@rubytech/create-maxy-code 0.1.469 → 0.1.471

package/payload/server/server.js

@@ -42,6 +42,7 @@ import {
   embed,
   emitMissingOnResolve,
   ensureConversation,
+  ensureSessionConversation,
   fetchAccountName,
   fetchBranding,
   findMissingPlugins,
@@ -111,7 +112,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-POBXIHOF.js";
+} from "./chunk-BSTIQX52.js";
 import {
   D1_MAX_SQL_STATEMENT_BYTES,
   D1_QUERY_MAX_BODY_BYTES,
@@ -1533,10 +1534,10 @@ var serveStatic = (options = { root: "" }) => {
 };
 
 // server/index.ts
-import { readFileSync as readFileSync38, existsSync as existsSync36, watchFile, readdirSync as readdirSync21, statSync as statSync14 } from "fs";
+import { readFileSync as readFileSync39, existsSync as existsSync37, watchFile, readdirSync as readdirSync23, statSync as statSync14 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { resolve as resolve36, join as join38, basename as basename12 } from "path";
+import { resolve as resolve36, join as join39, basename as basename12 } from "path";
 import { homedir as homedir4 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -6675,8 +6676,8 @@ function webchatTurnTimeoutMs() {
   return Number(process.env.WEBCHAT_TURN_TIMEOUT_MS ?? String(2 * 6e4));
 }
 function createChatRoutes(deps) {
-  const app63 = new Hono();
-  app63.post("/", async (c) => {
+  const app64 = new Hono();
+  app64.post("/", async (c) => {
     console.log(`[chat-route] entered route=public method=POST`);
     const contentType = c.req.header("content-type") ?? "";
     const account = resolveAccount();
@@ -6940,7 +6941,7 @@ ${result.result.text}` : result.result.text;
       }
     });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/channel-pty-bridge/admin-session-id.ts
@@ -6974,8 +6975,8 @@ function isLoopbackAddr(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
 function createScheduleInjectRoutes(deps) {
-  const app63 = new Hono();
-  app63.post("/", async (c) => {
+  const app64 = new Hono();
+  app64.post("/", async (c) => {
     const env = c.env;
     const remoteAddr = env?.incoming?.socket?.remoteAddress ?? "";
     if (!isLoopbackAddr(remoteAddr)) {
@@ -7076,11 +7077,11 @@ function createScheduleInjectRoutes(deps) {
     console.error(`${TAG17} op=inject-spawn eventId=${eventId} sessionId=${sessionId} result=ok status=-`);
     return c.json({ ok: true }, 200);
   });
-  return app63;
+  return app64;
 }
 
 // server/index.ts
-var import_dist9 = __toESM(require_dist(), 1);
+var import_dist10 = __toESM(require_dist(), 1);
 
 // app/lib/whatsapp/socket-resolution-error.ts
 function formatPresentKeys(presentKeys) {
@@ -12012,8 +12013,8 @@ async function reapplyLeversViaManager() {
 var WEBCHAT_SEND_TURN_WINDOW_MS = Number(process.env.WEBCHAT_SEND_TURN_WINDOW_MS ?? String(15e3));
 var sendSeq = 0;
 function createWebchatRoutes(deps) {
-  const app63 = new Hono();
-  app63.post("/send", requireAdminSession, async (c) => {
+  const app64 = new Hono();
+  app64.post("/send", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12225,7 +12226,7 @@ ${note}` : note;
     if (turnTimer.unref) turnTimer.unref();
     return c.json({ ok: true });
   });
-  app63.post("/interrupt", requireAdminSession, async (c) => {
+  app64.post("/interrupt", requireAdminSession, async (c) => {
     const cacheKey = c.get("cacheKey");
     const requesterUserId = (cacheKey ? getUserIdForSession(cacheKey) : void 0) ?? null;
     const primaryUserId = resolvePrimaryAdminUserId();
@@ -12253,7 +12254,7 @@ ${note}` : note;
     }
     return c.json({ ok: true, stopped: outcome.stopped, intId: outcome.intId, deadChild: outcome.deadChild }, 200);
   });
-  app63.post("/settings", requireAdminSession, async (c) => {
+  app64.post("/settings", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const op = body?.op;
     const value = body?.value;
@@ -12293,7 +12294,7 @@ ${note}` : note;
     console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
-  app63.get("/session", requireAdminSession, async (c) => {
+  app64.get("/session", requireAdminSession, async (c) => {
     let accountId;
     try {
       accountId = resolvePlatformAccountId();
@@ -12371,7 +12372,7 @@ ${note}` : note;
     const indicators = await fetchComposerIndicators(sessionId);
     return c.json({ sessionId, projectDir, source, sizeBytes: jsonlSizeBytes(projectDir, sessionId), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${sessionId}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${sessionId}`) ?? null, ...indicators, ...readLevers(account) });
   });
-  app63.post("/permission-verdict", requireAdminSession, async (c) => {
+  app64.post("/permission-verdict", requireAdminSession, async (c) => {
     const body = await c.req.json().catch(() => null);
     const sessionId = body?.sessionId;
     const requestId = body?.request_id;
@@ -12388,7 +12389,7 @@ ${note}` : note;
     const ok = deps.resolvePermissionVerdict?.(`session:${sessionId}`, requestId, behavior) ?? false;
     return c.json({ ok });
   });
-  return app63;
+  return app64;
 }
 
 // server/routes/webchat-greeting.ts
@@ -12788,9 +12789,249 @@ app9.get("/callback", async (c) => {
 });
 var quickbooks_default = app9;
 
+// server/routes/google-oauth.ts
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { chmodSync, existsSync as existsSync17, mkdirSync as mkdirSync5, readdirSync as readdirSync16, readFileSync as readFileSync25, renameSync as renameSync6, rmSync as rmSync2, writeFileSync as writeFileSync9 } from "fs";
+import { join as join24 } from "path";
+var TAG26 = "[google-oauth]";
+var TOKEN_URL = "https://oauth2.googleapis.com/token";
+var PRIMARY_CALENDAR_URL = "https://www.googleapis.com/calendar/v3/calendars/primary";
+var PENDING_LIFETIME_MS = 6e5;
+function sanitizeAccountKey(key) {
+  const safe = key.replace(/[^A-Za-z0-9._-]/g, "_");
+  return safe === "." || safe === ".." ? `_${safe}` : safe;
+}
+function secretsDir(accountsDir, accountId) {
+  return join24(accountsDir, sanitizeAccountKey(accountId), "secrets", "google");
+}
+function esc(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function refreshTokenBelongsToAccount(accountsDir, accountId, refreshToken) {
+  const dir = join24(secretsDir(accountsDir, accountId), "accounts");
+  if (!existsSync17(dir)) return false;
+  let key;
+  try {
+    key = loadKey(accountsDir, accountId);
+  } catch {
+    return false;
+  }
+  for (const entry of readdirSync16(dir)) {
+    const path3 = join24(dir, entry, "tokens.enc");
+    if (!existsSync17(path3)) continue;
+    try {
+      const blob = JSON.parse(decrypt(key, readFileSync25(path3, "utf-8").trim()));
+      if (blob.refreshToken && blob.refreshToken === refreshToken) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function loadKey(accountsDir, accountId) {
+  const dir = secretsDir(accountsDir, accountId);
+  const keyPath = join24(dir, ".key");
+  mkdirSync5(dir, { recursive: true, mode: 448 });
+  if (existsSync17(keyPath)) return Buffer.from(readFileSync25(keyPath, "utf-8").trim(), "base64");
+  const k = randomBytes(32);
+  writeFileSync9(keyPath, k.toString("base64"), { mode: 384 });
+  chmodSync(keyPath, 384);
+  return k;
+}
+function decrypt(key, raw) {
+  const [ivHex, payload] = raw.split(":");
+  const d = createDecipheriv("aes-256-cbc", key, Buffer.from(ivHex, "hex"));
+  return d.update(payload, "hex", "utf8") + d.final("utf8");
+}
+function encrypt(key, plain) {
+  const iv = randomBytes(16);
+  const c = createCipheriv("aes-256-cbc", key, iv);
+  return `${iv.toString("hex")}:${c.update(plain, "utf8", "hex") + c.final("hex")}`;
+}
+function atomicWrite(path3, contents) {
+  const temp = `${path3}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync9(temp, contents, { mode: 384 });
+    chmodSync(temp, 384);
+    renameSync6(temp, path3);
+  } catch (err) {
+    try {
+      rmSync2(temp, { force: true });
+    } catch {
+    }
+    throw err;
+  }
+}
+function readPending(accountsDir, accountId) {
+  const path3 = join24(secretsDir(accountsDir, accountId), "pending-oauth.enc");
+  if (!existsSync17(path3)) return null;
+  const raw = readFileSync25(path3, "utf-8").trim();
+  if (!raw) return null;
+  try {
+    return JSON.parse(decrypt(loadKey(accountsDir, accountId), raw));
+  } catch {
+    return null;
+  }
+}
+function clearPending(accountsDir, accountId) {
+  const path3 = join24(secretsDir(accountsDir, accountId), "pending-oauth.enc");
+  if (existsSync17(path3)) rmSync2(path3, { force: true });
+}
+function writeTokens(accountsDir, accountId, email, tok) {
+  const key = loadKey(accountsDir, accountId);
+  const dir = join24(secretsDir(accountsDir, accountId), "accounts", sanitizeAccountKey(email));
+  mkdirSync5(dir, { recursive: true, mode: 448 });
+  const now = Date.now();
+  const blob = {
+    accessToken: tok.accessToken,
+    refreshToken: tok.refreshToken,
+    accessTokenExpiry: now + tok.expiresInSeconds * 1e3,
+    lastRefresh: now,
+    email,
+    scopes: tok.scopes
+  };
+  atomicWrite(join24(dir, "tokens.enc"), encrypt(key, JSON.stringify(blob)));
+}
+function readHouseGoogleCreds(platformRoot5) {
+  const path3 = join24(platformRoot5, "config", "google-house.env");
+  if (!existsSync17(path3)) return null;
+  const env = {};
+  for (const line of readFileSync25(path3, "utf-8").split(/\r?\n/)) {
+    const m = line.match(/^([A-Z0-9_]+)=(.*)$/);
+    if (m) env[m[1]] = m[2].trim();
+  }
+  if (!env.GOOGLE_CLIENT_ID || !env.GOOGLE_CLIENT_SECRET) return null;
+  return { clientId: env.GOOGLE_CLIENT_ID, clientSecret: env.GOOGLE_CLIENT_SECRET };
+}
+function page2(title, body) {
+  return `<!doctype html><meta name="viewport" content="width=device-width,initial-scale=1"><title>${title}</title><div style="font:16px/1.5 system-ui;margin:3rem auto;max-width:30rem;padding:0 1rem"><h1 style="font-size:1.3rem">${title}</h1><p>${body}</p></div>`;
+}
+function createGoogleOAuthRoutes(platformRoot5, accountsDir) {
+  const routes = new Hono();
+  routes.get("/oauth/callback", async (c) => {
+    const code = c.req.query("code");
+    const state = c.req.query("state");
+    const accountId = c.req.query("account");
+    if (!code || !state || !accountId) {
+      console.error(`${TAG26} op=callback outcome=error error=missing-params`);
+      return c.html(page2("Missing parameters", "Return to your chat and start again."), 400);
+    }
+    const held = readPending(accountsDir, accountId);
+    const stateMatch = held !== null && held.state === state;
+    console.error(`${TAG26} op=callback reg=${state} account=${accountId} state-match=${stateMatch}`);
+    if (!held || !stateMatch) {
+      return c.html(page2("This link has expired", "Return to your chat and start again."), 400);
+    }
+    const ageMs = Date.now() - held.createdAt;
+    if (ageMs > PENDING_LIFETIME_MS) {
+      console.error(`${TAG26} op=callback reg=${state} outcome=error error=pending-expired ageMs=${ageMs}`);
+      clearPending(accountsDir, accountId);
+      return c.html(page2("This link has expired", "Return to your chat and start again."), 400);
+    }
+    const failed = (title, body, status) => {
+      clearPending(accountsDir, accountId);
+      return c.html(page2(title, body), status);
+    };
+    const creds = readHouseGoogleCreds(platformRoot5);
+    if (!creds) {
+      console.error(`${TAG26} op=token-exchange reg=${state} outcome=error error=house-env-missing`);
+      return failed("Not configured", "This install has no Google credentials yet.", 500);
+    }
+    const publicBase = (process.env.GOOGLE_PUBLIC_BASE ?? "").replace(/\/+$/, "");
+    if (!publicBase) {
+      console.error(`${TAG26} op=callback reg=${state} outcome=error error=public-base-unset`);
+      return failed("Not configured", "This install has no public base configured.", 500);
+    }
+    const redirectUri = `${publicBase}/api/google/oauth/callback?account=${encodeURIComponent(accountId)}`;
+    try {
+      const res = await fetch(TOKEN_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({
+          code,
+          client_id: creds.clientId,
+          client_secret: creds.clientSecret,
+          redirect_uri: redirectUri,
+          grant_type: "authorization_code",
+          code_verifier: held.verifier
+        })
+      });
+      const text = await res.text();
+      if (!res.ok) {
+        console.error(`${TAG26} op=token-exchange reg=${state} outcome=error status=${res.status} body=${text.slice(0, 300)}`);
+        return failed("Could not connect", `Google refused the exchange (${res.status}).`, 502);
+      }
+      console.error(`${TAG26} op=token-exchange reg=${state} outcome=ok`);
+      const tok = JSON.parse(text);
+      const calRes = await fetch(PRIMARY_CALENDAR_URL, {
+        headers: { authorization: `Bearer ${tok.access_token}` }
+      });
+      const calText = await calRes.text();
+      if (!calRes.ok) {
+        console.error(`${TAG26} op=identity reg=${state} outcome=error status=${calRes.status} body=${calText.slice(0, 300)}`);
+        return failed("Could not connect", "Connected, but the calendar identity could not be read.", 502);
+      }
+      const email = JSON.parse(calText).id;
+      console.error(`${TAG26} op=identity reg=${state} email=${email}`);
+      writeTokens(accountsDir, accountId, email, {
+        accessToken: tok.access_token,
+        refreshToken: tok.refresh_token ?? null,
+        expiresInSeconds: tok.expires_in,
+        scopes: tok.scope ? tok.scope.split(" ") : []
+      });
+      console.error(
+        `${TAG26} op=tokens-write reg=${state} account=${accountId} refreshIssued=${tok.refresh_token ? "true" : "false"}`
+      );
+      clearPending(accountsDir, accountId);
+      console.error(`${TAG26} op=pending-clear reg=${state} verified=${readPending(accountsDir, accountId) === null}`);
+      console.error(`${TAG26} op=registered reg=${state} account=${accountId} email=${email}`);
+      return c.html(
+        page2(
+          "Calendar connected",
+          `${esc(email)} is connected to this account. You can close this page and return to your chat.`
+        )
+      );
+    } catch (err) {
+      const msg = err.message;
+      console.error(`${TAG26} op=token-exchange reg=${state} outcome=error error=${msg}`);
+      return failed("Could not connect", "Something went wrong. Return to your chat and try again.", 502);
+    }
+  });
+  routes.post("/oauth/refresh", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const { accountId, refreshToken } = body;
+    if (!accountId || !refreshToken) {
+      return c.json({ error: "accountId and refreshToken are required" }, 400);
+    }
+    if (!refreshTokenBelongsToAccount(accountsDir, accountId, refreshToken)) {
+      console.error(`${TAG26} op=refresh account=${accountId} outcome=denied reason=token-not-held`);
+      return c.json({ error: "refresh token is not held by this account" }, 403);
+    }
+    const creds = readHouseGoogleCreds(platformRoot5);
+    if (!creds) return c.json({ error: "google-house.env is absent or incomplete" }, 500);
+    const res = await fetch(TOKEN_URL, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        client_id: creds.clientId,
+        client_secret: creds.clientSecret,
+        refresh_token: refreshToken,
+        grant_type: "refresh_token"
+      })
+    });
+    const text = await res.text();
+    if (!res.ok) {
+      console.error(`${TAG26} op=refresh account=${accountId} outcome=error status=${res.status} body=${text.slice(0, 300)}`);
+      return c.json({ error: text.slice(0, 300) }, 502);
+    }
+    console.error(`${TAG26} op=refresh account=${accountId} outcome=ok`);
+    return c.json(JSON.parse(text));
+  });
+  return routes;
+}
+
 // server/routes/onboarding.ts
 import { spawn, spawnSync as spawnSync2, execFileSync as execFileSync3 } from "child_process";
-import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync10, writeSync, existsSync as existsSync18, readFileSync as readFileSync26, unlinkSync as unlinkSync3, renameSync as renameSync7 } from "fs";
+import { openSync as openSync3, closeSync as closeSync3, writeFileSync as writeFileSync11, writeSync, existsSync as existsSync19, readFileSync as readFileSync27, unlinkSync as unlinkSync3, renameSync as renameSync8 } from "fs";
 import { createHash as createHash4, randomUUID as randomUUID8 } from "crypto";
 
 // app/lib/claude-spawn-env.ts
@@ -12799,7 +13040,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname9, join as join25 } from "path";
+import { dirname as dirname9, join as join26 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -12928,8 +13169,8 @@ function readHostCredsBlob(service) {
 }
 
 // ../lib/admins-write/src/index.ts
-import { existsSync as existsSync17, readFileSync as readFileSync25, writeFileSync as writeFileSync9, renameSync as renameSync6, mkdirSync as mkdirSync5, readdirSync as readdirSync16, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
-import { dirname as dirname8, join as join24 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync26, writeFileSync as writeFileSync10, renameSync as renameSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync17, statSync as statSync8, appendFileSync as appendFileSync2 } from "fs";
+import { dirname as dirname8, join as join25 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -12943,7 +13184,7 @@ function appendUsersAuditLine(audit, fields) {
   const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
 `;
   try {
-    mkdirSync5(dirname8(audit.logFile), { recursive: true, mode: 448 });
+    mkdirSync6(dirname8(audit.logFile), { recursive: true, mode: 448 });
     appendFileSync2(audit.logFile, line, { mode: 384 });
   } catch (err) {
     console.error(
@@ -12961,17 +13202,17 @@ function logLine(input, result) {
   );
 }
 function writeFileAtomic(filePath, contents, mode) {
-  mkdirSync5(dirname8(filePath), { recursive: true });
+  mkdirSync6(dirname8(filePath), { recursive: true });
   const tempPath = `${filePath}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync9(tempPath, contents, mode !== void 0 ? { mode } : void 0);
-  renameSync6(tempPath, filePath);
+  writeFileSync10(tempPath, contents, mode !== void 0 ? { mode } : void 0);
+  renameSync7(tempPath, filePath);
 }
 function writeAdminEntry(input) {
   const result = { usersJsonResult: "noop", accountJsonResult: "noop" };
   try {
     let users = [];
-    if (existsSync17(input.usersFile)) {
-      const raw = readFileSync25(input.usersFile, "utf-8").trim();
+    if (existsSync18(input.usersFile)) {
+      const raw = readFileSync26(input.usersFile, "utf-8").trim();
       if (raw) {
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
@@ -13002,11 +13243,11 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join24(input.accountDir, "account.json");
-    if (!existsSync17(accountJsonPath)) {
+    const accountJsonPath = join25(input.accountDir, "account.json");
+    if (!existsSync18(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
-    const config = JSON.parse(readFileSync25(accountJsonPath, "utf-8"));
+    const config = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));
     const admins = config.admins ?? [];
     if (admins.some((a) => a.userId === input.userId)) {
       result.accountJsonResult = "noop";
@@ -13026,9 +13267,9 @@ function writeAdminEntry(input) {
 function computeAdminStoreDivergence(input) {
   const result = { divergences: 0, accountWithoutUsers: [], usersWithoutAccount: [], errors: [] };
   const usersUserIds = /* @__PURE__ */ new Set();
-  if (existsSync17(input.usersFile)) {
+  if (existsSync18(input.usersFile)) {
     try {
-      const raw = readFileSync25(input.usersFile, "utf-8").trim();
+      const raw = readFileSync26(input.usersFile, "utf-8").trim();
       if (raw) {
         const users = JSON.parse(raw);
         for (const u of users) {
@@ -13040,27 +13281,27 @@ function computeAdminStoreDivergence(input) {
     }
   }
   const accountUserIds = /* @__PURE__ */ new Set();
-  if (existsSync17(input.accountsDir)) {
+  if (existsSync18(input.accountsDir)) {
     let entries;
     try {
-      entries = readdirSync16(input.accountsDir);
+      entries = readdirSync17(input.accountsDir);
     } catch (err) {
       result.errors.push({ source: input.accountsDir, detail: err instanceof Error ? err.message : String(err) });
       return result;
     }
     for (const entry of entries) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join24(input.accountsDir, entry);
+      const accountDir = join25(input.accountsDir, entry);
       try {
         if (!statSync8(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join24(accountDir, "account.json");
-      if (!existsSync17(accountJsonPath)) continue;
+      const accountJsonPath = join25(accountDir, "account.json");
+      if (!existsSync18(accountJsonPath)) continue;
       let admins = [];
       try {
-        const config = JSON.parse(readFileSync25(accountJsonPath, "utf-8"));
+        const config = JSON.parse(readFileSync26(accountJsonPath, "utf-8"));
         admins = config.admins ?? [];
       } catch (err) {
         result.errors.push({ source: accountJsonPath, detail: err instanceof Error ? err.message : String(err) });
@@ -13108,8 +13349,8 @@ function hashPin2(pin) {
   return createHash4("sha256").update(pin).digest("hex");
 }
 function readUsersFile2() {
-  if (!existsSync18(USERS_FILE)) return null;
-  const raw = readFileSync26(USERS_FILE, "utf-8").trim();
+  if (!existsSync19(USERS_FILE)) return null;
+  const raw = readFileSync27(USERS_FILE, "utf-8").trim();
   if (!raw) return [];
   return JSON.parse(raw);
 }
@@ -13168,7 +13409,7 @@ app10.post("/claude-auth", async (c) => {
     } catch (err) {
       logoutError = err instanceof Error ? err.message : String(err);
     }
-    const credentialsPresent = existsSync18(CLAUDE_CREDENTIALS_FILE);
+    const credentialsPresent = existsSync19(CLAUDE_CREDENTIALS_FILE);
     const ranMs = Date.now() - start;
     console.log(`[onboarding] op=claude-logout credentialsPresent=${credentialsPresent} ranMs=${ranMs} logoutError=${logoutError ? JSON.stringify(logoutError.slice(0, 120)) : "none"}`);
     return c.json({ logged_out: !credentialsPresent });
@@ -13202,7 +13443,7 @@ app10.post("/claude-auth", async (c) => {
     return c.json({ launched: cdpReady });
   }
   ensureLogDir();
-  writeFileSync10(logPath("claude-auth"), "");
+  writeFileSync11(logPath("claude-auth"), "");
   const claudeAuthLogFd = openSync3(logPath("claude-auth"), "a");
   const onClaudeOutput = (chunk) => writeSync(claudeAuthLogFd, chunk);
   if (process.platform === "darwin") {
@@ -13227,14 +13468,14 @@ app10.post("/claude-auth", async (c) => {
         readBlob: readHostCredsBlob,
         writeFile: (blob) => {
           const tmp = `${CLAUDE_CREDENTIALS_FILE}.${process.pid}.tmp`;
-          writeFileSync10(tmp, blob, { mode: 384 });
-          renameSync7(tmp, CLAUDE_CREDENTIALS_FILE);
+          writeFileSync11(tmp, blob, { mode: 384 });
+          renameSync8(tmp, CLAUDE_CREDENTIALS_FILE);
         },
         log: (line) => console.log(line)
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync10(join25(dirname9(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync11(join26(dirname9(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -13317,9 +13558,9 @@ app10.post("/set-pin", async (c) => {
   console.log(`[set-pin] wrote users.json + account.json admins: userId=${userId.slice(0, 8)}\u2026 role=owner`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync18(INSTALL_OWNER_FILE)) {
+    if (existsSync19(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync26(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync27(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -13400,7 +13641,7 @@ app10.delete("/set-pin", requireAdminSession, async (c) => {
     unlinkSync3(USERS_FILE);
     console.log(`[set-pin] cleared users.json (last entry removed): userId=${sessionUserId.slice(0, 8)}\u2026`);
   } else {
-    writeFileSync10(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
+    writeFileSync11(USERS_FILE, JSON.stringify(remaining), { mode: 384 });
     console.log(`[set-pin] removed entry from users.json: userId=${sessionUserId.slice(0, 8)}\u2026 remaining=${remaining.length}`);
   }
   logUsersAudit(
@@ -13465,9 +13706,9 @@ app10.put("/set-pin", requireAdminSession, async (c) => {
   console.log(`[set-pin] changed PIN in place: userId=${sessionUserId.slice(0, 8)}\u2026`);
   if (process.platform === "linux") {
     let installOwner = null;
-    if (existsSync18(INSTALL_OWNER_FILE)) {
+    if (existsSync19(INSTALL_OWNER_FILE)) {
       try {
-        const raw = readFileSync26(INSTALL_OWNER_FILE, "utf-8").trim();
+        const raw = readFileSync27(INSTALL_OWNER_FILE, "utf-8").trim();
         if (raw.length > 0) installOwner = raw;
       } catch (err) {
         console.error(`[set-pin] install-owner-read-failed path=${INSTALL_OWNER_FILE} error=${err instanceof Error ? err.message : String(err)}`);
@@ -13499,9 +13740,9 @@ ${body.newPin}
 var onboarding_default = app10;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync19, renameSync as renameSync8, statSync as statSync9 } from "fs";
-import { join as join26 } from "path";
-var CLIENT_ERRORS_LOG = join26(LOG_DIR, "client-errors.log");
+import { appendFileSync as appendFileSync3, existsSync as existsSync20, renameSync as renameSync9, statSync as statSync9 } from "fs";
+import { join as join27 } from "path";
+var CLIENT_ERRORS_LOG = join27(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -13549,10 +13790,10 @@ function stackHead(stack) {
 }
 function rotateIfNeeded() {
   try {
-    if (!existsSync19(CLIENT_ERRORS_LOG)) return;
+    if (!existsSync20(CLIENT_ERRORS_LOG)) return;
     const stats = statSync9(CLIENT_ERRORS_LOG);
     if (stats.size < MAX_LOG_SIZE) return;
-    renameSync8(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
+    renameSync9(CLIENT_ERRORS_LOG, CLIENT_ERRORS_LOG + ".1");
   } catch (err) {
     console.error(`[client-error] log rotation failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -13876,18 +14117,18 @@ app13.get("/", requireAdminSession, async (c) => {
 var accounts_default = app13;
 
 // server/routes/admin/logs.ts
-import { existsSync as existsSync21, readdirSync as readdirSync17, readFileSync as readFileSync27, statSync as statSync10 } from "fs";
+import { existsSync as existsSync22, readdirSync as readdirSync18, readFileSync as readFileSync28, statSync as statSync10 } from "fs";
 import { resolve as resolve17, basename as basename7 } from "path";
 
 // app/lib/logs-read-resolve.ts
-import { existsSync as existsSync20 } from "fs";
-import { join as join27 } from "path";
+import { existsSync as existsSync21 } from "fs";
+import { join as join28 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join27(dir, filename);
-    if (existsSync20(fullPath)) {
+    const fullPath = join28(dir, filename);
+    if (existsSync21(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
   }
@@ -13915,7 +14156,7 @@ app14.get("/", async (c) => {
       const filePath = resolve17(dir, safe);
       searched.push(filePath);
       try {
-        const buffer = readFileSync27(filePath);
+        const buffer = readFileSync28(filePath);
         const onDiskBytes = statSync10(filePath).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -13980,7 +14221,7 @@ app14.get("/", async (c) => {
       console.info(`[admin/logs] resolved cacheKey=${cacheKeySlice} sessionId=${sessionIdSlice} via=${primaryId === cacheKey ? "cacheKey" : primaryId === sessionKeyFromConv ? "reverse-lookup" : "sessionId-fallback"}`);
       try {
         const filename = basename7(hit.path);
-        const buffer = readFileSync27(hit.path);
+        const buffer = readFileSync28(hit.path);
         const onDiskBytes = statSync10(hit.path).size;
         const headers = {
           "Content-Type": "text/plain; charset=utf-8",
@@ -14015,10 +14256,10 @@ app14.get("/", async (c) => {
   const seen = /* @__PURE__ */ new Set();
   const logs = {};
   for (const dir of logDirs) {
-    if (!existsSync21(dir)) continue;
+    if (!existsSync22(dir)) continue;
     let files;
     try {
-      files = readdirSync17(dir).filter((f) => f.endsWith(".log"));
+      files = readdirSync18(dir).filter((f) => f.endsWith(".log"));
     } catch (err) {
       const reason = err instanceof Error ? err.message : String(err);
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
@@ -14027,7 +14268,7 @@ app14.get("/", async (c) => {
     files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync10(resolve17(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync27(resolve17(dir, name));
+        const content = readFileSync28(resolve17(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -14067,7 +14308,7 @@ var claude_info_default = app15;
 
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import { resolve as resolve18 } from "path";
 var app16 = new Hono();
 var ATTACHMENT_ID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
@@ -14090,12 +14331,12 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let accountId = pinnedAccountId;
   let dir = uploadsDirFor2(accountId, attachmentId);
-  let found = existsSync22(dir);
+  let found = existsSync23(dir);
   if (!found) {
     for (const candidate of listValidAccounts()) {
       if (candidate.accountId === pinnedAccountId) continue;
       const candidateDir = uploadsDirFor2(candidate.accountId, attachmentId);
-      if (existsSync22(candidateDir)) {
+      if (existsSync23(candidateDir)) {
         accountId = candidate.accountId;
         dir = candidateDir;
         found = true;
@@ -14110,7 +14351,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const metaPath = resolve18(dir, `${attachmentId}.meta.json`);
-  if (!existsSync22(metaPath)) {
+  if (!existsSync23(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
   let meta;
@@ -14144,23 +14385,23 @@ var attachment_default = app16;
 
 // server/routes/admin/agents.ts
 import { resolve as resolve19 } from "path";
-import { readdirSync as readdirSync18, readFileSync as readFileSync28, existsSync as existsSync23, rmSync as rmSync2 } from "fs";
+import { readdirSync as readdirSync19, readFileSync as readFileSync29, existsSync as existsSync24, rmSync as rmSync3 } from "fs";
 var app17 = new Hono();
 app17.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
   const agentsDir = resolve19(account.accountDir, "agents");
-  if (!existsSync23(agentsDir)) return c.json({ agents: [] });
+  if (!existsSync24(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
-    const entries = readdirSync18(agentsDir, { withFileTypes: true });
+    const entries = readdirSync19(agentsDir, { withFileTypes: true });
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
       const configPath2 = resolve19(agentsDir, entry.name, "config.json");
-      if (!existsSync23(configPath2)) continue;
+      if (!existsSync24(configPath2)) continue;
       try {
-        const config = JSON.parse(readFileSync28(configPath2, "utf-8"));
+        const config = JSON.parse(readFileSync29(configPath2, "utf-8"));
         agents.push({
           slug: entry.name,
           displayName: config.displayName ?? entry.name,
@@ -14187,7 +14428,7 @@ app17.delete("/:slug", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve19(account.accountDir, "agents", slug);
-  if (!existsSync23(agentDir)) {
+  if (!existsSync24(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
   try {
@@ -14198,7 +14439,7 @@ app17.delete("/:slug", async (c) => {
     return c.json({ error: `Graph cleanup failed: ${msg}` }, 500);
   }
   try {
-    rmSync2(agentDir, { recursive: true, force: true });
+    rmSync3(agentDir, { recursive: true, force: true });
     console.log(`[admin/agents] deleted agent "${slug}"`);
     return c.json({ ok: true });
   } catch (err) {
@@ -14217,7 +14458,7 @@ app17.post("/:slug/project", async (c) => {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
   const agentDir = resolve19(account.accountDir, "agents", slug);
-  if (!existsSync23(agentDir)) {
+  if (!existsSync24(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
   try {
@@ -14233,7 +14474,7 @@ var agents_default = app17;
 // server/routes/admin/sessions.ts
 import crypto2 from "crypto";
 import { resolve as resolvePath } from "path";
-import { existsSync as existsSync24, mkdirSync as mkdirSync6, createWriteStream } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync7, createWriteStream } from "fs";
 
 // ../lib/admin-conversation-purge/src/index.ts
 async function purgeAdminConversationJsonls(args) {
@@ -14380,7 +14621,7 @@ var pickComponentBytes = (..._args) => null;
 function openResumeStreamLog(accountId, sessionId) {
   const dir = resolvePath(ACCOUNTS_DIR, accountId, "resume-logs");
   try {
-    mkdirSync6(dir, { recursive: true });
+    mkdirSync7(dir, { recursive: true });
   } catch {
   }
   return createWriteStream(resolvePath(dir, `${sessionId}.log`), { flags: "a" });
@@ -14393,7 +14634,7 @@ function validateAndShapeAttachments(raws, conversationAccountId, sessionId, mes
     let reason = null;
     if (!a.attachmentId || !a.filename || !a.mimeType || !a.storagePath) reason = "schema-fail";
     else if (a.accountId !== conversationAccountId) reason = "account-mismatch";
-    else if (!existsSync24(a.storagePath)) reason = "missing-file";
+    else if (!existsSync25(a.storagePath)) reason = "missing-file";
     if (reason) {
       invalid++;
       try {
@@ -14919,8 +15160,8 @@ app18.put("/:id/label", requireAdminSession, async (c) => {
 var sessions_default = app18;
 
 // app/lib/claude-agent/spawn-context.ts
-import { existsSync as existsSync25, readFileSync as readFileSync29, readdirSync as readdirSync19, statSync as statSync11 } from "fs";
-import { dirname as dirname10, resolve as resolve20, join as join28 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync30, readdirSync as readdirSync20, statSync as statSync11 } from "fs";
+import { dirname as dirname10, resolve as resolve20, join as join29 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -14961,14 +15202,14 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join28(pluginDir, "mcp/dist/index.js"),
-    join28(pluginDir, "mcp/src/index.ts")
+    join29(pluginDir, "mcp/dist/index.js"),
+    join29(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path3 of candidates) {
-    if (!existsSync25(path3)) continue;
+    if (!existsSync26(path3)) continue;
     try {
-      raw = readFileSync29(path3, "utf-8");
+      raw = readFileSync30(path3, "utf-8");
       break;
     } catch {
     }
@@ -15018,9 +15259,9 @@ function parseSkillPathsFromFrontmatter(fm) {
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
   const platformPlugins = resolve20(PLATFORM_ROOT, "plugins");
-  if (existsSync25(platformPlugins)) {
-    for (const name of readdirSync19(platformPlugins)) {
-      const dir = join28(platformPlugins, name);
+  if (existsSync26(platformPlugins)) {
+    for (const name of readdirSync20(platformPlugins)) {
+      const dir = join29(platformPlugins, name);
       try {
         if (statSync11(dir).isDirectory()) out.set(name, dir);
       } catch {
@@ -15028,13 +15269,13 @@ function listPluginDirs() {
     }
   }
   const premiumRoot = resolve20(dirname10(PLATFORM_ROOT), "premium-plugins");
-  if (existsSync25(premiumRoot)) {
-    for (const bundle of readdirSync19(premiumRoot)) {
-      const bundlePlugins = join28(premiumRoot, bundle, "plugins");
-      if (!existsSync25(bundlePlugins)) continue;
+  if (existsSync26(premiumRoot)) {
+    for (const bundle of readdirSync20(premiumRoot)) {
+      const bundlePlugins = join29(premiumRoot, bundle, "plugins");
+      if (!existsSync26(bundlePlugins)) continue;
       try {
-        for (const name of readdirSync19(bundlePlugins)) {
-          const dir = join28(bundlePlugins, name);
+        for (const name of readdirSync20(bundlePlugins)) {
+          const dir = join29(bundlePlugins, name);
           try {
             if (statSync11(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -15048,9 +15289,9 @@ function listPluginDirs() {
 }
 function readEnabledPlugins(accountId) {
   const accountFile = resolve20(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync25(accountFile)) return /* @__PURE__ */ new Set();
+  if (!existsSync26(accountFile)) return /* @__PURE__ */ new Set();
   try {
-    const parsed = JSON.parse(readFileSync29(accountFile, "utf-8"));
+    const parsed = JSON.parse(readFileSync30(accountFile, "utf-8"));
     return new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
     );
@@ -15059,10 +15300,10 @@ function readEnabledPlugins(accountId) {
   }
 }
 function readFrontmatter(path3) {
-  if (!existsSync25(path3)) return null;
+  if (!existsSync26(path3)) return null;
   let raw;
   try {
-    raw = readFileSync29(path3, "utf-8");
+    raw = readFileSync30(path3, "utf-8");
   } catch {
     return null;
   }
@@ -15077,7 +15318,7 @@ function computeActivePlugins(accountId) {
   for (const name of Array.from(enabled).sort()) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join28(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join29(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -15094,7 +15335,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync25(join28(dir, "mcp/dist/index.js")) || existsSync25(join28(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync26(join29(dir, "mcp/dist/index.js")) || existsSync26(join29(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -15104,7 +15345,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join28(dir, relPath);
+      const skillPath = join29(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -15121,10 +15362,10 @@ ${skillFm}
 }
 function computeSpecialistDomains(accountId) {
   const specialistsDir = resolve20(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
-  if (!existsSync25(specialistsDir)) return [];
+  if (!existsSync26(specialistsDir)) return [];
   let entries;
   try {
-    entries = readdirSync19(specialistsDir);
+    entries = readdirSync20(specialistsDir);
   } catch {
     return [];
   }
@@ -15148,7 +15389,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join28(specialistsDir, file));
+    const fm = readFrontmatter(join29(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -15167,10 +15408,10 @@ ${fm}
 }
 function computeDormantPlugins(accountId) {
   const accountFile = resolve20(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
-  if (!existsSync25(accountFile)) return [];
+  if (!existsSync26(accountFile)) return [];
   let enabled;
   try {
-    const raw = readFileSync29(accountFile, "utf-8");
+    const raw = readFileSync30(accountFile, "utf-8");
     const parsed = JSON.parse(raw);
     enabled = new Set(
       Array.isArray(parsed.enabledPlugins) ? parsed.enabledPlugins.filter((p) => typeof p === "string") : []
@@ -15182,10 +15423,10 @@ function computeDormantPlugins(accountId) {
     return [];
   }
   const pluginsDir = resolve20(PLATFORM_ROOT, "plugins");
-  if (!existsSync25(pluginsDir)) return [];
+  if (!existsSync26(pluginsDir)) return [];
   let entries;
   try {
-    entries = readdirSync19(pluginsDir);
+    entries = readdirSync20(pluginsDir);
   } catch {
     return [];
   }
@@ -15193,10 +15434,10 @@ function computeDormantPlugins(accountId) {
   for (const name of entries) {
     if (enabled.has(name)) continue;
     const manifestPath = resolve20(pluginsDir, name, "PLUGIN.md");
-    if (!existsSync25(manifestPath)) continue;
+    if (!existsSync26(manifestPath)) continue;
     let manifest;
     try {
-      manifest = readFileSync29(manifestPath, "utf-8");
+      manifest = readFileSync30(manifestPath, "utf-8");
     } catch {
       continue;
     }
@@ -15210,13 +15451,13 @@ function computeDormantPlugins(accountId) {
 }
 
 // server/routes/admin/claude-sessions.ts
-import { existsSync as existsSync26, readFileSync as readFileSync30 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync31 } from "fs";
 import { resolve as resolve21 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
-  if (!existsSync26(statePath)) return null;
+  if (!existsSync27(statePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync30(statePath, "utf-8"));
+    const parsed = JSON.parse(readFileSync31(statePath, "utf-8"));
     const tunnelId = typeof parsed.tunnelId === "string" ? parsed.tunnelId : null;
     const tunnelName = typeof parsed.tunnelName === "string" ? parsed.tunnelName : null;
     const domain = typeof parsed.domain === "string" ? parsed.domain : null;
@@ -15230,7 +15471,7 @@ function resolveTunnelUrl() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync30(resolve21(platformRoot5, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync31(resolve21(platformRoot5, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -15241,7 +15482,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG26 = "[claude-session-manager:wrapper]";
+var TAG27 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -15259,12 +15500,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG26} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG27} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG26} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG27} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -15291,24 +15532,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG26} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG27} forward-spawn-start managerBase=${managerBase("claude-session-manager:wrapper")} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase("claude-session-manager:wrapper")}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG26} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG27} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG26} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG27} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG26} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG27} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -15343,7 +15584,7 @@ app19.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG26} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG27} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -15352,7 +15593,7 @@ app19.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG26} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG27} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -15371,13 +15612,13 @@ app19.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG26} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG27} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 var claude_sessions_default = app19;
 
 // server/routes/admin/log-ingest.ts
-var TAG27 = "[log-ingest]";
+var TAG28 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
@@ -15388,7 +15629,7 @@ function isLoopbackAddr2(addr) {
 app20.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG28} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -15397,7 +15638,7 @@ app20.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG28} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -15439,18 +15680,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app21 = new Hono();
 app21.post("/", async (c) => {
-  const TAG47 = "[admin:events]";
+  const TAG51 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG47} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG51} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG47} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG51} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -15472,11 +15713,11 @@ app21.post("/", async (c) => {
 var events_default = app21;
 
 // server/routes/admin/files.ts
-import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync27 } from "fs";
+import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync28 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, unlink as unlink2, rename, rmdir } from "fs/promises";
 import { realpathSync as realpathSync6 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename9, dirname as dirname11, join as join30, relative as relative4, resolve as resolve23, sep as sep6 } from "path";
+import { basename as basename9, dirname as dirname11, join as join31, relative as relative4, resolve as resolve23, sep as sep6 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -15794,7 +16035,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve22, relative as relative3, join as join29, basename as basename8, extname as extname2, sep as sep5 } from "path";
+import { resolve as resolve22, relative as relative3, join as join30, basename as basename8, extname as extname2, sep as sep5 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -15876,7 +16117,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join29(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join30(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -15938,7 +16179,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join29(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join30(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -15959,7 +16200,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join29(root, entry.name);
+    const abs = join30(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -16315,7 +16556,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile4(join30(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile4(join31(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -16370,7 +16611,7 @@ async function servableFilesIn(dirAbs, uuid) {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE3.test(entry.name)) {
-    const dirAbs = join30(absolute, entry.name);
+    const dirAbs = join31(absolute, entry.name);
     const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
       const servable = await servableFilesIn(dirAbs, entry.name);
@@ -16379,7 +16620,7 @@ async function enrich(absolute, entry, accountNames) {
         let size = null;
         let modifiedAt = entry.modifiedAt;
         try {
-          const st = await stat4(join30(dirAbs, innerName));
+          const st = await stat4(join31(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
@@ -16554,7 +16795,7 @@ app22.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join30(absolute, name);
+        const entryPath = join31(absolute, name);
         const s = await stat4(entryPath);
         entries.push({
           name,
@@ -16617,7 +16858,7 @@ app22.get("/download", requireAdminSession, async (c) => {
       console.error(`[data] op=scratchpad-no-session sessionId="${sessionId.slice(0, 8)}\u2026"`);
       return c.json({ error: "Not found" }, 404);
     }
-    const meta = readSidecarMeta(join30(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join31(projectDir, `${sessionId}.meta.json`));
     if (!meta.accountId || meta.accountId !== accountId) {
       console.error(`[data] account-scope-blocked root="scratchpad" sessionId="${sessionId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
@@ -16712,7 +16953,7 @@ async function* walkRegularFiles(dirAbsolute) {
   const dirents = await readdir3(dirAbsolute, { withFileTypes: true });
   for (const d of dirents) {
     if (d.isSymbolicLink()) continue;
-    const child = join30(dirAbsolute, d.name);
+    const child = join31(dirAbsolute, d.name);
     if (d.isDirectory()) {
       yield* walkRegularFiles(child);
       continue;
@@ -16822,7 +17063,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
   const relDir = relpath ? dirname11(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join30(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join31(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 404, error: "Not found" };
@@ -16896,7 +17137,7 @@ app22.post("/upload", requireAdminSession, async (c) => {
     });
     await unlink2(tmpPath).catch(() => {
     });
-    const tempRemoved = !existsSync27(tmpPath);
+    const tempRemoved = !existsSync28(tmpPath);
     console.error(`[data-upload] op=cleanup uid=${uid} tempRemoved=${tempRemoved}`);
   };
   const reader = body.getReader();
@@ -16970,7 +17211,7 @@ async function discardChunkUpload(uploadId, state) {
   });
   await unlink2(state.tmpPath).catch(() => {
   });
-  const tempRemoved = !existsSync27(state.tmpPath);
+  const tempRemoved = !existsSync28(state.tmpPath);
   console.error(`[data-upload] op=cleanup uid=${uploadId} tempRemoved=${tempRemoved}`);
 }
 async function writeChunkBody(body, out, alreadyReceived, ceiling) {
@@ -17199,7 +17440,7 @@ app22.delete("/", requireAdminSession, async (c) => {
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
     const containerDir = dirname11(absolute);
-    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join30(containerDir, `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE3.test(stem) && base !== `${stem}.meta.json` ? join31(containerDir, `${stem}.meta.json`) : null;
     const isAttachmentContainer = UUID_RE3.test(stem) && basename9(containerDir) === stem;
     await unlink2(absolute);
     if (sidecarPath) {
@@ -17209,7 +17450,7 @@ app22.delete("/", requireAdminSession, async (c) => {
       }
     }
     if (isAttachmentContainer) {
-      await unlink2(join30(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      await unlink2(join31(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
       });
       await rmdir(containerDir).catch(() => {
       });
@@ -18313,8 +18554,8 @@ function isHiddenByDefault(label) {
 }
 
 // server/lib/top-level-labels.ts
-import { readdirSync as readdirSync20, readFileSync as readFileSync31 } from "fs";
-import { join as join31, resolve as resolve24 } from "path";
+import { readdirSync as readdirSync21, readFileSync as readFileSync32 } from "fs";
+import { join as join32, resolve as resolve24 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -18407,7 +18648,7 @@ function parseTopLevelLabels(content) {
 }
 function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
-    return join31(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+    return join32(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
   return resolve24(import.meta.dirname, "../../../plugins/memory/references");
 }
@@ -18415,9 +18656,9 @@ function parseTableTopLevelLabels(referencesDir) {
   const labels = /* @__PURE__ */ new Set();
   const contributingFiles = [];
   try {
-    const fileNames = readdirSync20(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
+    const fileNames = readdirSync21(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
     for (const fileName of fileNames) {
-      const content = readFileSync31(join31(referencesDir, fileName), "utf-8");
+      const content = readFileSync32(join32(referencesDir, fileName), "utf-8");
       const parsed = parseTopLevelLabels(content);
       if (parsed.length > 0) contributingFiles.push(fileName);
       for (const label of parsed) labels.add(label);
@@ -19571,7 +19812,7 @@ var graph_default_view_default = app28;
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
 import { resolve as resolve25, relative as relative5, isAbsolute as isAbsolute2, sep as sep7, basename as basename10 } from "path";
-import { existsSync as existsSync28 } from "fs";
+import { existsSync as existsSync29 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
 function toDataRootRelPath(absPath) {
@@ -19678,7 +19919,7 @@ async function fetchAgentTemplateRows(accountDir) {
 async function unionSpecialistFilenames(overrideDir, bundledDir) {
   const names = /* @__PURE__ */ new Set();
   for (const dir of [overrideDir, bundledDir]) {
-    if (!existsSync28(dir)) continue;
+    if (!existsSync29(dir)) continue;
     try {
       const entries = await readdir4(dir);
       for (const entry of entries) {
@@ -19693,7 +19934,7 @@ async function unionSpecialistFilenames(overrideDir, bundledDir) {
 }
 async function readAgentTemplateRow(inp) {
   let chosenPath = null;
-  if (existsSync28(inp.overridePath)) {
+  if (existsSync29(inp.overridePath)) {
     try {
       validateFilePathInAccount(inp.overridePath, inp.overrideRoot);
       chosenPath = inp.overridePath;
@@ -19704,7 +19945,7 @@ async function readAgentTemplateRow(inp) {
       );
       return null;
     }
-  } else if (existsSync28(inp.bundledPath)) {
+  } else if (existsSync29(inp.bundledPath)) {
     if (!isWithin(inp.bundledPath, inp.bundledRoot)) {
       console.error(
         `[admin/sidebar-artefacts] agent-template-read-failed agent=${inp.displayName} kind=${inp.logName} error="bundled path outside PLATFORM_ROOT"`
@@ -20306,14 +20547,14 @@ app37.get("/", async (c) => {
 var system_stats_default = app37;
 
 // server/routes/admin/health.ts
-import { existsSync as existsSync29, readFileSync as readFileSync32 } from "fs";
-import { resolve as resolve26, join as join32 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync33 } from "fs";
+import { resolve as resolve26, join as join33 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join32(PLATFORM_ROOT6, "config", "brand.json");
-if (existsSync29(brandJsonPath)) {
+var brandJsonPath = join33(PLATFORM_ROOT6, "config", "brand.json");
+if (existsSync30(brandJsonPath)) {
   try {
-    const brand = JSON.parse(readFileSync32(brandJsonPath, "utf-8"));
+    const brand = JSON.parse(readFileSync33(brandJsonPath, "utf-8"));
     if (brand.hostname) brandHostname = brand.hostname;
   } catch {
   }
@@ -20322,8 +20563,8 @@ var VERSION_FILE = resolve26(PLATFORM_ROOT6, `config/.${brandHostname}-version`)
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
-  if (!existsSync29(VERSION_FILE)) return "unknown";
-  return readFileSync32(VERSION_FILE, "utf-8").trim() || "unknown";
+  if (!existsSync30(VERSION_FILE)) return "unknown";
+  return readFileSync33(VERSION_FILE, "utf-8").trim() || "unknown";
 }
 async function probeConversationDb() {
   let session;
@@ -20502,7 +20743,7 @@ function managerLogFollowUrl(sessionId, opts) {
 }
 
 // server/routes/admin/linkedin-ingest.ts
-var TAG28 = "[linkedin-ingest-route]";
+var TAG29 = "[linkedin-ingest-route]";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -20606,29 +20847,29 @@ app39.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG28 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG29 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG28 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG29 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG28 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG29 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG28 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG29 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID13();
-  console.log(TAG28 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG29 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -20637,12 +20878,12 @@ app39.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG28 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG29 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG28 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG29 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
@@ -20650,7 +20891,7 @@ var linkedin_ingest_default = app39;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG29 = "[post-turn-context]";
+var TAG30 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -20692,7 +20933,7 @@ var app40 = new Hono();
 app40.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG29} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -20701,7 +20942,7 @@ app40.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG29} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -20733,7 +20974,7 @@ app40.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG29} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG30} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -20742,7 +20983,7 @@ app40.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG29} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG30} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -20855,7 +21096,7 @@ function formatPreviousContext(writes) {
 }
 
 // server/routes/admin/public-session-context.ts
-var TAG30 = "[public-session-context]";
+var TAG31 = "[public-session-context]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -20863,7 +21104,7 @@ var app41 = new Hono();
 app41.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG30} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -20872,7 +21113,7 @@ app41.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG30} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -20886,14 +21127,14 @@ app41.get("/", async (c) => {
     const writes = await fetchSliceWrites(session, sliceToken, accountId);
     const total = Date.now() - started;
     console.log(
-      `${TAG30} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG31} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({ writes });
   } catch (err) {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG30} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG31} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
@@ -20912,7 +21153,7 @@ function getWebchatGateway() {
 }
 
 // server/routes/admin/public-session-exit.ts
-var TAG31 = "[public-session-exit-route]";
+var TAG32 = "[public-session-exit-route]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -20920,7 +21161,7 @@ var app42 = new Hono();
 app42.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG31} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -20929,7 +21170,7 @@ app42.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG31} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -20943,7 +21184,7 @@ app42.post("/", async (c) => {
   if (!sessionId) return c.json({ error: "sessionId required" }, 400);
   const gateway = getWebchatGateway();
   if (!gateway) {
-    console.error(`${TAG31} reject reason=gateway-unset sessionId=${sessionId.slice(0, 8)}`);
+    console.error(`${TAG32} reject reason=gateway-unset sessionId=${sessionId.slice(0, 8)}`);
     return c.json({ error: "webchat-gateway-unset" }, 503);
   }
   gateway.handlePublicSessionExit(sessionId);
@@ -20952,7 +21193,7 @@ app42.post("/", async (c) => {
 var public_session_exit_default = app42;
 
 // server/routes/admin/access-session-evict.ts
-var TAG32 = "[access-session-evict]";
+var TAG33 = "[access-session-evict]";
 function isLoopbackAddr6(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -20960,7 +21201,7 @@ var app43 = new Hono();
 app43.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr6(remoteAddr)) {
-    console.error(`${TAG32} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG33} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -20969,7 +21210,7 @@ app43.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr6(t));
     if (offender !== void 0) {
-      console.error(`${TAG32} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG33} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -20982,13 +21223,13 @@ app43.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG32} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG33} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
 var access_session_evict_default = app43;
 
 // server/routes/admin/enrol-person.ts
-var TAG33 = "[enrol]";
+var TAG34 = "[enrol]";
 function isLoopbackAddr7(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -20997,7 +21238,7 @@ var app44 = new Hono();
 app44.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr7(remoteAddr)) {
-    console.error(`${TAG33} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG34} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "enrol-person-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -21006,7 +21247,7 @@ app44.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr7(t));
     if (offender !== void 0) {
-      console.error(`${TAG33} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG34} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "enrol-person-loopback-only" }, 403);
     }
   }
@@ -21031,7 +21272,7 @@ app44.post("/", async (c) => {
   }
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG33} op=person result=no-account-id`);
+    console.error(`${TAG34} op=person result=no-account-id`);
     return c.json({ error: "no-account-id" }, 500);
   }
   let personId;
@@ -21039,7 +21280,7 @@ app44.post("/", async (c) => {
     personId = await enrolPerson({ accountId, phone, email, agentSlug });
   } catch (err) {
     console.error(
-      `${TAG33} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG34} op=person result=write-failed agentSlug=${agentSlug} contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "enrol-failed" }, 500);
   }
@@ -21049,11 +21290,11 @@ app44.post("/", async (c) => {
     if (g) grant = { grantId: g.grantId, status: g.status, contactValue: g.contactValue };
   } catch (err) {
     console.error(
-      `${TAG33} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG34} op=person result=grant-lookup-failed contact=${maskContact(email)} err="${err instanceof Error ? err.message : String(err)}"`
     );
   }
   console.log(
-    `${TAG33} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
+    `${TAG34} op=person personId=${personId} account=${accountId} agentSlug=${agentSlug} contact=${maskContact(email)}`
   );
   return c.json({ personId, grant }, 200);
 });
@@ -21099,8 +21340,8 @@ app45.post("/launch", requireAdminSession, async (c) => {
 var browser_default = app45;
 
 // server/routes/admin/calendar.ts
-import { existsSync as existsSync30 } from "fs";
-import { join as join34 } from "path";
+import { existsSync as existsSync31 } from "fs";
+import { join as join35 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -21199,8 +21440,8 @@ function countVEvents(ics) {
 }
 
 // server/lib/calendar-availability.ts
-import { readFileSync as readFileSync33 } from "fs";
-import { join as join33 } from "path";
+import { readFileSync as readFileSync34 } from "fs";
+import { join as join34 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -21209,10 +21450,10 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join33(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join34(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
-    raw = readFileSync33(path3, "utf-8");
+    raw = readFileSync34(path3, "utf-8");
   } catch {
     throw new Error(`availability not configured: ${path3} not found`);
   }
@@ -21571,7 +21812,7 @@ app46.get("/booking-link", requireAdminSession, (c) => {
       console.error('[calendar] op=booking-link-fail err="no account configured"');
       return c.json({ bookingDomain: null });
     }
-    if (!existsSync30(join34(account.accountDir, AVAILABILITY_FILENAME))) {
+    if (!existsSync31(join35(account.accountDir, AVAILABILITY_FILENAME))) {
       console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
       return c.json({ bookingDomain: null });
     }
@@ -21607,7 +21848,7 @@ function toNum(v) {
 }
 
 // server/routes/admin/tasks-list.ts
-var TAG34 = "[task-timer]";
+var TAG35 = "[task-timer]";
 var COMPLETED = /* @__PURE__ */ new Set(["completed"]);
 var HIDDEN_FROM_OPEN = /* @__PURE__ */ new Set(["completed", "cancelled"]);
 var app47 = new Hono();
@@ -21615,7 +21856,7 @@ app47.get("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
   const accountId = getAccountIdForSession(cacheKey);
   if (!accountId) {
-    console.error(`${TAG34} op=list auth-rejected reason="no account for session"`);
+    console.error(`${TAG35} op=list auth-rejected reason="no account for session"`);
     return c.json({ error: "Account not found for session" }, 401);
   }
   const session = getSession();
@@ -21653,10 +21894,10 @@ app47.get("/", requireAdminSession, async (c) => {
       if (COMPLETED.has(status)) completed.push(row);
       else if (!HIDDEN_FROM_OPEN.has(status)) open.push(row);
     }
-    console.log(`${TAG34} op=list account=${accountId} open=${open.length} completed=${completed.length}`);
+    console.log(`${TAG35} op=list account=${accountId} open=${open.length} completed=${completed.length}`);
     return c.json({ open, completed });
   } catch (err) {
-    console.error(`${TAG34} op=list error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG35} op=list error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "tasks-list-failed" }, 500);
   } finally {
     await session.close();
@@ -21666,7 +21907,7 @@ var tasks_list_default = app47;
 
 // server/routes/admin/task-timer-start.ts
 import { randomUUID as randomUUID14 } from "crypto";
-var TAG35 = "[task-timer]";
+var TAG36 = "[task-timer]";
 var app48 = new Hono();
 app48.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -21688,7 +21929,7 @@ app48.post("/", requireAdminSession, async (c) => {
       { taskId, accountId }
     );
     if (target.records.length === 0) {
-      console.error(`${TAG35} op=start taskId=${taskId} accountId=${accountId} result=task-not-found`);
+      console.error(`${TAG36} op=start taskId=${taskId} accountId=${accountId} result=task-not-found`);
       return c.json({ error: "task-not-found" }, 404);
     }
     const open = await session.run(
@@ -21700,7 +21941,7 @@ app48.post("/", requireAdminSession, async (c) => {
     const priorEntryId = open.records[0]?.get("entryId");
     const priorStartedAt = open.records[0]?.get("startedAt");
     if (priorEntryId) {
-      console.log(`${TAG35} op=start taskId=${taskId} accountId=${accountId} result=already-running`);
+      console.log(`${TAG36} op=start taskId=${taskId} accountId=${accountId} result=already-running`);
       return c.json({ ok: true, running: true, entryId: priorEntryId, startedAt: priorStartedAt });
     }
     const entryId = randomUUID14();
@@ -21710,10 +21951,10 @@ app48.post("/", requireAdminSession, async (c) => {
        CREATE (te)-[:LOGGED_AGAINST]->(t)`,
       { taskId, accountId, entryId, now }
     );
-    console.log(`${TAG35} op=opened taskId=${taskId} entryId=${entryId} startedAt=${now}`);
+    console.log(`${TAG36} op=opened taskId=${taskId} entryId=${entryId} startedAt=${now}`);
     return c.json({ ok: true, running: true, entryId, startedAt: now });
   } catch (err) {
-    console.error(`${TAG35} op=start error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG36} op=start error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "task-timer-start-failed" }, 500);
   } finally {
     await session.close();
@@ -21723,7 +21964,7 @@ var task_timer_start_default = app48;
 
 // server/routes/admin/task-timer-stop.ts
 import neo4j5 from "neo4j-driver";
-var TAG36 = "[task-timer]";
+var TAG37 = "[task-timer]";
 var app49 = new Hono();
 app49.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -21755,7 +21996,7 @@ app49.post("/", requireAdminSession, async (c) => {
         { taskId, accountId }
       );
       const secondsLogged2 = toNum(cur.records[0]?.get("secondsLogged"));
-      console.log(`${TAG36} op=stop taskId=${taskId} entryId=none seconds=0 totalAfter=${secondsLogged2}`);
+      console.log(`${TAG37} op=stop taskId=${taskId} entryId=none seconds=0 totalAfter=${secondsLogged2}`);
       return c.json({ ok: true, running: false, seconds: 0, secondsLogged: secondsLogged2 });
     }
     const seconds = secondsBetween(startedAt, now);
@@ -21778,11 +22019,11 @@ app49.post("/", requireAdminSession, async (c) => {
     const sumEntries = toNum(verify.records[0]?.get("sumEntries"));
     const sumAdjustments = toNum(verify.records[0]?.get("sumAdjustments"));
     const secondsLogged = toNum(verify.records[0]?.get("secondsLogged"));
-    console.log(`${TAG36} op=stop taskId=${taskId} entryId=${entryId} seconds=${seconds} totalAfter=${secondsLogged}`);
-    console.log(`${TAG36} op=persisted taskId=${taskId} entryId=${entryId} sumEntries=${sumEntries} sumAdjustments=${sumAdjustments} secondsLogged=${secondsLogged}`);
+    console.log(`${TAG37} op=stop taskId=${taskId} entryId=${entryId} seconds=${seconds} totalAfter=${secondsLogged}`);
+    console.log(`${TAG37} op=persisted taskId=${taskId} entryId=${entryId} sumEntries=${sumEntries} sumAdjustments=${sumAdjustments} secondsLogged=${secondsLogged}`);
     return c.json({ ok: true, running: false, seconds, secondsLogged });
   } catch (err) {
-    console.error(`${TAG36} op=stop error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG37} op=stop error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "task-timer-stop-failed" }, 500);
   } finally {
     await session.close();
@@ -21791,7 +22032,7 @@ app49.post("/", requireAdminSession, async (c) => {
 var task_timer_stop_default = app49;
 
 // server/routes/admin/task-complete.ts
-var TAG37 = "[task-timer]";
+var TAG38 = "[task-timer]";
 var app50 = new Hono();
 app50.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -21818,10 +22059,10 @@ app50.post("/", requireAdminSession, async (c) => {
       return c.json({ error: "task-not-found" }, 404);
     }
     const secondsLogged = toNum(result.records[0].get("secondsLogged"));
-    console.log(`${TAG37} op=complete taskId=${taskId} status=completed secondsLogged=${secondsLogged}`);
+    console.log(`${TAG38} op=complete taskId=${taskId} status=completed secondsLogged=${secondsLogged}`);
     return c.json({ ok: true, status: "completed", secondsLogged });
   } catch (err) {
-    console.error(`${TAG37} op=complete error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG38} op=complete error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "task-complete-failed" }, 500);
   } finally {
     await session.close();
@@ -21832,7 +22073,7 @@ var task_complete_default = app50;
 // server/routes/admin/task-time-adjust.ts
 import { randomUUID as randomUUID15 } from "crypto";
 import neo4j6 from "neo4j-driver";
-var TAG38 = "[task-time-adjust]";
+var TAG39 = "[task-time-adjust]";
 var app51 = new Hono();
 app51.post("/", requireAdminSession, async (c) => {
   const cacheKey = c.var.cacheKey;
@@ -21842,22 +22083,22 @@ app51.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(`${TAG38} op=reject reason=bad-json`);
+    console.error(`${TAG39} op=reject reason=bad-json`);
     return c.json({ error: "invalid-json" }, 400);
   }
   const taskId = typeof body.taskId === "string" ? body.taskId : "";
   if (!taskId) {
-    console.error(`${TAG38} op=reject reason=no-task`);
+    console.error(`${TAG39} op=reject reason=no-task`);
     return c.json({ error: "taskId required" }, 400);
   }
   const newSeconds = body.newSeconds;
   if (typeof newSeconds !== "number" || !Number.isInteger(newSeconds) || newSeconds < 0) {
-    console.error(`${TAG38} op=reject reason=invalid-seconds taskId=${taskId} accountId=${accountId}`);
+    console.error(`${TAG39} op=reject reason=invalid-seconds taskId=${taskId} accountId=${accountId}`);
     return c.json({ error: "newSeconds must be a non-negative integer" }, 400);
   }
   const adjustmentId = randomUUID15();
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  console.log(`${TAG38} op=request adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId} newSeconds=${newSeconds}`);
+  console.log(`${TAG39} op=request adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId} newSeconds=${newSeconds}`);
   const session = getSession();
   try {
     const guard = await session.run(
@@ -21867,12 +22108,12 @@ app51.post("/", requireAdminSession, async (c) => {
       { taskId, accountId }
     );
     if (guard.records.length === 0) {
-      console.error(`${TAG38} op=reject reason=no-task adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId}`);
+      console.error(`${TAG39} op=reject reason=no-task adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId}`);
       return c.json({ error: "task-not-found" }, 404);
     }
     const openCount = toNum(guard.records[0].get("openCount"));
     if (openCount > 0) {
-      console.error(`${TAG38} op=reject reason=running adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId}`);
+      console.error(`${TAG39} op=reject reason=running adjustmentId=${adjustmentId} taskId=${taskId} accountId=${accountId}`);
       return c.json({ error: "task-timer-running" }, 409);
     }
     const previousSeconds = toNum(guard.records[0].get("previousSeconds"));
@@ -21898,10 +22139,10 @@ app51.post("/", requireAdminSession, async (c) => {
       }
     );
     const secondsLoggedAfter = toNum(write.records[0]?.get("secondsLoggedAfter"));
-    console.log(`${TAG38} op=persisted adjustmentId=${adjustmentId} previousSeconds=${previousSeconds} newSeconds=${newSeconds} delta=${delta} secondsLoggedAfter=${secondsLoggedAfter}`);
+    console.log(`${TAG39} op=persisted adjustmentId=${adjustmentId} previousSeconds=${previousSeconds} newSeconds=${newSeconds} delta=${delta} secondsLoggedAfter=${secondsLoggedAfter}`);
     return c.json({ ok: true, secondsLogged: secondsLoggedAfter });
   } catch (err) {
-    console.error(`${TAG38} op=error adjustmentId=${adjustmentId} taskId=${taskId} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG39} op=error adjustmentId=${adjustmentId} taskId=${taskId} error="${err instanceof Error ? err.message : String(err)}"`);
     return c.json({ error: "task-time-adjust-failed" }, 500);
   } finally {
     await session.close();
@@ -21909,57 +22150,150 @@ app51.post("/", requireAdminSession, async (c) => {
 });
 var task_time_adjust_default = app51;
 
-// server/routes/admin/index.ts
+// server/routes/admin/activity.ts
+import { readdirSync as readdirSync22 } from "fs";
 var app52 = new Hono();
-app52.route("/session", session_default);
-app52.route("/accounts", accounts_default);
-app52.route("/logs", logs_default);
-app52.route("/claude-info", claude_info_default);
-app52.route("/attachment", attachment_default);
-app52.route("/agents", agents_default);
-app52.route("/sessions", sessions_default);
-app52.route("/claude-sessions", claude_sessions_default);
-app52.route("/log-ingest", log_ingest_default);
-app52.route("/events", events_default);
-app52.route("/files", files_default);
-app52.route("/graph-search", graph_search_default);
-app52.route("/graph-subgraph", graph_subgraph_default);
-app52.route("/graph-delete", graph_delete_default);
-app52.route("/graph-restore", graph_restore_default);
-app52.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app52.route("/graph-default-view", graph_default_view_default);
-app52.route("/sidebar-artefacts", sidebar_artefacts_default);
-app52.route("/sidebar-sessions", sidebar_sessions_default);
-app52.route("/session-delete", session_delete_default);
-app52.route("/session-stop", session_stop_default);
-app52.route("/session-archive", session_archive_default);
-app52.route("/session-rename", session_rename_default);
-app52.route("/session-usage", session_usage_default);
-app52.route("/browser", browser_default);
-app52.route("/session-rc-spawn", session_rc_spawn_default);
-app52.route("/session-reseat", session_reseat_default);
-app52.route("/system-stats", system_stats_default);
-app52.route("/health-brand", health_default2);
-app52.route("/linkedin-ingest", linkedin_ingest_default);
-app52.route("/post-turn-context", post_turn_context_default);
-app52.route("/public-session-context", public_session_context_default);
-app52.route("/public-session-exit", public_session_exit_default);
-app52.route("/access-session-evict", access_session_evict_default);
-app52.route("/enrol-person", enrol_person_default);
-app52.route("/calendar", calendar_default);
-app52.route("/tasks-list", tasks_list_default);
-app52.route("/task-timer-start", task_timer_start_default);
-app52.route("/task-timer-stop", task_timer_stop_default);
-app52.route("/task-complete", task_complete_default);
-app52.route("/task-time-adjust", task_time_adjust_default);
-var admin_default = app52;
+var TAG40 = "[activity]";
+function resolveHouseAccountId(accounts) {
+  const houses = accounts.filter((a) => a.config.role === "house");
+  if (houses.length === 1) return { accountId: houses[0].accountId, reason: "house" };
+  if (houses.length > 1) return { accountId: null, reason: "multiple-houses" };
+  if (accounts.length === 1) return { accountId: accounts[0].accountId, reason: "sole-account" };
+  return { accountId: null, reason: "no-house" };
+}
+function requestToken() {
+  return Math.random().toString(16).slice(2, 10);
+}
+var short = (id) => id ? id.slice(0, 8) : "unset";
+function countAccountDirsOnDisk() {
+  try {
+    return readdirSync22(ACCOUNTS_DIR, { withFileTypes: true }).filter(
+      (e) => e.isDirectory() && !e.name.startsWith(".")
+    ).length;
+  } catch {
+    return null;
+  }
+}
+app52.get("/", requireAdminSession, async (c) => {
+  const req = requestToken();
+  const cacheKey = c.var.cacheKey;
+  const caller2 = getAccountIdForSession(cacheKey) ?? null;
+  const valid = listValidAccounts();
+  const house = resolveHouseAccountId(valid);
+  const isHouse = caller2 !== null && house.accountId !== null && caller2 === house.accountId;
+  console.log(
+    `${TAG40} op=request req=${req} caller=${short(caller2)} house=${isHouse} houseVia=${house.reason}`
+  );
+  if (!isHouse) {
+    const reason = house.accountId === null ? house.reason : "not-house";
+    console.error(
+      `${TAG40} op=gate req=${req} decision=deny reason=${reason} caller=${short(caller2)} houseAcct=${short(house.accountId)} accounts=${valid.length}`
+    );
+    return c.json({ error: "house-only" }, 403);
+  }
+  console.log(`${TAG40} op=gate req=${req} decision=allow caller=${short(caller2)} via=${house.reason}`);
+  const onDisk = countAccountDirsOnDisk();
+  console.log(
+    `${TAG40} op=accounts req=${req} onDisk=${onDisk ?? "unknown"} valid=${valid.length} ids=${valid.map((a) => short(a.accountId)).join(",")}`
+  );
+  const start = Date.now();
+  let res;
+  try {
+    res = await fetch(`${managerBase("activity:wrapper")}/activity`, {
+      signal: AbortSignal.timeout(3e4)
+    });
+  } catch (err) {
+    console.error(
+      `${TAG40} op=manager-fail req=${req} reason=unreachable err=${err instanceof Error ? err.message : String(err)}`
+    );
+    return c.json({ error: "manager-unreachable" }, 502);
+  }
+  if (res.status !== 200) {
+    console.error(`${TAG40} op=manager-fail req=${req} reason=status status=${res.status}`);
+    return c.json({ error: `manager-status-${res.status}` }, 502);
+  }
+  const body = await res.json().catch(() => null);
+  if (!body || !Array.isArray(body.rows)) {
+    console.error(`${TAG40} op=manager-fail req=${req} reason=bad-json`);
+    return c.json({ error: "manager-bad-json" }, 502);
+  }
+  const rows = body.rows;
+  const census = body.census ?? null;
+  const untaggedCount = rows.filter((r) => r.accountId === null).length;
+  const meteringFailed = rows.filter((r) => r.meteringError !== null).length;
+  const censusAgeMs = census ? Date.now() - census.sampleAtMs : null;
+  console.log(
+    `${TAG40} op=census req=${req} ageMs=${censusAgeMs ?? "none"} live=${census?.live ?? "none"} cpuNull=${census?.cpuNull ?? "none"}`
+  );
+  console.log(
+    `${TAG40} op=response req=${req} rows=${rows.length} accounts=${valid.length} untagged=${untaggedCount} meteringFailed=${meteringFailed} ms=${Date.now() - start}`
+  );
+  return c.json({
+    rows,
+    census,
+    censusAgeMs,
+    accounts: {
+      onDisk,
+      valid: valid.length,
+      ids: valid.map((a) => a.accountId),
+      untaggedCount
+    }
+  });
+});
+var activity_default = app52;
+
+// server/routes/admin/index.ts
+var app53 = new Hono();
+app53.route("/session", session_default);
+app53.route("/accounts", accounts_default);
+app53.route("/logs", logs_default);
+app53.route("/claude-info", claude_info_default);
+app53.route("/attachment", attachment_default);
+app53.route("/agents", agents_default);
+app53.route("/sessions", sessions_default);
+app53.route("/claude-sessions", claude_sessions_default);
+app53.route("/log-ingest", log_ingest_default);
+app53.route("/events", events_default);
+app53.route("/files", files_default);
+app53.route("/graph-search", graph_search_default);
+app53.route("/graph-subgraph", graph_subgraph_default);
+app53.route("/graph-delete", graph_delete_default);
+app53.route("/graph-restore", graph_restore_default);
+app53.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app53.route("/graph-default-view", graph_default_view_default);
+app53.route("/sidebar-artefacts", sidebar_artefacts_default);
+app53.route("/sidebar-sessions", sidebar_sessions_default);
+app53.route("/session-delete", session_delete_default);
+app53.route("/session-stop", session_stop_default);
+app53.route("/session-archive", session_archive_default);
+app53.route("/session-rename", session_rename_default);
+app53.route("/session-usage", session_usage_default);
+app53.route("/browser", browser_default);
+app53.route("/session-rc-spawn", session_rc_spawn_default);
+app53.route("/session-reseat", session_reseat_default);
+app53.route("/system-stats", system_stats_default);
+app53.route("/health-brand", health_default2);
+app53.route("/linkedin-ingest", linkedin_ingest_default);
+app53.route("/post-turn-context", post_turn_context_default);
+app53.route("/public-session-context", public_session_context_default);
+app53.route("/public-session-exit", public_session_exit_default);
+app53.route("/access-session-evict", access_session_evict_default);
+app53.route("/enrol-person", enrol_person_default);
+app53.route("/calendar", calendar_default);
+app53.route("/tasks-list", tasks_list_default);
+app53.route("/task-timer-start", task_timer_start_default);
+app53.route("/task-timer-stop", task_timer_stop_default);
+app53.route("/task-complete", task_complete_default);
+app53.route("/task-time-adjust", task_time_adjust_default);
+app53.route("/activity", activity_default);
+var admin_default = app53;
 
 // server/routes/access/verify-token.ts
-var TAG39 = "[access-verify]";
+var TAG41 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app53 = new Hono();
-app53.post("/", async (c) => {
+var app54 = new Hono();
+app54.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -21974,39 +22308,39 @@ app53.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG39} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG41} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG39} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG41} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -22022,12 +22356,12 @@ app53.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG39} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG41} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -22041,7 +22375,7 @@ app53.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app53;
+var verify_token_default = app54;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -22103,10 +22437,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG40 = "[access-request-link]";
-var app54 = new Hono();
+var TAG42 = "[access-request-link]";
+var app55 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app54.post("/", async (c) => {
+app55.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -22120,18 +22454,18 @@ app54.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG40} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG42} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG40} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG42} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG40} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG42} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -22139,7 +22473,7 @@ app54.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG40} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG42} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -22171,25 +22505,25 @@ app54.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG40} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG42} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG40} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG42} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app54;
+var request_magic_link_default = app55;
 
 // server/routes/access/index.ts
-var app55 = new Hono();
-app55.route("/verify-token", verify_token_default);
-app55.route("/request-magic-link", request_magic_link_default);
-var access_default = app55;
+var app56 = new Hono();
+app56.route("/verify-token", verify_token_default);
+app56.route("/request-magic-link", request_magic_link_default);
+var access_default = app56;
 
 // server/routes/sites.ts
-import { existsSync as existsSync31, readFileSync as readFileSync34, realpathSync as realpathSync7, statSync as statSync12 } from "fs";
+import { existsSync as existsSync32, readFileSync as readFileSync35, realpathSync as realpathSync7, statSync as statSync12 } from "fs";
 import { resolve as resolve28 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
@@ -22221,8 +22555,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app56 = new Hono();
-app56.get("/:rel{.*}", (c) => {
+var app57 = new Hono();
+app57.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -22255,7 +22589,7 @@ app56.get("/:rel{.*}", (c) => {
   }
   let stat8;
   try {
-    stat8 = existsSync31(filePath) ? statSync12(filePath) : null;
+    stat8 = existsSync32(filePath) ? statSync12(filePath) : null;
   } catch {
     stat8 = null;
   }
@@ -22274,7 +22608,7 @@ app56.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync31(filePath)) {
+  if (!existsSync32(filePath)) {
     console.error(`[sites] not-found path=${reqPath} status=404`);
     return c.text("Not found", 404);
   }
@@ -22293,7 +22627,7 @@ app56.get("/:rel{.*}", (c) => {
   }
   let body;
   try {
-    body = readFileSync34(realPath);
+    body = readFileSync35(realPath);
   } catch (err) {
     const code = err?.code;
     if (code === "EISDIR") {
@@ -22325,11 +22659,11 @@ app56.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app56;
+var sites_default = app57;
 
 // app/lib/visitor-token.ts
-import { createHmac, randomBytes, timingSafeEqual } from "crypto";
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync35, writeFileSync as writeFileSync11 } from "fs";
+import { createHmac, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync36, writeFileSync as writeFileSync12 } from "fs";
 import { dirname as dirname12 } from "path";
 var TOKEN_PREFIX = "v1.";
 var SECRET_BYTES = 32;
@@ -22338,21 +22672,21 @@ var cachedSecret = null;
 function getSecret() {
   if (cachedSecret) return cachedSecret;
   try {
-    const hex2 = readFileSync35(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+    const hex2 = readFileSync36(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
     if (hex2.length === SECRET_BYTES * 2) {
       cachedSecret = Buffer.from(hex2, "hex");
       return cachedSecret;
     }
   } catch {
   }
-  const fresh = randomBytes(SECRET_BYTES).toString("hex");
+  const fresh = randomBytes2(SECRET_BYTES).toString("hex");
   try {
-    mkdirSync7(dirname12(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
-    writeFileSync11(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
+    mkdirSync8(dirname12(VISITOR_TOKEN_SECRET_FILE), { recursive: true, mode: 448 });
+    writeFileSync12(VISITOR_TOKEN_SECRET_FILE, fresh, { mode: 384, flag: "wx" });
     console.log(`[visitor-token] secret minted path=${VISITOR_TOKEN_SECRET_FILE}`);
   } catch {
   }
-  const hex = readFileSync35(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
+  const hex = readFileSync36(VISITOR_TOKEN_SECRET_FILE, "utf-8").trim();
   cachedSecret = Buffer.from(hex, "hex");
   return cachedSecret;
 }
@@ -22405,8 +22739,8 @@ var VISITOR_COOKIE_NAME = "mxy_v";
 var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
-import { existsSync as existsSync32, readFileSync as readFileSync36 } from "fs";
-import { join as join35 } from "path";
+import { existsSync as existsSync33, readFileSync as readFileSync37 } from "fs";
+import { join as join36 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -22414,10 +22748,10 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join35(platformRoot5, "config", "brand.json");
-  if (!existsSync32(brandPath)) return null;
+  const brandPath = join36(platformRoot5, "config", "brand.json");
+  if (!existsSync33(brandPath)) return null;
   try {
-    cached2 = JSON.parse(readFileSync36(brandPath, "utf-8"));
+    cached2 = JSON.parse(readFileSync37(brandPath, "utf-8"));
     return cached2;
   } catch {
     return null;
@@ -22425,7 +22759,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app57 = new Hono();
+var app58 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -22470,17 +22804,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app57.options("/consent", (c) => {
+app58.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app57.options("/brand-config", (c) => {
+app58.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app57.post("/consent", async (c) => {
+app58.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -22520,7 +22854,7 @@ app57.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app57.get("/brand-config", (c) => {
+app58.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -22530,7 +22864,7 @@ app57.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app57;
+var visitor_consent_default = app58;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -22557,8 +22891,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app58 = new Hono();
-app58.get("/:slug/click", async (c) => {
+var app59 = new Hono();
+app59.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -22622,10 +22956,10 @@ app58.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app58;
+var listings_default = app59;
 
 // server/routes/visitor-event.ts
-var app59 = new Hono();
+var app60 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -22692,12 +23026,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app59.options("/event", (c) => {
+app60.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app59.post("/event", async (c) => {
+app60.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -22902,17 +23236,17 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app59;
+var visitor_event_default = app60;
 
 // server/routes/session.ts
 import { resolve as resolve29 } from "path";
-import { existsSync as existsSync33, writeFileSync as writeFileSync12, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync34, writeFileSync as writeFileSync13, mkdirSync as mkdirSync9 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
     const cacheDir = resolve29(MAXY_DIR, "branding-cache", accountId);
-    mkdirSync8(cacheDir, { recursive: true });
-    writeFileSync12(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    mkdirSync9(cacheDir, { recursive: true });
+    writeFileSync13(resolve29(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -22948,8 +23282,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app60 = new Hono();
-app60.post("/", async (c) => {
+var app61 = new Hono();
+app61.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -22990,7 +23324,7 @@ app60.post("/", async (c) => {
   let agentConfig = null;
   if (account) {
     const agentDir = resolve29(account.accountDir, "agents", agentSlug);
-    if (!existsSync33(agentDir) || !existsSync33(resolve29(agentDir, "config.json"))) {
+    if (!existsSync34(agentDir) || !existsSync34(resolve29(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -23096,7 +23430,7 @@ app60.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app60;
+var session_default2 = app61;
 
 // server/lib/calendar-slots.ts
 var WEEKDAYS = ["sun", "mon", "tue", "wed", "thu", "fri", "sat"];
@@ -23179,17 +23513,17 @@ function computeOpenSlots(config, busy, fromISO, toISO) {
 }
 
 // server/routes/calendar-public.ts
-var app61 = new Hono();
+var app62 = new Hono();
 function setCors(c) {
   c.header("Access-Control-Allow-Origin", "*");
   c.header("Access-Control-Allow-Methods", "GET, OPTIONS");
   c.header("Access-Control-Allow-Headers", "content-type");
 }
-app61.options("/free-busy", (c) => {
+app62.options("/free-busy", (c) => {
   setCors(c);
   return c.body(null, 204);
 });
-app61.get("/free-busy", async (c) => {
+app62.get("/free-busy", async (c) => {
   setCors(c);
   const from = c.req.query("from");
   const to = c.req.query("to");
@@ -23235,10 +23569,10 @@ app61.get("/free-busy", async (c) => {
     await session.close();
   }
 });
-var calendar_public_default = app61;
+var calendar_public_default = app62;
 
 // app/lib/timeentry-census.ts
-var TAG41 = "[timeentry-census]";
+var TAG43 = "[timeentry-census]";
 function reconcileTimeEntries(rows, now, horizonMs) {
   const openEntries = rows.openEntries.length;
   let oldestOpenAgeMs = 0;
@@ -23278,12 +23612,12 @@ async function runTimeEntryCensusOnce(session, now, horizonMs) {
       sumAdjustments: toNum(r.get("sumAdjustments"))
     }));
     const finding = reconcileTimeEntries({ openEntries, taskSums }, now, horizonMs);
-    const line = `${TAG41} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
+    const line = `${TAG43} openEntries=${finding.openEntries} oldestOpenAgeMin=${finding.oldestOpenAgeMin} maxOpenPerAccount=${finding.maxOpenPerAccount} driftTasks=${finding.driftTasks}`;
     if (finding.alarm) console.error(`${line} alarm=true`);
     else console.log(line);
     return finding;
   } catch (err) {
-    console.error(`${TAG41} error="${err instanceof Error ? err.message : String(err)}"`);
+    console.error(`${TAG43} error="${err instanceof Error ? err.message : String(err)}"`);
     return null;
   }
 }
@@ -23297,13 +23631,13 @@ function startTimeEntryCensus(openSession, opts = {}) {
     try {
       session = openSession();
     } catch (err) {
-      console.error(`${TAG41} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG43} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`);
       return;
     }
     try {
       await runTimeEntryCensusOnce(session, Date.now(), horizonMs);
     } catch (err) {
-      console.error(`${TAG41} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
+      console.error(`${TAG43} tick-failed error="${err instanceof Error ? err.message : String(err)}"`);
     } finally {
       try {
         await session.close();
@@ -23321,8 +23655,181 @@ function startTimeEntryCensus(openSession, opts = {}) {
   return () => clearInterval(id);
 }
 
+// ../lib/ledger-core/dist/reconcile.js
+var LEDGER_INDEX_NAMES = [
+  "invoice_account_confirmation_unique",
+  "cash_entry_account_entryid_unique",
+  "cash_entry_account",
+  "invoice_line_account",
+  "invoice_payment_account",
+  "credit_account"
+];
+function countSuspectDuplicates(keys) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const k of keys) {
+    const composite = `${k.invoiceId}|${k.amount}|${k.date}`;
+    const ids = groups.get(composite) ?? /* @__PURE__ */ new Set();
+    ids.add(k.paymentId);
+    groups.set(composite, ids);
+  }
+  let total = 0;
+  for (const ids of groups.values())
+    total += Math.max(0, ids.size - 1);
+  return total;
+}
+function reconcileLedger(rows, _now) {
+  const suspectDuplicates = countSuspectDuplicates(rows.paymentKeys);
+  const alarm = rows.orphanPayments > 0 || rows.storedBalanceProps > 0 || suspectDuplicates > 0 || rows.declaredNotLive.length > 0;
+  return {
+    invoices: rows.invoices,
+    payments: rows.payments,
+    orphanPayments: rows.orphanPayments,
+    storedBalanceProps: rows.storedBalanceProps,
+    suspectDuplicates,
+    declaredNotLive: rows.declaredNotLive,
+    alarm
+  };
+}
+function formatCensusLine(f) {
+  return `[ledger-census] invoices=${f.invoices} payments=${f.payments} orphanPayments=${f.orphanPayments} storedBalanceProps=${f.storedBalanceProps} suspectDuplicates=${f.suspectDuplicates} declaredNotLive=${f.declaredNotLive.length === 0 ? "none" : f.declaredNotLive.join(",")}`;
+}
+
+// app/lib/ledger-census.ts
+var TAG44 = "[ledger-census]";
+function toNum2(v) {
+  if (typeof v === "number") return v;
+  if (v && typeof v === "object" && "toNumber" in v) {
+    return v.toNumber();
+  }
+  return 0;
+}
+async function runLedgerCensusOnce(session, now) {
+  try {
+    const counts = await session.run(
+      `MATCH (i:Invoice|InboundInvoice) WITH count(i) AS invoices
+       OPTIONAL MATCH (p:InvoicePayment)
+       RETURN invoices, count(p) AS payments`
+    );
+    const orphans = await session.run(
+      `MATCH (p:InvoicePayment)
+       WHERE NOT ( (:Invoice|InboundInvoice)-[:HAS_PAYMENT]->(p) )
+       RETURN count(p) AS orphanPayments`
+    );
+    const stored = await session.run(
+      `MATCH (i:Invoice|InboundInvoice)
+       WHERE i.outstanding IS NOT NULL OR i.balance IS NOT NULL OR i.amountPaid IS NOT NULL
+       RETURN count(i) AS storedBalanceProps`
+    );
+    const keys = await session.run(
+      `MATCH (i:Invoice|InboundInvoice)-[:HAS_PAYMENT]->(p:InvoicePayment)
+       RETURN i.confirmationNumber AS invoiceId, p.paymentId AS paymentId,
+              p.amount AS amount, p.date AS date`
+    );
+    const indexes = await session.run(`SHOW INDEXES YIELD name RETURN collect(name) AS names`);
+    const live = new Set(indexes.records[0]?.get("names") ?? []);
+    const finding = reconcileLedger(
+      {
+        invoices: toNum2(counts.records[0]?.get("invoices")),
+        payments: toNum2(counts.records[0]?.get("payments")),
+        orphanPayments: toNum2(orphans.records[0]?.get("orphanPayments")),
+        storedBalanceProps: toNum2(stored.records[0]?.get("storedBalanceProps")),
+        paymentKeys: keys.records.map((r) => ({
+          invoiceId: r.get("invoiceId") ?? "",
+          paymentId: r.get("paymentId") ?? "",
+          amount: toNum2(r.get("amount")),
+          date: r.get("date") ?? ""
+        })),
+        declaredNotLive: LEDGER_INDEX_NAMES.filter((n) => !live.has(n))
+      },
+      now
+    );
+    const line = formatCensusLine(finding);
+    if (finding.alarm) console.error(`${line} alarm=true`);
+    else console.log(line);
+    return finding;
+  } catch (err) {
+    console.error(`${TAG44} error="${err instanceof Error ? err.message : String(err)}"`);
+    return null;
+  }
+}
+var DEFAULT_INTERVAL_MS2 = 15 * 60 * 1e3;
+function startLedgerCensus(openSession, opts = {}) {
+  const intervalMs = opts.intervalMs ?? DEFAULT_INTERVAL_MS2;
+  const tick = async () => {
+    let session;
+    try {
+      session = openSession();
+    } catch (err) {
+      console.error(
+        `${TAG44} open-session-failed error="${err instanceof Error ? err.message : String(err)}"`
+      );
+      return;
+    }
+    try {
+      await runLedgerCensusOnce(session, Date.now());
+    } catch (err) {
+      console.error(
+        `${TAG44} tick-failed error="${err instanceof Error ? err.message : String(err)}"`
+      );
+    } finally {
+      try {
+        await session.close();
+      } catch {
+      }
+    }
+  };
+  void tick();
+  const id = setInterval(() => {
+    void tick();
+  }, intervalMs);
+  if (typeof id.unref === "function") {
+    ;
+    id.unref();
+  }
+  return () => clearInterval(id);
+}
+
+// app/lib/conversation-audit.ts
+var TAG45 = "[conversation-audit]";
+async function runConversationAudit() {
+  const session = getSession();
+  try {
+    const res = await session.run(
+      `MATCH (a:Conversation {channel: 'whatsapp'})
+       WHERE a.channelAddress =~ '[0-9]+'
+       WITH collect(a.channelAddress) AS anchored
+       MATCH (c:Conversation {channel: 'whatsapp'})
+       WITH anchored,
+            count(*) AS total,
+            sum(CASE WHEN c.channelAddress = 'default' THEN 1 ELSE 0 END) AS unpairable,
+            collect(CASE WHEN c.channelAddress =~ 'default:[0-9]+'
+                         THEN substring(c.channelAddress, 8) END) AS forensic
+       RETURN total,
+              unpairable,
+              size([p IN forensic WHERE p IS NOT NULL AND NOT p IN anchored]) AS unreconciled`,
+      {}
+    );
+    const rec = res.records[0];
+    const result = {
+      total: Number(rec?.get("total") ?? 0),
+      unreconciled: Number(rec?.get("unreconciled") ?? 0),
+      unpairable: Number(rec?.get("unpairable") ?? 0)
+    };
+    console.error(
+      `${TAG45} channel=whatsapp total=${result.total} unreconciled=${result.unreconciled} unpairable=${result.unpairable}`
+    );
+    return result;
+  } catch (err) {
+    const reason = err instanceof Error ? `${err.name}:${err.message.slice(0, 200)}` : String(err).slice(0, 200);
+    console.error(`${TAG45} op=failed reason=${reason}`);
+    return null;
+  } finally {
+    await session.close();
+  }
+}
+
 // app/lib/graph-health.ts
-var import_dist4 = __toESM(require_dist4(), 1);
+var import_dist5 = __toESM(require_dist4(), 1);
 var HOUR_MS = 60 * 60 * 1e3;
 function renderLabelTop(rows) {
   return rows.map((b) => {
@@ -23367,7 +23874,7 @@ async function runGraphHealthTick() {
     console.error(
       `[graph-health] userprofile-multi accounts=${upAccounts} top=${upTop.length > 0 ? upTop.join(",") : "none"}`
     );
-    const indexed = [...import_dist4.VECTOR_INDEXED_LABELS];
+    const indexed = [...import_dist5.VECTOR_INDEXED_LABELS];
     const embCount = await session.run(
       `MATCH (n) WHERE n.embedding IS NULL AND any(l IN labels(n) WHERE l IN $indexed)
        RETURN count(n) AS total`,
@@ -23666,8 +24173,8 @@ async function migrateUploads(opts = {}) {
 
 // app/lib/migrate-admin-webchat-sidecars.ts
 import { readdir as readdir6, readFile as readFile6, rename as rename3, writeFile as writeFile4, unlink as unlink3 } from "fs/promises";
-import { existsSync as existsSync34 } from "fs";
-import { join as join36 } from "path";
+import { existsSync as existsSync35 } from "fs";
+import { join as join37 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -23696,7 +24203,7 @@ async function writeRaw(path3, obj) {
     await rename3(tmp, path3);
   } catch (err) {
     try {
-      if (existsSync34(tmp)) await unlink3(tmp);
+      if (existsSync35(tmp)) await unlink3(tmp);
     } catch {
     }
     throw err;
@@ -23712,7 +24219,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join36(projectsRoot, slug.name);
+    const slugDir = join37(projectsRoot, slug.name);
     let entries;
     try {
       entries = await readdir6(slugDir, { withFileTypes: true });
@@ -23721,9 +24228,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join36(slugDir, entry.name));
+        out.push(join37(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join36(slugDir, entry.name);
+        const subDir = join37(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir6(subDir, { withFileTypes: true });
@@ -23731,7 +24238,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join36(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join37(subDir, s.name));
         }
       }
     }
@@ -23743,7 +24250,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join36(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join37(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -23935,7 +24442,7 @@ var InboundHub = class {
 };
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
-var import_dist5 = __toESM(require_dist(), 1);
+var import_dist6 = __toESM(require_dist(), 1);
 
 // node_modules/hono/dist/utils/stream.js
 var StreamingApi = class {
@@ -24088,8 +24595,8 @@ var streamSSE = (c, cb, onError) => {
 
 // app/lib/whatsapp/gateway/routes.ts
 function createWaChannelRoutes(deps) {
-  const app63 = new Hono();
-  app63.get("/wa-channel/inbound", (c) => {
+  const app64 = new Hono();
+  app64.get("/wa-channel/inbound", (c) => {
     const senderId = c.req.query("senderId");
     if (!senderId) return c.json({ error: "senderId required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -24107,7 +24614,7 @@ function createWaChannelRoutes(deps) {
       }
     });
   });
-  app63.post("/wa-channel/reply", async (c) => {
+  app64.post("/wa-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const text = body?.text;
@@ -24128,7 +24635,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=reply-dispatch senderId=${senderId} bytes=${bytes}`);
     return c.json({ ok: true });
   });
-  app63.post("/wa-channel/reply-document", async (c) => {
+  app64.post("/wa-channel/reply-document", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const files = body?.files;
@@ -24167,7 +24674,7 @@ function createWaChannelRoutes(deps) {
     }
     return c.json({ ok: true, results });
   });
-  app63.post("/wa-channel/ready", async (c) => {
+  app64.post("/wa-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     if (typeof senderId !== "string") {
@@ -24176,7 +24683,7 @@ function createWaChannelRoutes(deps) {
     deps.onReady?.(senderId);
     return c.json({ ok: true });
   });
-  app63.post("/wa-channel/received", async (c) => {
+  app64.post("/wa-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const waMessageId = body?.waMessageId;
@@ -24186,7 +24693,7 @@ function createWaChannelRoutes(deps) {
     deps.onReceived?.(senderId, waMessageId);
     return c.json({ ok: true });
   });
-  app63.post("/wa-channel/turn-end", async (c) => {
+  app64.post("/wa-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const senderId = body?.senderId;
     const sessionId = body?.sessionId;
@@ -24219,7 +24726,7 @@ function createWaChannelRoutes(deps) {
     console.error(`[whatsapp-native] op=turn-end sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/whatsapp/gateway/wa-gateway.ts
@@ -24321,7 +24828,7 @@ var WaGateway = class {
       const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
       const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist5.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=wa accountId=${input.effectiveAccountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -24594,12 +25101,12 @@ var InboundHub2 = class {
 };
 
 // app/lib/webchat/gateway/webchat-gateway.ts
-var import_dist6 = __toESM(require_dist(), 1);
+var import_dist7 = __toESM(require_dist(), 1);
 
 // app/lib/webchat/gateway/routes.ts
 function createWebchatChannelRoutes(deps) {
-  const app63 = new Hono();
-  app63.get("/webchat-channel/inbound", (c) => {
+  const app64 = new Hono();
+  app64.get("/webchat-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -24617,7 +25124,7 @@ function createWebchatChannelRoutes(deps) {
       }
     });
   });
-  app63.post("/webchat-channel/reply", async (c) => {
+  app64.post("/webchat-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -24627,7 +25134,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReply?.(key, text);
     return c.json({ ok: true });
   });
-  app63.post("/webchat-channel/connector-auth", async (c) => {
+  app64.post("/webchat-channel/connector-auth", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -24640,7 +25147,7 @@ function createWebchatChannelRoutes(deps) {
     const result = await deps.onConnectorAuth({ key, sessionId, name, completed });
     return c.json(result);
   });
-  app63.post("/webchat-channel/ready", async (c) => {
+  app64.post("/webchat-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -24649,7 +25156,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app63.post("/webchat-channel/permission-request", async (c) => {
+  app64.post("/webchat-channel/permission-request", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const requestId = body?.request_id;
@@ -24663,7 +25170,7 @@ function createWebchatChannelRoutes(deps) {
     const verdict = await deps.awaitPermissionVerdict({ key, requestId, toolName, description, inputPreview });
     return c.json(verdict);
   });
-  app63.post("/webchat-channel/received", async (c) => {
+  app64.post("/webchat-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -24673,7 +25180,7 @@ function createWebchatChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app63.post("/webchat-channel/turn-end", async (c) => {
+  app64.post("/webchat-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -24696,7 +25203,7 @@ function createWebchatChannelRoutes(deps) {
     console.error(`[webchat-native] op=turn-end channel=webchat key=${k} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/webchat/gateway/webchat-gateway.ts
@@ -25042,7 +25549,7 @@ var WebchatGateway = class _WebchatGateway {
       const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
       const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist6.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=web accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -25411,14 +25918,14 @@ function makeFileDelivery(opts) {
 }
 
 // app/lib/webchat/file-delivery.ts
-var TAG42 = "[webchat-adaptor]";
+var TAG46 = "[webchat-adaptor]";
 function platformRoot2() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
 function makeWebchatSendFile(entry) {
   return async (filePath) => {
     if (!entry.accountId) {
-      console.error(`${TAG42} file-delivery reject reason=no-account sender=${entry.senderId}`);
+      console.error(`${TAG46} file-delivery reject reason=no-account sender=${entry.senderId}`);
       return { ok: false, error: "no-account" };
     }
     const accountDir = resolve32(platformRoot2(), "..", "data/accounts", entry.accountId);
@@ -25426,14 +25933,14 @@ function makeWebchatSendFile(entry) {
       const resolved = realpathSync8(filePath);
       const accountResolved = realpathSync8(accountDir);
       if (!resolved.startsWith(accountResolved + "/")) {
-        console.error(`${TAG42} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
+        console.error(`${TAG46} file-delivery reject reason=outside_account_directory sender=${entry.senderId}`);
         return { ok: false, error: "outside-account" };
       }
       return { ok: true };
     } catch (err) {
       const code = err.code;
       console.error(
-        `${TAG42} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
+        `${TAG46} file-delivery reject reason=${code === "ENOENT" ? "not-found" : "path-error"} sender=${entry.senderId}`
       );
       return { ok: false, error: code === "ENOENT" ? "not-found" : "path-error" };
     }
@@ -25442,7 +25949,7 @@ function makeWebchatSendFile(entry) {
 function makeWebchatFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG42,
+    tag: TAG46,
     channel: "webchat",
     sendFile: makeWebchatSendFile(entry),
     deferUntilVerdict: true
@@ -25504,7 +26011,7 @@ function buildPublicWebchatSpawnRequest(input) {
 }
 
 // app/lib/whatsapp/inbound/file-delivery-bridge.ts
-var TAG43 = "[whatsapp-adaptor]";
+var TAG47 = "[whatsapp-adaptor]";
 var SEND_USER_FILE2 = "SendUserFile";
 var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
 function platformRoot3() {
@@ -25522,7 +26029,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
     });
     if (result.ok) return { ok: true };
     console.error(
-      `${TAG43} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+      `${TAG47} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
     );
     return { ok: false, error: result.error };
   };
@@ -25530,7 +26037,7 @@ function makeWhatsAppSendFile(entry, maxyAccountId) {
 function makeWhatsAppFileDelivery(entry, maxyAccountId) {
   const shared = makeFileDelivery({
     entry,
-    tag: TAG43,
+    tag: TAG47,
     channel: "whatsapp",
     sendFile: makeWhatsAppSendFile(entry, maxyAccountId)
   });
@@ -25565,7 +26072,7 @@ function makeWhatsAppFileDelivery(entry, maxyAccountId) {
         if (!delivered) {
           const fileField = call.filePath !== void 0 ? ` file=${call.filePath}` : "";
           console.error(
-            `${TAG43} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
+            `${TAG47} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${WHATSAPP_SEND_DOCUMENT}${fileField}`
           );
         }
       }
@@ -25747,12 +26254,12 @@ var InboundHub3 = class {
 };
 
 // app/lib/telegram/gateway/telegram-gateway.ts
-var import_dist7 = __toESM(require_dist(), 1);
+var import_dist8 = __toESM(require_dist(), 1);
 
 // app/lib/telegram/gateway/routes.ts
 function createTelegramChannelRoutes(deps) {
-  const app63 = new Hono();
-  app63.get("/tg-channel/inbound", (c) => {
+  const app64 = new Hono();
+  app64.get("/tg-channel/inbound", (c) => {
     const key = c.req.query("key");
     if (!key) return c.json({ error: "key required" }, 400);
     return streamSSE(c, async (stream2) => {
@@ -25770,7 +26277,7 @@ function createTelegramChannelRoutes(deps) {
       }
     });
   });
-  app63.post("/tg-channel/reply", async (c) => {
+  app64.post("/tg-channel/reply", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const text = body?.text;
@@ -25786,7 +26293,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=reply key=${key} bytes=${Buffer.byteLength(text, "utf8")}`);
     return c.json({ ok: true });
   });
-  app63.post("/tg-channel/ready", async (c) => {
+  app64.post("/tg-channel/ready", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     if (typeof key !== "string") {
@@ -25795,7 +26302,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReady?.(key);
     return c.json({ ok: true });
   });
-  app63.post("/tg-channel/received", async (c) => {
+  app64.post("/tg-channel/received", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const messageId = body?.messageId;
@@ -25805,7 +26312,7 @@ function createTelegramChannelRoutes(deps) {
     deps.onReceived?.(key, messageId);
     return c.json({ ok: true });
   });
-  app63.post("/tg-channel/turn-end", async (c) => {
+  app64.post("/tg-channel/turn-end", async (c) => {
     const body = await c.req.json().catch(() => null);
     const key = body?.key;
     const sessionId = body?.sessionId;
@@ -25838,7 +26345,7 @@ function createTelegramChannelRoutes(deps) {
     console.error(`[telegram-native] op=turn-end key=${key} sessionId=${sid} replied=no delivered=none`);
     return c.json({ ok: true, delivered: "none" });
   });
-  return app63;
+  return app64;
 }
 
 // app/lib/telegram/gateway/telegram-gateway.ts
@@ -25903,7 +26410,7 @@ var TelegramGateway = class {
       const injected = res.block ? (res.block.match(/^- /gm) ?? []).length : 0;
       const owner8 = res.ownerUserId ? res.ownerUserId.slice(0, 8) : "-";
       console.error(
-        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist7.INJECTION_RULE_CAP}`
+        `[preference-inject] op=inject channel=tg accountId=${input.accountId} injected=${injected} owner=${owner8} source=${res.source} capped=${injected >= import_dist8.INJECTION_RULE_CAP}`
       );
     }
     this.hub.deliver(
@@ -25969,7 +26476,7 @@ function buildTelegramSpawnRequest(input) {
 import { realpathSync as realpathSync9 } from "fs";
 import { readFile as readFile7, stat as stat7 } from "fs/promises";
 import { resolve as resolve33, basename as basename11 } from "path";
-var TAG44 = "[telegram:outbound]";
+var TAG48 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
 async function sendTelegramDocument(input) {
   const { botToken, chatId, filePath, caption, maxyAccountId, platformRoot: platformRoot5 } = input;
@@ -25985,16 +26492,16 @@ async function sendTelegramDocument(input) {
     resolvedPath = realpathSync9(filePath);
     const accountResolved = realpathSync9(accountDir);
     if (!resolvedPath.startsWith(accountResolved + "/")) {
-      console.error(`${TAG44} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
+      console.error(`${TAG48} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
       return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
     }
   } catch (err) {
     const code = err.code;
     if (code === "ENOENT") {
-      console.error(`${TAG44} document ENOENT path=${filePath}`);
+      console.error(`${TAG48} document ENOENT path=${filePath}`);
       return { ok: false, status: 404, error: `File not found: ${filePath}` };
     }
-    console.error(`${TAG44} document path error: ${String(err)}`);
+    console.error(`${TAG48} document path error: ${String(err)}`);
     return { ok: false, status: 500, error: String(err) };
   }
   const fileStat = await stat7(resolvedPath);
@@ -26027,13 +26534,13 @@ async function sendTelegramDocument(input) {
     error = e instanceof Error ? e.message : String(e);
   }
   console.error(
-    `${TAG44} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
+    `${TAG48} sent document to=${chatId} file=${filename} bytes=${fileStat.size} ok=${ok}` + (messageId !== void 0 ? ` id=${messageId}` : "")
   );
   return ok ? { ok: true, messageId } : { ok: false, status: 500, error };
 }
 
 // app/lib/telegram/outbound/file-delivery.ts
-var TAG45 = "[telegram:outbound]";
+var TAG49 = "[telegram:outbound]";
 function platformRoot4() {
   return process.env.MAXY_PLATFORM_ROOT || "";
 }
@@ -26045,11 +26552,11 @@ function makeTelegramSendFile(entry) {
       botToken = (entry.role === "admin" ? tg?.adminBotToken : tg?.publicBotToken) ?? null;
     }
     if (!botToken) {
-      console.error(`${TAG45} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG49} file-delivery reject reason=no-bot-token sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-bot-token" };
     }
     if (entry.replyTarget == null) {
-      console.error(`${TAG45} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
+      console.error(`${TAG49} file-delivery reject reason=no-reply-target sender=${entry.senderId} role=${entry.role}`);
       return { ok: false, error: "no-reply-target" };
     }
     const result = await sendTelegramDocument({
@@ -26066,7 +26573,7 @@ function makeTelegramSendFile(entry) {
 function makeTelegramFileDelivery(entry) {
   return makeFileDelivery({
     entry,
-    tag: TAG45,
+    tag: TAG49,
     channel: "telegram",
     sendFile: makeTelegramSendFile(entry)
   });
@@ -26106,17 +26613,17 @@ function startTelegramNativeFileFollower(input) {
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve34, join as join37 } from "path";
+import { resolve as resolve34, join as join38 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join37(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve34(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 
 // app/lib/channel-pty-bridge/public-session-end-review.ts
 import { randomUUID as randomUUID16 } from "crypto";
-var TAG46 = "[public-session-review]";
+var TAG50 = "[public-session-review]";
 var CONSUMED_CAP = 500;
 var consumed = /* @__PURE__ */ new Set();
 function consumeOnce(sessionId) {
@@ -26143,7 +26650,7 @@ async function fetchJsonl(sessionId) {
     return await res.text();
   } catch (err) {
     console.error(
-      `${TAG46} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG50} jsonl-fetch-failed sessionId=${sessionId} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return null;
   }
@@ -26167,7 +26674,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     const res = await fetch(url);
     if (!res.ok) {
       console.error(
-        `${TAG46} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
+        `${TAG50} prior-writes-fetch-failed sliceToken=${sliceToken.slice(0, 8)} status=${res.status}`
       );
       return [];
     }
@@ -26175,7 +26682,7 @@ async function fetchPriorWrites(sliceToken, accountId) {
     return Array.isArray(body.writes) ? body.writes : [];
   } catch (err) {
     console.error(
-      `${TAG46} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG50} prior-writes-fetch-threw sliceToken=${sliceToken.slice(0, 8)} err="${err instanceof Error ? err.message : String(err)}"`
     );
     return [];
   }
@@ -26204,7 +26711,7 @@ function composeInitialMessage(input) {
 }
 async function dispatchReviewer(input, initialMessage) {
   const sessionId = randomUUID16();
-  console.log(`${TAG46} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
+  console.log(`${TAG50} route target=rc-spawn sessionId=${sessionId.slice(0, 8)} sourceSession=${input.sessionId.slice(0, 8)}`);
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -26224,21 +26731,21 @@ async function firePublicSessionEndReview(input) {
   const dispatchedAt = Date.now();
   if (consumed.has(input.sessionId)) {
     console.log(
-      `${TAG46} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const jsonl = await fetchJsonl(input.sessionId);
   if (!jsonl) {
     console.log(
-      `${TAG46} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-jsonl-missing`
     );
     return;
   }
   const operatorTurns = countOperatorTurns(jsonl);
   if (operatorTurns === 0) {
     console.log(
-      `${TAG46} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-no-turns`
     );
     return;
   }
@@ -26252,28 +26759,28 @@ async function firePublicSessionEndReview(input) {
   });
   if (!consumeOnce(input.sessionId)) {
     console.log(
-      `${TAG46} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-already-reviewed`
     );
     return;
   }
   const dispatched = await dispatchReviewer(input, initialMessage);
   if (!dispatched.ok) {
     console.error(
-      `${TAG46} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
+      `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=skipped-spawn-failed reason=${dispatched.reason}`
     );
     return;
   }
   console.log(
-    `${TAG46} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
+    `${TAG50} dispatchFor=${input.dispatchFor} sessionId=${input.sessionId} sliceToken=${sliceShort} personId=${personField} result=dispatched managerSessionId=${dispatched.managerSessionId} operatorTurns=${operatorTurns} priorWrites=${priorWrites.length} ms=${Date.now() - dispatchedAt}`
   );
 }
 
 // app/lib/whatsapp/inbound/resolve-client-graph-owner.ts
-var import_dist8 = __toESM(require_dist(), 1);
+var import_dist9 = __toESM(require_dist(), 1);
 async function resolveClientOwnerUserId(accountId, deps = {}) {
   const listAccounts = deps.listAccounts ?? listValidAccounts;
   const getSession4 = deps.getSession ?? getSession;
-  const resolveOwner2 = deps.resolveOwner ?? import_dist8.resolveOwnerUserId;
+  const resolveOwner2 = deps.resolveOwner ?? import_dist9.resolveOwnerUserId;
   const role = listAccounts().find((a) => a.accountId === accountId)?.config.role;
   if (role !== "client") return null;
   const session = getSession4();
@@ -26398,7 +26905,7 @@ function broadcastAdminShutdown(reason) {
 
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash6, verify as cryptoVerify } from "crypto";
-import { existsSync as existsSync35, readFileSync as readFileSync37, statSync as statSync13 } from "fs";
+import { existsSync as existsSync36, readFileSync as readFileSync38, statSync as statSync13 } from "fs";
 import { resolve as resolve35 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
@@ -26447,7 +26954,7 @@ function resolveEntitlement(brand, account) {
     return logResolved(implicitTrust(account), null);
   }
   const entitlementPath = resolve35(brand.configDir, "entitlement.json");
-  if (!existsSync35(entitlementPath)) {
+  if (!existsSync36(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
   const stat8 = statSync13(entitlementPath);
@@ -26462,7 +26969,7 @@ function resolveEntitlement(brand, account) {
 function verifyAndResolve(brand, entitlementPath, account) {
   let pubkeyPem;
   try {
-    pubkeyPem = readFileSync37(pubkeyPath(brand), "utf-8");
+    pubkeyPem = readFileSync38(pubkeyPath(brand), "utf-8");
   } catch (err) {
     return logResolved(anonymousFallback("pubkey-missing"), {
       reason: "pubkey-missing"
@@ -26476,7 +26983,7 @@ function verifyAndResolve(brand, entitlementPath, account) {
   }
   let envelope;
   try {
-    envelope = JSON.parse(readFileSync37(entitlementPath, "utf-8"));
+    envelope = JSON.parse(readFileSync38(entitlementPath, "utf-8"));
   } catch {
     return logResolved(anonymousFallback("malformed"), { reason: "malformed" });
   }
@@ -26637,14 +27144,14 @@ function clientFrom(c) {
   );
 }
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join38(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join39(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
-if (BRAND_JSON_PATH && !existsSync36(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && !existsSync37(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
 }
-if (BRAND_JSON_PATH && existsSync36(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync37(BRAND_JSON_PATH)) {
   try {
-    const parsed = JSON.parse(readFileSync38(BRAND_JSON_PATH, "utf-8"));
+    const parsed = JSON.parse(readFileSync39(BRAND_JSON_PATH, "utf-8"));
     BRAND = { ...BRAND, ...parsed };
   } catch (err) {
     console.error(`[brand] Failed to parse brand.json: ${err.message}`);
@@ -26676,11 +27183,11 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join38(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join39(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
-    if (!existsSync36(ALIAS_DOMAINS_PATH)) return null;
-    const parsed = JSON.parse(readFileSync38(ALIAS_DOMAINS_PATH, "utf-8"));
+    if (!existsSync37(ALIAS_DOMAINS_PATH)) return null;
+    const parsed = JSON.parse(readFileSync39(ALIAS_DOMAINS_PATH, "utf-8"));
     if (!Array.isArray(parsed)) {
       console.error("[alias-domains] malformed alias-domains.json \u2014 expected array");
       return null;
@@ -26704,14 +27211,14 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app62 = new Hono();
+var app63 = new Hono();
 var nativeFileFollowers = /* @__PURE__ */ new Map();
 var webchatFileFollowers = /* @__PURE__ */ new Map();
 async function fetchAccountStandingRules(accountId) {
   const session = getSession();
   try {
-    const res = await (0, import_dist9.resolveActiveRules)(session, accountId);
-    return { block: (0, import_dist9.formatStandingRulesBlock)(res.rules), ownerUserId: res.ownerUserId, source: res.source };
+    const res = await (0, import_dist10.resolveActiveRules)(session, accountId);
+    return { block: (0, import_dist10.formatStandingRulesBlock)(res.rules), ownerUserId: res.ownerUserId, source: res.source };
   } catch (err) {
     console.error(
       `[preference-inject] op=fetch-failed accountId=${accountId} error=${err instanceof Error ? err.message : String(err)}`
@@ -26744,7 +27251,7 @@ async function recordPassiveDispatch(input) {
 var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve36(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve36(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -26759,7 +27266,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, ".."))
+      platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -26812,6 +27319,13 @@ var waGateway = new WaGateway({
       console.error(`[whatsapp-native] op=account-manager-route senderId=${senderId} managesAccount=${managesAccount} effectiveAccount=${effectiveAccountId} source=gate`);
     }
     const req = buildWaSpawnRequest({ accountId: effectiveAccountId, senderId, role, personId, gatewayUrl, serverPath });
+    await ensureSessionConversation({
+      accountId: effectiveAccountId,
+      sessionId: req.sessionId,
+      channel: "whatsapp",
+      channelAddress: senderId,
+      agentType: role === "admin" ? "admin" : "public"
+    });
     let userId = role === "admin" ? resolveAdminUserId({ accountId: effectiveAccountId, senderPhone: senderId }) ?? (ownerSelfPhone ? resolveOwnerUserId(effectiveAccountId) ?? void 0 : void 0) : void 0;
     let graphOwnerResolved = false;
     if (role === "admin" && userId === void 0) {
@@ -26850,13 +27364,13 @@ var waGateway = new WaGateway({
     nativeFileFollowers.set(senderId, ac);
   }
 });
-app62.route("/", waGateway.routes());
+app63.route("/", waGateway.routes());
 waGateway.startSweeper();
 function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join38(configDir2, "projects");
+    const projectsRoot = join39(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -26968,7 +27482,7 @@ var webchatGateway = new WebchatGateway({
   firePublicSessionEndReview: (input) => firePublicSessionEndReview(input)
 });
 setWebchatGateway(webchatGateway);
-app62.route("/", webchatGateway.routes());
+app63.route("/", webchatGateway.routes());
 webchatGateway.startSweeper();
 webchatGateway.startPublicReaper();
 var telegramFileFollowers = /* @__PURE__ */ new Map();
@@ -27002,7 +27516,7 @@ var telegramGateway = new TelegramGateway({
   }
 });
 setTelegramGateway(telegramGateway);
-app62.route("/", telegramGateway.routes());
+app63.route("/", telegramGateway.routes());
 telegramGateway.startSweeper();
 var chatRoutes = createChatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
@@ -27036,19 +27550,19 @@ var scheduleInjectRoutes = createScheduleInjectRoutes({
     return managed.account;
   }
 });
-app62.route("/api/channel/schedule-inject", scheduleInjectRoutes);
-app62.use("*", clientIpMiddleware);
+app63.route("/api/channel/schedule-inject", scheduleInjectRoutes);
+app63.use("*", clientIpMiddleware);
 function allowsSameOriginFraming(path3) {
   return path3 === "/vnc-viewer.html" || path3.startsWith("/api/admin/attachment/") || path3.startsWith("/api/public-reader/attachment/") || path3 === "/api/admin/files/download";
 }
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
   c.header("X-Frame-Options", allowsSameOriginFraming(c.req.path) ? "SAMEORIGIN" : "DENY");
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -27066,7 +27580,7 @@ app62.use("*", async (c, next) => {
     });
   }
 });
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains()) || !isPublicHost(host)) {
     await next();
@@ -27104,7 +27618,7 @@ function resolveRemoteAuthOpts(c) {
   return { ...brandLoginOpts, origin };
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app62.post("/__remote-auth/login", async (c) => {
+app63.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -27149,7 +27663,7 @@ app62.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app62.get("/__remote-auth/logout", (c) => {
+app63.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -27162,7 +27676,7 @@ app62.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app62.post("/__remote-auth/change-password", async (c) => {
+app63.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -27221,13 +27735,13 @@ app62.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app62.get("/__remote-auth/setup", (c) => {
+app63.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup" }), 200);
 });
-app62.post("/__remote-auth/set-initial-password", async (c) => {
+app63.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -27265,10 +27779,10 @@ app62.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app62.get("/api/remote-auth/status", (c) => {
+app63.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app62.post("/api/remote-auth/set-password", async (c) => {
+app63.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -27307,10 +27821,10 @@ app62.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app62.route("/api/_client-error", client_error_default);
+app63.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
 var PWA_PUBLIC_PATHS = /* @__PURE__ */ new Set(["/sw.js", ...PWA_SURFACES.map((s) => s.manifestPath)]);
-app62.use("*", async (c, next) => {
+app63.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (path3 === "/favicon.ico" || path3.startsWith("/assets/") || path3.startsWith("/brand/") || // Public free/busy is read by the booking page (a separate Cloudflare Pages
@@ -27354,27 +27868,34 @@ app62.use("*", async (c, next) => {
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(c), redirect: path3 }), 200);
 });
-app62.route("/api/health", health_default);
-app62.route("/api/chat", chatRoutes);
-app62.route("/api/whatsapp", whatsapp_default);
-app62.route("/api/storage", storage_broker_default);
-app62.route("/api/whatsapp-reader", whatsapp_reader_default);
-app62.route("/api/public-reader", public_reader_default);
-app62.route("/api/webchat", createWebchatRoutes({
+app63.route("/api/health", health_default);
+app63.route("/api/chat", chatRoutes);
+app63.route("/api/whatsapp", whatsapp_default);
+app63.route("/api/storage", storage_broker_default);
+app63.route("/api/whatsapp-reader", whatsapp_reader_default);
+app63.route("/api/public-reader", public_reader_default);
+app63.route("/api/webchat", createWebchatRoutes({
   handleInbound: (input) => webchatGateway.handleInbound(input),
   // Task 940 — the permission relay's pointer read + verdict write.
   pendingPromptFor: (key) => webchatGateway.pendingPromptFor(key),
   deliveryFailureFor: (key) => webchatGateway.deliveryFailureFor(key),
   resolvePermissionVerdict: (key, requestId, behavior) => webchatGateway.resolvePermissionVerdict(key, requestId, behavior)
 }));
-app62.route("/api/webchat/greeting", webchat_greeting_default);
-app62.route("/api/telegram", telegram_default);
-app62.route("/api/quickbooks", quickbooks_default);
-app62.route("/api/onboarding", onboarding_default);
-app62.route("/api/admin", admin_default);
-app62.route("/api/access", access_default);
-app62.route("/api/session", session_default2);
-app62.route("/api/calendar", calendar_public_default);
+app63.route("/api/webchat/greeting", webchat_greeting_default);
+app63.route("/api/telegram", telegram_default);
+app63.route("/api/quickbooks", quickbooks_default);
+app63.route(
+  "/api/google",
+  createGoogleOAuthRoutes(
+    resolve36(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..")),
+    resolve36(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "..", "data/accounts")
+  )
+);
+app63.route("/api/onboarding", onboarding_default);
+app63.route("/api/admin", admin_default);
+app63.route("/api/access", access_default);
+app63.route("/api/session", session_default2);
+app63.route("/api/calendar", calendar_public_default);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -27386,7 +27907,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app62.get("/agent-assets/:slug/:filename", (c) => {
+app63.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -27408,20 +27929,20 @@ app62.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync36(filePath)) {
+  if (!existsSync37(filePath)) {
     console.error(`[agent-assets] serve slug=${slug} file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[agent-assets] serve slug=${slug} file=${filename} status=200`);
-  const body = readFileSync38(filePath);
+  const body = readFileSync39(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=3600"
   });
 });
-app62.get("/generated/:filename", (c) => {
+app63.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -27438,29 +27959,29 @@ app62.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
   }
-  if (!existsSync36(filePath)) {
+  if (!existsSync37(filePath)) {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
   const ext = "." + filename.split(".").pop()?.toLowerCase();
   const contentType = IMAGE_MIME[ext] || "application/octet-stream";
   console.log(`[generated] serve file=${filename} status=200`);
-  const body = readFileSync38(filePath);
+  const body = readFileSync39(filePath);
   return c.body(body, 200, {
     "Content-Type": contentType,
     "Cache-Control": "public, max-age=86400"
   });
 });
-app62.route("/sites", sites_default);
-app62.route("/listings", listings_default);
-app62.route("/v", visitor_event_default);
-app62.route("/v", visitor_consent_default);
+app63.route("/sites", sites_default);
+app63.route("/listings", listings_default);
+app63.route("/v", visitor_event_default);
+app63.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
-if (BRAND_JSON_PATH && existsSync36(BRAND_JSON_PATH)) {
+if (BRAND_JSON_PATH && existsSync37(BRAND_JSON_PATH)) {
   try {
-    const fullBrand = JSON.parse(readFileSync38(BRAND_JSON_PATH, "utf-8"));
+    const fullBrand = JSON.parse(readFileSync39(BRAND_JSON_PATH, "utf-8"));
     if (fullBrand.assets?.logo) brandLogoPath = `/brand/${fullBrand.assets.logo}`;
     brandIconPath = fullBrand.assets?.icon ? `/brand/${fullBrand.assets.icon}` : brandLogoPath;
   } catch {
@@ -27487,11 +28008,11 @@ var brandScript = `<script>window.__BRAND__=${JSON.stringify({
 var brandThemeColor = BRAND.defaultColors?.primary ?? "#000000";
 var brandBackgroundColor = BRAND.defaultColors?.background ?? "#ffffff";
 var brandAppIconsExist = [brandAppIcon192Path, brandAppIcon512Path, brandMaskableIconPath].every(
-  (p) => existsSync36(resolve36(process.cwd(), "public", p.replace(/^\//, "")))
+  (p) => existsSync37(resolve36(process.cwd(), "public", p.replace(/^\//, "")))
 );
 var SW_SOURCE = (() => {
   try {
-    return readFileSync38(resolve36(process.cwd(), "public", "sw.js"), "utf-8");
+    return readFileSync39(resolve36(process.cwd(), "public", "sw.js"), "utf-8");
   } catch {
     return null;
   }
@@ -27499,9 +28020,9 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join38(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
-    if (!existsSync36(versionFile)) return "unknown";
-    const content = readFileSync38(versionFile, "utf-8").trim();
+    const versionFile = join39(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    if (!existsSync37(versionFile)) return "unknown";
+    const content = readFileSync39(versionFile, "utf-8").trim();
     return content || "unknown";
   } catch {
     return "unknown";
@@ -27542,7 +28063,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync38(resolve36(process.cwd(), "public", file), "utf-8");
+    html = readFileSync39(resolve36(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -27559,13 +28080,13 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join38(homedir4(), BRAND.configDir);
+  const configDir2 = join39(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join38(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
-    if (!existsSync36(cachePath)) return null;
-    return JSON.parse(readFileSync38(cachePath, "utf-8"));
+    const cachePath = join39(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    if (!existsSync37(cachePath)) return null;
+    return JSON.parse(readFileSync39(cachePath, "utf-8"));
   } catch {
     return null;
   }
@@ -27609,7 +28130,7 @@ function brandedPublicHtml(agentSlug) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app62.get("/", (c) => {
+app63.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const klass = classifyHost(host, getOperatorDomains(), isPublicHost);
   if (klass === "operator") {
@@ -27631,12 +28152,12 @@ app62.get("/", (c) => {
   console.log(`[host-class] host=${host} class=admin served=index.html`);
   return c.html(cachedHtml("index.html"));
 });
-app62.get("/public", (c) => {
+app63.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app62.get("/public-chat", (c) => {
+app63.get("/public-chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -27655,12 +28176,12 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app62.use("/vnc-viewer.html", logViewerFetch);
-app62.use("/vnc-popout.html", logViewerFetch);
-app62.get("/vnc-popout.html", (c) => {
+app63.use("/vnc-viewer.html", logViewerFetch);
+app63.use("/vnc-popout.html", logViewerFetch);
+app63.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync38(resolve36(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync39(resolve36(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -27670,7 +28191,7 @@ app62.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app62.post("/api/vnc/client-event", async (c) => {
+app63.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -27691,11 +28212,11 @@ app62.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app62.get("/g/:slug", (c) => {
+app63.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml(resolveDefaultSlug() ?? void 0));
 });
 for (const pwa of PWA_SURFACES) {
-  app62.get(pwa.manifestPath, (c) => {
+  app63.get(pwa.manifestPath, (c) => {
     const manifest = buildManifest(pwa, {
       productName: BRAND.productName,
       appIcon192: brandAppIcon192Path,
@@ -27711,7 +28232,7 @@ for (const pwa of PWA_SURFACES) {
     return c.body(JSON.stringify(manifest));
   });
 }
-app62.get("/sw.js", (c) => {
+app63.get("/sw.js", (c) => {
   if (SW_SOURCE == null) {
     console.error("[pwa] op=sw status=500 reason=sw-source-missing");
     return c.text("Service worker unavailable", 500);
@@ -27720,12 +28241,12 @@ app62.get("/sw.js", (c) => {
   console.log(`[pwa] op=sw status=200 ct=${SW_CONTENT_TYPE}`);
   return c.body(SW_SOURCE);
 });
-app62.get("/graph", (c) => {
+app63.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app62.get("/chat", (c) => {
+app63.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isOperatorHost(host, getOperatorDomains())) {
     console.log(`[host-class] host=${host} class=operator served=operator.html`);
@@ -27734,27 +28255,32 @@ app62.get("/chat", (c) => {
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("chat.html"));
 });
-app62.get("/data", (c) => {
+app63.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app62.get("/tasks", (c) => {
+app63.get("/tasks", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("tasks.html"));
 });
-app62.get("/calendar", (c) => {
+app63.get("/activity", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("activity.html"));
+});
+app63.get("/calendar", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("calendar.html"));
 });
-app62.get("/browser", (c) => {
+app63.get("/browser", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host) || isOperatorHost(host, getOperatorDomains())) return c.text("Not found", 404);
   return c.html(cachedHtml("browser.html"));
 });
-app62.get("/:slug", async (c, next) => {
+app63.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -27769,13 +28295,13 @@ app62.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app62.get("/favicon.ico", (c) => {
+  app63.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app62.use("/*", serveStatic({ root: "./public" }));
-app62.all("*", (c) => {
+app63.use("/*", serveStatic({ root: "./public" }));
+app63.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
   if (isPublicHost(host)) {
@@ -27789,14 +28315,14 @@ app62.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app62.fetch, port, hostname });
+var httpServer = serve({ fetch: app63.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
   const reconcileScript = resolve36(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const RECONCILE_INTERVAL_MS = 12e4;
   const runReconcile = () => {
-    if (!existsSync36(reconcileScript)) return;
+    if (!existsSync37(reconcileScript)) return;
     try {
       const child = spawn3(process.execPath, [reconcileScript], {
         env: { ...process.env, PLATFORM_ROOT: reconcilePlatformRoot },
@@ -27814,11 +28340,11 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   loop.unref();
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
   const outlookScript = resolve36(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = () => {
-    if (!existsSync36(outlookScript)) return;
+    if (!existsSync37(outlookScript)) return;
     try {
       const child = spawn3(process.execPath, [outlookScript], {
         env: { ...process.env, PLATFORM_ROOT: outlookPlatformRoot },
@@ -27836,19 +28362,19 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   outlookLoop.unref();
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
   const strandedAccountsDir = resolve36(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
   const STRANDED_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
   const runStrandedAudit = () => {
     try {
-      if (!existsSync36(strandedAccountsDir)) return;
+      if (!existsSync37(strandedAccountsDir)) return;
       const now = Date.now();
-      for (const name of readdirSync21(strandedAccountsDir)) {
+      for (const name of readdirSync23(strandedAccountsDir)) {
         if (!STRANDED_UUID_RE.test(name)) continue;
         const pendingPath2 = resolve36(strandedAccountsDir, name, "secrets/outlook/pending-devicecode.enc");
-        if (!existsSync36(pendingPath2)) continue;
+        if (!existsSync37(pendingPath2)) continue;
         const ageMs = now - statSync14(pendingPath2).mtimeMs;
         if (ageMs > STRANDED_AGE_MS) {
           console.error(`[outlook-mcp] devicecode-stranded account=${name} ageSec=${Math.floor(ageMs / 1e3)}`);
@@ -27864,7 +28390,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   strandedLoop.unref();
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => {
     runStorageAudit(auditPlatformRoot).catch(
@@ -27886,7 +28412,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   pagesAuditLoop.unref();
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
   const publishScript = resolve36(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const currentAccount = () => {
@@ -27898,7 +28424,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     }
   };
   const spawnPublish = (account) => {
-    if (!existsSync36(publishScript)) return;
+    if (!existsSync37(publishScript)) return;
     try {
       const child = spawn3(process.execPath, [publishScript], {
         env: {
@@ -27919,8 +28445,8 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     const availPath = resolve36(account.accountDir, "calendar-availability.json");
     let hasBookingSite = false;
     try {
-      if (existsSync36(availPath)) {
-        const cfg = JSON.parse(readFileSync38(availPath, "utf-8"));
+      if (existsSync37(availPath)) {
+        const cfg = JSON.parse(readFileSync39(availPath, "utf-8"));
         hasBookingSite = typeof cfg.bookingDbName === "string" && cfg.bookingDbName.length > 0;
       }
     } catch {
@@ -27928,9 +28454,9 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     if (!hasBookingSite) return;
     const statePath = resolve36(account.accountDir, "state", "booking-availability", "last-publish.json");
     let lastSuccessAt = null;
-    if (existsSync36(statePath)) {
+    if (existsSync37(statePath)) {
       try {
-        const rec = JSON.parse(readFileSync38(statePath, "utf-8"));
+        const rec = JSON.parse(readFileSync39(statePath, "utf-8"));
         lastSuccessAt = rec.lastSuccessAt ?? null;
       } catch {
         console.error(`[calendar-availability] op=audit accountId=${account.accountId} snapshotAgeMs=na reason=bad-state-file`);
@@ -27953,13 +28479,14 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   publishLoop.unref();
 }
 startTimeEntryCensus(() => getSession());
+startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..");
   const auditScript = resolve36(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
   const runConnectorAudit = () => {
-    if (!existsSync36(auditScript)) return;
+    if (!existsSync37(auditScript)) return;
     try {
       const child = spawn3(process.execPath, [auditScript], {
         env: { ...process.env, PLATFORM_ROOT: auditPlatformRoot, LOG_DIR: auditLogDir },
@@ -28030,7 +28557,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app62.routes ?? []) {
+  for (const r of app63.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });
@@ -28070,11 +28597,11 @@ try {
 var ADMINUSER_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 async function runAdminUserReconcileTick() {
   try {
-    if (!existsSync36(USERS_FILE)) {
+    if (!existsSync37(USERS_FILE)) {
       console.error("[adminuser-self-heal] skip reason=no-users-file");
       return;
     }
-    const usersRaw = readFileSync38(USERS_FILE, "utf-8").trim();
+    const usersRaw = readFileSync39(USERS_FILE, "utf-8").trim();
     if (!usersRaw) {
       console.error("[adminuser-self-heal] skip reason=empty-users-file");
       return;
@@ -28092,6 +28619,7 @@ async function runAdminUserReconcileTick() {
     }
     await runAdminUserSelfHeal({ userId, accountId: account.accountId });
     await runUserProfileReconcile();
+    await runConversationAudit();
   } catch (err) {
     console.error(`[adminuser-self-heal] rejected: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -28103,8 +28631,8 @@ var adminUserReconcileTimer = setInterval(() => {
 if (typeof adminUserReconcileTimer.unref === "function") adminUserReconcileTimer.unref();
 var USERS_RECONCILE_INTERVAL_MS = 60 * 60 * 1e3;
 function countUsersRows() {
-  if (!existsSync36(USERS_FILE)) return 0;
-  const raw = readFileSync38(USERS_FILE, "utf-8").trim();
+  if (!existsSync37(USERS_FILE)) return 0;
+  const raw = readFileSync39(USERS_FILE, "utf-8").trim();
   if (!raw) return 0;
   const users = JSON.parse(raw);
   return users.filter((u) => typeof u.userId === "string").length;
@@ -28224,7 +28752,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join38(__dirname, "..")),
+  platformRoot: resolve36(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.isOwnerMirror) {