveStatic({ root: "./public" }));
+app61.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -25678,14 +25827,14 @@ app60.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app60.fetch, port, hostname });
+var httpServer = serve({ fetch: app61.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
   const reconcileScript = resolve33(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
-    if (!existsSync34(reconcileScript)) return;
+    if (!existsSync35(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -25704,12 +25853,12 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 startTimeEntryCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
   const auditScript = resolve33(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
-    if (!existsSync34(auditScript)) return;
+    if (!existsSync35(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -25779,7 +25928,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app60.routes ?? []) {
+  for (const r of app61.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -25819,7 +25968,7 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync34(USERS_FILE)) {
+    if (!existsSync35(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
@@ -25852,7 +26001,7 @@ var adminUserReconcileTimer = setInterval(() => {
 if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer.unref();
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync34(USERS_FILE)) return 0;
+  if (!existsSync35(USERS_FILE)) return 0;
   const raw = readFileSync35(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
@@ -25909,7 +26058,7 @@ try {
 } catch (err) {
   console.error(`[graph-health] account-enumeration unavailable reason=${err instanceof Error ? err.message : String(err)}`);
 }
-var configDirForWhatsApp = basename13(MAXY_DIR) || ".maxy";
+var configDirForWhatsApp = basename12(MAXY_DIR) || ".maxy";
 var bootAccount = resolveAccount();
 if (bootAccount) {
   migrateRemovedConfigKeys(bootAccount.accountDir);
@@ -25925,7 +26074,7 @@ var bootEntitlement = bootAccountConfig ? resolveEntitlement(
   }
 ) : null;
 autoDeliverPremiumPlugins();
-reconcileEnabledPlugins(bootAccount?.accountDir, bootAccount?.config, bootAccount?.accountId);
+reconcileEnabledPluginsForAccounts(listValidAccounts());
 for (const acct of listValidAccounts()) {
   cleanupLeakedPremiumSubs(acct.accountDir, acct.config, acct.accountId);
 }
@@ -25973,7 +26122,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, "..")),
+  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {