@rubytech/create-maxy-code 0.1.441 → 0.1.443

package/payload/server/server.js

@@ -1413,10 +1413,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync35, existsSync as existsSync35, watchFile } from "fs";
+import { readFileSync as readFileSync37, existsSync as existsSync35, watchFile } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve33, join as join36, basename as basename12 } from "path";
+import { resolve as resolve34, join as join37, basename as basename12 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -1793,7 +1793,7 @@ async function ensureAuth() {
 }
 
 // server/routes/health.ts
-import { existsSync as existsSync5, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync10 } from "fs";
 import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
@@ -2129,7 +2129,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve34) => setTimeout(() => resolve34("timeout"), timeoutMs)
+    (resolve35) => setTimeout(() => resolve35("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -2292,11 +2292,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve34, reject) => {
+  return new Promise((resolve35, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve34();
+        resolve35();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -2401,7 +2401,7 @@ import { inspect as inspect2 } from "util";
 
 // app/lib/whatsapp/with-timeout.ts
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve34, reject) => {
+  return new Promise((resolve35, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
@@ -2409,7 +2409,7 @@ function withTimeout(label, promise, timeoutMs) {
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve34(value);
+        resolve35(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -3489,10 +3489,10 @@ function readConversationSummaries(platformAccountId) {
       } catch {
         continue;
       }
-      const cached2 = summaryCache.get(file);
-      if (cached2 && cached2.size === size && cached2.mtimeMs === mtimeMs) {
+      const cached3 = summaryCache.get(file);
+      if (cached3 && cached3.size === size && cached3.mtimeMs === mtimeMs) {
         cacheHits++;
-        out.set(remoteJid, cached2.summary);
+        out.set(remoteJid, cached3.summary);
         continue;
       }
       let summary;
@@ -3556,8 +3556,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve34) => {
-    release = resolve34;
+  const mine = new Promise((resolve35) => {
+    release = resolve35;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -3700,8 +3700,8 @@ import { resolve as resolve3 } from "path";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var cache = /* @__PURE__ */ new Map();
 function enumerateValidAccountIds(accountsDir) {
-  const cached2 = cache.get(accountsDir);
-  if (cached2 !== void 0) return cached2;
+  const cached3 = cache.get(accountsDir);
+  if (cached3 !== void 0) return cached3;
   let names;
   try {
     names = readdirSync2(accountsDir);
@@ -3843,7 +3843,7 @@ import {
 // app/lib/attachments.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir, writeFile } from "fs/promises";
-import { realpathSync as realpathSync2, existsSync as existsSync4 } from "fs";
+import { realpathSync as realpathSync2, existsSync as existsSync4, readFileSync as readFileSync8, readdirSync as readdirSync3 } from "fs";
 import { resolve as resolve6, extname } from "path";
 
 // app/lib/data-path.ts
@@ -3926,11 +3926,15 @@ function resolveScratchpadPath(raw, scratchpadRootAbs) {
 import { unzipSync, strFromU8 } from "fflate";
 var DOCX = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
 var ODT = "application/vnd.oasis.opendocument.text";
+var XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
+var ODS = "application/vnd.oasis.opendocument.spreadsheet";
 var CONVERTIBLE_DOC_MIME = /* @__PURE__ */ new Set([
   DOCX,
   ODT,
   "text/rtf",
-  "application/rtf"
+  "application/rtf",
+  XLSX,
+  ODS
 ]);
 function bareMime(mimeType) {
   return mimeType.split(";")[0].trim().toLowerCase();
@@ -3964,6 +3968,80 @@ function odtToText(buffer) {
   const stripped = withBreaks.replace(/<[^>]+>/g, "");
   return unescapeXml(stripped).replace(/\n{3,}/g, "\n\n").trim();
 }
+function sheetOrdinal(name) {
+  const m = name.match(/sheet(\d+)\.xml$/);
+  return m ? parseInt(m[1], 10) : 0;
+}
+function xlsxToText(buffer) {
+  const files = unzipSync(new Uint8Array(buffer));
+  const shared = [];
+  const sharedBytes = files["xl/sharedStrings.xml"];
+  if (sharedBytes) {
+    for (const si of strFromU8(sharedBytes).split("</si>")) {
+      if (!si.includes("<si")) continue;
+      const base = si.replace(/<rPh\b[\s\S]*?<\/rPh>/g, "");
+      let s = "";
+      for (const m of base.matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)) s += m[1];
+      shared.push(unescapeXml(s));
+    }
+  }
+  const sheetKeys = Object.keys(files).filter((n) => /^xl\/worksheets\/sheet\d+\.xml$/.test(n)).sort((a, b) => sheetOrdinal(a) - sheetOrdinal(b));
+  const sheets = [];
+  for (const key of sheetKeys) {
+    const xml = strFromU8(files[key]);
+    const rows = [];
+    for (const rowXml of xml.split("</row>")) {
+      if (!rowXml.includes("<row")) continue;
+      const cells = [];
+      for (const c of rowXml.matchAll(/<c\b([^>]*)>([\s\S]*?)<\/c>/g)) {
+        const attrs = c[1];
+        const body = c[2];
+        if (/\bt="inlineStr"/.test(attrs)) {
+          let s = "";
+          for (const m of body.matchAll(/<t\b[^>]*>([\s\S]*?)<\/t>/g)) s += m[1];
+          cells.push(unescapeXml(s));
+          continue;
+        }
+        const v = body.match(/<v\b[^>]*>([\s\S]*?)<\/v>/);
+        if (!v) {
+          cells.push("");
+          continue;
+        }
+        if (/\bt="s"/.test(attrs)) {
+          const idx = parseInt(v[1], 10);
+          cells.push(Number.isInteger(idx) && idx >= 0 && idx < shared.length ? shared[idx] : "");
+        } else {
+          cells.push(unescapeXml(v[1]));
+        }
+      }
+      while (cells.length && cells[cells.length - 1] === "") cells.pop();
+      if (cells.length) rows.push(cells.join("	"));
+    }
+    if (rows.length) sheets.push(rows.join("\n"));
+  }
+  return sheets.join("\n\n");
+}
+function odsToText(buffer) {
+  const xml = unzipEntry(buffer, "content.xml");
+  const tables = [];
+  for (const tableXml of xml.split(/<table:table(?=[\s>])/).slice(1)) {
+    const rows = [];
+    for (const rowXml of tableXml.split(/<table:table-row\b/).slice(1)) {
+      const cells = rowXml.split(/<table:(?:covered-)?table-cell\b/).slice(1).map((frag) => {
+        const withBreaks = frag.replace(/<text:line-break\b[^>]*\/?>/g, "\n").replace(/<text:tab\b[^>]*\/?>/g, "	");
+        let s = "";
+        for (const m of withBreaks.matchAll(/<text:p\b[^>]*>([\s\S]*?)<\/text:p>/g)) {
+          s += (s ? "\n" : "") + m[1].replace(/<[^>]+>/g, "");
+        }
+        return unescapeXml(s);
+      });
+      while (cells.length && cells[cells.length - 1] === "") cells.pop();
+      if (cells.length) rows.push(cells.join("	"));
+    }
+    if (rows.length) tables.push(rows.join("\n"));
+  }
+  return tables.join("\n\n");
+}
 var RTF_DROP_DEST = /^\\(?:\*|fonttbl|colortbl|stylesheet|listtable|info|pict)\b/;
 function stripRtfDestinations(s) {
   let out = "";
@@ -4004,6 +4082,8 @@ function docToText(buffer, mimeType) {
   const mime = bareMime(mimeType);
   if (mime === DOCX) return docxToText(buffer);
   if (mime === ODT) return odtToText(buffer);
+  if (mime === XLSX) return xlsxToText(buffer);
+  if (mime === ODS) return odsToText(buffer);
   if (mime === "text/rtf" || mime === "application/rtf") return rtfToText(buffer.toString("latin1"));
   return null;
 }
@@ -4033,6 +4113,21 @@ var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "application/vnd.oasis.opendocument.text",
   "text/rtf",
   "application/rtf",
+  // Task 1607 — spreadsheets + presentations operators send. These land
+  // download-only in the reader; the Read tool cannot parse the binary
+  // containers and agent-readable text extraction for them is task 1608.
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  // xlsx
+  "application/vnd.ms-excel",
+  // xls
+  "application/vnd.oasis.opendocument.spreadsheet",
+  // ods
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  // pptx
+  "application/vnd.ms-powerpoint",
+  // ppt
+  "application/vnd.oasis.opendocument.presentation",
+  // odp
   // Task 1240 — voice recordings persist as playable clips in the admin bubble.
   // These match AUDIO_MIME_TYPES in app/lib/stt/audio-mime.ts exactly.
   "audio/ogg",
@@ -4049,6 +4144,7 @@ var MAX_FILES_PER_MESSAGE = 5;
 var MAX_DATA_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
 var MAX_ZIP_UNCOMPRESSED_BYTES = 100 * 1024 * 1024;
 var EXTRACTED_TEXT_SUFFIX = ".extracted.txt";
+var ATTACHMENT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function assertSupportedMime(mimeType) {
   const bare = mimeType.split(";")[0].trim().toLowerCase();
   if (!SUPPORTED_MIME_TYPES.has(bare)) {
@@ -4057,22 +4153,47 @@ function assertSupportedMime(mimeType) {
     );
   }
 }
-function isSupportedMime(mimeType) {
-  return SUPPORTED_MIME_TYPES.has(mimeType.split(";")[0].trim().toLowerCase());
+function isInlineSafeMime(mimeType) {
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (bare === "image/svg+xml") return false;
+  return bare.startsWith("image/") || bare === "application/pdf" || bare.startsWith("audio/") || bare === "video/mp4";
 }
 async function storeMediaBuffer(accountId, attachmentId, filename, mimeType, buffer) {
-  assertSupportedMime(mimeType);
   if (buffer.byteLength > MAX_FILE_SIZE_BYTES) {
     throw new Error(
       `Media exceeds the 50 MB limit (${(buffer.byteLength / 1024 / 1024).toFixed(1)} MB).`
     );
   }
-  return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId, true);
+  return writeAttachment(accountId, "", filename, mimeType, buffer.byteLength, buffer, attachmentId);
 }
 function attachmentExists(accountId, attachmentId) {
   return existsSync4(resolve6(uploadsDirFor(accountId, "", attachmentId), `${attachmentId}.meta.json`));
 }
-async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId, skipDocToText = false) {
+function resolveStoredAttachment(accountId, attachmentId) {
+  if (!ATTACHMENT_ID_RE.test(attachmentId)) return null;
+  const dir = uploadsDirFor(accountId, "", attachmentId);
+  let meta;
+  try {
+    meta = JSON.parse(readFileSync8(resolve6(dir, `${attachmentId}.meta.json`), "utf8"));
+  } catch {
+    return null;
+  }
+  if (!meta || typeof meta !== "object") return null;
+  const { filename, mimeType } = meta;
+  if (typeof filename !== "string" || typeof mimeType !== "string") return null;
+  let entries;
+  try {
+    entries = readdirSync3(dir, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  const dataFile = entries.find((e) => e.isFile() && !e.name.endsWith(".meta.json") && !e.name.endsWith(EXTRACTED_TEXT_SUFFIX));
+  if (!dataFile) return null;
+  const readableSibling = `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`;
+  const readableTextPath = entries.some((e) => e.isFile() && e.name === readableSibling) ? resolve6(dir, readableSibling) : void 0;
+  return { attachmentId, filename, mimeType, path: resolve6(dir, dataFile.name), readableTextPath };
+}
+async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes, buffer, explicitId) {
   const attachmentId = explicitId ?? randomUUID3();
   const dir = uploadsDirFor(accountId, subPath, attachmentId);
   await mkdir(dir, { recursive: true });
@@ -4090,11 +4211,23 @@ async function writeAttachment(accountId, subPath, filename, mimeType, sizeBytes
   await writeFile(storagePath, buffer);
   await writeFile(metaPath, JSON.stringify(meta, null, 2));
   let readableTextPath;
-  if (!skipDocToText && CONVERTIBLE_DOC_MIME.has(mimeType.split(";")[0].trim().toLowerCase())) {
-    const text = docToText(buffer, mimeType);
+  const bare = mimeType.split(";")[0].trim().toLowerCase();
+  if (CONVERTIBLE_DOC_MIME.has(bare)) {
+    let text = null;
+    try {
+      text = docToText(buffer, mimeType);
+    } catch {
+      text = null;
+    }
+    console.error(`[doc-to-text] op=convert mime=${bare} ok=${text !== null} chars=${text?.length ?? 0}`);
     if (text) {
-      readableTextPath = resolve6(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
-      await writeFile(readableTextPath, text);
+      const siblingPath = resolve6(dir, `${attachmentId}${EXTRACTED_TEXT_SUFFIX}`);
+      try {
+        await writeFile(siblingPath, text);
+        readableTextPath = siblingPath;
+      } catch (err) {
+        console.error(`[doc-to-text] op=sibling-write mime=${bare} ok=false reason=${String(err).slice(0, 80)}`);
+      }
     }
   }
   return { attachmentId, filename, storagePath, metaPath, mimeType, sizeBytes, readableTextPath };
@@ -4141,6 +4274,13 @@ var MIME_BY_EXT = {
   ".odt": "application/vnd.oasis.opendocument.text",
   ".rtf": "text/rtf",
   ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  // Task 1607 — legacy + OpenDocument office extensions, so a device-stored file
+  // attached to a WhatsApp reply (detectMimeType → isMimeAdmitted, whatsapp-reader.ts)
+  // resolves to the mime now admitted in SUPPORTED_MIME_TYPES rather than octet-stream.
+  ".xls": "application/vnd.ms-excel",
+  ".ods": "application/vnd.oasis.opendocument.spreadsheet",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".odp": "application/vnd.oasis.opendocument.presentation",
   ".ics": "text/calendar"
 };
 function detectMimeType(filePath) {
@@ -4978,20 +5118,6 @@ function attachSelfIdRefreshOnCredsUpdate(conn) {
 function reloadConfig(accountConfig) {
   loadConfig(accountConfig);
 }
-function getMessages(accountId, jid, limit) {
-  const entries = messageStore.get(messageStoreKey(accountId, jid)) ?? [];
-  return limit ? entries.slice(-limit) : entries.slice();
-}
-function listConversationJids(accountId) {
-  const prefix = messageStoreKey(accountId, "");
-  const jids = [];
-  for (const key of messageStore.keys()) {
-    if (key.startsWith(prefix)) {
-      jids.push(key.slice(prefix.length));
-    }
-  }
-  return jids;
-}
 function listStoreAccountKeys() {
   const accounts = /* @__PURE__ */ new Set();
   for (const key of messageStore.keys()) {
@@ -5133,11 +5259,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve34) => {
-        const timer2 = setTimeout(resolve34, delay);
+      await new Promise((resolve35) => {
+        const timer2 = setTimeout(resolve35, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve34();
+          resolve35();
         }, { once: true });
       });
     }
@@ -5145,16 +5271,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve34) => {
+  return new Promise((resolve35) => {
     if (!conn.sock) {
-      resolve34();
+      resolve35();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve34();
+        resolve35();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -5205,7 +5331,7 @@ function monitorInbound(conn) {
         if (!msg.message) continue;
         let receiptDeferredToWorker = false;
         const extracted = extractMessage(msg);
-        const mediaServable = !!(extracted.mediaType && extracted.mimetype && isSupportedMime(extracted.mimetype));
+        const mediaServable = !!(extracted.mediaType && extracted.mimetype);
         if (extracted.text || mediaServable) {
           const isGroup = isGroupJid(remoteJid);
           const senderJid = isGroup ? msg.key.participant ?? remoteJid : remoteJid;
@@ -5476,8 +5602,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve34) => {
-      resolvePending = resolve34;
+    const sttPending = new Promise((resolve35) => {
+      resolvePending = resolve35;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -5602,7 +5728,7 @@ async function handleInboundMessage(conn, msg) {
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
 import { createConnection } from "net";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "fs";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "fs";
 import { resolve as resolve7 } from "path";
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve7(process.cwd(), "..");
 var VNC_SCRIPT = resolve7(PLATFORM_ROOT4, "scripts/vnc.sh");
@@ -5660,7 +5786,7 @@ function discoverNativeDisplay() {
       const leaderPid = leaderResult.stdout?.trim();
       if (leaderPid) {
         try {
-          const environ = readFileSync8(`/proc/${leaderPid}/environ`, "utf8");
+          const environ = readFileSync9(`/proc/${leaderPid}/environ`, "utf8");
           const match = environ.split("\0").find((e) => e.startsWith("WAYLAND_DISPLAY="));
           if (match) waylandDisplay = match.split("=")[1];
         } catch {
@@ -5905,20 +6031,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve34) => {
+  return new Promise((resolve35) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve34(true);
+      resolve35(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve34(false);
+      resolve35(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve34(false);
+      resolve35(false);
     });
   });
 }
@@ -5928,7 +6054,7 @@ app.get("/", async (c) => {
   let pinConfigured = false;
   try {
     if (existsSync5(USERS_FILE)) {
-      const raw = readFileSync9(USERS_FILE, "utf-8").trim();
+      const raw = readFileSync10(USERS_FILE, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         pinConfigured = Array.isArray(users) && users.length > 0;
@@ -6600,13 +6726,13 @@ async function sendTelegramText(botToken, chatId, text) {
 
 // server/routes/whatsapp.ts
 import { join as join10, resolve as resolve10 } from "path";
-import { readdirSync as readdirSync4, readFileSync as readFileSync11, existsSync as existsSync7 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync12, existsSync as existsSync7 } from "fs";
 
 // app/lib/whatsapp/login.ts
 import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
-import { readFileSync as readFileSync10, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync4, existsSync as existsSync6 } from "fs";
 import { resolve as resolve8, join as join8, dirname as dirname2, basename as basename2 } from "path";
 var TAG17 = "[whatsapp:config]";
 function configPath(accountDir) {
@@ -6615,7 +6741,7 @@ function configPath(accountDir) {
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
   if (!existsSync6(path2)) throw new Error(`account.json not found at ${path2}`);
-  return JSON.parse(readFileSync10(path2, "utf-8"));
+  return JSON.parse(readFileSync11(path2, "utf-8"));
 }
 function writeConfig(accountDir, config) {
   const path2 = configPath(accountDir);
@@ -7195,8 +7321,8 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   let resolveCode = null;
   let rejectCode = null;
-  const codePromise = new Promise((resolve34, reject) => {
-    resolveCode = resolve34;
+  const codePromise = new Promise((resolve35, reject) => {
+    resolveCode = resolve35;
     rejectCode = reject;
   });
   const codeTimer = setTimeout(
@@ -7536,13 +7662,13 @@ function serializeWhatsAppSchema() {
 }
 
 // app/lib/whatsapp/status-reconcile.ts
-import { readdirSync as readdirSync3 } from "fs";
+import { readdirSync as readdirSync4 } from "fs";
 import { join as join9 } from "path";
 var TAG20 = "[whatsapp:reconcile]";
 var HALF_REGISTERED_MIN_AGE_MS = 5 * 6e4;
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync3(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join9(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync4(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join9(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -7689,6 +7815,15 @@ function authorizeRecallRead(input) {
 // server/routes/whatsapp.ts
 var TAG21 = "[whatsapp:api]";
 var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT || "";
+function recallAttachment(storeAccountId, attachmentId) {
+  if (!attachmentId) return void 0;
+  const a = resolveStoredAttachment(storeAccountId, attachmentId);
+  if (!a) {
+    console.error(`[whatsapp-read-tool] op=attachment-miss attachmentId=${attachmentId.slice(0, 8)} storeAccount=${storeAccountId}`);
+    return void 0;
+  }
+  return a;
+}
 function projectionFor(requestedAccountId) {
   const validAccounts = listValidAccounts();
   if (validAccounts.length <= 1) return { storeAccountId: requestedAccountId, managerPhones: null };
@@ -7880,13 +8015,13 @@ app2.post("/config", async (c) => {
         const agents = [];
         if (existsSync7(agentsDir)) {
           try {
-            const entries = readdirSync4(agentsDir, { withFileTypes: true });
+            const entries = readdirSync5(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
               const configPath2 = resolve10(agentsDir, entry.name, "config.json");
               if (!existsSync7(configPath2)) continue;
               try {
-                const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
+                const config = JSON.parse(readFileSync12(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
                 console.error(`${TAG21} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
@@ -8031,20 +8166,23 @@ app2.get("/conversations", (c) => {
     const requestedAccountId = validateAccountId(c.req.query("accountId") ?? null);
     const denial = callerScopeDenial(c, requestedAccountId);
     if (denial) return denial;
-    const accountId = resolveReadStoreKey(requestedAccountId);
-    const jids = listConversationJids(accountId);
-    const conversations = jids.map((jid) => {
-      const messages = getMessages(accountId, jid);
-      const lastMessage = messages.length > 0 ? messages[messages.length - 1] : null;
+    const projection = projectionFor(requestedAccountId);
+    const storeAccountId = resolveReadStoreKey(projection.storeAccountId);
+    const projecting = projection.managerPhones != null;
+    const managerPhonesBound = projection.managerPhones?.length ?? 0;
+    const allConversations = readAllConversations(storeAccountId);
+    const scoped = projection.managerPhones ? filterConversationsForSubAccount(allConversations, projection.managerPhones) : allConversations;
+    const conversations = [...scoped.entries()].map(([jid, messages]) => {
+      const last = messages.length > 0 ? messages[messages.length - 1] : null;
       return {
         jid,
         type: isGroupJid(jid) ? "group" : "dm",
-        lastMessageTimestamp: lastMessage?.timestamp ?? null,
+        lastMessageTimestamp: last ? Math.floor(Date.parse(last.dateSent) / 1e3) : null,
         messageCount: messages.length
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG21} conversations requested=${requestedAccountId} account=${accountId} storeKeyFound=${jids.length > 0} count=${conversations.length}`);
+    console.error(`${TAG21} conversations requested=${requestedAccountId} account=${storeAccountId} projected=${projecting} storeAccount=${projecting ? storeAccountId : "self"} managerPhonesBound=${managerPhonesBound} storeKeyFound=${allConversations.size > 0} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
     console.error(`${TAG21} conversations error: ${String(err)}`);
@@ -8056,7 +8194,6 @@ app2.get("/messages", (c) => {
     const requestedAccountId = validateAccountId(c.req.query("accountId") ?? null);
     const denial = callerScopeDenial(c, requestedAccountId);
     if (denial) return denial;
-    const accountId = resolveReadStoreKey(requestedAccountId);
     const jid = c.req.query("jid");
     if (!jid) {
       return c.json({ error: "Missing required parameter: jid" }, 400);
@@ -8064,9 +8201,33 @@ app2.get("/messages", (c) => {
     const limitParam = c.req.query("limit");
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
-    const messages = getMessages(accountId, jid, effectiveLimit);
-    const storeKeyFound = listConversationJids(accountId).length > 0;
-    console.error(`${TAG21} messages requested=${requestedAccountId} account=${accountId} jid=${jid} storeKeyFound=${storeKeyFound} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    const projection = projectionFor(requestedAccountId);
+    const storeAccountId = resolveReadStoreKey(projection.storeAccountId);
+    const projecting = projection.managerPhones != null;
+    const managerPhonesBound = projection.managerPhones?.length ?? 0;
+    const storeMessages = readConversation(storeAccountId, jid);
+    const counterpartyBound = !projecting || counterpartyBoundToSubAccount(
+      projection.managerPhones,
+      conversationCounterpartyPhone(jid, storeMessages[0]?.senderTelephone ?? "")
+    );
+    const bounded = counterpartyBound ? storeMessages : [];
+    const limited = effectiveLimit ? bounded.slice(-effectiveLimit) : bounded;
+    let withAttachments = 0;
+    const messages = limited.map((m) => {
+      const attachment = recallAttachment(storeAccountId, m.attachmentId);
+      if (attachment) withAttachments += 1;
+      return {
+        id: m.messageId,
+        sender: m.senderTelephone,
+        senderName: m.senderName ?? void 0,
+        body: m.body,
+        timestamp: Math.floor(Date.parse(m.dateSent) / 1e3),
+        fromMe: m.fromMe,
+        quoted: m.quotedId ? { id: m.quotedId, sender: m.quotedSender ?? void 0 } : void 0,
+        attachment
+      };
+    });
+    console.error(`${TAG21} messages requested=${requestedAccountId} account=${storeAccountId} jid=${jid} projected=${projecting} storeAccount=${projecting ? storeAccountId : "self"} managerPhonesBound=${managerPhonesBound} storeKeyFound=${storeMessages.length > 0} limit=${effectiveLimit ?? "all"} returned=${messages.length} withAttachments=${withAttachments}`);
     return c.json({ messages });
   } catch (err) {
     console.error(`${TAG21} messages error: ${String(err)}`);
@@ -8090,6 +8251,7 @@ app2.get("/conversation-graph-state", async (c) => {
       const rows2 = [];
       const nameCache = /* @__PURE__ */ new Map();
       let unresolvedSenders = 0;
+      let withAttachments2 = 0;
       let session = null;
       try {
         session = getSession();
@@ -8105,6 +8267,8 @@ app2.get("/conversation-graph-state", async (c) => {
               nameCache.set(m.senderTelephone, resolved);
               if (!resolved) unresolvedSenders += 1;
             }
+            const attachment = recallAttachment(projection2.storeAccountId, m.attachmentId);
+            if (attachment) withAttachments2 += 1;
             rows2.push({
               remoteJid: remoteJid2,
               messageId: m.messageId,
@@ -8112,7 +8276,8 @@ app2.get("/conversation-graph-state", async (c) => {
               fromMe: m.fromMe,
               senderTelephone: m.senderTelephone,
               senderName: nameCache.get(m.senderTelephone) ?? m.senderName,
-              body: m.body
+              body: m.body,
+              attachment
             });
           }
         }
@@ -8120,7 +8285,7 @@ app2.get("/conversation-graph-state", async (c) => {
         if (session) await session.close();
       }
       const ms2 = Date.now() - t0;
-      console.error(`[whatsapp-read-tool] op=query scope=${requestedAccountId} storeAccount=${projection2.storeAccountId} managerPhonesBound=${managerPhonesBound} resultCount=${rows2.length} unresolvedSenders=${unresolvedSenders} ms=${ms2}`);
+      console.error(`[whatsapp-read-tool] op=query scope=${requestedAccountId} storeAccount=${projection2.storeAccountId} managerPhonesBound=${managerPhonesBound} resultCount=${rows2.length} unresolvedSenders=${unresolvedSenders} withAttachments=${withAttachments2} ms=${ms2}`);
       return c.json({ accountId: requestedAccountId, rows: rows2, unresolvedSenders, ms: ms2, managerPhonesBound });
     }
     let remoteJid;
@@ -8144,15 +8309,21 @@ app2.get("/conversation-graph-state", async (c) => {
     );
     const messages = counterpartyBound ? storeMessages : [];
     const sessionId = messages[0]?.sessionId ?? null;
-    const rows = messages.map((m) => ({
-      messageId: m.messageId,
-      dateSent: m.dateSent,
-      fromMe: m.fromMe,
-      senderTelephone: m.senderTelephone,
-      body: m.body
-    }));
+    let withAttachments = 0;
+    const rows = messages.map((m) => {
+      const attachment = recallAttachment(projection.storeAccountId, m.attachmentId);
+      if (attachment) withAttachments += 1;
+      return {
+        messageId: m.messageId,
+        dateSent: m.dateSent,
+        fromMe: m.fromMe,
+        senderTelephone: m.senderTelephone,
+        body: m.body,
+        attachment
+      };
+    });
     const ms = Date.now() - t0;
-    console.error(`[whatsapp-read-tool] op=query mode=single scope=${accountId} storeAccount=${projection.storeAccountId} graphRows=${rows.length} sessionId=${sessionId ?? "null"} ms=${ms}`);
+    console.error(`[whatsapp-read-tool] op=query mode=single scope=${accountId} storeAccount=${projection.storeAccountId} graphRows=${rows.length} sessionId=${sessionId ?? "null"} withAttachments=${withAttachments} ms=${ms}`);
     return c.json({
       cacheKey,
       sessionId,
@@ -8201,15 +8372,15 @@ app2.get("/group-info", async (c) => {
 var whatsapp_default = app2;
 
 // server/routes/whatsapp-reader.ts
-import { readFileSync as readFileSync15, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync10, readdirSync as readdirSync9, realpathSync as realpathSync4 } from "fs";
+import { readFileSync as readFileSync16, watch, statSync as statSync5, openSync, readSync, closeSync, existsSync as existsSync10, readdirSync as readdirSync10, realpathSync as realpathSync4 } from "fs";
 import { basename as basename4, dirname as dirname4, isAbsolute, join as join15, relative as relative2, resolve as resolve12, sep as sep3 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync4 } from "fs";
+import { readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync4 } from "fs";
 import { dirname as dirname3, join as join13, resolve as resolve11 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
-import { existsSync as existsSync8, readdirSync as readdirSync5 } from "fs";
+import { existsSync as existsSync8, readdirSync as readdirSync6 } from "fs";
 import { homedir } from "os";
 import { join as join11 } from "path";
 function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
@@ -8217,7 +8388,7 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   if (!existsSync8(projectsRoot)) return null;
   let slugs;
   try {
-    slugs = readdirSync5(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync6(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
@@ -8233,14 +8404,14 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync12, readdirSync as readdirSync6, statSync as statSync3 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync13, readdirSync as readdirSync7, statSync as statSync3 } from "fs";
 import { join as join12 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
 function readUsersFile(usersFilePath) {
   if (!existsSync9(usersFilePath)) return null;
-  const raw = readFileSync12(usersFilePath, "utf-8").trim();
+  const raw = readFileSync13(usersFilePath, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -8359,7 +8530,7 @@ function enumerateJsonls(projectsRoot) {
   const out = [];
   let slugs;
   try {
-    slugs = readdirSync7(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync8(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch (err) {
     if (err.code === "ENOENT") return out;
     throw err;
@@ -8368,7 +8539,7 @@ function enumerateJsonls(projectsRoot) {
     const slugDir = join13(projectsRoot, slug);
     let entries;
     try {
-      entries = readdirSync7(slugDir, { withFileTypes: true });
+      entries = readdirSync8(slugDir, { withFileTypes: true });
     } catch (err) {
       const code = err.code ?? "unknown";
       console.error(`[admin-sessions-list] slug-skipped slug=${slug} code=${code}`);
@@ -8381,7 +8552,7 @@ function enumerateJsonls(projectsRoot) {
         const subDir = join13(slugDir, entry.name);
         let subEntries;
         try {
-          subEntries = readdirSync7(subDir, { withFileTypes: true });
+          subEntries = readdirSync8(subDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] subagents-skipped slug=${slug} code=${code}`);
@@ -8396,7 +8567,7 @@ function enumerateJsonls(projectsRoot) {
         const archiveDir = join13(slugDir, entry.name);
         let archiveEntries;
         try {
-          archiveEntries = readdirSync7(archiveDir, { withFileTypes: true });
+          archiveEntries = readdirSync8(archiveDir, { withFileTypes: true });
         } catch (err) {
           const code = err.code ?? "unknown";
           console.error(`[admin-sessions-list] archive-skipped slug=${slug} code=${code}`);
@@ -8440,7 +8611,7 @@ function loadUserTitles(accountDir) {
   const path2 = join13(accountDir, "session-titles.json");
   let raw;
   try {
-    raw = readFileSync13(path2, "utf8");
+    raw = readFileSync14(path2, "utf8");
   } catch {
     return out;
   }
@@ -8466,7 +8637,7 @@ function readSidecarMeta(metaPath) {
   const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null, accountId: null };
   let raw;
   try {
-    raw = readFileSync13(metaPath, "utf8");
+    raw = readFileSync14(metaPath, "utf8");
   } catch {
     return empty;
   }
@@ -8608,7 +8779,7 @@ app3.get("/", requireAdminSession, async (c) => {
     let body;
     let mtimeMs;
     try {
-      body = readFileSync13(path2, "utf8");
+      body = readFileSync14(path2, "utf8");
       mtimeMs = statSync4(path2).mtimeMs;
     } catch {
       continue;
@@ -8968,7 +9139,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 }
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync8 } from "fs";
+import { readFileSync as readFileSync15, readdirSync as readdirSync9 } from "fs";
 import { join as join14 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
@@ -8990,7 +9161,7 @@ function adminAttachmentsFromText(text, uploadsBase) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync14(join14(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync15(join14(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -9013,7 +9184,7 @@ function readAttachmentMeta(dir) {
 function listSessionAttachmentsInDir(dir) {
   let entries;
   try {
-    entries = readdirSync8(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    entries = readdirSync9(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return [];
   }
@@ -9039,6 +9210,24 @@ function splitNewLines(buf, baseOffset) {
   };
 }
 
+// app/lib/whatsapp-reader/authorize-reply-file-ref.ts
+var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function accountPartitionOwner(relative7) {
+  const segs = relative7.split("/").filter(Boolean);
+  if (segs.length < 2 || segs[0] !== "accounts") return null;
+  return ACCOUNT_UUID_RE2.test(segs[1]) ? segs[1] : null;
+}
+function authorizeReplyFileRef(input) {
+  const { relative: relative7, sendAccountId, sessionAccountId } = input;
+  const segs = relative7.split("/").filter(Boolean);
+  const inAccounts = segs.length >= 2 && segs[0] === "accounts";
+  if (inAccounts && segs[1] === sendAccountId) return { allow: true, via: "own" };
+  if (inAccounts && sessionAccountId && segs[1] === sessionAccountId) return { allow: true, via: "session" };
+  if (accountPartitionOwner(relative7)) return { allow: false, reason: "cross-account" };
+  if (segs[0] === "public" || inAccounts && segs[1] === "public") return { allow: false, reason: "public" };
+  return { allow: false, reason: "foreign" };
+}
+
 // server/routes/admin/manager-client.ts
 var SESSION_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isSessionId(value) {
@@ -9060,7 +9249,7 @@ function pickActivity(entries, grown, nowMs, concurrencyWindowMs) {
 }
 
 // app/admin-types.ts
-var ACCEPT_MIME = "image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain,text/markdown,text/csv,text/html,text/calendar,application/zip,application/x-zip-compressed,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.oasis.opendocument.text,text/rtf,application/rtf,audio/ogg,audio/opus,audio/mp4,audio/x-m4a,audio/mpeg,audio/webm,audio/wav,video/mp4,.docx,.odt,.rtf,.opus,.ogg,.m4a,.mp4,.mp3,.wav,.webm";
+var ACCEPT_MIME = "image/jpeg,image/png,image/gif,image/webp,application/pdf,text/plain,text/markdown,text/csv,text/html,text/calendar,application/zip,application/x-zip-compressed,application/vnd.openxmlformats-officedocument.wordprocessingml.document,application/vnd.oasis.opendocument.text,text/rtf,application/rtf,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet,application/vnd.ms-excel,application/vnd.oasis.opendocument.spreadsheet,application/vnd.openxmlformats-officedocument.presentationml.presentation,application/vnd.ms-powerpoint,application/vnd.oasis.opendocument.presentation,audio/ogg,audio/opus,audio/mp4,audio/x-m4a,audio/mpeg,audio/webm,audio/wav,video/mp4,.docx,.odt,.rtf,.xlsx,.xls,.ods,.pptx,.ppt,.odp,.opus,.ogg,.m4a,.mp4,.mp3,.wav,.webm";
 var SUPPORTED_MIME_SET = new Set(ACCEPT_MIME.split(",").filter((t) => !t.startsWith(".")));
 var MAX_ATTACHMENTS = 5;
 var MAX_FILE_BYTES = 50 * 1024 * 1024;
@@ -9073,6 +9262,11 @@ function isMimeAdmitted(mimeType, supportedSet) {
 
 // server/routes/whatsapp-reader.ts
 var app4 = new Hono();
+var DENY_COPY = {
+  "cross-account": "This file belongs to another account. Open that account to send it.",
+  public: "This file cannot be sent to a WhatsApp contact.",
+  foreign: "This file cannot be sent to a WhatsApp contact."
+};
 app4.get("/conversations", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const scopeAccountId = getAccountIdForSession(cacheKey) ?? null;
@@ -9099,7 +9293,7 @@ app4.get("/conversations", requireAdminSession, async (c) => {
     }
     let body = "";
     try {
-      body = readFileSync15(path2, "utf8");
+      body = readFileSync16(path2, "utf8");
     } catch {
     }
     const { title } = resolveTitle(body, sessionId, userTitles);
@@ -9268,7 +9462,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync15(join15(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync16(join15(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -9291,7 +9485,7 @@ function runActivityTick(c) {
   c.parentGrewThisTick = false;
   let names = [];
   try {
-    names = readdirSync9(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
+    names = readdirSync10(c.subagentsDir).filter((n) => AGENT_JSONL_RE.test(n));
   } catch {
   }
   const entries = [];
@@ -9486,7 +9680,7 @@ app4.get("/directives", requireAdminSession, (c) => {
   if (!dir || !existsSync10(dir)) return c.json({ entries: [] });
   let names;
   try {
-    names = readdirSync9(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
+    names = readdirSync10(dir).filter((n) => DIRECTIVE_NAME_RE.test(n));
   } catch {
     return c.json({ entries: [] });
   }
@@ -9515,7 +9709,7 @@ app4.get("/directive", requireAdminSession, (c) => {
   if (!path2.startsWith(dir + sep3)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
-    body = readFileSync15(path2, "utf8");
+    body = readFileSync16(path2, "utf8");
   } catch {
     return c.json({ error: "not found" }, 404);
   }
@@ -9720,7 +9914,9 @@ app4.post("/reply", requireAdminSession, async (c) => {
       return c.json({ error: "invalid accountId" }, 400);
     }
     const validAccount = isValidAccountId(accountId);
-    console.log(`${MANUAL_TAG} op=scope sendId=${sendId} accountId=${accountId} validAccount=${validAccount}`);
+    const cacheKey = c.var.cacheKey;
+    const sessionAccountId = getAccountIdForSession(cacheKey) ?? null;
+    console.log(`${MANUAL_TAG} op=scope sendId=${sendId} accountId=${accountId} validAccount=${validAccount} sessionAccount=${sessionAccountId ?? "null"} src=session`);
     if (!validAccount) {
       exit("rejected");
       return c.json({ error: "unknown account" }, 400);
@@ -9758,26 +9954,37 @@ app4.post("/reply", requireAdminSession, async (c) => {
       }
     }
     const resolvedRefs = [];
+    const acct8 = accountId.slice(0, 8);
+    const sess8 = sessionAccountId ? sessionAccountId.slice(0, 8) : "";
     for (const ref of fileRefs) {
       const resolved = resolveDataPath(ref);
-      const withinOwn = resolved.ok && !crossesForeignAccountPartition(resolved.relative, accountId) && isWithinOwnAccountPartition(resolved.relative, accountId);
-      let absolute = "";
+      if (!resolved.ok) {
+        console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner= sendAccount=${acct8} sessionAccount=${sess8} via=deny reason=unresolved ok=false`);
+        exit("rejected");
+        return c.json({ error: `device file not found: ${ref}`, reason: "file-ref-unresolved" }, 404);
+      }
+      const owner = accountPartitionOwner(resolved.relative);
+      const owner8 = owner ? owner.slice(0, 8) : "";
+      const decision = authorizeReplyFileRef({ relative: resolved.relative, sendAccountId: accountId, sessionAccountId });
+      if (!decision.allow) {
+        console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner=${owner8} sendAccount=${acct8} sessionAccount=${sess8} via=deny reason=${decision.reason} ok=false`);
+        exit("rejected");
+        return c.json({ error: DENY_COPY[decision.reason], reason: `file-ref-${decision.reason}` }, 403);
+      }
+      const absolute = resolved.absolute;
       let size = -1;
-      if (withinOwn) {
-        absolute = resolved.absolute;
-        try {
-          const st = statSync5(absolute);
-          size = st.isFile() ? st.size : -1;
-        } catch {
-          size = -1;
-        }
+      try {
+        const st = statSync5(absolute);
+        size = st.isFile() ? st.size : -1;
+      } catch {
+        size = -1;
       }
-      const ok = size >= 0;
-      console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} resolved=${absolute} ok=${ok}`);
-      if (!ok) {
+      if (size < 0) {
+        console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner=${owner8} sendAccount=${acct8} sessionAccount=${sess8} via=${decision.via} reason=missing ok=false`);
         exit("rejected");
         return c.json({ error: `device file not found: ${ref}`, reason: "file-ref-unresolved" }, 404);
       }
+      console.log(`${MANUAL_TAG} op=reply-file-ref sendId=${sendId} path=${ref} owner=${owner8} sendAccount=${acct8} sessionAccount=${sess8} via=${decision.via} reason=none ok=true`);
       if (size > MAX_FILE_BYTES) {
         exit("rejected");
         return c.json({ error: `"${basename4(absolute)}" exceeds the 50 MB limit` }, 400);
@@ -9872,7 +10079,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
     }
     for (let i = 0; i < resolvedRefs.length; i++) {
       const { absolute, mime } = resolvedRefs[i];
-      const file = new File([readFileSync15(absolute)], basename4(absolute), { type: mime });
+      const file = new File([readFileSync16(absolute)], basename4(absolute), { type: mime });
       const out = await sendStagedFile(file, `ref=${i}`);
       if (!out.ok) {
         exit("error");
@@ -9891,7 +10098,7 @@ app4.post("/reply", requireAdminSession, async (c) => {
 var whatsapp_reader_default = app4;
 
 // server/routes/public-reader.ts
-import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync16, readdirSync as readdirSync10 } from "fs";
+import { statSync as statSync6, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch2, readFileSync as readFileSync17, readdirSync as readdirSync11 } from "fs";
 import { basename as basename5, dirname as dirname5, join as join16, resolve as resolve13, sep as sep4 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
@@ -10125,7 +10332,7 @@ data: ${JSON.stringify(turn)}
   });
 });
 var ATT_TAG = "[public-attachment]";
-var ATTACHMENT_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 app5.get("/attachment/:attachmentId", (c) => {
   const visitor = resolveVisitor(c);
   const attachmentId = c.req.param("attachmentId");
@@ -10137,7 +10344,7 @@ app5.get("/attachment/:attachmentId", (c) => {
     return new Response("Unauthorized", { status: 401 });
   }
   console.log(`${ATT_TAG} op=request session=${ses} att=${at}`);
-  if (!ATTACHMENT_ID_RE.test(attachmentId) || !SESSION_ID_RE2.test(sessionId)) {
+  if (!ATTACHMENT_ID_RE2.test(attachmentId) || !SESSION_ID_RE2.test(sessionId)) {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=bad-id`);
     return new Response("Not found", { status: 404 });
   }
@@ -10166,19 +10373,22 @@ app5.get("/attachment/:attachmentId", (c) => {
   let dataFile;
   let buffer;
   try {
-    dataFile = readdirSync10(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
+    dataFile = readdirSync11(dir).find((f) => !f.endsWith(".meta.json") && !f.endsWith(EXTRACTED_TEXT_SUFFIX));
     if (!dataFile) throw new Error("no data file");
-    buffer = readFileSync16(resolve13(dir, dataFile));
+    buffer = readFileSync17(resolve13(dir, dataFile));
   } catch {
     console.error(`${ATT_TAG} op=denied session=${ses} att=${at} reason=not-found`);
     return new Response("Not found", { status: 404 });
   }
-  console.log(`${ATT_TAG} op=served session=${ses} att=${at} bytes=${buffer.length} mime=${meta.mimeType}`);
+  const inlineSafe = isInlineSafeMime(meta.mimeType);
+  const disposition = inlineSafe ? "inline" : "attachment";
+  console.log(`${ATT_TAG} op=served session=${ses} att=${at} bytes=${buffer.length} mime=${meta.mimeType} disposition=${disposition}${inlineSafe ? "" : " reason=non-preview-mime"}`);
   const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": meta.mimeType,
-      "Content-Disposition": `inline; filename="${safeName}"`,
+      "Content-Disposition": `${disposition}; filename="${safeName}"`,
+      "X-Content-Type-Options": "nosniff",
       "Cache-Control": "private, max-age=3600"
     }
   });
@@ -10188,10 +10398,10 @@ var public_reader_default = app5;
 // server/routes/webchat.ts
 import { basename as basename6, dirname as dirname6 } from "path";
 import { join as join19 } from "path";
-import { existsSync as existsSync12, readdirSync as readdirSync12, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync12, readdirSync as readdirSync13, readFileSync as readFileSync20, renameSync as renameSync4, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 
 // server/canonical-webchat-override.ts
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync5, renameSync as renameSync2 } from "fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync5, renameSync as renameSync2 } from "fs";
 import { join as join17 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
@@ -10200,7 +10410,7 @@ function canonicalOverridePath(accountDir) {
 }
 function readRaw(accountDir) {
   try {
-    return JSON.parse(readFileSync17(canonicalOverridePath(accountDir), "utf8"));
+    return JSON.parse(readFileSync18(canonicalOverridePath(accountDir), "utf8"));
   } catch {
     return null;
   }
@@ -10275,7 +10485,7 @@ function isNewSessionEffortLevel(value) {
 }
 
 // ../services/claude-session-manager/src/sidecar-store.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync11, readFileSync as readFileSync18, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readdirSync as readdirSync12, readFileSync as readFileSync19, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { join as join18 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -10305,7 +10515,7 @@ function createSidecarStore(config) {
   function readFileAt(path2) {
     let raw;
     try {
-      raw = readFileSync18(path2, "utf8");
+      raw = readFileSync19(path2, "utf8");
     } catch {
       return null;
     }
@@ -10321,7 +10531,7 @@ function createSidecarStore(config) {
   function readAll(sessionsDir, onSkip) {
     let names;
     try {
-      names = readdirSync11(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
+      names = readdirSync12(sessionsDir, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name);
     } catch {
       return [];
     }
@@ -10331,7 +10541,7 @@ function createSidecarStore(config) {
       const path2 = join18(sessionsDir, name);
       let raw;
       try {
-        raw = readFileSync18(path2, "utf8");
+        raw = readFileSync19(path2, "utf8");
       } catch {
         onSkip?.(name, "unreadable");
         continue;
@@ -10414,7 +10624,7 @@ function locateSidecar(sessionId) {
   const projectsRoot = join19(cfg, "projects");
   let slugs;
   try {
-    slugs = readdirSync12(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
+    slugs = readdirSync13(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
   } catch {
     return null;
   }
@@ -10897,7 +11107,7 @@ ${note}` : note;
     }
     const accountJsonPath = join19(account.accountDir, "account.json");
     try {
-      const parsed = JSON.parse(readFileSync19(accountJsonPath, "utf8"));
+      const parsed = JSON.parse(readFileSync20(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
       else if (op === "effort") parsed.effort = value;
       else parsed.adminPermissionMode = value;
@@ -11015,7 +11225,7 @@ ${note}` : note;
 import { resolve as resolve14 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
-import { existsSync as existsSync13, readFileSync as readFileSync20, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync21, readdirSync as readdirSync14 } from "fs";
 import { join as join20 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
@@ -11028,14 +11238,14 @@ function field(fm, name) {
 }
 function readSpecialistRoster(specialistsDir) {
   if (!existsSync13(specialistsDir)) return { specialists: [], skipped: [] };
-  const entries = readdirSync13(specialistsDir);
+  const entries = readdirSync14(specialistsDir);
   const specialists = [];
   const skipped = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync20(join20(specialistsDir, file), "utf-8");
+      raw = readFileSync21(join20(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -11153,7 +11363,7 @@ var webchat_greeting_default = app6;
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
 import { resolve as resolve15, join as join21 } from "path";
-import { existsSync as existsSync14, readFileSync as readFileSync21 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync22 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
 var instance = null;
@@ -11215,7 +11425,7 @@ function configDirName() {
   const brandPath = join21(platformRoot3, "config", "brand.json");
   if (existsSync14(brandPath)) {
     try {
-      return JSON.parse(readFileSync21(brandPath, "utf-8")).configDir ?? ".maxy";
+      return JSON.parse(readFileSync22(brandPath, "utf-8")).configDir ?? ".maxy";
     } catch {
     }
   }
@@ -11238,7 +11448,7 @@ app7.post("/", async (c) => {
     console.error(`${TAG23} op=reject reason=no-secret-file botType=${botType}`);
     return c.json({ ok: false }, 401);
   }
-  const expected = readFileSync21(sp, "utf-8").trim();
+  const expected = readFileSync22(sp, "utf-8").trim();
   const got = c.req.header("x-telegram-bot-api-secret-token") ?? "";
   if (got !== expected) {
     console.error(`${TAG23} op=reject reason=bad-secret botType=${botType}`);
@@ -11302,7 +11512,7 @@ var telegram_default = app7;
 
 // server/routes/quickbooks.ts
 import { join as join22 } from "path";
-import { existsSync as existsSync15, readFileSync as readFileSync22, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync23, writeFileSync as writeFileSync8, mkdirSync as mkdirSync4, rmSync, renameSync as renameSync5 } from "fs";
 var TAG24 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
@@ -11329,7 +11539,7 @@ async function completeConsent(args) {
   try {
     let pending;
     try {
-      pending = JSON.parse(readFileSync22(claimFile, "utf-8"));
+      pending = JSON.parse(readFileSync23(claimFile, "utf-8"));
     } catch {
       console.error(`${TAG24} op=callback state=${state} stateValid=false realmId=${realmId ?? ""}`);
       return { ok: false, status: 400, message: "Authorization state could not be read.", stateValid: false };
@@ -11345,7 +11555,7 @@ async function completeConsent(args) {
     if (!existsSync15(storePath(accountDir))) {
       return { ok: false, status: 500, message: "No QuickBooks credentials are stored for this account.", stateValid: true };
     }
-    const store2 = JSON.parse(readFileSync22(storePath(accountDir), "utf-8"));
+    const store2 = JSON.parse(readFileSync23(storePath(accountDir), "utf-8"));
     const form = new URLSearchParams({
       grant_type: "authorization_code",
       code,
@@ -11379,7 +11589,7 @@ async function completeConsent(args) {
     };
     mkdirSync4(join22(accountDir, "secrets"), { recursive: true });
     writeFileSync8(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
-    const persisted = JSON.parse(readFileSync22(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
+    const persisted = JSON.parse(readFileSync23(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG24} op=token-exchange realmId=${realmId} persisted=${persisted}`);
     return { ok: persisted, status: persisted ? 200 : 500, message: persisted ? `Connected company ${realmId}.` : "Failed to persist the connection.", stateValid: true };
   } finally {
@@ -11410,7 +11620,7 @@ var quickbooks_default = app8;
 
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync3 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync17, readFileSync as readFileSync24, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync17, readFileSync as readFileSync25, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID7 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
@@ -11548,7 +11758,7 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync16, readFileSync as readFileSync23, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync14, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync24, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync15, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
 import { dirname as dirname7, join as join23 } from "path";
 function id8(value) {
   return value.slice(0, 8);
@@ -11591,7 +11801,7 @@ function writeAdminEntry(input) {
   try {
     let users = [];
     if (existsSync16(input.usersFile)) {
-      const raw = readFileSync23(input.usersFile, "utf-8").trim();
+      const raw = readFileSync24(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -11626,7 +11836,7 @@ function writeAdminEntry(input) {
     if (!existsSync16(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync24(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -11648,7 +11858,7 @@ function computeAdminStoreDivergence(input) {
   const usersUserIds = /* @__PURE__ */ new Set();
   if (existsSync16(input.usersFile)) {
     try {
-      const raw = readFileSync23(input.usersFile, "utf-8").trim();
+      const raw = readFileSync24(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -11663,7 +11873,7 @@ function computeAdminStoreDivergence(input) {
   if (existsSync16(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync14(input.accountsDir);
+      entries = readdirSync15(input.accountsDir);
     } catch (err) {
       result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
@@ -11680,7 +11890,7 @@ function computeAdminStoreDivergence(input) {
       if (!existsSync16(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync23(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync24(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         result.errors.push({ source: accountJsonPath, detail: err instanceof Error ? err.message : String(err) });
@@ -11729,7 +11939,7 @@ function hashPin2(pin) {
 }
 function readUsersFile2() {
   if (!existsSync17(USERS_FILE)) return null;
-  const raw = readFileSync24(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync25(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -11939,7 +12149,7 @@ app9.post("/set-pin", async (c) => {
     let installOwner = null;
     if (existsSync17(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync25(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -12087,7 +12297,7 @@ app9.put("/set-pin", requireAdminSession, async (c) => {
     let installOwner = null;
     if (existsSync17(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync24(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync25(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -12489,7 +12699,7 @@ app12.get("/", requireAdminSession, async (c) => {
 var accounts_default = app12;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync20, readdirSync as readdirSync15, readFileSync as readFileSync25, statSync as statSync10 } from "fs";
+import { existsSync as existsSync20, readdirSync as readdirSync16, readFileSync as readFileSync26, statSync as statSync10 } from "fs";
 import { resolve as resolve16, basename as basename7 } from "path";
 
 // app/lib/logs-read-resolve.ts
@@ -12528,7 +12738,7 @@ app13.get("/", async (c) => {
       const filePath = resolve16(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync25(filePath);
+        const buffer = readFileSync26(filePath);
         const onDiskBytes = statSync10(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -12593,7 +12803,7 @@ app13.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename7(hit.path);
-        const buffer = readFileSync25(hit.path);
+        const buffer = readFileSync26(hit.path);
         const onDiskBytes = statSync10(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -12631,7 +12841,7 @@ app13.get("/", async (c) => {
     if (!existsSync20(dir)) continue;
     let files;
     try {
-      files = readdirSync15(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync16(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
@@ -12640,7 +12850,7 @@ app13.get("/", async (c) => {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync10(resolve16(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync25(resolve16(dir, name));
+        const content = readFileSync26(resolve16(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -12683,7 +12893,7 @@ import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync21 } from "fs";
 import { resolve as resolve17 } from "path";
 var app15 = new Hono();
-var ATTACHMENT_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+var ATTACHMENT_ID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function uploadsDirFor2(accountId, attachmentId) {
   return resolve17(DATA_ROOT, "accounts", accountId, "uploads", attachmentId);
 }
@@ -12697,7 +12907,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
     console.log(`[admin-attachment] op=miss attachmentId=${shortId2} session=${shortSession} status=401 reason=no-account`);
     return new Response("Unauthorized", { status: 401 });
   }
-  if (!ATTACHMENT_ID_RE2.test(attachmentId)) {
+  if (!ATTACHMENT_ID_RE3.test(attachmentId)) {
     console.log(`[admin-attachment] op=miss attachmentId=${shortId2} session=${shortSession} status=404 reason=bad-id`);
     return new Response("Not found", { status: 404 });
   }
@@ -12739,10 +12949,16 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   const filePath = resolve17(dir, dataFile);
   const buffer = await readFile2(filePath);
+  const inlineSafe = isInlineSafeMime(meta.mimeType);
+  const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
+  if (!inlineSafe) {
+    console.log(`[admin-attachment] op=served attachmentId=${shortId2} disposition=attachment reason=non-preview-mime mime=${meta.mimeType}`);
+  }
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": meta.mimeType,
-      "Content-Disposition": `inline; filename="${meta.filename}"`,
+      "Content-Disposition": `${inlineSafe ? "inline" : "attachment"}; filename="${safeName}"`,
+      "X-Content-Type-Options": "nosniff",
       "Cache-Control": "private, max-age=3600"
     }
   });
@@ -12751,7 +12967,7 @@ var attachment_default = app15;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve18 } from "path";
-import { readdirSync as readdirSync16, readFileSync as readFileSync26, existsSync as existsSync22, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync17, readFileSync as readFileSync27, existsSync as existsSync22, rmSync as rmSync2 } from "fs";
 var app16 = new Hono();
 app16.get("/", (c) => {
   const account = resolveAccount();
@@ -12760,14 +12976,14 @@ app16.get("/", (c) => {
   if (!existsSync22(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync16(agentsDir, { withFileTypes: true });
+    const entries = readdirSync17(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve18(agentsDir, entry.name, "config.json");
       if (!existsSync22(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync26(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync27(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -13526,7 +13742,7 @@ app17.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app17;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync24, readFileSync as readFileSync27, readdirSync as readdirSync17, statSync as statSync11 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync28, readdirSync as readdirSync18, statSync as statSync11 } from "fs";
 import { dirname as dirname9, resolve as resolve19, join as join27 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
@@ -13575,7 +13791,7 @@ function extractPluginToolDescriptions(pluginDir) {
   for (const path2 of candidates) {
     if (!existsSync24(path2)) continue;
     try {
-      raw = readFileSync27(path2, "utf-8");
+      raw = readFileSync28(path2, "utf-8");
       break;
     } catch {
     }
@@ -13626,7 +13842,7 @@ function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve19(PLATFORM_ROOT, "plugins");
   if (existsSync24(platformPlugins)) {
-    for (const name of readdirSync17(platformPlugins)) {
+    for (const name of readdirSync18(platformPlugins)) {
       const dir = join27(platformPlugins, name);
       try {
         if (statSync11(dir).isDirectory()) out.set(name, dir);
@@ -13636,11 +13852,11 @@ function listPluginDirs() {
   }
   const premiumRoot = resolve19(dirname9(PLATFORM_ROOT), "premium-plugins");
   if (existsSync24(premiumRoot)) {
-    for (const bundle of readdirSync17(premiumRoot)) {
+    for (const bundle of readdirSync18(premiumRoot)) {
       const bundlePlugins = join27(premiumRoot, bundle, "plugins");
       if (!existsSync24(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync17(bundlePlugins)) {
+        for (const name of readdirSync18(bundlePlugins)) {
           const dir = join27(bundlePlugins, name);
           try {
             if (statSync11(dir).isDirectory()) out.set(name, dir);
@@ -13657,7 +13873,7 @@ function readEnabledPlugins(accountId) {
   const accountFile = resolve19(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync24(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync27(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync28(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -13669,7 +13885,7 @@ function readFrontmatter(path2) {
   if (!existsSync24(path2)) return null;
   let raw;
   try {
-    raw = readFileSync27(path2, "utf-8");
+    raw = readFileSync28(path2, "utf-8");
   } catch {
     return null;
   }
@@ -13731,7 +13947,7 @@ function computeSpecialistDomains(accountId) {
   if (!existsSync24(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync17(specialistsDir);
+    entries = readdirSync18(specialistsDir);
   } catch {
     return [];
   }
@@ -13777,7 +13993,7 @@ function computeDormantPlugins(accountId) {
   if (!existsSync24(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync27(accountFile, "utf-8");
+    const raw = readFileSync28(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -13792,7 +14008,7 @@ function computeDormantPlugins(accountId) {
   if (!existsSync24(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync17(pluginsDir);
+    entries = readdirSync18(pluginsDir);
   } catch {
     return [];
   }
@@ -13803,7 +14019,7 @@ function computeDormantPlugins(accountId) {
     if (!existsSync24(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync27(manifestPath, "utf-8");
+      manifest = readFileSync28(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -13817,13 +14033,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync25, readFileSync as readFileSync28 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync29 } from "fs";
 import { resolve as resolve20 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync25(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync28(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync29(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -13837,7 +14053,7 @@ function resolveTunnelUrl() {
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync28(resolve20(platformRoot3, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync29(resolve20(platformRoot3, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -14080,7 +14296,7 @@ var events_default = app20;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync26 } from "fs";
-import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename } from "fs/promises";
+import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename, rmdir } from "fs/promises";
 import { realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID9 } from "crypto";
 import { basename as basename9, dirname as dirname10, join as join29, relative as relative4, resolve as resolve22, sep as sep6 } from "path";
@@ -14958,19 +15174,55 @@ async function readAccountNames() {
   }
   return map;
 }
+async function servableFilesIn(dirAbs, uuid) {
+  const metaName = `${uuid}.meta.json`;
+  let dirents;
+  try {
+    dirents = await readdir3(dirAbs, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const d of dirents) {
+    if (!d.isFile()) continue;
+    if (d.name === metaName) continue;
+    if (d.name.endsWith(EXTRACTED_TEXT_SUFFIX)) continue;
+    out.push(d.name);
+  }
+  return out;
+}
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const meta = await readMeta(join29(absolute, entry.name), entry.name);
+    const dirAbs = join29(absolute, entry.name);
+    const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
+      const servable = await servableFilesIn(dirAbs, entry.name);
+      if (servable.length === 1) {
+        const innerName = servable[0];
+        let size = null;
+        let modifiedAt = entry.modifiedAt;
+        try {
+          const st = await stat4(join29(dirAbs, innerName));
+          size = st.size;
+          modifiedAt = st.mtime.toISOString();
+        } catch {
+        }
+        entry.kind = "file";
+        entry.displayName = meta.filename;
+        entry.mimeType = meta.mimeType;
+        entry.sizeBytes = size;
+        entry.modifiedAt = modifiedAt;
+        entry.entryPath = `${entry.name}/${innerName}`;
+        return "flattened";
+      }
       entry.displayName = meta.filename;
-      entry.mimeType = meta.mimeType;
-      return;
+      return "kept-as-dir";
     }
     const accountName = accountNames.get(entry.name);
     if (accountName) {
       entry.displayName = accountName;
     }
-    return;
+    return null;
   }
   if (entry.kind === "file") {
     const dot = entry.name.lastIndexOf(".");
@@ -14983,6 +15235,7 @@ async function enrich(absolute, entry, accountNames) {
       }
     }
   }
+  return null;
 }
 function buildDisplayPath(relPath, accountNames) {
   if (relPath === "." || relPath === "") return [];
@@ -15138,8 +15391,18 @@ app21.get("/", requireAdminSession, async (c) => {
       }
     }
     const accountNames = await readAccountNames();
-    await Promise.all(entries.map((e) => enrich(absolute, e, accountNames)));
+    const classes = await Promise.all(entries.map((e) => enrich(absolute, e, accountNames)));
     sortDirEntries(entries);
+    let flattened = 0;
+    let keptAsDir = 0;
+    for (const cls of classes) {
+      if (cls === "flattened") flattened++;
+      else if (cls === "kept-as-dir") keptAsDir++;
+    }
+    const containers = flattened + keptAsDir;
+    if (containers > 0) {
+      console.error(`[data] op=uploads-flatten containers=${containers} flattened=${flattened} kept-as-dir=${keptAsDir}`);
+    }
     const displayPath = buildDisplayPath(relPath, accountNames);
     console.error(`[data] file-list path="${relPath}" entries=${entries.length}`);
     return c.json({ path: relPath, displayPath, entries });
@@ -15228,8 +15491,16 @@ app21.get("/download", requireAdminSession, async (c) => {
       });
     }
     console.error(`[data] file-download root="${root}" path="${relPath}" size=${info.size}`);
-    const safeQuotedName = filename.replace(/[\r\n"\\]/g, "_");
-    const encodedName = encodeURIComponent(filename);
+    let downloadName = filename;
+    if (root === "data") {
+      const parsed = parseAttachmentPath(relPath);
+      if (parsed) {
+        const meta = await readMeta(dirname10(absolute), parsed.attachmentId);
+        if (meta?.filename) downloadName = meta.filename;
+      }
+    }
+    const safeQuotedName = downloadName.replace(/[\r\n"\\]/g, "_");
+    const encodedName = encodeURIComponent(downloadName);
     return new Response(webStream, {
       status: 200,
       headers: {
@@ -15324,7 +15595,13 @@ app21.get("/download-zip", requireAdminSession, async (c) => {
           if (over) return over;
         }
       } else if (info.isFile()) {
-        const over = await addFile(absolute, info.size, basename9(absolute));
+        let member = basename9(absolute);
+        const parsed = parseAttachmentPath(relPath);
+        if (parsed) {
+          const meta = await readMeta(dirname10(absolute), parsed.attachmentId);
+          if (meta?.filename) member = meta.filename;
+        }
+        const over = await addFile(absolute, info.size, member);
         if (over) return over;
       } else {
         return c.json({ error: "Path is not a file or directory" }, 400);
@@ -15744,7 +16021,9 @@ app21.delete("/", requireAdminSession, async (c) => {
     }
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join29(dirname10(absolute), `${stem}.meta.json`) : null;
+    const containerDir = dirname10(absolute);
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join29(containerDir, `${stem}.meta.json`) : null;
+    const isAttachmentContainer = UUID_RE3.test(stem) && basename9(containerDir) === stem;
     await unlink2(absolute);
     if (sidecarPath) {
       try {
@@ -15752,6 +16031,12 @@ app21.delete("/", requireAdminSession, async (c) => {
       } catch {
       }
     }
+    if (isAttachmentContainer) {
+      await unlink2(join29(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      });
+      await rmdir(containerDir).catch(() => {
+      });
+    }
     console.error(`[data] file-delete path="${relPath}" bytes=${info.size}`);
     try {
       await dropFileIndex(accountId, relPath);
@@ -16850,6 +17135,142 @@ function isHiddenByDefault(label) {
   return HIDDEN_BY_DEFAULT_LABELS.has(label);
 }
 
+// server/lib/top-level-labels.ts
+import { readdirSync as readdirSync19, readFileSync as readFileSync30 } from "fs";
+import { join as join30, resolve as resolve23 } from "path";
+var STATIC_TOP_LEVEL_LABELS = Object.freeze(
+  /* @__PURE__ */ new Set([
+    // Base-schema infra (schema-base.md has no top-level section).
+    "LocalBusiness",
+    "Service",
+    "PriceSpecification",
+    "OpeningHoursSpecification",
+    "Organization",
+    "Person",
+    "UserProfile",
+    "Preference",
+    "AdminUser",
+    "AccessGrant",
+    "KnowledgeDocument",
+    "DigitalDocument",
+    "CreativeWork",
+    "Question",
+    "FAQPage",
+    "DefinedTerm",
+    "Review",
+    "ImageObject",
+    "Invoice",
+    "Task",
+    "Project",
+    "Event",
+    "Workflow",
+    "Email",
+    "EmailAccount",
+    "Agent",
+    // Knowledge-work vertical: schema-knowledge-work.md has no top-level
+    // section yet.
+    "Objective",
+    "KeyResult",
+    "Decision",
+    "Risk",
+    "Source",
+    "Finding",
+    "Hypothesis"
+  ])
+);
+function splitPipeRow(row) {
+  let trimmed = row.trim();
+  if (trimmed.startsWith("|")) trimmed = trimmed.slice(1);
+  if (trimmed.endsWith("|")) trimmed = trimmed.slice(0, -1);
+  const cells = [];
+  let inBacktick = false;
+  let start = 0;
+  for (let i = 0; i < trimmed.length; i++) {
+    const ch = trimmed[i];
+    if (ch === "`") inBacktick = !inBacktick;
+    else if (ch === "|" && !inBacktick) {
+      cells.push(trimmed.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  cells.push(trimmed.slice(start).trim());
+  return cells;
+}
+var stripBackticks = (s) => s.replace(/`/g, "").trim();
+function parseTopLevelLabels(content) {
+  const lines = content.split(/\r?\n/);
+  let i = 0;
+  while (i < lines.length) {
+    if (lines[i].toLowerCase().startsWith("## top-level node types")) break;
+    i++;
+  }
+  if (i >= lines.length) return [];
+  i++;
+  for (; i < lines.length - 1; i++) {
+    const line = lines[i];
+    if (line.startsWith("## ")) return [];
+    if (!line.includes("|")) continue;
+    const sep9 = lines[i + 1];
+    if (!/^\s*\|?[\s:|-]+\|?\s*$/.test(sep9) || !sep9.includes("-")) continue;
+    const headers = splitPipeRow(line).map((h) => stripBackticks(h).toLowerCase());
+    const labelCol = headers.findIndex((h) => h === "neo4j label");
+    if (labelCol === -1) return [];
+    const out = [];
+    let j = i + 2;
+    for (; j < lines.length; j++) {
+      const row = lines[j];
+      if (!row.trim() || !row.includes("|")) break;
+      const cells = splitPipeRow(row);
+      const label = stripBackticks(cells[labelCol] ?? "");
+      if (label) out.push(label);
+    }
+    return out;
+  }
+  return [];
+}
+function resolveReferencesDir() {
+  if (process.env.MAXY_PLATFORM_ROOT) {
+    return join30(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+  }
+  return resolve23(import.meta.dirname, "../../../plugins/memory/references");
+}
+function parseTableTopLevelLabels(referencesDir) {
+  const labels = /* @__PURE__ */ new Set();
+  const contributingFiles = [];
+  try {
+    const fileNames = readdirSync19(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
+    for (const fileName of fileNames) {
+      const content = readFileSync30(join30(referencesDir, fileName), "utf-8");
+      const parsed = parseTopLevelLabels(content);
+      if (parsed.length > 0) contributingFiles.push(fileName);
+      for (const label of parsed) labels.add(label);
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(
+      `[graph-page] op=top-level-labels source=ontology status=error dir=${referencesDir} reason="${message}"
+`
+    );
+    throw err;
+  }
+  return { labels, contributingFiles };
+}
+var cached = null;
+function getTopLevelLabelAllowlist(opts = {}) {
+  if (!opts.referencesDir && cached) return cached;
+  const referencesDir = opts.referencesDir ?? resolveReferencesDir();
+  const { labels: derived, contributingFiles } = parseTableTopLevelLabels(referencesDir);
+  const derivedCount = derived.size;
+  for (const label of STATIC_TOP_LEVEL_LABELS) derived.add(label);
+  const result = Object.freeze(derived);
+  process.stderr.write(
+    `[graph-page] op=top-level-labels source=ontology count=${derived.size} files=${contributingFiles.join("|") || "none"} derived=${derivedCount} static=${STATIC_TOP_LEVEL_LABELS.size}
+`
+  );
+  if (!opts.referencesDir) cached = result;
+  return result;
+}
+
 // server/routes/admin/graph-subgraph.ts
 var CEILING = 2e3;
 var TOP_LEVEL_LIMIT = 1e3;
@@ -16971,7 +17392,7 @@ async function handleDefault(c, accountId) {
 }
 async function handleDefaultTopLevel(c, accountId, flags) {
   const { includeTrashed, includeAgentActions } = flags;
-  const labels = [...FILTER_TOP_LEVEL_LABELS].filter((l) => !HIDDEN_BY_DEFAULT_LABELS.has(l));
+  const labels = [...getTopLevelLabelAllowlist()].filter((l) => !HIDDEN_BY_DEFAULT_LABELS.has(l));
   const agentActionLabels = [...AGENT_ACTION_LABELS];
   const started = Date.now();
   const session = getSession();
@@ -17782,7 +18203,7 @@ app26.get("/", requireAdminSession, async (c) => {
   const started = Date.now();
   const session = getSession();
   try {
-    const allowedSet = new Set(FILTER_TOP_LEVEL_LABELS);
+    const allowedSet = new Set(getTopLevelLabelAllowlist());
     if (includeAgentActions) {
       for (const label of AGENT_ACTION_LABELS) allowedSet.add(label);
     }
@@ -17944,12 +18365,12 @@ function validateBody(body) {
     if (typeof lbl !== "string") {
       return { ok: false, code: "shape", reason: "labels must be an array of strings" };
     }
-    if (!FILTER_TOP_LEVEL_LABELS.has(lbl)) {
+    if (!getTopLevelLabelAllowlist().has(lbl)) {
       return {
         ok: false,
         code: "not-eligible-chip",
         label: lbl,
-        reason: `label "${lbl}" is not eligible for default view \u2014 outside the chip allowlist (FILTER_TOP_LEVEL_LABELS)`
+        reason: `label "${lbl}" is not eligible for default view \u2014 outside the chip allowlist`
       };
     }
     seen.add(lbl);
@@ -17972,7 +18393,7 @@ var graph_default_view_default = app27;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve23, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
+import { resolve as resolve24, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
 import { existsSync as existsSync27 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -17992,7 +18413,7 @@ app28.get("/", requireAdminSession, async (c) => {
   if (accountFiles === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve23(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve24(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...accountFiles, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -18044,8 +18465,8 @@ async function fetchAccountFileArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve23(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve23(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve24(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve24(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -18058,12 +18479,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve23(accountDir, "specialists", "agents");
-  const bundledDir = resolve23(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve24(accountDir, "specialists", "agents");
+  const bundledDir = resolve24(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve23(overrideDir, filename);
-    const bundledPath = resolve23(bundledDir, filename);
+    const overridePath = resolve24(overrideDir, filename);
+    const bundledPath = resolve24(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -18345,7 +18766,7 @@ var session_usage_default = app33;
 
 // server/routes/admin/session-rc-spawn.ts
 import { randomUUID as randomUUID10 } from "crypto";
-var ACCOUNT_UUID_RE2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+var ACCOUNT_UUID_RE3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10, adminUserId, authenticatedName, callerAccountId) {
   const operator = isOperatorHost(host, operatorDomains);
   const resumeId = typeof body.sessionId === "string" && body.sessionId.length > 0 ? body.sessionId : void 0;
@@ -18356,8 +18777,8 @@ function resolveSpawnPlan(host, operatorDomains, body, mintId = randomUUID10, ad
   const pickedModel = kind === "new" && typeof body.model === "string" && isSelectableModel(body.model) ? body.model : null;
   const pickedEffort = kind === "new" && typeof body.effort === "string" && isNewSessionEffortLevel(body.effort) ? body.effort : null;
   const paramsSource = pickedModel !== null && pickedEffort !== null ? "picker" : "default";
-  const callerTargetAccountId = typeof callerAccountId === "string" && ACCOUNT_UUID_RE2.test(callerAccountId) ? callerAccountId : void 0;
-  const bodyTargetAccountId = typeof body.targetAccountId === "string" && ACCOUNT_UUID_RE2.test(body.targetAccountId) ? body.targetAccountId : void 0;
+  const callerTargetAccountId = typeof callerAccountId === "string" && ACCOUNT_UUID_RE3.test(callerAccountId) ? callerAccountId : void 0;
+  const bodyTargetAccountId = typeof body.targetAccountId === "string" && ACCOUNT_UUID_RE3.test(body.targetAccountId) ? body.targetAccountId : void 0;
   const targetAccountId = kind === "new" ? callerTargetAccountId : bodyTargetAccountId;
   const payload = {};
   let sessionId;
@@ -18708,24 +19129,24 @@ app36.get("/", async (c) => {
 var system_stats_default = app36;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync28, readFileSync as readFileSync29 } from "fs";
-import { resolve as resolve24, join as join30 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+import { existsSync as existsSync28, readFileSync as readFileSync31 } from "fs";
+import { resolve as resolve25, join as join31 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join30(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join31(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync28(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync29(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync31(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
 }
-var VERSION_FILE = resolve24(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve25(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
   if (!existsSync28(VERSION_FILE)) return "unknown";
-  return readFileSync29(VERSION_FILE, "utf-8").trim() || "unknown";
+  return readFileSync31(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -19502,7 +19923,7 @@ var browser_default = app44;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync29 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -19601,8 +20022,8 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync30 } from "fs";
-import { join as join31 } from "path";
+import { readFileSync as readFileSync32 } from "fs";
+import { join as join32 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -19611,10 +20032,10 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path2 = join31(accountDir, AVAILABILITY_FILENAME);
+  const path2 = join32(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync30(path2, "utf-8");
+    raw = readFileSync32(path2, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path2} not found`);
   }
@@ -19973,7 +20394,7 @@ app45.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync29(join32(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync29(join33(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -20447,9 +20868,9 @@ var verify_token_default = app52;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve25 } from "path";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
-var SEND_SCRIPT = resolve25(
+import { resolve as resolve26 } from "path";
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
+var SEND_SCRIPT = resolve26(
   PLATFORM_ROOT7,
   "plugins",
   "email",
@@ -20591,8 +21012,8 @@ app54.route("/request-magic-link", request_magic_link_default);
 var access_default = app54;
 
 // server/routes/sites.ts
-import { existsSync as existsSync30, readFileSync as readFileSync31, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
-import { resolve as resolve26 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync33, realpathSync as realpathSync6, statSync as statSync12 } from "fs";
+import { resolve as resolve27 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -20649,8 +21070,8 @@ app55.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve26(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve26(rootDir, ...segments);
+  const rootDir = resolve27(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve27(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -20670,7 +21091,7 @@ app55.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat8?.isDirectory()) {
-    filePath = resolve26(filePath, "index.html");
+    filePath = resolve27(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -20695,7 +21116,7 @@ app55.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync31(realPath);
+    body = readFileSync33(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -20731,7 +21152,7 @@ var sites_default = app55;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync32, writeFileSync as writeFileSync11 } from "fs";
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync34, writeFileSync as writeFileSync11 } from "fs";
 import { dirname as dirname11 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -20740,7 +21161,7 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync32(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync34(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
@@ -20754,7 +21175,7 @@ function getSecret() {
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync32(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync34(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -20807,20 +21228,20 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync31, readFileSync as readFileSync33 } from "fs";
-import { join as join33 } from "path";
-var cached = null;
+import { existsSync as existsSync31, readFileSync as readFileSync35 } from "fs";
+import { join as join34 } from "path";
+var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
-  if (cachedAttempted) return cached;
+  if (cachedAttempted) return cached2;
   cachedAttempted = true;
   const platformRoot3 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot3) return null;
-  const brandPath = join33(platformRoot3, "config", "brand.json");
+  const brandPath = join34(platformRoot3, "config", "brand.json");
   if (!existsSync31(brandPath)) return null;
   try {
-    cached = JSON.parse(readFileSync33(brandPath, "utf-8"));
-    return cached;
+    cached2 = JSON.parse(readFileSync35(brandPath, "utf-8"));
+    return cached2;
   } catch {
     return null;
   }
@@ -21307,14 +21728,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app58;
 
 // server/routes/session.ts
-import { resolve as resolve27 } from "path";
+import { resolve as resolve28 } from "path";
 import { existsSync as existsSync32, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve27(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve28(MAXY_DIR, "branding-cache", accountId);
     mkdirSync8(cacheDir, { recursive: true });
-    writeFileSync12(resolve27(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync12(resolve28(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -21391,8 +21812,8 @@ app59.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve27(account.accountDir, "agents", agentSlug);
-    if (!existsSync32(agentDir) || !existsSync32(resolve27(agentDir, "config.json"))) {
+    const agentDir = resolve28(account.accountDir, "agents", agentSlug);
+    if (!existsSync32(agentDir) || !existsSync32(resolve28(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -21838,8 +22259,8 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve28, sep as sep8 } from "path";
-var ACCOUNT_UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+import { resolve as resolve29, sep as sep8 } from "path";
+var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["accounts"];
 function _routeEvent(rootName, filename) {
@@ -21847,7 +22268,7 @@ function _routeEvent(rootName, filename) {
   const segs = filename.split(sep8).filter(Boolean);
   if (segs.length < 2) return null;
   const accountId = segs[0];
-  if (!ACCOUNT_UUID_RE3.test(accountId)) return null;
+  if (!ACCOUNT_UUID_RE4.test(accountId)) return null;
   return { accountId, relativePath: `${rootName}/${segs.join("/")}` };
 }
 async function startFileWatcher(opts = {}) {
@@ -21857,7 +22278,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve28(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve29(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -21878,7 +22299,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve28(dataRoot, relativePath);
+    const absolute = resolve29(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -21902,7 +22323,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve28(dataRoot, rootName);
+    const absRoot = resolve29(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -21941,8 +22362,8 @@ async function startFileWatcher(opts = {}) {
 
 // app/lib/migrate-uploads.ts
 import { mkdir as mkdir5, readdir as readdir5, rename as rename2, rm as rm3 } from "fs/promises";
-import { dirname as dirname12, relative as relative6, resolve as resolve29 } from "path";
-var ACCOUNT_UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+import { dirname as dirname12, relative as relative6, resolve as resolve30 } from "path";
+var ACCOUNT_UUID_RE5 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function walkFiles(dir) {
   const out = [];
   let entries;
@@ -21952,7 +22373,7 @@ async function walkFiles(dir) {
     return out;
   }
   for (const e of entries) {
-    const abs = resolve29(dir, e.name);
+    const abs = resolve30(dir, e.name);
     if (e.isDirectory()) {
       out.push(...await walkFiles(abs));
     } else if (e.isFile()) {
@@ -21972,7 +22393,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
   let moved = 0;
   for (const oldAbs of files) {
     const suffix = relative6(srcDir, oldAbs);
-    const newAbs = resolve29(destDir, suffix);
+    const newAbs = resolve30(destDir, suffix);
     await mkdir5(dirname12(newAbs), { recursive: true });
     await rename2(oldAbs, newAbs);
     moved++;
@@ -21999,7 +22420,7 @@ async function relocateTree(srcDir, destDir, dataRoot, accountId, session) {
 }
 async function migrateUploads(opts = {}) {
   const dataRoot = opts.dataRoot ?? DATA_ROOT;
-  const oldRoot = resolve29(dataRoot, "uploads");
+  const oldRoot = resolve30(dataRoot, "uploads");
   let topEntries;
   try {
     topEntries = await readdir5(oldRoot, { withFileTypes: true });
@@ -22018,10 +22439,10 @@ async function migrateUploads(opts = {}) {
   try {
     for (const entry of topEntries) {
       const name = entry.name;
-      if (ACCOUNT_UUID_RE4.test(name)) {
+      if (ACCOUNT_UUID_RE5.test(name)) {
         moved += await relocateTree(
-          resolve29(oldRoot, name),
-          resolve29(dataRoot, "accounts", name, "uploads"),
+          resolve30(oldRoot, name),
+          resolve30(dataRoot, "accounts", name, "uploads"),
           dataRoot,
           name,
           session
@@ -22033,8 +22454,8 @@ async function migrateUploads(opts = {}) {
           continue;
         }
         moved += await relocateTree(
-          resolve29(oldRoot, "public"),
-          resolve29(dataRoot, "accounts", installAccountId, "uploads", "public"),
+          resolve30(oldRoot, "public"),
+          resolve30(dataRoot, "accounts", installAccountId, "uploads", "public"),
           dataRoot,
           null,
           // public uploads carry no graph nodes
@@ -22065,7 +22486,7 @@ async function migrateUploads(opts = {}) {
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
 import { existsSync as existsSync33 } from "fs";
-import { join as join34 } from "path";
+import { join as join35 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -22110,7 +22531,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join34(projectsRoot, slug.name);
+    const slugDir = join35(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -22119,9 +22540,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join34(slugDir, entry.name));
+        out.push(join35(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join34(slugDir, entry.name);
+        const subDir = join35(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -22129,7 +22550,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join34(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join35(subDir, s.name));
         }
       }
     }
@@ -22141,7 +22562,7 @@ function shortId(path2) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join34(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join35(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -23120,16 +23541,16 @@ var WebchatGateway = class _WebchatGateway {
    *  The public /api/chat route awaits this to return the reply on the same SSE
    *  response, preserving the pre-756 POST→single-blob browser contract. */
   awaitReply(key, timeoutMs) {
-    return new Promise((resolve34) => {
+    return new Promise((resolve35) => {
       const timer2 = setTimeout(() => {
         this.replyAwaiters.delete(key);
-        resolve34({ timeout: true });
+        resolve35({ timeout: true });
       }, timeoutMs);
       if (timer2.unref) timer2.unref();
       this.replyAwaiters.set(key, (r) => {
         clearTimeout(timer2);
         this.replyAwaiters.delete(key);
-        resolve34(r);
+        resolve35(r);
       });
     });
   }
@@ -23140,11 +23561,11 @@ var WebchatGateway = class _WebchatGateway {
    *  terminal dialog stays answerable). */
   awaitPermissionVerdict(p, timeoutMs) {
     const k = _WebchatGateway.promptKey(p.key, p.requestId);
-    return new Promise((resolve34) => {
+    return new Promise((resolve35) => {
       this.pendingPrompts.get(k)?.resolve({ timeout: true });
       const timer2 = setTimeout(() => {
         this.pendingPrompts.delete(k);
-        resolve34({ timeout: true });
+        resolve35({ timeout: true });
       }, timeoutMs);
       if (timer2.unref) timer2.unref();
       this.pendingPrompts.set(k, {
@@ -23153,7 +23574,7 @@ var WebchatGateway = class _WebchatGateway {
         resolve: (r) => {
           clearTimeout(timer2);
           this.pendingPrompts.delete(k);
-          resolve34(r);
+          resolve35(r);
         }
       });
       console.error(`[webchat:perm] op=open key=${keyDisplay(p.key)} id=${p.requestId} tool=${p.toolName}`);
@@ -24149,7 +24570,7 @@ function buildTelegramSpawnRequest(input) {
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync7 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
-import { resolve as resolve30, basename as basename11 } from "path";
+import { resolve as resolve31, basename as basename11 } from "path";
 var TAG42 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
@@ -24160,7 +24581,7 @@ async function sendTelegramDocument(input) {
   if (!maxyAccountId || !platformRoot3) {
     return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
   }
-  const accountDir = resolve30(platformRoot3, "..", "data/accounts", maxyAccountId);
+  const accountDir = resolve31(platformRoot3, "..", "data/accounts", maxyAccountId);
   let resolvedPath;
   try {
     resolvedPath = realpathSync7(filePath);
@@ -24287,12 +24708,12 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve31, join as join35 } from "path";
+import { resolve as resolve32, join as join36 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join35(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve32(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
@@ -24554,8 +24975,8 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync34, readFileSync as readFileSync34, statSync as statSync13 } from "fs";
-import { resolve as resolve32 } from "path";
+import { existsSync as existsSync34, readFileSync as readFileSync36, statSync as statSync13 } from "fs";
+import { resolve as resolve33 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -24590,7 +25011,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve32(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve33(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -24602,7 +25023,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve32(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve33(brand.configDir, "entitlement.json");
   if (!existsSync34(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -24618,7 +25039,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync34(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync36(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -24632,7 +25053,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync34(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync36(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -24793,14 +25214,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join36(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join37(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync35(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
 if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync37(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -24832,11 +25253,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join36(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join37(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync35(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync35(ALIAS_DOMAINS_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync37(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -24899,7 +25320,7 @@ async function recordPassiveDispatch(input) {
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -24914,7 +25335,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, ".."))
+      platformRoot: resolve34(process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -25512,8 +25933,8 @@ app61.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve33(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve33(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve34(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve34(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -25525,7 +25946,7 @@ app61.get("/agent-assets/:slug/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync35(filePath);
+  const body = readFileSync37(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
@@ -25542,8 +25963,8 @@ app61.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve33(account.accountDir, "generated", filename);
-  const expectedDir = resolve33(account.accountDir, "generated");
+  const filePath = resolve34(account.accountDir, "generated", filename);
+  const expectedDir = resolve34(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -25555,7 +25976,7 @@ app61.get("/generated/:filename", (c) => {
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync35(filePath);
+  const body = readFileSync37(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
@@ -25570,7 +25991,7 @@ var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
 if (BRAND_JSON_PATH && existsSync35(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync35(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync37(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -25597,11 +26018,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync35(resolve33(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync35(resolve34(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync35(resolve33(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync37(resolve34(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -25609,9 +26030,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join36(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join37(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync35(versionFile)) return "unknown";
-    const content = readFileSync35(versionFile, "utf-8").trim();
+    const content = readFileSync37(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -25652,7 +26073,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync35(resolve33(process.cwd(), "public", file), "utf-8");
+    html = readFileSync37(resolve34(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -25669,13 +26090,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join36(homedir4(), BRAND.configDir);
+  const configDir2 = join37(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join36(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join37(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync35(cachePath)) return null;
-    return JSON.parse(readFileSync35(cachePath, "utf-8"));
+    return JSON.parse(readFileSync37(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -25692,11 +26113,11 @@ var brandedHtmlCache = /* @__PURE__ */ new Map();
 function brandedPublicHtml(agentSlug) {
   const baseHtml = cachedHtml("public.html");
   if (!agentSlug) return baseHtml;
-  const cached2 = brandedHtmlCache.get(agentSlug);
+  const cached3 = brandedHtmlCache.get(agentSlug);
   const branding = loadBrandingCache(agentSlug);
   if (!branding) return baseHtml;
   const brandHash = JSON.stringify(branding).length;
-  if (cached2 && cached2.mtime === brandHash) return cached2.html;
+  if (cached3 && cached3.mtime === brandHash) return cached3.html;
   const title = escapeHtml(branding.name);
   const description = branding.tagline ? escapeHtml(branding.tagline) : "";
   const themeColor = branding.primaryColor || "";
@@ -25770,7 +26191,7 @@ app61.use("/vnc-popout.html", logViewerFetch);
 app61.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync35(resolve33(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync37(resolve34(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -25902,8 +26323,8 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app61.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
-  const reconcileScript = resolve33(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..");
+  const reconcileScript = resolve34(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
     if (!existsSync35(reconcileScript)) return;
@@ -25924,8 +26345,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   loop.unref();
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
-  const publishScript = resolve33(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..");
+  const publishScript = resolve34(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const currentAccount = () => {
     try {
@@ -25954,21 +26375,21 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const auditSnapshotAge = (account) => {
-    const availPath = resolve33(account.accountDir, "calendar-availability.json");
+    const availPath = resolve34(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
       if (existsSync35(availPath)) {
-        const cfg = JSON.parse(readFileSync35(availPath, "utf-8"));
+        const cfg = JSON.parse(readFileSync37(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
     }
     if (!hasBookingSite) return;
-    const statePath = resolve33(account.accountDir, "state", "booking-availability", "last-publish.json");
+    const statePath = resolve34(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
     if (existsSync35(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync35(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync37(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -25992,8 +26413,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 startTimeEntryCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..");
-  const auditScript = resolve33(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..");
+  const auditScript = resolve34(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
@@ -26111,7 +26532,7 @@ async function runAdminUserReconcileTick() {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync35(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync37(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -26141,7 +26562,7 @@ if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
   if (!existsSync35(USERS_FILE)) return 0;
-  const raw = readFileSync35(USERS_FILE, "utf-8").trim();
+  const raw = readFileSync37(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -26261,7 +26682,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve33(process.env.MAXY_PLATFORM_ROOT ?? join36(__dirname, "..")),
+  platformRoot: resolve34(process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {