@rubytech/create-maxy-code 0.1.440 → 0.1.442

package/payload/server/server.js

@@ -1413,7 +1413,7 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync35, existsSync as existsSync35, watchFile } from "fs";
+import { readFileSync as readFileSync36, existsSync as existsSync35, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
 import { resolve as resolve33, join as join36, basename as basename12 } from "path";
@@ -1793,7 +1793,7 @@ async function ensureAuth() {
 }
 
 // server/routes/health.ts
-import { existsSync as existsSync5, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync10 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -3843,7 +3843,7 @@ import {
 // app/lib/attachments.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir, writeFile } from "fs/promises";
-import { realpathSync as realpathSync2, existsSync as existsSync4 } from "fs";
+import { realpathSync as realpathSync2, existsSync as existsSync4, readFileSync as readFileSync8, readdirSync as readdirSync3 } from "fs";
 import { resolve as resolve6, extname } from "path";
 
 // app/lib/data-path.ts
@@ -3926,11 +3926,15 @@ function resolveScratchpadPath(raw, scratchpadRootAbs) {
 import { unzipSync, strFromU8 } from "fflate";
 var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
 var ODT = "application/vnd.oasis.opendocument.text";
+var XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+var ODS = "application/vnd.oasis.opendocument.spreadsheet";
 var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
   DOCX,
   ODT,
   "text/rtf",
-  "application/rtf"
+  "application/rtf",
+  XLSX,
+  ODS
 ]);
 function bareMime(mimeType) {
   return mimeType.split(";")[0].trim().toLowerCase();
@@ -3964,6 +3968,80 @@ function odtToText(buffer) {
   const stripped = withBreaks.replace(/<[^>]+>/g, "");
   return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
 }
+function sheetOrdinal(name) {
+  const m = name.match(/sheet(\d+)\.xml$/);
+  return m ? parseInt(m[1], 10) : 0;
+}
+function xlsxToText(buffer) {
+  const files = unzipSync(new Uint8Array(buffer));
+  const shared = [];
+  const sharedBytes = files["xl/sharedStrings.xml"];
+  if (sharedBytes) {
+    for (const si of strFromU8(sharedBytes).split("</si>")) {
+      if (!si.includes("<si")) continue;
+      const base = si.replace(/<rPh\b[\s\S]*?<\/rPh>/g, "");
+      let s = "";
+      for (const m of base.matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)) s += m[1];
+      shared.push(unescapeXml(s));
+    }
+  }
+  const sheetKeys = Object.keys(files).filter((n) => /^xl\/worksheets\/sheet\d+\.xml$/.test(n)).sort((a, b) => sheetOrdinal(a) - sheetOrdinal(b));
+  const sheets = [];
+  for (const key of sheetKeys) {
+    const xml = strFromU8(files[key]);
+    const rows = [];
+    for (const rowXml of xml.split("</row>")) {
+      if (!rowXml.includes("<row")) continue;
+      const cells = [];
+      for (const c of rowXml.matchAll(/<c\b([^>]*)>([\s\S]*?)<\/c>/g)) {
+        const attrs = c[1];
+        const body = c[2];
+        if (/\bt="inlineStr"/.test(attrs)) {
+          let s = "";
+          for (const m of body.matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)) s += m[1];
+          cells.push(unescapeXml(s));
+          continue;
+        }
+        const v = body.match(/<v\b[^>]*>([\s\S]*?)<\/v>/);
+        if (!v) {
+          cells.push("");
+          continue;
+        }
+        if (/\bt="s"/.test(attrs)) {
+          const idx = parseInt(v[1], 10);
+          cells.push(Number.isInteger(idx) && idx >= 0 && idx < shared.length ? shared[idx] : "");
+        } else {
+          cells.push(unescapeXml(v[1]));
+        }
+      }
+      while (cells.length && cells[cells.length - 1] === "") cells.pop();
+      if (cells.length) rows.push(cells.join("	"));
+    }
+    if (rows.length) sheets.push(rows.join("\n"));
+  }
+  return sheets.join("\n\n");
+}
+function odsToText(buffer) {
+  const xml = unzipEntry(buffer, "content.xml");
+  const tables = [];
+  for (const tableXml of xml.split(/<table:table(?=[\s>])/).slice(1)) {
+    const rows = [];
+    for (const rowXml of tableXml.split(/<table:table-row\b/).slice(1)) {
+      const cells = rowXml.split(/<table:(?:covered-)?table-cell\b/).slice(1).map((frag) => {
+        const withBreaks = frag.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	");
+        let s = "";
+        for (const m of withBreaks.matchAll(/<text:p\b[^>]*>([\s\S]*?)<\/text:p>/g)) {
+          s += (s ? "\n" : "") + m[1].replace(/<[^>]+>/g, "");
+        }
+        return unescapeXml(s);
+      });
+      while (cells.length && cells[cells.length - 1] === "") cells.pop();
+      if (cells.length) rows.push(cells.join("	"));
+    }
+    if (rows.length) tables.push(rows.join("\n"));
+  }
+  return tables.join("\n\n");
+}
 var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
 function stripRtfDestinations(s) {
   let out = "";
@@ -4004,6 +4082,8 @@ function docToText(buffer, mimeType) {
   const mime = bareMime(mimeType);
   if (mime === DOCX) return docxToText(buffer);
   if (mime === ODT) return odtToText(buffer);
+  if (mime === XLSX) return xlsxToText(buffer);
+  if (mime === ODS) return odsToText(buffer);
   if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
   return null;
 }
@@ -4033,6 +4113,21 @@ var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "application/vnd.oasis.opendocument.text",
   "text/rtf",
   "application/rtf",
+  // Task 1607 — spreadsheets + presentations operators send. These land
+  // download-only in the reader; the Read tool cannot parse the binary
+  // containers and agent-readable text extraction for them is task 1608.
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  // xlsx
+  "application/vnd.ms-excel",
+  // xls
+  "application/vnd.oasis.opendocument.spreadsheet",
+  // ods
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  // pptx
+  "application/vnd.ms-powerpoint",
+  // ppt
+  "application/vnd.oasis.opendocument.presentation",
+  // odp
   // Task 1240 — voice recordings persist as playable clips in the admin bubble.
   // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
   "audio/ogg",
@@ -4049,6 +4144,7 @@ var MAX_FILES_PER_MESSAGE = 5;
 var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
 var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
+var ATTACHMENT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function assertSupportedMime(mimeType) {
   const bare = mimeType.split(";")[0].trim().toLowerCase();
   if (!SUPPORTED_MIME_TYPES.has(bare)) {
@@ -4057,22 +4153,47 @@ function assertSupportedMime(mimeType) {
     );
   }
 }
-function isSupportedMime(mimeType) {
-  return SUPPORTED_MIME_TYPES.has(mimeType.split(";")[0].trim().toLowerCase());
+function isInlineSafeMime(mimeType) {
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (bare === "image/svg+xml") return false;
+  return bare.startsWith("image/") || bare === "application/pdf" || bare.startsWith("audio/") || bare === "video/mp4";
 }
 async function storeMediaBuffer(accountId, attachmentId, filename, mimeType, buffer) {
-  assertSupportedMime(mimeType);
   if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
     throw new Error(
       `Media exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId, true);
+  return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId);
 }
 function attachmentExists(accountId, attachmentId) {
   return existsSync4(resolve6(uploadsDirFor(accountId, "", attachmentId), `${attachmentId}.meta.json`));
 }
-async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId, skipDocToText = false) {
+function resolveStoredAttachment(accountId, attachmentId) {
+  if (!ATTACHMENT_ID_RE.test(attachmentId)) return null;
+  const dir = uploadsDirFor(accountId, "", attachmentId);
+  let meta;
+  try {
+    meta = JSON.parse(readFileSync8(resolve6(dir, `${attachmentId}.meta.json`), "utf8"));
+  } catch {
+    return null;
+  }
+  if (!meta || typeof meta !== "object") return null;
+  const { filename, mimeType } = meta;
+  if (typeof filename !== "string" || typeof mimeType !== "string") return null;
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  const dataFile = entries.find((e) => e.isFile() && !e.name.endsWith(".meta.json") && !e.name.endsWith(EXTRACTED_TEXT_SUFFIX));
+  if (!dataFile) return null;
+  const readableSibling = `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`;
+  const readableTextPath = entries.some((e) => e.isFile() && e.name === readableSibling) ? resolve6(dir, readableSibling) : void 0;
+  return { attachmentId, filename, mimeType, path: resolve6(dir, dataFile.name), readableTextPath };
+}
+async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId) {
   const attachmentId = explicitId ?? randomUUID3();
   const dir = uploadsDirFor(accountId, subPath, attachmentId);
   await mkdir(dir, { recursive: true });
@@ -4090,11 +4211,23 @@ async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes
   await writeFile(storagePath, buffer);
   await writeFile(metaPath, JSON.stringify(meta, null, 2));
   let readableTextPath;
-  if (!skipDocToText && CONVERTIBLE_DOC_MIME.has(mimeType.split(";")[0].trim().toLowerCase())) {
-    const text = docToText(buffer, mimeType);
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (CONVERTIBLE_DOC_MIME.has(bare)) {
+    let text = null;
+    try {
+      text = docToText(buffer, mimeType);
+    } catch {
+      text = null;
+    }
+    console.error(`[doc-to-text] op=convert mime=${bare} ok=${text !== null} chars=${text?.length ?? 0}`);
     if (text) {
-      readableTextPath = resolve6(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
-      await writeFile(readableTextPath, text);
+      const siblingPath = resolve6(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
+      try {
+        await writeFile(siblingPath, text);
+        readableTextPath = siblingPath;
+      } catch (err) {
+        console.error(`[doc-to-text] op=sibling-write mime=${bare} ok=false reason=${String(err).slice(0, 80)}`);
+      }
     }
   }
   return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
@@ -4141,6 +4274,13 @@ var MIME_BY_EXT = {
   ".odt": "application/vnd.oasis.opendocument.text",
   ".rtf": "text/rtf",
   ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  // Task 1607 — legacy + OpenDocument office extensions, so a device-stored file
+  // attached to a WhatsApp reply (detectMimeType → isMimeAdmitted, whatsapp-reader.ts)
+  // resolves to the mime now admitted in SUPPORTED_MIME_TYPES rather than octet-stream.
+  ".xls": "application/vnd.ms-excel",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
   ".ics": "text/calendar"
 };
 function detectMimeType(filePath) {
@@ -4978,20 +5118,6 @@ function attachSelfIdRefreshOnCredsUpdate(conn) {
 function reloadConfig(accountConfig) {
   loadConfig(accountConfig);
 }
-function getMessages(accountId, jid, limit) {
-  const entries = messageStore.get(messageStoreKey(accountId, jid)) ?? [];
-  return limit ? entries.slice(-limit) : entries.slice();
-}
-function listConversationJids(accountId) {
-  const prefix = messageStoreKey(accountId, "");
-  const jids = [];
-  for (const key of messageStore.keys()) {
-    if (key.startsWith(prefix)) {
-      jids.push(key.slice(prefix.length));
-    }
-  }
-  return jids;
-}
 function listStoreAccountKeys() {
   const accounts = /* @__PURE__ */ new Set();
   for (const key of messageStore.keys()) {
@@ -5205,7 +5331,7 @@ function monitorInbound(conn) {
         if (!msg.message) continue;
         let receiptDeferredToWorker = false;
         const extracted = extractMessage(msg);
-        const mediaServable = !!(extracted.mediaType && extracted.mimetype && isSupportedMime(extracted.mimetype));
+        const mediaServable = !!(extracted.mediaType && extracted.mimetype);
         if (extracted.text || mediaServable) {
           const isGroup = isGroupJid(remoteJid);
           const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
@@ -5602,7 +5728,7 @@ async function handleInboundMessage(conn, msg) {
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve7 } from "path";
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve7(process.cwd(), "..");
 var VNC_SCRIPT = resolve7(PLATFORM_ROOT4, "scripts/vnc.sh");
@@ -5660,7 +5786,7 @@ function discoverNativeDisplay() {
       const leaderPid = leaderResult.stdout?.trim();
       if (leaderPid) {
         try {
-          const environ = readFileSync8(`/proc/${leaderPid}/environ`, "utf8");
+          const environ = readFileSync9(`/proc/${leaderPid}/environ`, "utf8");
           const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
           if (match) waylandDisplay = match.split("=")[1];
         } catch {
@@ -5928,7 +6054,7 @@ app.get("/", async (c) => {
   let pinConfigured = false;
   try {
     if (existsSync5(USERS_FILE)) {
-      const raw = readFileSync9(USERS_FILE, "utf-8").trim();
+      const raw = readFileSync10(USERS_FILE, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -6600,13 +6726,13 @@ async function sendTelegramText(botToken, chatId, text) {
 
 // server/routes/whatsapp.ts
 import { join as join10, resolve as resolve10 } from "path";
-import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync7 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync12, existsSync as existsSync7 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
 import { resolve as resolve8, join as join8, dirname as dirname2, basename as basename2 } from "path";
 var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
@@ -6615,7 +6741,7 @@ function configPath(accountDir) {
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
   if (!existsSync6(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync10(path2, "utf-8"));
+  return JSON.parse(readFileSync11(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
   const path2 = configPath(accountDir);
@@ -7536,13 +7662,13 @@ function serializeWhatsAppSchema() {
 }
 
 // app/lib/whatsapp/status-reconcile.ts
-import { readdirSync as readdirSync3 } from "fs";
+import { readdirSync as readdirSync4 } from "fs";
 import { join as join9 } from "path";
 var TAG20 = "[whatsapp:reconcile]";
 var HALF_REGISTERED_MIN_AGE_MS = 5 * 6e4;
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync3(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join9(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync4(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join9(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -7689,6 +7815,15 @@ function authorizeRecallRead(input) {
 // server/routes/whatsapp.ts
 var TAG21 = "[whatsapp:api]";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
+function recallAttachment(storeAccountId, attachmentId) {
+  if (!attachmentId) return void 0;
+  const a = resolveStoredAttachment(storeAccountId, attachmentId);
+  if (!a) {
+    console.error(`[whatsapp-read-tool] op=attachment-miss attachmentId=${attachmentId.slice(0, 8)} storeAccount=${storeAccountId}`);
+    return void 0;
+  }
+  return a;
+}
 function projectionFor(requestedAccountId) {
   const validAccounts = listValidAccounts();
   if (validAccounts.length <= 1) return { storeAccountId: requestedAccountId, managerPhones: null };
@@ -7880,13 +8015,13 @@ app2.post("/config", async (c) => {
         const agents = [];
         if (existsSync7(agentsDir)) {
           try {
-            const entries = readdirSync4(agentsDir, { withFileTypes: true });
+            const entries = readdirSync5(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
               const configPath2 = resolve10(agentsDir, entry.name, "config.json");
               if (!existsSync7(configPath2)) continue;
               try {
-                const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
                 console.error(`${TAG21} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -8031,20 +8166,23 @@ app2.get("/conversations", (c) => {
     const requestedAccountId = validateAccountId(c.req.query("accountId") ?? null);
     const denial = callerScopeDenial(c, requestedAccountId);
     if (denial) return denial;
-    const accountId = resolveReadStoreKey(requestedAccountId);
-    const jids = listConversationJids(accountId);
-    const conversations = jids.map((jid) => {
-      const messages = getMessages(accountId, jid);
-      const lastMessage = messages.length > 0 ? messages[messages.length - 1] : null;
+    const projection = projectionFor(requestedAccountId);
+    const storeAccountId = resolveReadStoreKey(projection.storeAccountId);
+    const projecting = projection.managerPhones != null;
+    const managerPhonesBound = projection.managerPhones?.length ?? 0;
+    const allConversations = readAllConversations(storeAccountId);
+    const scoped = projection.managerPhones ? filterConversationsForSubAccount(allConversations, projection.managerPhones) : allConversations;
+    const conversations = [...scoped.entries()].map(([jid, messages]) => {
+      const last = messages.length > 0 ? messages[messages.length - 1] : null;
       return {
         jid,
         type: isGroupJid(jid) ? "group" : "dm",
-        lastMessageTimestamp: lastMessage?.timestamp ?? null,
+        lastMessageTimestamp: last ? Math.floor(Date.parse(last.dateSent) / 1e3) : null,
         messageCount: messages.length
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG21} conversations requested=${requestedAccountId} account=${accountId} storeKeyFound=${jids.length > 0} count=${conversations.length}`);
+    console.error(`${TAG21} conversations requested=${requestedAccountId} account=${storeAccountId} projected=${projecting} storeAccount=${projecting ? storeAccountId : "self"} managerPhonesBound=${managerPhonesBound} storeKeyFound=${allConversations.size > 0} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
     console.error(`${TAG21} conversations error: ${String(err)}`);
@@ -8056,7 +8194,6 @@ app2.get("/messages", (c) => {
     const requestedAccountId = validateAccountId(c.req.query("accountId") ?? null);
     const denial = callerScopeDenial(c, requestedAccountId);
     if (denial) return denial;
-    const accountId = resolveReadStoreKey(requestedAccountId);
     const jid = c.req.query("jid");
     if (!jid) {
       return c.json({ error: "Missing required parameter: jid" }, 400);
@@ -8064,9 +8201,33 @@ app2.get("/messages", (c) => {
     const limitParam = c.req.query("limit");
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
-    const messages = getMessages(accountId, jid, effectiveLimit);
-    const storeKeyFound = listConversationJids(accountId).length > 0;
-    console.error(`${TAG21} messages requested=${requestedAccountId} account=${accountId} jid=${jid} storeKeyFound=${storeKeyFound} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    const projection = projectionFor(requestedAccountId);
+    const storeAccountId = resolveReadStoreKey(projection.storeAccountId);
+    const projecting = projection.managerPhones != null;
+    const managerPhonesBound = projection.managerPhones?.length ?? 0;
+    const storeMessages = readConversation(storeAccountId, jid);
+    const counterpartyBound = !projecting || counterpartyBoundToSubAccount(
+      projection.managerPhones,
+      conversationCounterpartyPhone(jid, storeMessages[0]?.senderTelephone ?? "")
+    );
+    const bounded = counterpartyBound ? storeMessages : [];
+    const limited = effectiveLimit ? bounded.slice(-effectiveLimit) : bounded;
+    let withAttachments = 0;
+    const messages = limited.map((m) => {
+      const attachment = recallAttachment(storeAccountId, m.attachmentId);
+      if (attachment) withAttachments += 1;
+      return {
+        id: m.messageId,
+        sender: m.senderTelephone,
+        senderName: m.senderName ?? void 0,
+        body: m.body,
+        timestamp: Math.floor(Date.parse(m.dateSent) / 1e3),
+        fromMe: m.fromMe,
+        quoted: m.quotedId ? { id: m.quotedId, sender: m.quotedSender ?? void 0 } : void 0,
+        attachment
+      };
+    });
+    console.error(`${TAG21} messages requested=${requestedAccountId} account=${storeAccountId} jid=${jid} projected=${projecting} storeAccount=${projecting ? storeAccountId : "self"} managerPhonesBound=${managerPhonesBound} storeKeyFound=${storeMessages.length > 0} limit=${effectiveLimit ?? "all"} returned=${messages.length} withAttachments=${withAttachments}`);
     return c.json({ messages });
   } catch (err) {
     console.error(`${TAG21} messages error: ${String(err)}`);
@@ -8090,6 +8251,7 @@ app2.get("/conversation-graph-state", async (c) => {
       const rows2 = [];
       const nameCache = /* @__PURE__ */ new Map();
       let unresolvedSenders = 0;
+      let withAttachments2 = 0;
       let session = null;
       try {
         session = getSession();
@@ -8105,6 +8267,8 @@ app2.get("/conversation-graph-state", async (c) => {
               nameCache.set(m.senderTelephone, resolved);
               if (!resolved) unresolvedSenders += 1;
             }
+            const attachment = recallAttachment(projection2.storeAccountId, m.attachmentId);
+            if (attachment) withAttachments2 += 1;
             rows2.push({
               remoteJid: remoteJid2,
               messageId: m.messageId,
@@ -8112,7 +8276,8 @@ app2.get("/conversation-graph-state", async (c) => {
               fromMe: m.fromMe,
               senderTelephone: m.senderTelephone,
               senderName: nameCache.get(m.senderTelephone) ?? m.senderName,
-              body: m.body
+              body: m.body,
+              attachment
             });
           }
         }
@@ -8120,7 +8285,7 @@ app2.get("/conversation-graph-state", async (c) => {
         if (session) await session.close();
       }
       const ms2 = Date.now() - t0;
-      console.error(`[whatsapp-read-tool] op=query scope=${requestedAccountId} storeAccount=${projection2.storeAccountId} managerPhonesBound=${managerPhonesBound} resultCount=${rows2.length} unresolvedSenders=${unresolvedSenders} ms=${ms2}`);
+      console.error(`[whatsapp-read-tool] op=query scope=${requestedAccountId} storeAccount=${projection2.storeAccountId} managerPhonesBound=${managerPhonesBound} resultCount=${rows2.length} unresolvedSenders=${unresolvedSenders} withAttachments=${withAttachments2} ms=${ms2}`);
       return c.json({ accountId: requestedAccountId, rows: rows2, unresolvedSenders, ms: ms2, managerPhonesBound });
     }
     let remoteJid;
@@ -8144,15 +8309,21 @@ app2.get("/conversation-graph-state", async (c) => {
     );
     const messages = counterpartyBound ? storeMessages : [];
     const sessionId = messages[0]?.sessionId ?? null;
-    const rows = messages.map((m) => ({
-      messageId: m.messageId,
-      dateSent: m.dateSent,
-      fromMe: m.fromMe,
-      senderTelephone: m.senderTelephone,
-      body: m.body
-    }));
+    let withAttachments = 0;
+    const rows = messages.map((m) => {
+      const attachment = recallAttachment(projection.storeAccountId, m.attachmentId);
+      if (attachment) withAttachments += 1;
+      return {
+        messageId: m.messageId,
+        dateSent: m.dateSent,
+        fromMe: m.fromMe,
+        senderTelephone: m.senderTelephone,
+        body: m.body,
+        attachment
+      };
+    });
     const ms = Date.now() - t0;
-    console.error(`[whatsapp-read-tool] op=query mode=single scope=${accountId} storeAccount=${projection.storeAccountId} graphRows=${rows.length} sessionId=${sessionId ?? "null"} ms=${ms}`);
+    console.error(`[whatsapp-read-tool] op=query mode=single scope=${accountId} storeAccount=${projection.storeAccountId} graphRows=${rows.length} sessionId=${sessionId ?? "null"} withAttachments=${withAttachments} ms=${ms}`);
     return c.json({
       cacheKey,
       sessionId,
@@ -8201,15 +8372,15 @@ app2.get("/group-info", async (c) => {
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync10, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
+import { readFileSync as readFileSync16, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync10, readdirSync as readdirSync10, realpathSync as realpathSync4 } from "fs";
 import { basename as basename4, dirname as dirname4, isAbsolute, join as join15, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync4 } from "fs";
+import { readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync4 } from "fs";
 import { dirname as dirname3, join as join13, resolve as resolve11 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync6 } from "fs";
 import { homedir } from "os";
 import { join as join11 } from "path";
 function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
@@ -8217,7 +8388,7 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   if (!existsSync8(projectsRoot)) return null;
   let slugs;
   try {
-    slugs = readdirSync5(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync6(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
@@ -8233,14 +8404,14 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync3 } from "fs";
 import { join as join12 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
   if (!existsSync9(usersFilePath)) return null;
-  const raw = readFileSync12(usersFilePath, "utf-8").trim();
+  const raw = readFileSync13(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -8273,6 +8444,7 @@ function pickOwnerUserId(admins) {
 function resolveOwnerUserId(accountId) {
   try {
     const account = listValidAccounts().find((a) => a.accountId === accountId);
+    if (account?.config.role === "client") return null;
     return pickOwnerUserId(account?.config.admins ?? []);
   } catch {
     return null;
@@ -8283,6 +8455,7 @@ function resolveAdminUserId(params) {
     const users = readUsersFile(USERS_FILE);
     if (!users) return null;
     const account = listValidAccounts().find((a) => a.accountId === params.accountId);
+    if (account?.config.role === "client") return null;
     const admins = account?.config.admins ?? [];
     const direct = pickAdminUserId(users, admins, params.senderPhone);
     if (direct) return direct;
@@ -8357,7 +8530,7 @@ function enumerateJsonls(projectsRoot) {
   const out = [];
   let slugs;
   try {
-    slugs = readdirSync7(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync8(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (err) {
     if (err.code === "ENOENT") return out;
     throw err;
@@ -8366,7 +8539,7 @@ function enumerateJsonls(projectsRoot) {
     const slugDir = join13(projectsRoot, slug);
     let entries;
     try {
-      entries = readdirSync7(slugDir, { withFileTypes: true });
+      entries = readdirSync8(slugDir, { withFileTypes: true });
     } catch (err) {
       const code = err.code ?? "unknown";
       console.error(`[admin-sessions-list] slug-skipped slug=${slug} code=${code}`);
@@ -8379,7 +8552,7 @@ function enumerateJsonls(projectsRoot) {
         const subDir = join13(slugDir, entry.name);
         let subEntries;
         try {
-          subEntries = readdirSync7(subDir, { withFileTypes: true });
+          subEntries = readdirSync8(subDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] subagents-skipped slug=${slug} code=${code}`);
@@ -8394,7 +8567,7 @@ function enumerateJsonls(projectsRoot) {
         const archiveDir = join13(slugDir, entry.name);
         let archiveEntries;
         try {
-          archiveEntries = readdirSync7(archiveDir, { withFileTypes: true });
+          archiveEntries = readdirSync8(archiveDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] archive-skipped slug=${slug} code=${code}`);
@@ -8438,7 +8611,7 @@ function loadUserTitles(accountDir) {
   const path2 = join13(accountDir, "session-titles.json");
   let raw;
   try {
-    raw = readFileSync13(path2, "utf8");
+    raw = readFileSync14(path2, "utf8");
   } catch {
     return out;
   }
@@ -8464,7 +8637,7 @@ function readSidecarMeta(metaPath) {
   const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null, accountId: null };
   let raw;
   try {
-    raw = readFileSync13(metaPath, "utf8");
+    raw = readFileSync14(metaPath, "utf8");
   } catch {
     return empty;
   }
@@ -8606,7 +8779,7 @@ app3.get("/", requireAdminSession, async (c) => {
     let body;
     let mtimeMs;
     try {
-      body = readFileSync13(path2, "utf8");
+      body = readFileSync14(path2, "utf8");
       mtimeMs = statSync4(path2).mtimeMs;
     } catch {
       continue;
@@ -8966,7 +9139,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync8 } from "fs";
+import { readFileSync as readFileSync15, readdirSync as readdirSync9 } from "fs";
 import { join as join14 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
@@ -8988,7 +9161,7 @@ function adminAttachmentsFromText(text, uploadsBase) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync14(join14(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync15(join14(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -9011,7 +9184,7 @@ function readAttachmentMeta(dir) {
 function listSessionAttachmentsInDir(dir) {
   let entries;
   try {
-    entries = readdirSync8(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync9(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
@@ -9058,7 +9231,7 @@ function pickActivity(entries, grown, nowMs, concurrencyWindowMs) {
 }
 
 // app/admin-types.ts
-var ACCEPT_MIME = "image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain,text/markdown,text/csv,text/html,text/calendar,application/zip,application/x-zip-compressed,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.oasis.opendocument.text,text/rtf,application/rtf,audio/ogg,audio/opus,audio/mp4,audio/x-m4a,audio/mpeg,audio/webm,audio/wav,video/mp4,.docx,.odt,.rtf,.opus,.ogg,.m4a,.mp4,.mp3,.wav,.webm";
+var ACCEPT_MIME = "image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain,text/markdown,text/csv,text/html,text/calendar,application/zip,application/x-zip-compressed,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.oasis.opendocument.text,text/rtf,application/rtf,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.ms-excel,application/vnd.oasis.opendocument.spreadsheet,application/vnd.openxmlformats-officedocument.presentationml.presentation,application/vnd.ms-powerpoint,application/vnd.oasis.opendocument.presentation,audio/ogg,audio/opus,audio/mp4,audio/x-m4a,audio/mpeg,audio/webm,audio/wav,video/mp4,.docx,.odt,.rtf,.xlsx,.xls,.ods,.pptx,.ppt,.odp,.opus,.ogg,.m4a,.mp4,.mp3,.wav,.webm";
 var SUPPORTED_MIME_SET = new Set(ACCEPT_MIME.split(",").filter((t) => !t.startsWith(".")));
 var MAX_ATTACHMENTS = 5;
 var MAX_FILE_BYTES = 50 * 1024 * 1024;
@@ -9097,7 +9270,7 @@ app4.get("/conversations", requireAdminSession, async (c) => {
     }
     let body = "";
     try {
-      body = readFileSync15(path2, "utf8");
+      body = readFileSync16(path2, "utf8");
     } catch {
     }
     const { title } = resolveTitle(body, sessionId, userTitles);
@@ -9266,7 +9439,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync15(join15(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync16(join15(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -9289,7 +9462,7 @@ function runActivityTick(c) {
   c.parentGrewThisTick = false;
   let names = [];
   try {
-    names = readdirSync9(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
+    names = readdirSync10(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
   } catch {
   }
   const entries = [];
@@ -9484,7 +9657,7 @@ app4.get("/directives", requireAdminSession, (c) => {
   if (!dir || !existsSync10(dir)) return c.json({ entries: [] });
   let names;
   try {
-    names = readdirSync9(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
+    names = readdirSync10(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
   } catch {
     return c.json({ entries: [] });
   }
@@ -9513,7 +9686,7 @@ app4.get("/directive", requireAdminSession, (c) => {
   if (!path2.startsWith(dir + sep3)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
-    body = readFileSync15(path2, "utf8");
+    body = readFileSync16(path2, "utf8");
   } catch {
     return c.json({ error: "not found" }, 404);
   }
@@ -9870,7 +10043,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
     }
     for (let i = 0; i < resolvedRefs.length; i++) {
       const { absolute, mime } = resolvedRefs[i];
-      const file = new File([readFileSync15(absolute)], basename4(absolute), { type: mime });
+      const file = new File([readFileSync16(absolute)], basename4(absolute), { type: mime });
       const out = await sendStagedFile(file, `ref=${i}`);
       if (!out.ok) {
         exit("error");
@@ -9889,7 +10062,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
-import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync10 } from "fs";
+import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync17, readdirSync as readdirSync11 } from "fs";
 import { basename as basename5, dirname as dirname5, join as join16, resolve as resolve13, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
@@ -10123,7 +10296,7 @@ data: ${JSON.stringify(turn)}
   });
 });
 var ATT_TAG = "[public-attachment]";
-var ATTACHMENT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 app5.get("/attachment/:attachmentId", (c) => {
   const visitor = resolveVisitor(c);
   const attachmentId = c.req.param("attachmentId");
@@ -10135,7 +10308,7 @@ app5.get("/attachment/:attachmentId", (c) => {
     return new Response("Unauthorized", { status: 401 });
   }
   console.log(`${ATT_TAG} op=request session=${ses} att=${at}`);
-  if (!ATTACHMENT_ID_RE.test(attachmentId) || !SESSION_ID_RE2.test(sessionId)) {
+  if (!ATTACHMENT_ID_RE2.test(attachmentId) || !SESSION_ID_RE2.test(sessionId)) {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=bad-id`);
     return new Response("Not found", { status: 404 });
   }
@@ -10164,19 +10337,22 @@ app5.get("/attachment/:attachmentId", (c) => {
   let dataFile;
   let buffer;
   try {
-    dataFile = readdirSync10(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
+    dataFile = readdirSync11(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
     if (!dataFile) throw new Error("no data file");
-    buffer = readFileSync16(resolve13(dir, dataFile));
+    buffer = readFileSync17(resolve13(dir, dataFile));
   } catch {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
     return new Response("Not found", { status: 404 });
   }
-  console.log(`${ATT_TAG} op=served session=${ses} att=${at} bytes=${buffer.length} mime=${meta.mimeType}`);
+  const inlineSafe = isInlineSafeMime(meta.mimeType);
+  const disposition = inlineSafe ? "inline" : "attachment";
+  console.log(`${ATT_TAG} op=served session=${ses} att=${at} bytes=${buffer.length} mime=${meta.mimeType} disposition=${disposition}${inlineSafe ? "" : " reason=non-preview-mime"}`);
   const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": meta.mimeType,
-      "Content-Disposition": `inline; filename="${safeName}"`,
+      "Content-Disposition": `${disposition}; filename="${safeName}"`,
+      "X-Content-Type-Options": "nosniff",
       "Cache-Control": "private, max-age=3600"
     }
   });
@@ -10186,10 +10362,10 @@ var public_reader_default = app5;
 // server/routes/webchat.ts
 import { basename as basename6, dirname as dirname6 } from "path";
 import { join as join19 } from "path";
-import { existsSync as existsSync12, readdirSync as readdirSync12, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync12, readdirSync as readdirSync13, readFileSync as readFileSync20, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync5, renameSync as renameSync2 } from "fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync5, renameSync as renameSync2 } from "fs";
 import { join as join17 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -10198,7 +10374,7 @@ function canonicalOverridePath(accountDir) {
 }
 function readRaw(accountDir) {
   try {
-    return JSON.parse(readFileSync17(canonicalOverridePath(accountDir), "utf8"));
+    return JSON.parse(readFileSync18(canonicalOverridePath(accountDir), "utf8"));
   } catch {
     return null;
   }
@@ -10273,7 +10449,7 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync11, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync12, readFileSync as readFileSync19, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join18 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -10303,7 +10479,7 @@ function createSidecarStore(config) {
   function readFileAt(path2) {
     let raw;
     try {
-      raw = readFileSync18(path2, "utf8");
+      raw = readFileSync19(path2, "utf8");
     } catch {
       return null;
     }
@@ -10319,7 +10495,7 @@ function createSidecarStore(config) {
   function readAll(sessionsDir, onSkip) {
     let names;
     try {
-      names = readdirSync11(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+      names = readdirSync12(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
     } catch {
       return [];
     }
@@ -10329,7 +10505,7 @@ function createSidecarStore(config) {
       const path2 = join18(sessionsDir, name);
       let raw;
       try {
-        raw = readFileSync18(path2, "utf8");
+        raw = readFileSync19(path2, "utf8");
       } catch {
         onSkip?.(name, "unreadable");
         continue;
@@ -10412,7 +10588,7 @@ function locateSidecar(sessionId) {
   const projectsRoot = join19(cfg, "projects");
   let slugs;
   try {
-    slugs = readdirSync12(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync13(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
@@ -10895,7 +11071,7 @@ ${note}` : note;
     }
     const accountJsonPath = join19(account.accountDir, "account.json");
     try {
-      const parsed = JSON.parse(readFileSync19(accountJsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync20(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
       else if (op === "effort") parsed.effort = value;
       else parsed.adminPermissionMode = value;
@@ -11013,7 +11189,7 @@ ${note}` : note;
 import { resolve as resolve14 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync13, readFileSync as readFileSync20, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync21, readdirSync as readdirSync14 } from "fs";
 import { join as join20 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
@@ -11026,14 +11202,14 @@ function field(fm, name) {
 }
 function readSpecialistRoster(specialistsDir) {
   if (!existsSync13(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync13(specialistsDir);
+  const entries = readdirSync14(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync20(join20(specialistsDir, file), "utf-8");
+      raw = readFileSync21(join20(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -11151,7 +11327,7 @@ var webchat_greeting_default = app6;
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
 import { resolve as resolve15, join as join21 } from "path";
-import { existsSync as existsSync14, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync22 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
@@ -11213,7 +11389,7 @@ function configDirName() {
   const brandPath = join21(platformRoot3, "config", "brand.json");
   if (existsSync14(brandPath)) {
     try {
-      return JSON.parse(readFileSync21(brandPath, "utf-8")).configDir ?? ".maxy";
+      return JSON.parse(readFileSync22(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
     }
   }
@@ -11236,7 +11412,7 @@ app7.post("/", async (c) => {
     console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
-  const expected = readFileSync21(sp, "utf-8").trim();
+  const expected = readFileSync22(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
     console.error(`${TAG23} op=reject reason=bad-secret botType=${botType}`);
@@ -11300,7 +11476,7 @@ var telegram_default = app7;
 
 // server/routes/quickbooks.ts
 import { join as join22 } from "path";
-import { existsSync as existsSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync23, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
 var TAG24 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
@@ -11327,7 +11503,7 @@ async function completeConsent(args) {
   try {
     let pending;
     try {
-      pending = JSON.parse(readFileSync22(claimFile, "utf-8"));
+      pending = JSON.parse(readFileSync23(claimFile, "utf-8"));
     } catch {
       console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization state could not be read.", stateValid: false };
@@ -11343,7 +11519,7 @@ async function completeConsent(args) {
     if (!existsSync15(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
-    const store2 = JSON.parse(readFileSync22(storePath(accountDir), "utf-8"));
+    const store2 = JSON.parse(readFileSync23(storePath(accountDir), "utf-8"));
     const form = new URLSearchParams({
       grant_type: "authorization_code",
       code,
@@ -11377,7 +11553,7 @@ async function completeConsent(args) {
     };
     mkdirSync4(join22(accountDir, "secrets"), { recursive: true });
     writeFileSync8(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
-    const persisted = JSON.parse(readFileSync22(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
+    const persisted = JSON.parse(readFileSync23(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=${persisted}`);
     return { ok: persisted, status: persisted ? 200 : 500, message: persisted ? `Connected company ${realmId}.` : "Failed to persist the connection.", stateValid: true };
   } finally {
@@ -11408,7 +11584,7 @@ var quickbooks_default = app8;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync3 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync17, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync17, readFileSync as readFileSync25, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
@@ -11546,7 +11722,7 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync16, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync14, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync24, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync15, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
 import { dirname as dirname7, join as join23 } from "path";
 function id8(value) {
   return value.slice(0, 8);
@@ -11589,7 +11765,7 @@ function writeAdminEntry(input) {
   try {
     let users = [];
     if (existsSync16(input.usersFile)) {
-      const raw = readFileSync23(input.usersFile, "utf-8").trim();
+      const raw = readFileSync24(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -11624,7 +11800,7 @@ function writeAdminEntry(input) {
     if (!existsSync16(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync24(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -11646,7 +11822,7 @@ function computeAdminStoreDivergence(input) {
   const usersUserIds = /* @__PURE__ */ new Set();
   if (existsSync16(input.usersFile)) {
     try {
-      const raw = readFileSync23(input.usersFile, "utf-8").trim();
+      const raw = readFileSync24(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -11661,7 +11837,7 @@ function computeAdminStoreDivergence(input) {
   if (existsSync16(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync14(input.accountsDir);
+      entries = readdirSync15(input.accountsDir);
     } catch (err) {
       result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
@@ -11678,7 +11854,7 @@ function computeAdminStoreDivergence(input) {
       if (!existsSync16(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync24(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         result.errors.push({ source: accountJsonPath, detail: err instanceof Error ? err.message : String(err) });
@@ -11727,7 +11903,7 @@ function hashPin2(pin) {
 }
 function readUsersFile2() {
   if (!existsSync17(USERS_FILE)) return null;
-  const raw = readFileSync24(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync25(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -11937,7 +12113,7 @@ app9.post("/set-pin", async (c) => {
     let installOwner = null;
     if (existsSync17(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync25(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -12085,7 +12261,7 @@ app9.put("/set-pin", requireAdminSession, async (c) => {
     let installOwner = null;
     if (existsSync17(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync25(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -12487,7 +12663,7 @@ app12.get("/", requireAdminSession, async (c) => {
 var accounts_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync20, readdirSync as readdirSync15, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { existsSync as existsSync20, readdirSync as readdirSync16, readFileSync as readFileSync26, statSync as statSync10 } from "fs";
 import { resolve as resolve16, basename as basename7 } from "path";
 
 // app/lib/logs-read-resolve.ts
@@ -12526,7 +12702,7 @@ app13.get("/", async (c) => {
       const filePath = resolve16(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync25(filePath);
+        const buffer = readFileSync26(filePath);
         const onDiskBytes = statSync10(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -12591,7 +12767,7 @@ app13.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename7(hit.path);
-        const buffer = readFileSync25(hit.path);
+        const buffer = readFileSync26(hit.path);
         const onDiskBytes = statSync10(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -12629,7 +12805,7 @@ app13.get("/", async (c) => {
     if (!existsSync20(dir)) continue;
     let files;
     try {
-      files = readdirSync15(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync16(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
@@ -12638,7 +12814,7 @@ app13.get("/", async (c) => {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync10(resolve16(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync25(resolve16(dir, name));
+        const content = readFileSync26(resolve16(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -12681,7 +12857,7 @@ import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync21 } from "fs";
 import { resolve as resolve17 } from "path";
 var app15 = new Hono();
-var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var ATTACHMENT_ID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function uploadsDirFor2(accountId, attachmentId) {
   return resolve17(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
 }
@@ -12695,7 +12871,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
     console.log(`[admin-attachment] op=miss attachmentId=${shortId2} session=${shortSession} status=401 reason=no-account`);
     return new Response("Unauthorized", { status: 401 });
   }
-  if (!ATTACHMENT_ID_RE2.test(attachmentId)) {
+  if (!ATTACHMENT_ID_RE3.test(attachmentId)) {
     console.log(`[admin-attachment] op=miss attachmentId=${shortId2} session=${shortSession} status=404 reason=bad-id`);
     return new Response("Not found", { status: 404 });
   }
@@ -12737,10 +12913,16 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   const filePath = resolve17(dir, dataFile);
   const buffer = await readFile2(filePath);
+  const inlineSafe = isInlineSafeMime(meta.mimeType);
+  const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
+  if (!inlineSafe) {
+    console.log(`[admin-attachment] op=served attachmentId=${shortId2} disposition=attachment reason=non-preview-mime mime=${meta.mimeType}`);
+  }
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": meta.mimeType,
-      "Content-Disposition": `inline; filename="${meta.filename}"`,
+      "Content-Disposition": `${inlineSafe ? "inline" : "attachment"}; filename="${safeName}"`,
+      "X-Content-Type-Options": "nosniff",
       "Cache-Control": "private, max-age=3600"
     }
   });
@@ -12749,7 +12931,7 @@ var attachment_default = app15;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve18 } from "path";
-import { readdirSync as readdirSync16, readFileSync as readFileSync26, existsSync as existsSync22, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync17, readFileSync as readFileSync27, existsSync as existsSync22, rmSync as rmSync2 } from "fs";
 var app16 = new Hono();
 app16.get("/", (c) => {
   const account = resolveAccount();
@@ -12758,14 +12940,14 @@ app16.get("/", (c) => {
   if (!existsSync22(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync16(agentsDir, { withFileTypes: true });
+    const entries = readdirSync17(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve18(agentsDir, entry.name, "config.json");
       if (!existsSync22(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync26(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync27(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -13524,7 +13706,7 @@ app17.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync24, readFileSync as readFileSync27, readdirSync as readdirSync17, statSync as statSync11 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync28, readdirSync as readdirSync18, statSync as statSync11 } from "fs";
 import { dirname as dirname9, resolve as resolve19, join as join27 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -13573,7 +13755,7 @@ function extractPluginToolDescriptions(pluginDir) {
   for (const path2 of candidates) {
     if (!existsSync24(path2)) continue;
     try {
-      raw = readFileSync27(path2, "utf-8");
+      raw = readFileSync28(path2, "utf-8");
       break;
     } catch {
     }
@@ -13624,7 +13806,7 @@ function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve19(PLATFORM_ROOT, "plugins");
   if (existsSync24(platformPlugins)) {
-    for (const name of readdirSync17(platformPlugins)) {
+    for (const name of readdirSync18(platformPlugins)) {
       const dir = join27(platformPlugins, name);
       try {
         if (statSync11(dir).isDirectory()) out.set(name, dir);
@@ -13634,11 +13816,11 @@ function listPluginDirs() {
   }
   const premiumRoot = resolve19(dirname9(PLATFORM_ROOT), "premium-plugins");
   if (existsSync24(premiumRoot)) {
-    for (const bundle of readdirSync17(premiumRoot)) {
+    for (const bundle of readdirSync18(premiumRoot)) {
       const bundlePlugins = join27(premiumRoot, bundle, "plugins");
       if (!existsSync24(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync17(bundlePlugins)) {
+        for (const name of readdirSync18(bundlePlugins)) {
           const dir = join27(bundlePlugins, name);
           try {
             if (statSync11(dir).isDirectory()) out.set(name, dir);
@@ -13655,7 +13837,7 @@ function readEnabledPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync24(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync27(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync28(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -13667,7 +13849,7 @@ function readFrontmatter(path2) {
   if (!existsSync24(path2)) return null;
   let raw;
   try {
-    raw = readFileSync27(path2, "utf-8");
+    raw = readFileSync28(path2, "utf-8");
   } catch {
     return null;
   }
@@ -13729,7 +13911,7 @@ function computeSpecialistDomains(accountId) {
   if (!existsSync24(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync17(specialistsDir);
+    entries = readdirSync18(specialistsDir);
   } catch {
     return [];
   }
@@ -13775,7 +13957,7 @@ function computeDormantPlugins(accountId) {
   if (!existsSync24(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync27(accountFile, "utf-8");
+    const raw = readFileSync28(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -13790,7 +13972,7 @@ function computeDormantPlugins(accountId) {
   if (!existsSync24(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync17(pluginsDir);
+    entries = readdirSync18(pluginsDir);
   } catch {
     return [];
   }
@@ -13801,7 +13983,7 @@ function computeDormantPlugins(accountId) {
     if (!existsSync24(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync27(manifestPath, "utf-8");
+      manifest = readFileSync28(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -13815,13 +13997,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync25, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync29 } from "fs";
 import { resolve as resolve20 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync25(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync28(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync29(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -13835,7 +14017,7 @@ function resolveTunnelUrl() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync28(resolve20(platformRoot3, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync29(resolve20(platformRoot3, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -14078,7 +14260,7 @@ var events_default = app20;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync26 } from "fs";
-import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
+import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename, rmdir } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
 import { basename as basename9, dirname as dirname10, join as join29, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
@@ -14956,19 +15138,55 @@ async function readAccountNames() {
   }
   return map;
 }
+async function servableFilesIn(dirAbs, uuid) {
+  const metaName = `${uuid}.meta.json`;
+  let dirents;
+  try {
+    dirents = await readdir3(dirAbs, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const d of dirents) {
+    if (!d.isFile()) continue;
+    if (d.name === metaName) continue;
+    if (d.name.endsWith(EXTRACTED_TEXT_SUFFIX)) continue;
+    out.push(d.name);
+  }
+  return out;
+}
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join29(absolute, entry.name), entry.name);
+    const dirAbs = join29(absolute, entry.name);
+    const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
+      const servable = await servableFilesIn(dirAbs, entry.name);
+      if (servable.length === 1) {
+        const innerName = servable[0];
+        let size = null;
+        let modifiedAt = entry.modifiedAt;
+        try {
+          const st = await stat4(join29(dirAbs, innerName));
+          size = st.size;
+          modifiedAt = st.mtime.toISOString();
+        } catch {
+        }
+        entry.kind = "file";
+        entry.displayName = meta.filename;
+        entry.mimeType = meta.mimeType;
+        entry.sizeBytes = size;
+        entry.modifiedAt = modifiedAt;
+        entry.entryPath = `${entry.name}/${innerName}`;
+        return "flattened";
+      }
       entry.displayName = meta.filename;
-      entry.mimeType = meta.mimeType;
-      return;
+      return "kept-as-dir";
     }
     const accountName = accountNames.get(entry.name);
     if (accountName) {
       entry.displayName = accountName;
     }
-    return;
+    return null;
   }
   if (entry.kind === "file") {
     const dot = entry.name.lastIndexOf(".");
@@ -14981,6 +15199,7 @@ async function enrich(absolute, entry, accountNames) {
       }
     }
   }
+  return null;
 }
 function buildDisplayPath(relPath, accountNames) {
   if (relPath === "." || relPath === "") return [];
@@ -15136,8 +15355,18 @@ app21.get("/", requireAdminSession, async (c) => {
       }
     }
     const accountNames = await readAccountNames();
-    await Promise.all(entries.map((e) => enrich(absolute, e, accountNames)));
+    const classes = await Promise.all(entries.map((e) => enrich(absolute, e, accountNames)));
     sortDirEntries(entries);
+    let flattened = 0;
+    let keptAsDir = 0;
+    for (const cls of classes) {
+      if (cls === "flattened") flattened++;
+      else if (cls === "kept-as-dir") keptAsDir++;
+    }
+    const containers = flattened + keptAsDir;
+    if (containers > 0) {
+      console.error(`[data] op=uploads-flatten containers=${containers} flattened=${flattened} kept-as-dir=${keptAsDir}`);
+    }
     const displayPath = buildDisplayPath(relPath, accountNames);
     console.error(`[data] file-list path="${relPath}" entries=${entries.length}`);
     return c.json({ path: relPath, displayPath, entries });
@@ -15226,8 +15455,16 @@ app21.get("/download", requireAdminSession, async (c) => {
       });
     }
     console.error(`[data] file-download root="${root}" path="${relPath}" size=${info.size}`);
-    const safeQuotedName = filename.replace(/[\r\n"\\]/g, "_");
-    const encodedName = encodeURIComponent(filename);
+    let downloadName = filename;
+    if (root === "data") {
+      const parsed = parseAttachmentPath(relPath);
+      if (parsed) {
+        const meta = await readMeta(dirname10(absolute), parsed.attachmentId);
+        if (meta?.filename) downloadName = meta.filename;
+      }
+    }
+    const safeQuotedName = downloadName.replace(/[\r\n"\\]/g, "_");
+    const encodedName = encodeURIComponent(downloadName);
     return new Response(webStream, {
       status: 200,
       headers: {
@@ -15322,7 +15559,13 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
           if (over) return over;
         }
       } else if (info.isFile()) {
-        const over = await addFile(absolute, info.size, basename9(absolute));
+        let member = basename9(absolute);
+        const parsed = parseAttachmentPath(relPath);
+        if (parsed) {
+          const meta = await readMeta(dirname10(absolute), parsed.attachmentId);
+          if (meta?.filename) member = meta.filename;
+        }
+        const over = await addFile(absolute, info.size, member);
         if (over) return over;
       } else {
         return c.json({ error: "Path is not a file or directory" }, 400);
@@ -15742,7 +15985,9 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join29(dirname10(absolute), `${stem}.meta.json`) : null;
+    const containerDir = dirname10(absolute);
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join29(containerDir, `${stem}.meta.json`) : null;
+    const isAttachmentContainer = UUID_RE3.test(stem) && basename9(containerDir) === stem;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -15750,6 +15995,12 @@ app21.delete("/", requireAdminSession, async (c) => {
       } catch {
       }
     }
+    if (isAttachmentContainer) {
+      await unlink2(join29(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      });
+      await rmdir(containerDir).catch(() => {
+      });
+    }
     console.error(`[data] file-delete path="${relPath}" bytes=${info.size}`);
     try {
       await dropFileIndex(accountId, relPath);
@@ -18706,14 +18957,14 @@ app36.get("/", async (c) => {
 var system_stats_default = app36;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync28, readFileSync as readFileSync29 } from "fs";
+import { existsSync as existsSync28, readFileSync as readFileSync30 } from "fs";
 import { resolve as resolve24, join as join30 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join30(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync28(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync29(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync30(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -18723,7 +18974,7 @@ var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync28(VERSION_FILE)) return "unknown";
-  return readFileSync29(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync30(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -19599,7 +19850,7 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync30 } from "fs";
+import { readFileSync as readFileSync31 } from "fs";
 import { join as join31 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
@@ -19612,7 +19863,7 @@ function readAvailabilityConfig(accountDir) {
   const path2 = join31(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync30(path2, "utf-8");
+    raw = readFileSync31(path2, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path2} not found`);
   }
@@ -20589,7 +20840,7 @@ app54.route("/request-magic-link", request_magic_link_default);
 var access_default = app54;
 
 // server/routes/sites.ts
-import { existsSync as existsSync30, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
+import { existsSync as existsSync30, readFileSync as readFileSync32, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
 import { resolve as resolve26 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -20693,7 +20944,7 @@ app55.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync31(realPath);
+    body = readFileSync32(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -20729,7 +20980,7 @@ var sites_default = app55;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync32, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync33, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname11 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -20738,7 +20989,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync32(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync33(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -20752,7 +21003,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync32(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync33(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -20805,7 +21056,7 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync31, readFileSync as readFileSync33 } from "fs";
+import { existsSync as existsSync31, readFileSync as readFileSync34 } from "fs";
 import { join as join33 } from "path";
 var cached = null;
 var cachedAttempted = false;
@@ -20817,7 +21068,7 @@ function readBrandConfig() {
   const brandPath = join33(platformRoot3, "config", "brand.json");
   if (!existsSync31(brandPath)) return null;
   try {
-    cached = JSON.parse(readFileSync33(brandPath, "utf-8"));
+    cached = JSON.parse(readFileSync34(brandPath, "utf-8"));
     return cached;
   } catch {
     return null;
@@ -24552,7 +24803,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync34, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync35, statSync as statSync13 } from "fs";
 import { resolve as resolve32 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -24616,7 +24867,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync34(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync35(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -24630,7 +24881,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync34(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync35(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -24798,7 +25049,7 @@ if (BRAND_JSON_PATH && !existsSync35(BRAND_JSON_PATH)) {
 }
 if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync36(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -24834,7 +25085,7 @@ var ALIAS_DOMAINS_PATH = join36(homedir4(), BRAND.configDir, "alias-domains.json
 function loadAliasDomains() {
   try {
     if (!existsSync35(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync35(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync36(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -25523,7 +25774,7 @@ app61.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync35(filePath);
+  const body = readFileSync36(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -25553,7 +25804,7 @@ app61.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync35(filePath);
+  const body = readFileSync36(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -25568,7 +25819,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync36(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -25599,7 +25850,7 @@ var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskabl
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync35(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync36(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -25609,7 +25860,7 @@ function readInstalledVersion() {
     if (!PLATFORM_ROOT8) return "unknown";
     const versionFile = join36(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync35(versionFile)) return "unknown";
-    const content = readFileSync35(versionFile, "utf-8").trim();
+    const content = readFileSync36(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -25650,7 +25901,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync35(resolve33(process.cwd(), "public", file), "utf-8");
+    html = readFileSync36(resolve33(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -25673,7 +25924,7 @@ function loadBrandingCache(agentSlug) {
     if (!accountId) return null;
     const cachePath = join36(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync35(cachePath)) return null;
-    return JSON.parse(readFileSync35(cachePath, "utf-8"));
+    return JSON.parse(readFileSync36(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -25768,7 +26019,7 @@ app61.use("/vnc-popout.html", logViewerFetch);
 app61.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync35(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync36(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -25921,6 +26172,73 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   const loop = setInterval(runReconcile, RECONCILE_INTERVAL_MS);
   loop.unref();
 }
+{
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
+  const publishScript = resolve33(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const PUBLISH_INTERVAL_MS = 3e5;
+  const currentAccount = () => {
+    try {
+      return resolveAccount();
+    } catch (err) {
+      console.error(`[calendar-availability] op=publish result=error reason=account-resolve-failed err="${err.message}"`);
+      return null;
+    }
+  };
+  const spawnPublish = (account) => {
+    if (!existsSync35(publishScript)) return;
+    try {
+      const child = spawn3(process.execPath, [publishScript], {
+        env: {
+          ...process.env,
+          PLATFORM_ROOT: publishPlatformRoot,
+          PUBLISH_ACCOUNT_ID: account.accountId,
+          PUBLISH_ACCOUNT_DIR: account.accountDir
+        },
+        stdio: "inherit"
+      });
+      child.unref();
+      child.on("error", (err) => console.error(`[calendar-availability] op=publish result=error reason=spawn-failed err="${err.message}"`));
+    } catch (err) {
+      console.error(`[calendar-availability] op=publish result=error reason=spawn-failed err="${err.message}"`);
+    }
+  };
+  const auditSnapshotAge = (account) => {
+    const availPath = resolve33(account.accountDir, "calendar-availability.json");
+    let hasBookingSite = false;
+    try {
+      if (existsSync35(availPath)) {
+        const cfg = JSON.parse(readFileSync36(availPath, "utf-8"));
+        hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
+      }
+    } catch {
+    }
+    if (!hasBookingSite) return;
+    const statePath = resolve33(account.accountDir, "state", "booking-availability", "last-publish.json");
+    let lastSuccessAt = null;
+    if (existsSync35(statePath)) {
+      try {
+        const rec = JSON.parse(readFileSync36(statePath, "utf-8"));
+        lastSuccessAt = rec.lastSuccessAt ?? null;
+      } catch {
+        console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
+        return;
+      }
+    }
+    const parsed = lastSuccessAt ? Date.parse(lastSuccessAt) : NaN;
+    const ageMs = Number.isNaN(parsed) ? null : Date.now() - parsed;
+    console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=${ageMs ?? "na"}`);
+  };
+  const publishTick = () => {
+    const account = currentAccount();
+    if (!account) return;
+    spawnPublish(account);
+    auditSnapshotAge(account);
+  };
+  const firstPublish = setTimeout(publishTick, 2e4);
+  firstPublish.unref();
+  const publishLoop = setInterval(publishTick, PUBLISH_INTERVAL_MS);
+  publishLoop.unref();
+}
 startTimeEntryCensus(() => getSession());
 {
   const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
@@ -26042,7 +26360,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync35(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync36(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -26072,7 +26390,7 @@ if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync35(USERS_FILE)) return 0;
-  const raw = readFileSync35(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync36(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;