@rubytech/create-realagent-code 0.1.252 → 0.1.253

package/payload/server/server.js

@@ -4514,10 +4514,10 @@ var require_browser = __commonJS({
           text = canvas;
           canvas = void 0;
         }
-        return new Promise(function(resolve26, reject) {
+        return new Promise(function(resolve27, reject) {
           try {
             const data = QRCode2.create(text, opts);
-            resolve26(renderFunc(data, canvas, opts));
+            resolve27(renderFunc(data, canvas, opts));
           } catch (e) {
             reject(e);
           }
@@ -4599,11 +4599,11 @@ var require_server = __commonJS({
     }
     function render(renderFunc, text, params) {
       if (!params.cb) {
-        return new Promise(function(resolve26, reject) {
+        return new Promise(function(resolve27, reject) {
           try {
             const data = QRCode2.create(text, params.opts);
             return renderFunc(data, params.opts, function(err, data2) {
-              return err ? reject(err) : resolve26(data2);
+              return err ? reject(err) : resolve27(data2);
             });
           } catch (e) {
             reject(e);
@@ -5435,7 +5435,7 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync22, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve25, join as join17, basename as basename6 } from "path";
+import { resolve as resolve26, join as join17, basename as basename6 } from "path";
 import { homedir as homedir2 } from "os";
 import { monitorEventLoopDelay } from "perf_hooks";
 
@@ -5958,7 +5958,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG2} draining credential save queue\u2026`);
   const timer2 = new Promise(
-    (resolve26) => setTimeout(() => resolve26("timeout"), timeoutMs)
+    (resolve27) => setTimeout(() => resolve27("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -6086,11 +6086,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve27, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve26();
+        resolve27();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -6204,14 +6204,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve27, reject) => {
     const timer2 = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer2);
-        resolve26(value);
+        resolve27(value);
       },
       (err) => {
         clearTimeout(timer2);
@@ -6753,8 +6753,8 @@ async function persistWhatsAppMessage(input) {
   const { givenName, familyName } = splitName(input.pushName);
   const prev = sessionWriteLocks.get(input.cacheKey);
   let release;
-  const mine = new Promise((resolve26) => {
-    release = resolve26;
+  const mine = new Promise((resolve27) => {
+    release = resolve27;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   sessionWriteLocks.set(input.cacheKey, chained);
@@ -7790,11 +7790,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG12} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve26) => {
-        const timer2 = setTimeout(resolve26, delay);
+      await new Promise((resolve27) => {
+        const timer2 = setTimeout(resolve27, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer2);
-          resolve26();
+          resolve27();
         }, { once: true });
       });
     }
@@ -7802,16 +7802,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve27) => {
     if (!conn.sock) {
-      resolve26();
+      resolve27();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve26();
+        resolve27();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -8078,8 +8078,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve26) => {
-      resolvePending = resolve26;
+    const sttPending = new Promise((resolve27) => {
+      resolvePending = resolve27;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -8488,20 +8488,20 @@ function buildX11Env(chromiumWrapperPath, transport = "vnc") {
 
 // server/routes/health.ts
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve26) => {
+  return new Promise((resolve27) => {
     const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve26(true);
+      resolve27(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve26(false);
+      resolve27(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve26(false);
+      resolve27(false);
     });
   });
 }
@@ -8773,7 +8773,7 @@ async function transcribeVoiceNote(file, source) {
 }
 
 // app/lib/channel-pty-bridge/bridge.ts
-import { resolve as resolve4 } from "path";
+import { resolve as resolve5 } from "path";
 
 // app/lib/channel-pty-bridge/manager-client.ts
 function managerBase() {
@@ -9073,6 +9073,8 @@ function startFollower(opts) {
       const reader = res.body.getReader();
       const decoder = new TextDecoder("utf8");
       let buffered = "";
+      const fileDelivery = opts.fileDelivery ?? null;
+      let firedFileTools = [];
       while (!abort.signal.aborted) {
         const { value, done } = await reader.read();
         if (done) break;
@@ -9094,6 +9096,7 @@ function startFollower(opts) {
           }
           if (event.type === "user") {
             entry.pendingTurnText = "";
+            firedFileTools = [];
             continue;
           }
           if (event.type !== "assistant") continue;
@@ -9103,6 +9106,15 @@ function startFollower(opts) {
             for (const block of msg.content) {
               if (block?.type === "text" && typeof block.text === "string") {
                 entry.pendingTurnText += block.text;
+              } else if (fileDelivery && block?.type === "tool_use" && typeof block.name === "string" && fileDelivery.isFileDeliveryTool(block.name)) {
+                firedFileTools.push(block.name);
+                try {
+                  await fileDelivery.onFileToolUse({ toolName: block.name, input: block.input });
+                } catch (err) {
+                  console.error(
+                    `${tag} file-delivery-error sessionId=${sid} tool=${block.name} message=${err instanceof Error ? err.message : String(err)}`
+                  );
+                }
               }
             }
           }
@@ -9112,6 +9124,17 @@ function startFollower(opts) {
             if (flush.trim()) {
               await fanOut(entry.subscribers, flush, opts.onError, tag);
             }
+            if (fileDelivery && firedFileTools.length > 0) {
+              const fired = firedFileTools;
+              firedFileTools = [];
+              try {
+                fileDelivery.onTurnEnd(fired);
+              } catch (err) {
+                console.error(
+                  `${tag} file-delivery-error sessionId=${sid} phase=turn-end message=${err instanceof Error ? err.message : String(err)}`
+                );
+              }
+            }
           }
         }
       }
@@ -9138,10 +9161,145 @@ async function fanOut(subscribers, text, onError, tag) {
   );
 }
 
+// app/lib/whatsapp/outbound/send-document.ts
+import { realpathSync as realpathSync2 } from "fs";
+import { readFile, stat as stat2 } from "fs/promises";
+import { resolve as resolve4, basename } from "path";
+var TAG15 = "[whatsapp:outbound]";
+var lastDocumentOutboundAt = /* @__PURE__ */ new Map();
+function normalizeJid(to) {
+  return to.includes("@") ? to : toWhatsappJid(to);
+}
+function documentOutboundAt(to) {
+  return lastDocumentOutboundAt.get(normalizeJid(to));
+}
+async function sendWhatsAppDocument(input) {
+  const { to, filePath, caption, accountId, maxyAccountId, platformRoot: platformRoot2 } = input;
+  if (!to || !filePath) {
+    return { ok: false, status: 400, error: "Missing required fields: to, filePath" };
+  }
+  if (!maxyAccountId || !platformRoot2) {
+    return { ok: false, status: 400, error: "Cannot validate file path: missing account or platform context" };
+  }
+  const accountDir = resolve4(platformRoot2, "..", "data/accounts", maxyAccountId);
+  let resolvedPath;
+  try {
+    resolvedPath = realpathSync2(filePath);
+    const accountResolved = realpathSync2(accountDir);
+    if (!resolvedPath.startsWith(accountResolved + "/")) {
+      const sanitised = filePath.replace(accountDir, "<account>/");
+      console.error(`${TAG15} document REJECTED path=${sanitised} reason=outside_account_directory`);
+      return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
+    }
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") {
+      console.error(`${TAG15} document ENOENT path=${filePath}`);
+      return { ok: false, status: 404, error: `File not found: ${filePath}` };
+    }
+    console.error(`${TAG15} document path error: ${String(err)}`);
+    return { ok: false, status: 500, error: String(err) };
+  }
+  const fileStat = await stat2(resolvedPath);
+  if (fileStat.size > MAX_FILE_SIZE_BYTES) {
+    return {
+      ok: false,
+      status: 400,
+      error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)`
+    };
+  }
+  const filename = basename(resolvedPath);
+  const jid = normalizeJid(to);
+  const sock = getSocket(accountId);
+  if (!sock) {
+    console.error(`${TAG15} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=false reason=not-connected`);
+    return { ok: false, status: 503, error: `WhatsApp account "${accountId}" is not connected` };
+  }
+  const buffer = Buffer.from(await readFile(resolvedPath));
+  const mimetype = detectMimeType(resolvedPath);
+  const result = await sendMediaMessage(
+    sock,
+    to,
+    { type: "document", buffer, mimetype, filename, caption },
+    { accountId }
+  );
+  console.error(
+    `${TAG15} sent document to=${jid} file=${filename} bytes=${fileStat.size} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
+  );
+  if (result.success) {
+    lastDocumentOutboundAt.set(jid, Date.now());
+    return { ok: true, messageId: result.messageId };
+  }
+  return { ok: false, status: 500, error: result.error ?? "send failed" };
+}
+
+// app/lib/whatsapp/inbound/file-delivery-bridge.ts
+var TAG16 = "[whatsapp-adaptor]";
+var SEND_USER_FILE = "SendUserFile";
+var WHATSAPP_SEND_DOCUMENT = "whatsapp-send-document";
+function platformRoot() {
+  return process.env.MAXY_PLATFORM_ROOT || "";
+}
+function makeWhatsAppFileDelivery(entry) {
+  let turnStartedAt = null;
+  return {
+    isFileDeliveryTool(toolName) {
+      return toolName === SEND_USER_FILE || toolName === WHATSAPP_SEND_DOCUMENT;
+    },
+    async onFileToolUse(use) {
+      if (turnStartedAt === null) turnStartedAt = Date.now();
+      if (use.toolName !== SEND_USER_FILE) return;
+      const input = use.input ?? {};
+      const files = Array.isArray(input.files) ? input.files.filter((f) => typeof f === "string") : [];
+      const caption = typeof input.caption === "string" ? input.caption : void 0;
+      if (files.length === 0) return;
+      let maxyAccountId;
+      try {
+        maxyAccountId = resolvePlatformAccountId();
+      } catch (err) {
+        console.error(
+          `${TAG16} file-delivery reject reason=account-unresolved sender=${entry.senderId} message=${err instanceof Error ? err.message : String(err)}`
+        );
+        return;
+      }
+      for (let i = 0; i < files.length; i++) {
+        const result = await sendWhatsAppDocument({
+          to: entry.senderId,
+          filePath: files[i],
+          caption: i === 0 ? caption : void 0,
+          accountId: entry.accountId,
+          maxyAccountId,
+          platformRoot: platformRoot()
+        });
+        if (!result.ok) {
+          console.error(
+            `${TAG16} file-delivery reject reason=send-failed sender=${entry.senderId} status=${result.status} message=${result.error}`
+          );
+        }
+      }
+    },
+    onTurnEnd(firedTools) {
+      const startedAt = turnStartedAt ?? 0;
+      turnStartedAt = null;
+      const okAt = documentOutboundAt(entry.senderId);
+      if (okAt !== void 0 && okAt >= startedAt) return;
+      const sid = entry.sessionId.slice(0, 8);
+      for (const tool of firedTools) {
+        console.error(
+          `${TAG16} file-delivery-unreconciled sender=${entry.senderId} sessionId=${sid} tool=${tool}`
+        );
+      }
+    }
+  };
+}
+
 // app/lib/channel-pty-bridge/bridge.ts
 function tagFor(channel) {
   return `[${channel}-adaptor]`;
 }
+function fileDeliveryFor(entry) {
+  return entry.channel === "whatsapp" ? makeWhatsAppFileDelivery(entry) : null;
+}
 function publicIdleMs() {
   return Number(process.env.CHANNEL_PTY_IDLE_MS ?? String(5 * 6e4));
 }
@@ -9163,6 +9321,7 @@ async function ensureEntry(input) {
       existing.followerAbort = startFollower({
         entry: existing,
         tag,
+        fileDelivery: fileDeliveryFor(existing),
         onClose: () => {
           existing.followerRunning = false;
         }
@@ -9182,7 +9341,7 @@ async function ensureEntry(input) {
     });
   } else {
     console.error(`${tag} route role=${input.role} target=public-spawn senderId=${input.senderId}`);
-    const attachmentDir = resolve4(ATTACHMENTS_ROOT, "public", input.senderId);
+    const attachmentDir = resolve5(ATTACHMENTS_ROOT, "public", input.senderId);
     spawned = await managerSpawn({
       senderId: input.senderId,
       role: input.role,
@@ -9223,6 +9382,7 @@ async function ensureEntry(input) {
   entry.followerAbort = startFollower({
     entry,
     tag,
+    fileDelivery: fileDeliveryFor(entry),
     onClose: () => {
       entry.followerRunning = false;
     }
@@ -9308,12 +9468,12 @@ async function dispatchOnce(input) {
   });
   if (!entry) return { error: "spawn-failed" };
   entry.lastInboundAt = Date.now();
-  let resolve26;
+  let resolve27;
   const turnPromise = new Promise((r) => {
-    resolve26 = r;
+    resolve27 = r;
   });
   const listener = (text) => {
-    resolve26(text);
+    resolve27(text);
   };
   entry.subscribers.add(listener);
   const writeOk = await writeInput(entry, input.text);
@@ -9672,19 +9832,18 @@ app2.post("/", async (c) => {
 var chat_default = app2;
 
 // server/routes/whatsapp.ts
-import { join as join5, resolve as resolve6, basename } from "path";
-import { readFile, stat as stat2 } from "fs/promises";
-import { realpathSync as realpathSync2, readdirSync as readdirSync2, readFileSync as readFileSync6, existsSync as existsSync4 } from "fs";
+import { join as join5, resolve as resolve7 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, existsSync as existsSync4 } from "fs";
 
 // app/lib/whatsapp/login.ts
 var import_qrcode = __toESM(require_lib(), 1);
 import { randomUUID as randomUUID6 } from "crypto";
-var TAG15 = "[whatsapp:login]";
+var TAG17 = "[whatsapp:login]";
 async function renderQrTerminal(qr) {
   try {
     return await import_qrcode.default.toString(qr, { type: "utf8" });
   } catch (err) {
-    console.error(`${TAG15} terminal QR render failed: ${String(err)}`);
+    console.error(`${TAG17} terminal QR render failed: ${String(err)}`);
     return void 0;
   }
 }
@@ -9694,7 +9853,7 @@ function closeSocket(sock) {
   try {
     sock.ws?.close?.();
   } catch (err) {
-    console.warn(`${TAG15} socket close error during cleanup: ${String(err)}`);
+    console.warn(`${TAG17} socket close error during cleanup: ${String(err)}`);
   }
 }
 function resetActiveLogin(accountId) {
@@ -9717,7 +9876,7 @@ async function loginConnectionLoop(accountId, login) {
       const current = activeLogins.get(accountId);
       if (current?.id === login.id) {
         current.connected = true;
-        console.error(`${TAG15} loginConnectionLoop: connected account=${accountId} attempt=${attempt}`);
+        console.error(`${TAG17} loginConnectionLoop: connected account=${accountId} attempt=${attempt}`);
       }
       return;
     } catch (err) {
@@ -9727,7 +9886,7 @@ async function loginConnectionLoop(accountId, login) {
       if (!classification.shouldRetry || attempt >= LOGIN_MAX_RECONNECTS) {
         if (attempt >= LOGIN_MAX_RECONNECTS) {
           console.error(
-            `${TAG15} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
+            `${TAG17} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
           );
           current.error = `Login failed after ${attempt} reconnect attempts: ${formatError(err)}`;
         } else {
@@ -9739,7 +9898,7 @@ async function loginConnectionLoop(accountId, login) {
       attempt++;
       const delay = LOGIN_RECONNECT_DELAYS[attempt - 1] ?? 8e3;
       console.error(
-        `${TAG15} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
+        `${TAG17} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
       );
       closeSocket(current.sock);
       await new Promise((r) => setTimeout(r, delay));
@@ -9750,7 +9909,7 @@ async function loginConnectionLoop(accountId, login) {
         current.sock = newSock;
       } catch (sockErr) {
         console.error(
-          `${TAG15} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
+          `${TAG17} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
         );
         current.error = `Reconnection failed: ${String(sockErr)}`;
         return;
@@ -9764,7 +9923,7 @@ async function startLogin(opts) {
   const hasAuth = await authExists(authDir);
   const selfId = readSelfId(authDir);
   console.error(
-    `${TAG15} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasQr=${!!existing0.qr}}` : " activeLogin=none")
+    `${TAG17} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasQr=${!!existing0.qr}}` : " activeLogin=none")
   );
   if (hasAuth && !force) {
     const who = selfId.e164 ?? selfId.jid ?? "unknown";
@@ -9776,7 +9935,7 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   const existing = activeLogins.get(accountId);
   if (existing && isLoginFresh(existing) && existing.qrDataUrl && !force) {
-    console.error(`${TAG15} startLogin account=${accountId} guard: returning existing QR (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
+    console.error(`${TAG17} startLogin account=${accountId} guard: returning existing QR (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
     return {
       qrDataUrl: existing.qrDataUrl,
       qrRaw: existing.qr,
@@ -9785,13 +9944,13 @@ async function startLogin(opts) {
     };
   }
   if (existing) {
-    console.error(`${TAG15} startLogin account=${accountId} ${force ? "force override" : "stale/no-QR"}, resetting active login`);
+    console.error(`${TAG17} startLogin account=${accountId} ${force ? "force override" : "stale/no-QR"}, resetting active login`);
   }
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve26, reject) => {
-    resolveQr = resolve26;
+  const qrPromise = new Promise((resolve27, reject) => {
+    resolveQr = resolve27;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -9807,14 +9966,14 @@ async function startLogin(opts) {
       onQr: (qr2) => {
         loginQrCount++;
         if (pendingQr) {
-          console.error(`${TAG15} QR rotation #${loginQrCount} received for account=${accountId} \u2014 not forwarded (initial QR already captured)`);
+          console.error(`${TAG17} QR rotation #${loginQrCount} received for account=${accountId} \u2014 not forwarded (initial QR already captured)`);
           return;
         }
         pendingQr = qr2;
         const current = activeLogins.get(accountId);
         if (current && !current.qr) current.qr = qr2;
         clearTimeout(qrTimer);
-        console.error(`${TAG15} QR #${loginQrCount} received for account=${accountId} \u2014 forwarding to caller`);
+        console.error(`${TAG17} QR #${loginQrCount} received for account=${accountId} \u2014 forwarding to caller`);
         resolveQr?.(qr2);
       }
     });
@@ -9834,7 +9993,7 @@ async function startLogin(opts) {
   activeLogins.set(accountId, login);
   if (pendingQr && !login.qr) login.qr = pendingQr;
   loginConnectionLoop(accountId, login).catch((err) => {
-    console.error(`${TAG15} loginConnectionLoop unexpected error: ${String(err)}`);
+    console.error(`${TAG17} loginConnectionLoop unexpected error: ${String(err)}`);
     const current = activeLogins.get(accountId);
     if (current?.id === login.id) {
       current.error = `Unexpected login error: ${String(err)}`;
@@ -9860,7 +10019,7 @@ async function waitForLogin(opts) {
   const { accountId, timeoutMs = 6e4 } = opts;
   const login = activeLogins.get(accountId);
   console.error(
-    `${TAG15} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasQr=${!!login.qr}}` : " login=none")
+    `${TAG17} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasQr=${!!login.qr}}` : " login=none")
   );
   if (!login) {
     return { connected: false, message: "No active WhatsApp login in progress." };
@@ -9873,7 +10032,7 @@ async function waitForLogin(opts) {
   while (Date.now() < deadline) {
     if (login.connected) {
       const selfId = readSelfId(login.authDir);
-      console.error(`${TAG15} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
+      console.error(`${TAG17} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
       const sock = login.sock;
       const authDir = login.authDir;
       activeLogins.delete(accountId);
@@ -9893,17 +10052,17 @@ async function waitForLogin(opts) {
     await new Promise((r) => setTimeout(r, 1e3));
   }
   const elapsed = Math.round((Date.now() - (deadline - timeoutMs)) / 1e3);
-  console.error(`${TAG15} waitForLogin timeout account=${accountId} elapsed=${elapsed}s \u2014 cleaning up active login`);
+  console.error(`${TAG17} waitForLogin timeout account=${accountId} elapsed=${elapsed}s \u2014 cleaning up active login`);
   resetActiveLogin(accountId);
   return { connected: false, message: "Login timed out. Try generating a new QR." };
 }
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync3 } from "fs";
-import { resolve as resolve5, join as join4 } from "path";
-var TAG16 = "[whatsapp:config]";
+import { resolve as resolve6, join as join4 } from "path";
+var TAG18 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve5(accountDir, "account.json");
+  return resolve6(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
@@ -9918,9 +10077,9 @@ function reloadManagerConfig(accountDir) {
   try {
     const config = readConfig(accountDir);
     reloadConfig(config);
-    console.error(`${TAG16} reloaded manager config`);
+    console.error(`${TAG18} reloaded manager config`);
   } catch (err) {
-    console.error(`${TAG16} manager config reload failed: ${String(err)}`);
+    console.error(`${TAG18} manager config reload failed: ${String(err)}`);
   }
 }
 var E164_PATTERN = /^\+\d{7,15}$/;
@@ -9946,25 +10105,25 @@ function persistAfterPairing(accountDir, accountId, selfPhone) {
       const adminPhones = wa.adminPhones;
       if (!adminPhones.includes(normalized)) {
         adminPhones.push(normalized);
-        console.error(`${TAG16} added selfPhone=${normalized} to adminPhones`);
+        console.error(`${TAG18} added selfPhone=${normalized} to adminPhones`);
       }
     } else {
-      console.error(`${TAG16} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
+      console.error(`${TAG18} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
     }
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG16} validation failed after pairing: ${msg}`);
+      console.error(`${TAG18} validation failed after pairing: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
+    console.error(`${TAG18} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
     reloadManagerConfig(accountDir);
     return { ok: true };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} persist failed account=${accountId}: ${msg}`);
+    console.error(`${TAG18} persist failed account=${accountId}: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -9994,12 +10153,12 @@ function addAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} added admin phone=${normalized}`);
+    console.error(`${TAG18} added admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Added ${normalized} as admin phone. Messages from this number will route to the admin agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} addAdminPhone failed: ${msg}`);
+    console.error(`${TAG18} addAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10027,12 +10186,12 @@ function removeAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} removed admin phone=${normalized}`);
+    console.error(`${TAG18} removed admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Removed ${normalized} from admin phones. Messages from this number will now route to the public agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} removeAdminPhone failed: ${msg}`);
+    console.error(`${TAG18} removeAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10070,12 +10229,12 @@ function setPublicAgent(accountDir, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} publicAgent set to ${trimmed}`);
+    console.error(`${TAG18} publicAgent set to ${trimmed}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Public agent set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} setPublicAgent failed: ${msg}`);
+    console.error(`${TAG18} setPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10139,12 +10298,12 @@ function setGroupPublicAgent(accountDir, accountId, groupJid, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} setGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup} slug=${trimmedSlug}`);
+    console.error(`${TAG18} setGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup} slug=${trimmedSlug}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Per-group public agent set to "${trimmedSlug}" for group ${trimmedGroup}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} setGroupPublicAgent failed: ${msg}`);
+    console.error(`${TAG18} setGroupPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10171,12 +10330,12 @@ function unsetGroupPublicAgent(accountDir, accountId, groupJid) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} unsetGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup}`);
+    console.error(`${TAG18} unsetGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Per-group public agent override removed for group ${trimmedGroup}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} unsetGroupPublicAgent failed: ${msg}`);
+    console.error(`${TAG18} unsetGroupPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10197,17 +10356,17 @@ function updateConfig(accountDir, fields) {
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG16} update validation failed: ${msg}`);
+      console.error(`${TAG18} update validation failed: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG16} updated fields=[${fieldNames.join(",")}]`);
+    console.error(`${TAG18} updated fields=[${fieldNames.join(",")}]`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Updated WhatsApp config: ${fieldNames.join(", ")}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG16} updateConfig failed: ${msg}`);
+    console.error(`${TAG18} updateConfig failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10333,17 +10492,17 @@ function serializeWhatsAppSchema() {
 }
 
 // server/routes/whatsapp.ts
-var TAG17 = "[whatsapp:api]";
+var TAG19 = "[whatsapp:api]";
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT || "";
 var app3 = new Hono();
 app3.get("/status", (c) => {
   try {
     const status = getStatus();
     const summary = status.map((a) => `${a.accountId}:${a.connected ? "up" : "down"}`).join(", ");
-    console.error(`${TAG17} status accounts=${status.length} [${summary}]`);
+    console.error(`${TAG19} status accounts=${status.length} [${summary}]`);
     return c.json({ accounts: status });
   } catch (err) {
-    console.error(`${TAG17} status error: ${String(err)}`);
+    console.error(`${TAG19} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10354,10 +10513,10 @@ app3.post("/login/start", async (c) => {
     const force = body.force ?? false;
     const authDir = join5(MAXY_DIR, "credentials", "whatsapp", accountId);
     const result = await startLogin({ accountId, authDir, force });
-    console.error(`${TAG17} login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
+    console.error(`${TAG19} login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG17} login/start error: ${String(err)}`);
+    console.error(`${TAG19} login/start error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10372,7 +10531,7 @@ app3.post("/login/wait", async (c) => {
       try {
         await registerLoginSocket(accountId, result.sock, result.authDir);
       } catch (regErr) {
-        console.error(`${TAG17} registerLoginSocket failed account=${accountId}: ${String(regErr)}`);
+        console.error(`${TAG19} registerLoginSocket failed account=${accountId}: ${String(regErr)}`);
       }
       try {
         const account = resolveAccount();
@@ -10380,16 +10539,16 @@ app3.post("/login/wait", async (c) => {
           const persistResult = persistAfterPairing(account.accountDir, accountId, result.selfPhone ?? null);
           configPersisted = persistResult.ok;
           if (!persistResult.ok) {
-            console.error(`${TAG17} config persist failed account=${accountId}: ${persistResult.error}`);
+            console.error(`${TAG19} config persist failed account=${accountId}: ${persistResult.error}`);
           }
         } else {
-          console.error(`${TAG17} config persist skipped \u2014 no account resolved`);
+          console.error(`${TAG19} config persist skipped \u2014 no account resolved`);
         }
       } catch (persistErr) {
-        console.error(`${TAG17} config persist error account=${accountId}: ${String(persistErr)}`);
+        console.error(`${TAG19} config persist error account=${accountId}: ${String(persistErr)}`);
       }
     }
-    console.error(`${TAG17} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${configPersisted}`);
+    console.error(`${TAG19} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${configPersisted}`);
     return c.json({
       connected: result.connected,
       message: result.message,
@@ -10397,7 +10556,7 @@ app3.post("/login/wait", async (c) => {
       configPersisted
     });
   } catch (err) {
-    console.error(`${TAG17} login/wait error: ${String(err)}`);
+    console.error(`${TAG19} login/wait error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10408,7 +10567,7 @@ app3.post("/disconnect", async (c) => {
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
   } catch (err) {
-    console.error(`${TAG17} disconnect error: ${String(err)}`);
+    console.error(`${TAG19} disconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10419,7 +10578,7 @@ app3.post("/reconnect", async (c) => {
     await startConnection(accountId);
     return c.json({ reconnecting: true, accountId });
   } catch (err) {
-    console.error(`${TAG17} reconnect error: ${String(err)}`);
+    console.error(`${TAG19} reconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10438,7 +10597,7 @@ app3.post("/send", async (c) => {
     const result = await sendTextMessage(sock, to, text, { accountId });
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG17} send error: ${String(err)}`);
+    console.error(`${TAG19} send error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10459,7 +10618,7 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG17} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG19} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -10467,12 +10626,12 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone".' }, 400);
         }
         const result = removeAdminPhone(account.accountDir, phone);
-        console.error(`${TAG17} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG19} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-admin-phones": {
         const phones = readAdminPhones(account.accountDir);
-        console.error(`${TAG17} config action=list-admin-phones count=${phones.length}`);
+        console.error(`${TAG19} config action=list-admin-phones count=${phones.length}`);
         return c.json({ ok: true, phones });
       }
       case "set-public-agent": {
@@ -10480,14 +10639,14 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
         }
         const result = setPublicAgent(account.accountDir, slug);
-        console.error(`${TAG17} config action=set-public-agent slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG19} config action=set-public-agent slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-public-agent": {
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const targetGroup = typeof groupJid === "string" && groupJid.trim() ? groupJid.trim() : void 0;
         const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount, groupJid: targetGroup });
-        console.error(`${TAG17} config action=get-public-agent accountId=${targetAccount} groupJid=${targetGroup ?? "none"} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
+        console.error(`${TAG19} config action=get-public-agent accountId=${targetAccount} groupJid=${targetGroup ?? "none"} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "set-group-public-agent": {
@@ -10499,7 +10658,7 @@ app3.post("/config", async (c) => {
         }
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const result = setGroupPublicAgent(account.accountDir, targetAccount, groupJid, slug);
-        console.error(`${TAG17} config action=set-group-public-agent accountId=${targetAccount} groupJid=${groupJid} slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG19} config action=set-group-public-agent accountId=${targetAccount} groupJid=${groupJid} slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "unset-group-public-agent": {
@@ -10508,43 +10667,43 @@ app3.post("/config", async (c) => {
         }
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const result = unsetGroupPublicAgent(account.accountDir, targetAccount, groupJid);
-        console.error(`${TAG17} config action=unset-group-public-agent accountId=${targetAccount} groupJid=${groupJid} ok=${result.ok}`);
+        console.error(`${TAG19} config action=unset-group-public-agent accountId=${targetAccount} groupJid=${groupJid} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-public-agents": {
-        const agentsDir = resolve6(account.accountDir, "agents");
+        const agentsDir = resolve7(account.accountDir, "agents");
         const agents = [];
         if (existsSync4(agentsDir)) {
           try {
             const entries = readdirSync2(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve6(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve7(agentsDir, entry.name, "config.json");
               if (!existsSync4(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync6(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
-                console.error(`${TAG17} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+                console.error(`${TAG19} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
               }
             }
           } catch (err) {
-            console.error(`${TAG17} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
+            console.error(`${TAG19} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
           }
         }
-        console.error(`${TAG17} config action=list-public-agents count=${agents.length}`);
+        console.error(`${TAG19} config action=list-public-agents count=${agents.length}`);
         return c.json({ ok: true, agents });
       }
       case "schema": {
         const text = serializeWhatsAppSchema();
-        console.error(`${TAG17} config action=schema`);
+        console.error(`${TAG19} config action=schema`);
         return c.json({ ok: true, text });
       }
       case "list-groups": {
         const groupAccountId = accountId ?? "default";
         const sock = getSocket(groupAccountId);
         if (!sock) {
-          console.error(`${TAG17} config action=list-groups error="not connected" accountId=${groupAccountId}`);
+          console.error(`${TAG19} config action=list-groups error="not connected" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `WhatsApp account "${groupAccountId}" is not connected. Connect first, then retry.` });
         }
         try {
@@ -10554,10 +10713,10 @@ app3.post("/config", async (c) => {
             name: g.subject ?? g.id,
             participantCount: Array.isArray(g.participants) ? g.participants.length : 0
           }));
-          console.error(`${TAG17} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
+          console.error(`${TAG19} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
           return c.json({ ok: true, groups });
         } catch (err) {
-          console.error(`${TAG17} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
+          console.error(`${TAG19} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `Failed to fetch groups: ${String(err)}` });
         }
       }
@@ -10567,12 +10726,12 @@ app3.post("/config", async (c) => {
         }
         const result = updateConfig(account.accountDir, fields);
         const fieldNames = Object.keys(fields);
-        console.error(`${TAG17} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
+        console.error(`${TAG19} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-config": {
         const waConfig = getConfig(account.accountDir);
-        console.error(`${TAG17} config action=get-config`);
+        console.error(`${TAG19} config action=get-config`);
         return c.json({ ok: true, config: waConfig });
       }
       default:
@@ -10582,7 +10741,7 @@ app3.post("/config", async (c) => {
         );
     }
   } catch (err) {
-    console.error(`${TAG17} config error: ${String(err)}`);
+    console.error(`${TAG19} config error: ${String(err)}`);
     return c.json({ ok: false, error: String(err) }, 500);
   }
 });
@@ -10591,55 +10750,18 @@ app3.post("/send-document", async (c) => {
     const body = await c.req.json();
     const { to, filePath, caption, maxyAccountId } = body;
     const accountId = validateAccountId(body.accountId);
-    if (!to || !filePath) {
-      return c.json({ error: "Missing required fields: to, filePath" }, 400);
-    }
-    if (!maxyAccountId || !PLATFORM_ROOT4) {
-      return c.json({ error: "Cannot validate file path: missing account or platform context" }, 400);
-    }
-    const accountDir = resolve6(PLATFORM_ROOT4, "..", "data/accounts", maxyAccountId);
-    let resolvedPath;
-    try {
-      resolvedPath = realpathSync2(filePath);
-      const accountResolved = realpathSync2(accountDir);
-      if (!resolvedPath.startsWith(accountResolved + "/")) {
-        const sanitised = filePath.replace(accountDir, "<account>/");
-        console.error(`${TAG17} send-document REJECTED path=${sanitised} reason=outside_account_directory`);
-        return c.json({ error: "Access denied: file is outside the account directory" }, 403);
-      }
-    } catch (err) {
-      const code = err.code;
-      if (code === "ENOENT") {
-        console.error(`${TAG17} send-document ENOENT path=${filePath}`);
-        return c.json({ error: `File not found: ${filePath}` }, 404);
-      }
-      console.error(`${TAG17} send-document path error: ${String(err)}`);
-      return c.json({ error: String(err) }, 500);
-    }
-    const fileStat = await stat2(resolvedPath);
-    if (fileStat.size > MAX_FILE_SIZE_BYTES) {
-      return c.json({ error: `File exceeds 50 MB limit (${(fileStat.size / 1024 / 1024).toFixed(1)} MB)` }, 400);
-    }
-    const buffer = Buffer.from(await readFile(resolvedPath));
-    const filename = basename(resolvedPath);
-    const mimetype = detectMimeType(resolvedPath);
-    const sock = getSocket(accountId);
-    if (!sock) {
-      return c.json({ error: `WhatsApp account "${accountId}" is not connected` }, 503);
-    }
-    const result = await sendMediaMessage(sock, to, {
-      type: "document",
-      buffer,
-      mimetype,
-      filename,
-      caption
-    }, { accountId });
-    console.error(
-      `${TAG17} send-document to=${to} size=${fileStat.size} mime=${mimetype} ok=${result.success}` + (result.messageId ? ` id=${result.messageId}` : "")
-    );
-    return c.json(result);
+    const result = await sendWhatsAppDocument({
+      to,
+      filePath,
+      caption,
+      accountId,
+      maxyAccountId,
+      platformRoot: PLATFORM_ROOT4
+    });
+    if (!result.ok) return c.json({ error: result.error }, result.status);
+    return c.json({ success: true, messageId: result.messageId });
   } catch (err) {
-    console.error(`${TAG17} send-document error: ${String(err)}`);
+    console.error(`${TAG19} send-document error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10649,11 +10771,11 @@ app3.get("/activity", (c) => {
     const result = getChannelActivity(accountId);
     const total = result.accounts.reduce((sum, a) => sum + a.total, 0);
     console.error(
-      `${TAG17} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
+      `${TAG19} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
     );
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG17} activity error: ${String(err)}`);
+    console.error(`${TAG19} activity error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10672,10 +10794,10 @@ app3.get("/conversations", (c) => {
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG17} conversations account=${accountId} count=${conversations.length}`);
+    console.error(`${TAG19} conversations account=${accountId} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
-    console.error(`${TAG17} conversations error: ${String(err)}`);
+    console.error(`${TAG19} conversations error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10690,10 +10812,10 @@ app3.get("/messages", (c) => {
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
     const messages = getMessages(accountId, jid, effectiveLimit);
-    console.error(`${TAG17} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    console.error(`${TAG19} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
     return c.json({ messages });
   } catch (err) {
-    console.error(`${TAG17} messages error: ${String(err)}`);
+    console.error(`${TAG19} messages error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10774,7 +10896,7 @@ app3.get("/conversation-graph-state", async (c) => {
       }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      console.error(`${TAG17} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
+      console.error(`${TAG19} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
       return c.json({ error: `Graph query failed: ${msg}`, cacheKey, cypher: cypher.trim() }, 500);
     }
     const ms = Date.now() - t0;
@@ -10787,7 +10909,7 @@ app3.get("/conversation-graph-state", async (c) => {
       ms
     });
   } catch (err) {
-    console.error(`${TAG17} conversation-graph-state error: ${String(err)}`);
+    console.error(`${TAG19} conversation-graph-state error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -10799,12 +10921,12 @@ app3.get("/group-info", async (c) => {
       return c.json({ error: "Missing required parameter: jid" }, 400);
     }
     if (!isGroupJid(jid)) {
-      console.error(`${TAG17} group-info error="not a group JID" jid=${jid} account=${accountId}`);
+      console.error(`${TAG19} group-info error="not a group JID" jid=${jid} account=${accountId}`);
       return c.json({ error: `"${jid}" is not a group JID. Group JIDs end with @g.us.` }, 400);
     }
     const sock = getSocket(accountId);
     if (!sock) {
-      console.error(`${TAG17} group-info error="not connected" account=${accountId}`);
+      console.error(`${TAG19} group-info error="not connected" account=${accountId}`);
       return c.json({ error: `WhatsApp account "${accountId}" is not connected. Connect first, then retry.` }, 400);
     }
     const meta = await sock.groupMetadata(jid);
@@ -10817,10 +10939,10 @@ app3.get("/group-info", async (c) => {
       participantCount: meta.participants.length,
       participants: meta.participants.map((p) => ({ jid: p.id, admin: p.admin ?? null }))
     };
-    console.error(`${TAG17} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
+    console.error(`${TAG19} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG17} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
+    console.error(`${TAG19} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
     return c.json({ error: `Failed to fetch group info: ${String(err)}` }, 500);
   }
 });
@@ -11605,7 +11727,7 @@ var session_default = app6;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync10, statSync as statSync5 } from "fs";
-import { resolve as resolve7, basename as basename2 } from "path";
+import { resolve as resolve8, basename as basename2 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync9 } from "fs";
@@ -11632,7 +11754,7 @@ app7.get("/", async (c) => {
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir = account ? resolve7(account.accountDir, "logs") : null;
+  const accountLogDir = account ? resolve8(account.accountDir, "logs") : null;
   const logDirs = [];
   if (accountLogDir) logDirs.push(accountLogDir);
   logDirs.push(LOG_DIR);
@@ -11640,7 +11762,7 @@ app7.get("/", async (c) => {
     const safe = basename2(fileParam);
     const searched = [];
     for (const dir of logDirs) {
-      const filePath = resolve7(dir, safe);
+      const filePath = resolve8(dir, safe);
       searched.push(filePath);
       try {
         const buffer = readFileSync10(filePath);
@@ -11752,10 +11874,10 @@ app7.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync5(resolve7(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync5(resolve8(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync10(resolve7(dir, name));
+        const content = readFileSync10(resolve8(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -11795,7 +11917,7 @@ var claude_info_default = app8;
 // server/routes/admin/attachment.ts
 import { readFile as readFile2, readdir } from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
-import { resolve as resolve8 } from "path";
+import { resolve as resolve9 } from "path";
 var app9 = new Hono();
 app9.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -11807,11 +11929,11 @@ app9.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve8(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve9(ATTACHMENTS_ROOT, accountId, attachmentId);
   if (!existsSync11(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve8(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve9(dir, `${attachmentId}.meta.json`);
   if (!existsSync11(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
@@ -11826,7 +11948,7 @@ app9.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve8(dir, dataFile);
+  const filePath = resolve9(dir, dataFile);
   const buffer = await readFile2(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -11839,13 +11961,13 @@ app9.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app9;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve9 } from "path";
+import { resolve as resolve10 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync11, existsSync as existsSync12, rmSync } from "fs";
 var app10 = new Hono();
 app10.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve9(account.accountDir, "agents");
+  const agentsDir = resolve10(account.accountDir, "agents");
   if (!existsSync12(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -11853,7 +11975,7 @@ app10.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve9(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve10(agentsDir, entry.name, "config.json");
       if (!existsSync12(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync11(configPath2, "utf-8"));
@@ -11882,7 +12004,7 @@ app10.delete("/:slug", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve9(account.accountDir, "agents", slug);
+  const agentDir = resolve10(account.accountDir, "agents", slug);
   if (!existsSync12(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -11912,7 +12034,7 @@ app10.post("/:slug/project", async (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve9(account.accountDir, "agents", slug);
+  const agentDir = resolve10(account.accountDir, "agents", slug);
   if (!existsSync12(agentDir)) {
     return c.json({ error: "Agent not found on disk" }, 404);
   }
@@ -12617,7 +12739,7 @@ var sessions_default = app11;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync14, readFileSync as readFileSync12, readdirSync as readdirSync7, statSync as statSync6 } from "fs";
-import { dirname as dirname2, resolve as resolve10, join as join10 } from "path";
+import { dirname as dirname2, resolve as resolve11, join as join10 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -12702,7 +12824,7 @@ function parseSkillPathsFromFrontmatter(fm) {
 }
 function listPluginDirs() {
   const out = /* @__PURE__ */ new Map();
-  const platformPlugins = resolve10(PLATFORM_ROOT, "plugins");
+  const platformPlugins = resolve11(PLATFORM_ROOT, "plugins");
   if (existsSync14(platformPlugins)) {
     for (const name of readdirSync7(platformPlugins)) {
       const dir = join10(platformPlugins, name);
@@ -12712,7 +12834,7 @@ function listPluginDirs() {
       }
     }
   }
-  const premiumRoot = resolve10(dirname2(PLATFORM_ROOT), "premium-plugins");
+  const premiumRoot = resolve11(dirname2(PLATFORM_ROOT), "premium-plugins");
   if (existsSync14(premiumRoot)) {
     for (const bundle of readdirSync7(premiumRoot)) {
       const bundlePlugins = join10(premiumRoot, bundle, "plugins");
@@ -12732,7 +12854,7 @@ function listPluginDirs() {
   return out;
 }
 function readEnabledPlugins(accountId) {
-  const accountFile = resolve10(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync14(accountFile)) return /* @__PURE__ */ new Set();
   try {
     const parsed = JSON.parse(readFileSync12(accountFile, "utf-8"));
@@ -12805,7 +12927,7 @@ ${skillFm}
   return out;
 }
 function computeSpecialistDomains(accountId) {
-  const specialistsDir = resolve10(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
+  const specialistsDir = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "specialists", "agents");
   if (!existsSync14(specialistsDir)) return [];
   let entries;
   try {
@@ -12851,7 +12973,7 @@ ${fm}
   return out;
 }
 function computeDormantPlugins(accountId) {
-  const accountFile = resolve10(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
+  const accountFile = resolve11(PLATFORM_ROOT, "..", "data/accounts", accountId, "account.json");
   if (!existsSync14(accountFile)) return [];
   let enabled;
   try {
@@ -12866,7 +12988,7 @@ function computeDormantPlugins(accountId) {
     );
     return [];
   }
-  const pluginsDir = resolve10(PLATFORM_ROOT, "plugins");
+  const pluginsDir = resolve11(PLATFORM_ROOT, "plugins");
   if (!existsSync14(pluginsDir)) return [];
   let entries;
   try {
@@ -12877,7 +12999,7 @@ function computeDormantPlugins(accountId) {
   const out = [];
   for (const name of entries) {
     if (enabled.has(name)) continue;
-    const manifestPath = resolve10(pluginsDir, name, "PLUGIN.md");
+    const manifestPath = resolve11(pluginsDir, name, "PLUGIN.md");
     if (!existsSync14(manifestPath)) continue;
     let manifest;
     try {
@@ -12896,7 +13018,7 @@ function computeDormantPlugins(accountId) {
 
 // server/routes/admin/claude-sessions.ts
 import { existsSync as existsSync15, readFileSync as readFileSync13 } from "fs";
-import { resolve as resolve11 } from "path";
+import { resolve as resolve12 } from "path";
 function readTunnelState(brandConfigDir) {
   const statePath = `${process.env.HOME ?? ""}/${brandConfigDir}/cloudflared/tunnel.state`;
   if (!existsSync15(statePath)) return null;
@@ -12912,10 +13034,10 @@ function readTunnelState(brandConfigDir) {
   }
 }
 function resolveTunnelUrl() {
-  const platformRoot = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve11(process.cwd(), "..");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? resolve12(process.cwd(), "..");
   let brand;
   try {
-    brand = JSON.parse(readFileSync13(resolve11(platformRoot, "config", "brand.json"), "utf-8"));
+    brand = JSON.parse(readFileSync13(resolve12(platformRoot2, "config", "brand.json"), "utf-8"));
   } catch {
     return null;
   }
@@ -12926,7 +13048,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG18 = "[claude-session-manager:wrapper]";
+var TAG20 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -12948,12 +13070,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG18} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG20} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG18} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG20} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -12980,24 +13102,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG18} forward-spawn-start managerBase=${managerBase3()} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG20} forward-spawn-start managerBase=${managerBase3()} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase3()}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG18} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG20} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG18} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG20} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG18} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG20} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -13032,7 +13154,7 @@ app12.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG18} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG20} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -13041,7 +13163,7 @@ app12.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG18} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG20} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -13060,13 +13182,13 @@ app12.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG18} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG20} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 var claude_sessions_default = app12;
 
 // server/routes/admin/log-ingest.ts
-var TAG19 = "[log-ingest]";
+var TAG21 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
@@ -13077,7 +13199,7 @@ function isLoopbackAddr(addr) {
 app13.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG19} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -13086,7 +13208,7 @@ app13.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG19} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG21} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -13128,18 +13250,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app14 = new Hono();
 app14.post("/", async (c) => {
-  const TAG29 = "[admin:events]";
+  const TAG31 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG29} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG31} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG29} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG31} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -13164,15 +13286,15 @@ var events_default = app14;
 import { createReadStream as createReadStream2 } from "fs";
 import { readdir as readdir3, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename4, dirname as dirname3, join as join12, resolve as resolve14, sep as sep4 } from "path";
+import { basename as basename4, dirname as dirname3, join as join12, resolve as resolve15, sep as sep4 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve12, normalize, sep as sep2, relative } from "path";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "../platform");
-var DATA_ROOT = resolve12(PLATFORM_ROOT5, "..", "data");
-var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve12(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
+import { resolve as resolve13, normalize, sep as sep2, relative } from "path";
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "../platform");
+var DATA_ROOT = resolve13(PLATFORM_ROOT5, "..", "data");
+var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve13(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
 var ACCOUNT_PARTITION_DIRS = /* @__PURE__ */ new Set(["uploads", "accounts"]);
 var ACCOUNT_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function crossesForeignAccountPartition(relPath, accountId) {
@@ -13185,7 +13307,7 @@ function crossesForeignAccountPartition(relPath, accountId) {
 }
 function resolveUnderRoot(raw, rootAbs, rootLabel) {
   const cleaned = normalize("/" + (raw ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve12(rootAbs, cleaned);
+  const absolute = resolve13(rootAbs, cleaned);
   let rootReal;
   try {
     rootReal = realpathSync3(rootAbs);
@@ -13544,7 +13666,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve13, relative as relative2, join as join11, basename as basename3, extname as extname2, sep as sep3 } from "path";
+import { resolve as resolve14, relative as relative2, join as join11, basename as basename3, extname as extname2, sep as sep3 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -13852,8 +13974,8 @@ async function reconcileFileIndex(accountId, opts) {
   return withSession(opts, async (session) => {
     const walked = [];
     const subtreeRoots = [
-      resolve13(dataRoot, "uploads", accountId),
-      resolve13(dataRoot, "accounts", accountId)
+      resolve14(dataRoot, "uploads", accountId),
+      resolve14(dataRoot, "accounts", accountId)
     ];
     let clean = true;
     for (const root of subtreeRoots) {
@@ -13934,7 +14056,7 @@ async function reconcileFileIndexDebounced(accountId, opts) {
 async function indexFile(accountId, relativePath, opts) {
   const dataRoot = opts?.dataRoot ?? DATA_ROOT;
   const embed2 = opts?.embed ?? embed;
-  const absolute = resolve13(dataRoot, relativePath);
+  const absolute = resolve14(dataRoot, relativePath);
   await withSession(opts, async (session) => {
     const st = await fsp.stat(absolute);
     const wf = {
@@ -13979,7 +14101,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve14(DATA_ROOT, "accounts");
+  const accountsDir = resolve15(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir3(accountsDir);
@@ -13988,7 +14110,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve14(accountsDir, name, "account.json");
+    const configPath2 = resolve15(accountsDir, name, "account.json");
     try {
       const raw = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw);
@@ -14229,8 +14351,8 @@ app15.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename4(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve14(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve14(destDir, finalName);
+  const destDir = resolve15(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve15(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -16337,7 +16459,7 @@ var graph_default_view_default = app21;
 
 // server/routes/admin/sidebar-artefacts.ts
 import { readdir as readdir4, stat as stat5 } from "fs/promises";
-import { resolve as resolve15, relative as relative3, isAbsolute, sep as sep5, basename as basename5 } from "path";
+import { resolve as resolve16, relative as relative3, isAbsolute, sep as sep5, basename as basename5 } from "path";
 import { existsSync as existsSync16 } from "fs";
 var LIMIT = 50;
 var ADMIN_AGENT_FILES = ["IDENTITY.md", "SOUL.md", "KNOWLEDGE.md"];
@@ -16357,7 +16479,7 @@ app22.get("/", requireAdminSession, async (c) => {
   if (outputs === null) {
     return c.json({ error: "Failed to load artefacts" }, 500);
   }
-  const accountDir = resolve15(ACCOUNTS_DIR, accountId);
+  const accountDir = resolve16(ACCOUNTS_DIR, accountId);
   const agents = await fetchAgentTemplateRows(accountDir);
   const artefacts = [...outputs, ...agents].sort(
     (a, b) => (b.updatedAt ?? "").localeCompare(a.updatedAt ?? "")
@@ -16408,8 +16530,8 @@ async function fetchOutputArtefacts(accountId) {
 async function fetchAgentTemplateRows(accountDir) {
   const rows = [];
   for (const filename of ADMIN_AGENT_FILES) {
-    const overridePath = resolve15(accountDir, "agents", "admin", filename);
-    const bundledPath = resolve15(PLATFORM_ROOT, "templates", "agents", "admin", filename);
+    const overridePath = resolve16(accountDir, "agents", "admin", filename);
+    const bundledPath = resolve16(PLATFORM_ROOT, "templates", "agents", "admin", filename);
     const labelStem = filename.replace(/\.md$/, "");
     const row = await readAgentTemplateRow({
       id: `agent-template:admin:${filename}`,
@@ -16422,12 +16544,12 @@ async function fetchAgentTemplateRows(accountDir) {
     });
     if (row) rows.push(row);
   }
-  const overrideDir = resolve15(accountDir, "specialists", "agents");
-  const bundledDir = resolve15(PLATFORM_ROOT, "templates", "specialists", "agents");
+  const overrideDir = resolve16(accountDir, "specialists", "agents");
+  const bundledDir = resolve16(PLATFORM_ROOT, "templates", "specialists", "agents");
   const specialistNames = await unionSpecialistFilenames(overrideDir, bundledDir);
   for (const filename of specialistNames) {
-    const overridePath = resolve15(overrideDir, filename);
-    const bundledPath = resolve15(bundledDir, filename);
+    const overridePath = resolve16(overrideDir, filename);
+    const bundledPath = resolve16(bundledDir, filename);
     const row = await readAgentTemplateRow({
       id: `agent-template:specialist:${filename}`,
       displayName: filename.replace(/\.md$/, ""),
@@ -16513,7 +16635,7 @@ var sidebar_artefacts_default = app22;
 
 // server/routes/admin/sidebar-sessions.ts
 import { readdirSync as readdirSync8, readFileSync as readFileSync14, statSync as statSync7 } from "fs";
-import { join as join13, resolve as resolve16 } from "path";
+import { join as join13, resolve as resolve17 } from "path";
 var SESSION_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/i;
 var PID_FILE_RE = /^([0-9]+)\.json$/;
 var TITLE_MAX = 80;
@@ -16694,7 +16816,7 @@ app23.get("/", requireAdminSession, async (c) => {
   const projectsRoot = join13(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const pidsBySession = sessionIdToPidMap(configDir2);
-  const accountDir = accountId ? resolve16(ACCOUNTS_DIR, accountId) : null;
+  const accountDir = accountId ? resolve17(ACCOUNTS_DIR, accountId) : null;
   const userTitles = loadUserTitles(accountDir);
   const rows = [];
   const seenIds = /* @__PURE__ */ new Set();
@@ -16748,7 +16870,7 @@ var sidebar_sessions_default = app23;
 
 // server/routes/admin/session-delete.ts
 import { existsSync as existsSync17, readdirSync as readdirSync9, readFileSync as readFileSync15, unlinkSync as unlinkSync2 } from "fs";
-import { join as join14, resolve as resolve17 } from "path";
+import { join as join14, resolve as resolve18 } from "path";
 var app24 = new Hono();
 var SESSION_ID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var PID_FILE_RE2 = /^([0-9]+)\.json$/;
@@ -16797,7 +16919,7 @@ function isPidAlive(pid) {
   }
 }
 function sleep2(ms) {
-  return new Promise((resolve26) => setTimeout(resolve26, ms));
+  return new Promise((resolve27) => setTimeout(resolve27, ms));
 }
 function sendSignal(pid, signal) {
   try {
@@ -16865,8 +16987,8 @@ app24.post("/", requireAdminSession, async (c) => {
   if (!configDir2) {
     return c.json({ error: "CLAUDE_CONFIG_DIR not set" }, 500);
   }
-  const projectsRoot = resolve17(join14(configDir2, "projects")) + "/";
-  const resolvedProject = resolve17(projectDir) + "/";
+  const projectsRoot = resolve18(join14(configDir2, "projects")) + "/";
+  const resolvedProject = resolve18(projectDir) + "/";
   if (!resolvedProject.startsWith(projectsRoot)) {
     console.error(`[sessions-delete] reject reason=projectDir-outside-tree projectDir=${projectDir}`);
     return c.json({ error: "projectDir is not under CLAUDE_CONFIG_DIR/projects/" }, 400);
@@ -17097,8 +17219,8 @@ var system_stats_default = app26;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync18, readFileSync as readFileSync16 } from "fs";
-import { resolve as resolve18, join as join15 } from "path";
-var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve18(process.cwd(), "..");
+import { resolve as resolve19, join as join15 } from "path";
+var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandJsonPath = join15(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync18(brandJsonPath)) {
@@ -17108,7 +17230,7 @@ if (existsSync18(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve18(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve19(PLATFORM_ROOT6, `config/.${brandHostname}-version`);
 var PROCESS_STARTED_AT = (/* @__PURE__ */ new Date()).toISOString();
 var PROBE_TIMEOUT_MS = 1e3;
 function readVersion() {
@@ -17165,7 +17287,7 @@ var health_default2 = app27;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID9 } from "crypto";
-var TAG20 = "[linkedin-ingest-route]";
+var TAG22 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -17269,29 +17391,29 @@ app28.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG20 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG22 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG20 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG22 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG20 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG22 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG20 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG22 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID9();
-  console.log(TAG20 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG22 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -17300,12 +17422,12 @@ app28.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG20 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG22 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG20 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG22 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
@@ -17313,7 +17435,7 @@ var linkedin_ingest_default = app28;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j2 from "neo4j-driver";
-var TAG21 = "[post-turn-context]";
+var TAG23 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -17355,7 +17477,7 @@ var app29 = new Hono();
 app29.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17364,7 +17486,7 @@ app29.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG21} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG23} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -17396,7 +17518,7 @@ app29.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG21} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG23} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -17405,7 +17527,7 @@ app29.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG21} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG23} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -17416,7 +17538,7 @@ var post_turn_context_default = app29;
 
 // server/routes/admin/public-session-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG22 = "[public-session-context]";
+var TAG24 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -17458,7 +17580,7 @@ var app30 = new Hono();
 app30.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17467,7 +17589,7 @@ app30.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG22} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -17498,7 +17620,7 @@ app30.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG22} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG24} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -17507,7 +17629,7 @@ app30.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG22} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG24} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
@@ -17517,7 +17639,7 @@ app30.get("/", async (c) => {
 var public_session_context_default = app30;
 
 // server/routes/admin/public-session-exit.ts
-var TAG23 = "[public-session-exit-route]";
+var TAG25 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -17525,7 +17647,7 @@ var app31 = new Hono();
 app31.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17534,7 +17656,7 @@ app31.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG23} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -17552,7 +17674,7 @@ app31.post("/", async (c) => {
 var public_session_exit_default = app31;
 
 // server/routes/admin/access-session-evict.ts
-var TAG24 = "[access-session-evict]";
+var TAG26 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -17560,7 +17682,7 @@ var app32 = new Hono();
 app32.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17569,7 +17691,7 @@ app32.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -17582,7 +17704,7 @@ app32.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG24} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG26} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
 var access_session_evict_default = app32;
@@ -17590,7 +17712,7 @@ var access_session_evict_default = app32;
 // server/routes/admin/identity.ts
 var import_dist4 = __toESM(require_dist3(), 1);
 var app33 = new Hono();
-var TAG25 = "[admin-identity]";
+var TAG27 = "[admin-identity]";
 function managerBase5() {
   const port2 = (0, import_dist4.requirePortEnv)("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-identity" });
   return `http://127.0.0.1:${port2}`;
@@ -17621,20 +17743,20 @@ app33.post("/validate", async (c) => {
   const verdict = validatePin(pin, USERS_FILE);
   if (verdict.kind !== "match") {
     if (verdict.kind === "miss") fireStop();
-    console.log(`${TAG25} op=endpoint-validate result=${verdict.kind}${sessionId ? ` sessionId=${sessionId.slice(0, 8)}` : ""}`);
+    console.log(`${TAG27} op=endpoint-validate result=${verdict.kind}${sessionId ? ` sessionId=${sessionId.slice(0, 8)}` : ""}`);
     return c.json({ kind: verdict.kind });
   }
   const { userId } = verdict;
   const accounts = resolveUserAccounts(userId);
   if (accounts.length === 0) {
     fireStop();
-    console.log(`${TAG25} op=endpoint-validate result=no-account userId=${userId.slice(0, 8)}`);
+    console.log(`${TAG27} op=endpoint-validate result=no-account userId=${userId.slice(0, 8)}`);
     return c.json({ kind: "miss" });
   }
   const accountId = accounts[0].accountId;
   const { userName } = await resolveUserIdentity(accountId, userId);
   const aboutOwner = await resolveOwnerProfileBlock(accountId, userId);
-  console.log(`${TAG25} op=endpoint-validate result=match userId=${userId.slice(0, 8)} aboutOwner=${aboutOwner.ok ? "ok" : `unresolved:${aboutOwner.reason}`}`);
+  console.log(`${TAG27} op=endpoint-validate result=match userId=${userId.slice(0, 8)} aboutOwner=${aboutOwner.ok ? "ok" : `unresolved:${aboutOwner.reason}`}`);
   return c.json({ kind: "match", userId, userName, aboutOwner });
 });
 var identity_default = app33;
@@ -17674,13 +17796,13 @@ var admin_default = app34;
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
 import { readFileSync as readFileSync17 } from "fs";
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 import { randomUUID as randomUUID10 } from "crypto";
-var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve19(process.cwd(), "..");
+var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve19(PLATFORM_ROOT7, "config/.neo4j-password");
+  const passwordFile = resolve20(PLATFORM_ROOT7, "config/.neo4j-password");
   try {
     return readFileSync17(passwordFile, "utf-8").trim();
   } catch {
@@ -17880,7 +18002,7 @@ async function generateNewMagicToken(grantId) {
 }
 
 // server/routes/access/verify-token.ts
-var TAG26 = "[access-verify]";
+var TAG28 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
 var app35 = new Hono();
@@ -17899,39 +18021,39 @@ app35.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG26} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG26} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -17947,12 +18069,12 @@ app35.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG26} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -17970,9 +18092,9 @@ var verify_token_default = app35;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
-import { resolve as resolve20 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
-var SEND_SCRIPT = resolve20(
+import { resolve as resolve21 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve21(process.cwd(), "..");
+var SEND_SCRIPT = resolve21(
   PLATFORM_ROOT8,
   "plugins",
   "email",
@@ -18028,7 +18150,7 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG27 = "[access-request-link]";
+var TAG29 = "[access-request-link]";
 var app36 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
 app36.post("/", async (c) => {
@@ -18045,18 +18167,18 @@ app36.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG27} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG27} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG27} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG29} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -18064,7 +18186,7 @@ app36.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG27} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG29} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -18096,12 +18218,12 @@ app36.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG27} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG29} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG27} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG29} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
@@ -18115,7 +18237,7 @@ var access_default = app37;
 
 // server/routes/sites.ts
 import { existsSync as existsSync19, readFileSync as readFileSync18, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 var SAFE_SEG_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var MIME = {
   ".html": "text/html; charset=utf-8",
@@ -18172,8 +18294,8 @@ app38.get("/:rel{.*}", (c) => {
     }
     segments.push(seg);
   }
-  const rootDir = resolve21(account.accountDir, "sites");
-  let filePath = segments.length === 0 ? rootDir : resolve21(rootDir, ...segments);
+  const rootDir = resolve22(account.accountDir, "sites");
+  let filePath = segments.length === 0 ? rootDir : resolve22(rootDir, ...segments);
   if (filePath !== rootDir && !filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
@@ -18193,7 +18315,7 @@ app38.get("/:rel{.*}", (c) => {
     return c.redirect(target, 301);
   }
   if (stat7?.isDirectory()) {
-    filePath = resolve21(filePath, "index.html");
+    filePath = resolve22(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
@@ -18337,9 +18459,9 @@ var cachedAttempted = false;
 function readBrandConfig() {
   if (cachedAttempted) return cached2;
   cachedAttempted = true;
-  const platformRoot = process.env.MAXY_PLATFORM_ROOT;
-  if (!platformRoot) return null;
-  const brandPath = join16(platformRoot, "config", "brand.json");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT;
+  if (!platformRoot2) return null;
+  const brandPath = join16(platformRoot2, "config", "brand.json");
   if (!existsSync20(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync20(brandPath, "utf-8"));
@@ -18830,14 +18952,14 @@ async function writeEvent(opts) {
 var visitor_event_default = app41;
 
 // server/routes/session.ts
-import { resolve as resolve22 } from "path";
+import { resolve as resolve23 } from "path";
 import { existsSync as existsSync21, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "fs";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve22(MAXY_DIR, "branding-cache", accountId);
+    const cacheDir = resolve23(MAXY_DIR, "branding-cache", accountId);
     mkdirSync5(cacheDir, { recursive: true });
-    writeFileSync7(resolve22(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    writeFileSync7(resolve23(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -18916,8 +19038,8 @@ app42.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve22(account.accountDir, "agents", agentSlug);
-    if (!existsSync21(agentDir) || !existsSync21(resolve22(agentDir, "config.json"))) {
+    const agentDir = resolve23(account.accountDir, "agents", agentSlug);
+    if (!existsSync21(agentDir) || !existsSync21(resolve23(agentDir, "config.json"))) {
       return c.json({ error: "Agent not found" }, 404);
     }
     agentConfig = resolveAgentConfig(account.accountDir, agentSlug);
@@ -19154,7 +19276,7 @@ function startGraphHealthTimer() {
 
 // app/lib/file-watcher.ts
 import * as fsp2 from "fs/promises";
-import { resolve as resolve23, sep as sep6 } from "path";
+import { resolve as resolve24, sep as sep6 } from "path";
 var ACCOUNT_UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var DEFAULT_COALESCE_MS = 500;
 var ROOTS = ["uploads", "accounts"];
@@ -19173,7 +19295,7 @@ async function startFileWatcher(opts = {}) {
   const dropFn = opts.drop ?? dropFileIndex;
   for (const r of ROOTS) {
     try {
-      await fsp2.mkdir(resolve23(dataRoot, r), { recursive: true });
+      await fsp2.mkdir(resolve24(dataRoot, r), { recursive: true });
     } catch (err) {
       console.error(
         `[file-watcher] start-failed root="${r}" err="${err.message}" \u2014 index will be maintained by the 5-min reconcile backstop only`
@@ -19194,7 +19316,7 @@ async function startFileWatcher(opts = {}) {
     timers.set(relativePath, t);
   }
   async function runHook(relativePath, accountId) {
-    const absolute = resolve23(dataRoot, relativePath);
+    const absolute = resolve24(dataRoot, relativePath);
     let exists = false;
     try {
       const st = await fsp2.stat(absolute);
@@ -19218,7 +19340,7 @@ async function startFileWatcher(opts = {}) {
     }
   }
   async function watchRoot(rootName) {
-    const absRoot = resolve23(dataRoot, rootName);
+    const absRoot = resolve24(dataRoot, rootName);
     try {
       const iter = fsp2.watch(absRoot, { recursive: true, signal: controller.signal });
       for await (const event of iter) {
@@ -19256,7 +19378,7 @@ async function startFileWatcher(opts = {}) {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG28 = "[whatsapp-adaptor]";
+var TAG30 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -19278,7 +19400,7 @@ async function dispatchToClaude(input) {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG28} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG30} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -19316,7 +19438,7 @@ function broadcastAdminShutdown(reason) {
 // ../lib/entitlement/src/index.ts
 import { createPublicKey, createHash as createHash5, verify as cryptoVerify } from "crypto";
 import { existsSync as existsSync22, readFileSync as readFileSync21, statSync as statSync9 } from "fs";
-import { resolve as resolve24 } from "path";
+import { resolve as resolve25 } from "path";
 
 // ../lib/entitlement/src/canonicalize.ts
 function canonicalize(value) {
@@ -19351,7 +19473,7 @@ var PUBKEY_SHA256 = "8eee6bcb33545fd13b16d3199a5735ca5db5062834c7b49dfe4f23801d9
 var GRACE_DAYS = 7;
 var GRACE_MS = GRACE_DAYS * 24 * 60 * 60 * 1e3;
 function pubkeyPath(brand) {
-  return resolve24(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
+  return resolve25(brand.platformRoot, "lib", "entitlement", "rubytech-pubkey.pem");
 }
 var memo = null;
 function memoKey(mtimeMs, account) {
@@ -19363,7 +19485,7 @@ function resolveEntitlement(brand, account) {
   if (brand.commercialMode !== true) {
     return logResolved(implicitTrust(account), null);
   }
-  const entitlementPath = resolve24(brand.configDir, "entitlement.json");
+  const entitlementPath = resolve25(brand.configDir, "entitlement.json");
   if (!existsSync22(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
@@ -19925,8 +20047,8 @@ app43.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve25(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve25(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve26(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve26(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -19955,8 +20077,8 @@ app43.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve25(account.accountDir, "generated", filename);
-  const expectedDir = resolve25(account.accountDir, "generated");
+  const filePath = resolve26(account.accountDir, "generated", filename);
+  const expectedDir = resolve26(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -20043,7 +20165,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync22(resolve25(process.cwd(), "public", file), "utf-8");
+    html = readFileSync22(resolve26(process.cwd(), "public", file), "utf-8");
     const productNameEsc = escapeHtml(BRAND.productName);
     html = html.replace(/<title>([^<]*)<\/title>/, (_match, inner) => `<title>${escapeHtml(inner).replace(/Maxy/g, productNameEsc)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
@@ -20161,7 +20283,7 @@ app43.use("/vnc-popout.html", logViewerFetch);
 app43.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync22(resolve25(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync22(resolve26(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -20405,7 +20527,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve25(process.env.MAXY_PLATFORM_ROOT ?? join17(__dirname, "..")),
+  platformRoot: resolve26(process.env.MAXY_PLATFORM_ROOT ?? join17(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (msg.text && !msg.isOwnerMirror) {