@rubytech/create-realagent 1.0.676 → 1.0.678

package/payload/server/server.js

@@ -16,7 +16,6 @@ import {
   invalidateRemoteSession,
   isPasswordValid,
   isRemoteAuthConfigured,
-  newCorrId,
   recordFailedAttempt,
   renderLoginPage,
   resolveClientIp,
@@ -2530,7 +2529,7 @@ var responseViaResponseObject = async (res, outgoing, options = {}) => {
         });
         if (!chunk) {
           if (i === 1) {
-            await new Promise((resolve29) => setTimeout(resolve29));
+            await new Promise((resolve28) => setTimeout(resolve28));
             maxReadCount = 3;
             continue;
           }
@@ -2897,317 +2896,9 @@ var serveStatic = (options = { root: "" }) => {
 
 // server/index.ts
 import { readFileSync as readFileSync24, existsSync as existsSync23, watchFile } from "fs";
-import { resolve as resolve28, join as join12, basename as basename7 } from "path";
+import { resolve as resolve27, join as join12, basename as basename7 } from "path";
 import { homedir as homedir4 } from "os";
 
-// server/ws-proxy-terminal.ts
-import { createConnection } from "net";
-
-// app/lib/terminal-logger.ts
-import { appendFileSync, mkdirSync } from "fs";
-import { resolve } from "path";
-var TERMINAL_LOG_FILE = resolve(LOG_DIR, "terminal.log");
-try {
-  mkdirSync(LOG_DIR, { recursive: true });
-} catch (err) {
-  console.error(`[terminal-log-fail] mkdir ${LOG_DIR} failed: ${err.message}`);
-}
-function terminalLog(phase, fields = {}) {
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  const kv = Object.entries(fields).map(([k, v]) => `${k}=${JSON.stringify(v)}`).join(" ");
-  const line = kv.length > 0 ? `[${ts}] [terminal-${phase}] ${kv}
-` : `[${ts}] [terminal-${phase}]
-`;
-  try {
-    appendFileSync(TERMINAL_LOG_FILE, line);
-  } catch (err) {
-    console.error(`[terminal-log-fail] ${err.message} \u2014 dropped: ${line.slice(0, 300).trim()}`);
-  }
-}
-
-// server/ws-proxy-terminal.ts
-var WS_PATH = "/admin/terminal/ws";
-var UPSTREAM_TIMEOUT_MS = 5e3;
-var FLOW_TICK_MS = 5e3;
-var FLOW_IDLE_EMIT_MS = 3e4;
-var HOP_BY_HOP = /* @__PURE__ */ new Set([
-  "connection",
-  "keep-alive",
-  "proxy-authenticate",
-  "proxy-authorization",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-function attachTerminalWsProxy(server, opts) {
-  const upstreamHost = opts.upstreamHost ?? "127.0.0.1";
-  const upstreamPort = opts.upstreamPort ?? 7681;
-  server.on("upgrade", (req, clientSocket, head) => {
-    try {
-      handleUpgrade(req, clientSocket, head, {
-        isPublicHost: opts.isPublicHost,
-        upstreamHost,
-        upstreamPort
-      });
-    } catch (err) {
-      terminalLog("ws-upgrade", {
-        decision: "rejected",
-        reason: "handler-exception",
-        err: err.message
-      });
-      clientSocket.destroy();
-    }
-  });
-}
-function handleUpgrade(req, clientSocket, head, opts) {
-  const url = req.url ?? "";
-  const qsIndex = url.indexOf("?");
-  const pathname = qsIndex === -1 ? url : url.slice(0, qsIndex);
-  if (pathname !== WS_PATH) {
-    return;
-  }
-  const corrId = newCorrId();
-  const query = qsIndex === -1 ? "" : url.slice(qsIndex + 1);
-  const rawClientCorrId = parseQueryParam(query, "corrId");
-  const clientCorrId = sanitizeClientCorrId(rawClientCorrId);
-  const hostHeader = (req.headers.host ?? "").split(":")[0];
-  const originHeader = headerString(req.headers.origin);
-  const remote = req.socket.remoteAddress;
-  const xff = headerString(req.headers["x-forwarded-for"]);
-  const decision = canAccessAdmin({
-    host: hostHeader,
-    remoteAddress: remote,
-    xForwardedFor: xff,
-    cookieHeader: headerString(req.headers.cookie),
-    isPublicHost: opts.isPublicHost
-  });
-  if (!decision.allow) {
-    const status = decision.reason === "public-host" ? 404 : 401;
-    terminalLog("ws-upgrade", {
-      corrId,
-      clientCorrId: clientCorrId ?? null,
-      decision: "rejected",
-      reason: decision.reason,
-      ip: remote,
-      xff: xff ?? null,
-      origin: originHeader ?? null,
-      host: hostHeader
-    });
-    writeStatusAndDestroy(clientSocket, status, decision.reason === "public-host" ? "Not Found" : "Unauthorized");
-    return;
-  }
-  const originHost = parseOriginHost(originHeader);
-  if (!originHost) {
-    terminalLog("ws-upgrade", {
-      corrId,
-      clientCorrId: clientCorrId ?? null,
-      decision: "rejected",
-      reason: "origin-missing-or-invalid",
-      origin: originHeader ?? null,
-      host: hostHeader,
-      ip: remote
-    });
-    writeStatusAndDestroy(clientSocket, 403, "Forbidden");
-    return;
-  }
-  if (originHost !== hostHeader) {
-    terminalLog("ws-upgrade", {
-      corrId,
-      clientCorrId: clientCorrId ?? null,
-      decision: "rejected",
-      reason: "origin-mismatch",
-      origin_host: originHost,
-      host: hostHeader,
-      ip: remote
-    });
-    writeStatusAndDestroy(clientSocket, 403, "Forbidden");
-    return;
-  }
-  if (opts.isPublicHost(originHost)) {
-    terminalLog("ws-upgrade", {
-      corrId,
-      clientCorrId: clientCorrId ?? null,
-      decision: "rejected",
-      reason: "origin-public-host",
-      origin_host: originHost,
-      host: hostHeader,
-      ip: remote
-    });
-    writeStatusAndDestroy(clientSocket, 403, "Forbidden");
-    return;
-  }
-  terminalLog("ws-upgrade", {
-    corrId,
-    clientCorrId: clientCorrId ?? null,
-    decision: "accepted",
-    ip: remote,
-    xff: xff ?? null,
-    origin: originHeader ?? null,
-    host: hostHeader,
-    sec_ws_version: headerString(req.headers["sec-websocket-version"]) ?? null,
-    sec_ws_protocol: headerString(req.headers["sec-websocket-protocol"]) ?? null
-  });
-  const upstream = createConnection({ host: opts.upstreamHost, port: opts.upstreamPort });
-  upstream.setTimeout(UPSTREAM_TIMEOUT_MS);
-  let bytesClientToUpstream = 0;
-  let bytesUpstreamToClient = 0;
-  let closedBy = null;
-  let proxyOpened = false;
-  let lastUpstreamByteTs = 0;
-  let flowInterval = null;
-  let lastEmittedAt = 0;
-  let lastEmittedUpstreamBytes = 0;
-  const finish = (side, reason) => {
-    if (closedBy) return;
-    closedBy = side;
-    if (flowInterval) {
-      clearInterval(flowInterval);
-      flowInterval = null;
-    }
-    if (proxyOpened) {
-      terminalLog("proxy-close", {
-        corrId,
-        closedBy: side,
-        reason,
-        clientBytes: bytesClientToUpstream,
-        upstreamBytes: bytesUpstreamToClient
-      });
-    }
-    clientSocket.destroy();
-    upstream.destroy();
-  };
-  upstream.once("connect", () => {
-    upstream.setTimeout(0);
-    proxyOpened = true;
-    terminalLog("proxy-open", {
-      corrId,
-      upstream: `${opts.upstreamHost}:${opts.upstreamPort}`
-    });
-    const lines = [];
-    lines.push(`${req.method ?? "GET"} ${WS_PATH} HTTP/${req.httpVersion}`);
-    lines.push(`host: ${opts.upstreamHost}:${opts.upstreamPort}`);
-    for (const [name, value] of Object.entries(req.headers)) {
-      if (name === "host") continue;
-      if (HOP_BY_HOP.has(name)) continue;
-      if (value == null) continue;
-      if (Array.isArray(value)) {
-        for (const v of value) lines.push(`${name}: ${v}`);
-      } else {
-        lines.push(`${name}: ${value}`);
-      }
-    }
-    const upgradeHeader = headerString(req.headers.upgrade);
-    const connectionHeader = headerString(req.headers.connection);
-    if (upgradeHeader) lines.push(`upgrade: ${upgradeHeader}`);
-    if (connectionHeader) lines.push(`connection: ${connectionHeader}`);
-    upstream.write(lines.join("\r\n") + "\r\n\r\n");
-    if (head && head.length > 0) upstream.write(head);
-    clientSocket.on("data", (chunk) => {
-      bytesClientToUpstream += chunk.length;
-    });
-    upstream.on("data", (chunk) => {
-      bytesUpstreamToClient += chunk.length;
-      lastUpstreamByteTs = Date.now();
-    });
-    clientSocket.pipe(upstream);
-    upstream.pipe(clientSocket);
-    lastEmittedAt = Date.now();
-    lastEmittedUpstreamBytes = 0;
-    flowInterval = setInterval(() => {
-      const now = Date.now();
-      const idleMs = lastUpstreamByteTs === 0 ? now - lastEmittedAt : now - lastUpstreamByteTs;
-      const upstreamMoved = bytesUpstreamToClient !== lastEmittedUpstreamBytes;
-      const sinceLastEmit = now - lastEmittedAt;
-      if (upstreamMoved || sinceLastEmit >= FLOW_IDLE_EMIT_MS) {
-        terminalLog("proxy-flow", {
-          corrId,
-          clientBytes: bytesClientToUpstream,
-          upstreamBytes: bytesUpstreamToClient,
-          idleMs
-        });
-        lastEmittedAt = now;
-        lastEmittedUpstreamBytes = bytesUpstreamToClient;
-      }
-    }, FLOW_TICK_MS);
-    clientSocket.once("close", (hadError) => {
-      finish("client", hadError ? "error" : "normal");
-    });
-    upstream.once("close", (hadError) => {
-      finish("upstream", hadError ? "error" : "normal");
-    });
-    clientSocket.once("error", (err) => {
-      terminalLog("proxy-error", { corrId, side: "client", err: err.message });
-      finish("client", "error");
-    });
-    upstream.once("error", (err) => {
-      terminalLog("proxy-error", { corrId, side: "upstream", err: err.message });
-      finish("upstream", "error");
-    });
-  });
-  upstream.once("timeout", () => {
-    if (proxyOpened) return;
-    terminalLog("proxy-error", {
-      corrId,
-      side: "upstream-connect",
-      err: "timeout",
-      timeout_ms: UPSTREAM_TIMEOUT_MS
-    });
-    writeStatusAndDestroy(clientSocket, 504, "Gateway Timeout");
-    upstream.destroy();
-  });
-  upstream.once("error", (err) => {
-    if (proxyOpened) return;
-    terminalLog("proxy-error", {
-      corrId,
-      side: "upstream-connect",
-      err: err.message
-    });
-    writeStatusAndDestroy(clientSocket, 502, "Bad Gateway");
-    upstream.destroy();
-  });
-}
-function parseQueryParam(query, key) {
-  if (!query) return null;
-  for (const pair of query.split("&")) {
-    const eq = pair.indexOf("=");
-    const k = eq === -1 ? pair : pair.slice(0, eq);
-    if (k !== key) continue;
-    const v = eq === -1 ? "" : pair.slice(eq + 1);
-    try {
-      return decodeURIComponent(v);
-    } catch {
-      return null;
-    }
-  }
-  return null;
-}
-function headerString(value) {
-  if (value == null) return void 0;
-  return Array.isArray(value) ? value[0] : value;
-}
-function parseOriginHost(origin) {
-  if (!origin) return null;
-  try {
-    return new URL(origin).hostname;
-  } catch {
-    return null;
-  }
-}
-function writeStatusAndDestroy(socket, status, statusText) {
-  try {
-    socket.write(
-      `HTTP/1.1 ${status} ${statusText}\r
-Connection: close\r
-Content-Length: 0\r
-\r
-`
-    );
-  } catch {
-  }
-  socket.destroy();
-}
-
 // app/lib/agent-slug-pattern.ts
 var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
 
@@ -3215,9 +2906,9 @@ var AGENT_SLUG_PATTERN = /^\/([a-z][a-z0-9-]{2,49})$/;
 import Anthropic3 from "@anthropic-ai/sdk";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { resolve as resolve6, join as join3 } from "path";
+import { resolve as resolve5, join as join3 } from "path";
 import { platform as osPlatform } from "os";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync5, mkdirSync as mkdirSync5, createWriteStream, statSync as statSync3, unlinkSync as unlinkSync3, cpSync, rmSync as rmSync2, appendFileSync as appendFileSync2, openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync5, readdirSync as readdirSync2, existsSync as existsSync5, mkdirSync as mkdirSync4, createWriteStream, statSync as statSync3, unlinkSync as unlinkSync3, cpSync, rmSync as rmSync2, appendFileSync, openSync as openSync2, readSync as readSync2, closeSync as closeSync2 } from "fs";
 import { lookup as dnsLookup } from "dns/promises";
 import { createConnection as netConnect } from "net";
 import { StringDecoder } from "string_decoder";
@@ -3226,12 +2917,12 @@ import { StringDecoder } from "string_decoder";
 var import_dist = __toESM(require_dist());
 import {
   existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
+  mkdirSync,
   readFileSync,
   unlinkSync,
   writeFileSync
 } from "fs";
-import { resolve as resolve2, join as join2, dirname } from "path";
+import { resolve, join as join2, dirname } from "path";
 import { homedir } from "os";
 var cachedKeyFilePath = null;
 function resolveKeyFilePath() {
@@ -3262,7 +2953,7 @@ function resolveKeyFilePath() {
       throw err;
     }
   }
-  cachedKeyFilePath = resolve2(homedir(), configDirName, ".anthropic-api-key");
+  cachedKeyFilePath = resolve(homedir(), configDirName, ".anthropic-api-key");
   return cachedKeyFilePath;
 }
 function readKey() {
@@ -3548,11 +3239,11 @@ async function ensureAuth() {
 
 // app/lib/vnc.ts
 import { spawnSync, execFileSync } from "child_process";
-import { createConnection as createConnection2 } from "net";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-import { resolve as resolve3 } from "path";
-var PLATFORM_ROOT = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
-var VNC_SCRIPT = resolve3(PLATFORM_ROOT, "scripts/vnc.sh");
+import { createConnection } from "net";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { resolve as resolve2 } from "path";
+var PLATFORM_ROOT = process.env.MAXY_PLATFORM_ROOT ?? resolve2(process.cwd(), "..");
+var VNC_SCRIPT = resolve2(PLATFORM_ROOT, "scripts/vnc.sh");
 var displayMode = process.env.DISPLAY_MODE ?? "virtual";
 if (displayMode === "native") {
   console.log(`[vnc] DISPLAY_MODE=native \u2014 local requests use desktop display, remote requests use VNC`);
@@ -3644,7 +3335,7 @@ async function waitForPort(port2, timeoutMs = 12e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     const ready = await new Promise((res) => {
-      const socket = createConnection2(port2, "127.0.0.1");
+      const socket = createConnection(port2, "127.0.0.1");
       socket.setTimeout(500);
       socket.once("connect", () => {
         socket.destroy();
@@ -3665,10 +3356,10 @@ async function waitForPort(port2, timeoutMs = 12e3) {
   return false;
 }
 function ensureLogDir() {
-  mkdirSync3(LOG_DIR, { recursive: true });
+  mkdirSync2(LOG_DIR, { recursive: true });
 }
 function logPath(name) {
-  return resolve3(LOG_DIR, `${name}.log`);
+  return resolve2(LOG_DIR, `${name}.log`);
 }
 async function ensureVnc() {
   const up = await waitForPort(5900, 1e3);
@@ -3877,8 +3568,8 @@ async function ensureTerminalUpgrade(transport = "vnc") {
   return { ok: true };
 }
 function writeChromiumWrapper() {
-  mkdirSync3(BIN_DIR, { recursive: true });
-  const wrapperPath = resolve3(BIN_DIR, "chromium");
+  mkdirSync2(BIN_DIR, { recursive: true });
+  const wrapperPath = resolve2(BIN_DIR, "chromium");
   writeFileSync3(wrapperPath, `#!/bin/bash
 LOG="${LOG_DIR}/chromium.log"
 echo "==== [$(date)] chromium wrapper ====" >> "$LOG"
@@ -3964,12 +3655,12 @@ import neo4j from "neo4j-driver";
 import { randomUUID } from "crypto";
 import { spawn } from "child_process";
 import { readFileSync as readFileSync4, readdirSync, existsSync as existsSync3, openSync, readSync, closeSync, statSync as statSync2, rmSync } from "fs";
-import { resolve as resolve4 } from "path";
-var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
+import { resolve as resolve3 } from "path";
+var PLATFORM_ROOT2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
 var driver = null;
 function readPassword() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve4(PLATFORM_ROOT2, "config/.neo4j-password");
+  const passwordFile = resolve3(PLATFORM_ROOT2, "config/.neo4j-password");
   try {
     return readFileSync4(passwordFile, "utf-8").trim();
   } catch {
@@ -4434,8 +4125,8 @@ async function persistMessage(conversationId, role, content, accountId, tokens,
   const prev = persistMessageLocks.get(conversationId);
   const waited = prev !== void 0;
   let release;
-  const mine = new Promise((resolve29) => {
-    release = resolve29;
+  const mine = new Promise((resolve28) => {
+    release = resolve28;
   });
   const chained = (prev ?? Promise.resolve()).then(() => mine);
   persistMessageLocks.set(conversationId, chained);
@@ -4694,7 +4385,7 @@ ${userContent}`;
     "dontAsk",
     prompt
   ];
-  return new Promise((resolve29) => {
+  return new Promise((resolve28) => {
     let stdout = "";
     let stderr = "";
     const spawnFn = _spawnOverride ?? spawn;
@@ -4712,35 +4403,35 @@ ${userContent}`;
     const timer = setTimeout(() => {
       proc.kill("SIGTERM");
       console.error("[persist] autoLabel: haiku subprocess timed out");
-      resolve29(null);
+      resolve28(null);
     }, SESSION_LABEL_TIMEOUT_MS);
     proc.on("error", (err) => {
       clearTimeout(timer);
       console.error(`[persist] autoLabel: subprocess error \u2014 ${err.message}`);
-      resolve29(null);
+      resolve28(null);
     });
     proc.on("close", (code) => {
       clearTimeout(timer);
       if (code !== 0) {
         console.error(`[persist] autoLabel: subprocess exited code=${code}${stderr ? ` stderr=${stderr.trim().slice(0, 200)}` : ""}`);
-        resolve29(null);
+        resolve28(null);
         return;
       }
       const text = stdout.trim();
       if (!text) {
         console.error("[persist] autoLabel: haiku returned empty response");
-        resolve29(null);
+        resolve28(null);
         return;
       }
       if (text === "SKIP") {
         console.error("[persist] autoLabel: haiku returned SKIP \u2014 messages too vague");
-        resolve29(null);
+        resolve28(null);
         return;
       }
       const words = text.split(/\s+/).slice(0, SESSION_LABEL_MAX_WORDS);
       const label = words.join(" ");
       console.error(`[persist] autoLabel: haiku response="${label}"`);
-      resolve29(label);
+      resolve28(label);
     });
   });
 }
@@ -5012,9 +4703,9 @@ var MAX_RECENT_TOOL_FAILURES = 3;
 var RECENT_FAILURES_TAIL_BYTES = 10 * 1024;
 function readRecentToolFailures(accountId, conversationId) {
   try {
-    const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
-    const logDir = resolve4(platformRoot2, "..", "data/accounts", accountId, "logs");
-    const logPath2 = resolve4(logDir, `claude-agent-stream-${conversationId}.log`);
+    const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
+    const logDir = resolve3(platformRoot2, "..", "data/accounts", accountId, "logs");
+    const logPath2 = resolve3(logDir, `claude-agent-stream-${conversationId}.log`);
     if (!existsSync3(logPath2)) {
       console.error(`[review-tail-skip] path=${logPath2} reason=file-missing \u2014 first turn of conversation, subprocess not yet spawned, or log rotated`);
       return [];
@@ -5171,13 +4862,13 @@ ${taskLines.join("\n")}`);
     let pendingCount = 0;
     let pendingLines = [];
     try {
-      const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve4(process.cwd(), "..");
-      const pendingDir = resolve4(platformRoot2, "..", "data/accounts", accountId, "pending-actions");
+      const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve3(process.cwd(), "..");
+      const pendingDir = resolve3(platformRoot2, "..", "data/accounts", accountId, "pending-actions");
       if (existsSync3(pendingDir)) {
         const files = readdirSync(pendingDir).filter((f) => f.endsWith(".json") && !f.startsWith("."));
         for (const file of files) {
           try {
-            const raw2 = readFileSync4(resolve4(pendingDir, file), "utf-8");
+            const raw2 = readFileSync4(resolve3(pendingDir, file), "utf-8");
             const action = JSON.parse(raw2);
             if (action.state === "pending") {
               const inputSummary = JSON.stringify(action.hookPayload?.tool_input ?? {}).slice(0, 150);
@@ -5244,8 +4935,8 @@ ${sections.join("\n\n")}
   }
 }
 async function consumeStep7FlagUI(session, accountId) {
-  const accountDir = resolve4(PLATFORM_ROOT2, "..", "data/accounts", accountId);
-  const flagPath = resolve4(accountDir, "onboarding", "step7-complete");
+  const accountDir = resolve3(PLATFORM_ROOT2, "..", "data/accounts", accountId);
+  const flagPath = resolve3(accountDir, "onboarding", "step7-complete");
   if (!existsSync3(flagPath)) return false;
   let completedAt = (/* @__PURE__ */ new Date()).toISOString();
   try {
@@ -5687,8 +5378,8 @@ ${items}
 }
 
 // app/lib/adherence-ledger.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync5, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
-import { resolve as resolve5, dirname as dirname2 } from "path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync5, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync4 } from "fs";
+import { resolve as resolve4, dirname as dirname2 } from "path";
 import lockfile from "proper-lockfile";
 var LOG_TAG = "[adherence-ledger]";
 var ADHERENCE_BLOCK_THRESHOLD = 5;
@@ -5703,7 +5394,7 @@ function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
 function ledgerPath(accountDir, agentName) {
-  return resolve5(accountDir, "agents", agentName, "adherence-ledger.json");
+  return resolve4(accountDir, "agents", agentName, "adherence-ledger.json");
 }
 function lockPath(accountDir, agentName) {
   return `${ledgerPath(accountDir, agentName)}.lock`;
@@ -5748,7 +5439,7 @@ function writeAtomic(path2, data) {
   }
   data.updated_at = nowIso();
   const dir = dirname2(path2);
-  mkdirSync4(dir, { recursive: true });
+  mkdirSync3(dir, { recursive: true });
   const tmp = `${path2}.tmp-${process.pid}-${Date.now()}`;
   try {
     writeFileSync4(tmp, JSON.stringify(data, null, 2), "utf-8");
@@ -5764,7 +5455,7 @@ function writeAtomic(path2, data) {
 async function withLock(accountDir, agentName, fn) {
   const path2 = ledgerPath(accountDir, agentName);
   const lock = lockPath(accountDir, agentName);
-  mkdirSync4(dirname2(lock), { recursive: true });
+  mkdirSync3(dirname2(lock), { recursive: true });
   if (!existsSync4(lock)) {
     writeFileSync4(lock, "", "utf-8");
   }
@@ -6252,20 +5943,20 @@ function agentLogStream(name, accountDir, conversationId) {
   if (!conversationId) {
     throw new Error(`agentLogStream: conversationId is required (name=${name}) \u2014 use preConversationLogStream for pre-session events`);
   }
-  const logDir = resolve6(accountDir, "logs");
-  mkdirSync5(logDir, { recursive: true });
+  const logDir = resolve5(accountDir, "logs");
+  mkdirSync4(logDir, { recursive: true });
   purgeOldLogs(logDir, `${name}-`);
-  const logPath2 = resolve6(logDir, `${name}-${conversationId}.log`);
+  const logPath2 = resolve5(logDir, `${name}-${conversationId}.log`);
   const stream = createWriteStream(logPath2, { flags: "a" });
   registerStreamLog(stream, { path: logPath2, conversationId, name });
   return stream;
 }
 function preConversationLogStream(name, accountDir) {
-  const logDir = resolve6(accountDir, "logs");
-  mkdirSync5(logDir, { recursive: true });
+  const logDir = resolve5(accountDir, "logs");
+  mkdirSync4(logDir, { recursive: true });
   const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   purgeOldLogs(logDir, `preconversation-${name}-`);
-  const logPath2 = resolve6(logDir, `preconversation-${name}-${date}.log`);
+  const logPath2 = resolve5(logDir, `preconversation-${name}-${date}.log`);
   const stream = createWriteStream(logPath2, { flags: "a" });
   registerStreamLog(stream, { path: logPath2, conversationId: null, name: `preconversation-${name}` });
   return stream;
@@ -6284,7 +5975,7 @@ function sigtermFlushStreamLogs(reason, source) {
     const line = `[${ts}] [server-sigterm] reason=${reason}${convPart} name=${entry.name} source=${source}
 `;
     try {
-      appendFileSync2(entry.path, line);
+      appendFileSync(entry.path, line);
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       console.error(`[server-sigterm-flush-err] path=${entry.path} reason=${msg}`);
@@ -6303,7 +5994,7 @@ function purgeOldLogs(logDir, prefix) {
   }
   for (const file of entries) {
     if (!file.startsWith(prefix)) continue;
-    const filePath = resolve6(logDir, file);
+    const filePath = resolve5(logDir, file);
     try {
       if (statSync3(filePath).mtimeMs < cutoff) unlinkSync3(filePath);
     } catch (err) {
@@ -6421,8 +6112,8 @@ function sampleProcState(pid) {
     return `proc_err=${JSON.stringify(msg.slice(0, 60))}`;
   }
 }
-var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "..");
-var ACCOUNTS_DIR = resolve6(PLATFORM_ROOT3, "..", "data/accounts");
+var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve5(process.cwd(), "..");
+var ACCOUNTS_DIR = resolve5(PLATFORM_ROOT3, "..", "data/accounts");
 if (!existsSync5(PLATFORM_ROOT3)) {
   throw new Error(
     `PLATFORM_ROOT does not exist: ${PLATFORM_ROOT3}
@@ -6431,7 +6122,7 @@ Set the MAXY_PLATFORM_ROOT environment variable to the absolute path of the plat
 }
 function resolveAccount() {
   if (!existsSync5(ACCOUNTS_DIR)) return null;
-  const usersFilePath = resolve6(PLATFORM_ROOT3, "config", "users.json");
+  const usersFilePath = resolve5(PLATFORM_ROOT3, "config", "users.json");
   let usersJsonUserId = null;
   if (existsSync5(usersFilePath)) {
     try {
@@ -6449,7 +6140,7 @@ function resolveAccount() {
   let fallback = null;
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const configPath2 = resolve6(ACCOUNTS_DIR, entry.name, "account.json");
+    const configPath2 = resolve5(ACCOUNTS_DIR, entry.name, "account.json");
     if (!existsSync5(configPath2)) continue;
     const raw2 = readFileSync6(configPath2, "utf-8");
     let config;
@@ -6466,7 +6157,7 @@ function resolveAccount() {
     }
     const result = {
       accountId: config.accountId,
-      accountDir: resolve6(ACCOUNTS_DIR, entry.name),
+      accountDir: resolve5(ACCOUNTS_DIR, entry.name),
       config
     };
     if (usersJsonUserId && config.admins?.some((a) => a.userId === usersJsonUserId)) {
@@ -6484,7 +6175,7 @@ function resolveAccount() {
   return fallback;
 }
 function readAgentFile(accountDir, agentName, filename) {
-  const filePath = resolve6(accountDir, "agents", agentName, filename);
+  const filePath = resolve5(accountDir, "agents", agentName, filename);
   if (!existsSync5(filePath)) return null;
   return readFileSync6(filePath, "utf-8");
 }
@@ -6521,7 +6212,7 @@ function validateAgentSlug(slug) {
   return true;
 }
 function resolveDefaultAgentSlug(accountDir) {
-  const configPath2 = resolve6(accountDir, "account.json");
+  const configPath2 = resolve5(accountDir, "account.json");
   if (!existsSync5(configPath2)) {
     console.error("[agent-resolve] account.json not found \u2014 cannot resolve defaultAgent");
     return null;
@@ -6537,7 +6228,7 @@ function resolveDefaultAgentSlug(accountDir) {
     console.error("[agent-resolve] defaultAgent not configured in account.json \u2014 set it via the connect-whatsapp skill");
     return null;
   }
-  const agentConfigPath = resolve6(accountDir, "agents", config.defaultAgent, "config.json");
+  const agentConfigPath = resolve5(accountDir, "agents", config.defaultAgent, "config.json");
   if (!existsSync5(agentConfigPath)) {
     console.error(`[agent-resolve] defaultAgent="${config.defaultAgent}" has no config.json at ${agentConfigPath}`);
     return null;
@@ -6610,9 +6301,9 @@ function resolveAgentConfig(accountDir, agentName) {
   }
   let knowledge = null;
   let knowledgeBaked = false;
-  const agentDir = resolve6(accountDir, "agents", agentName);
-  const knowledgePath = resolve6(agentDir, "KNOWLEDGE.md");
-  const summaryPath = resolve6(agentDir, "KNOWLEDGE-SUMMARY.md");
+  const agentDir = resolve5(accountDir, "agents", agentName);
+  const knowledgePath = resolve5(agentDir, "KNOWLEDGE.md");
+  const summaryPath = resolve5(agentDir, "KNOWLEDGE-SUMMARY.md");
   const hasKnowledge = existsSync5(knowledgePath);
   const hasSummary = existsSync5(summaryPath);
   if (hasKnowledge && hasSummary) {
@@ -6648,7 +6339,7 @@ function resolveAgentConfig(accountDir, agentName) {
   return { model, plugins, status, displayName, image, imageShape, showAgentName, knowledge, knowledgeBaked, liveMemory, knowledgeKeywords, budget, accessMode };
 }
 function parsePluginFrontmatter(pluginDir) {
-  const pluginPath = resolve6(PLATFORM_ROOT3, "plugins", pluginDir, "PLUGIN.md");
+  const pluginPath = resolve5(PLATFORM_ROOT3, "plugins", pluginDir, "PLUGIN.md");
   if (!existsSync5(pluginPath)) return null;
   let raw2;
   try {
@@ -6711,14 +6402,14 @@ function parsePluginFrontmatter(pluginDir) {
 function autoDeliverPremiumPlugins(purchasedPlugins) {
   if (!purchasedPlugins || purchasedPlugins.length === 0) return;
   const TAG19 = "[premium-auto-deliver]";
-  const stagingRoot = resolve6(PLATFORM_ROOT3, "../premium-plugins");
-  const pluginsDir = resolve6(PLATFORM_ROOT3, "plugins");
+  const stagingRoot = resolve5(PLATFORM_ROOT3, "../premium-plugins");
+  const pluginsDir = resolve5(PLATFORM_ROOT3, "plugins");
   if (!existsSync5(stagingRoot)) {
     console.log(`${TAG19} no staging directory \u2014 skipping`);
     return;
   }
   for (const pluginName of purchasedPlugins) {
-    const stagingDir = resolve6(stagingRoot, pluginName);
+    const stagingDir = resolve5(stagingRoot, pluginName);
     if (!existsSync5(stagingDir)) {
       console.log(`${TAG19} ${pluginName}: not in staging \u2014 skipping`);
       continue;
@@ -6759,12 +6450,12 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
       let delivered = 0;
       let skipped = 0;
       for (const sub of subPlugins) {
-        const target = resolve6(pluginsDir, sub);
-        if (existsSync5(resolve6(target, "PLUGIN.md"))) {
+        const target = resolve5(pluginsDir, sub);
+        if (existsSync5(resolve5(target, "PLUGIN.md"))) {
           skipped++;
           continue;
         }
-        const source = resolve6(stagingDir, "plugins", sub);
+        const source = resolve5(stagingDir, "plugins", sub);
         if (!existsSync5(source)) {
           console.log(`${TAG19} ${pluginName}/${sub}: source missing in staging \u2014 skipping`);
           continue;
@@ -6778,8 +6469,8 @@ function autoDeliverPremiumPlugins(purchasedPlugins) {
       }
       console.log(`${TAG19} ${pluginName} (bundle): ${delivered} delivered, ${skipped} already present`);
     } else {
-      const target = resolve6(pluginsDir, pluginName);
-      if (existsSync5(resolve6(target, "PLUGIN.md"))) {
+      const target = resolve5(pluginsDir, pluginName);
+      if (existsSync5(resolve5(target, "PLUGIN.md"))) {
         console.log(`${TAG19} ${pluginName}: already present \u2014 skipping`);
         continue;
       }
@@ -6819,7 +6510,7 @@ function migratePluginRenames(accountDir, config) {
     return name;
   });
   if (!changed) return;
-  const configPath2 = resolve6(accountDir, "account.json");
+  const configPath2 = resolve5(accountDir, "account.json");
   try {
     const raw2 = readFileSync6(configPath2, "utf-8");
     const parsed = JSON.parse(raw2);
@@ -6830,9 +6521,9 @@ function migratePluginRenames(accountDir, config) {
   } catch (err) {
     console.error(`${TAG19} failed to update account.json \u2014 ${err instanceof Error ? err.message : String(err)}`);
   }
-  const pluginsDir = resolve6(PLATFORM_ROOT3, "plugins");
+  const pluginsDir = resolve5(PLATFORM_ROOT3, "plugins");
   for (const oldName of Object.keys(PLUGIN_RENAMES)) {
-    const orphan = resolve6(pluginsDir, oldName);
+    const orphan = resolve5(pluginsDir, oldName);
     if (existsSync5(orphan)) {
       try {
         rmSync2(orphan, { recursive: true });
@@ -6846,13 +6537,13 @@ function migratePluginRenames(accountDir, config) {
 function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   if (!purchasedPlugins || purchasedPlugins.length === 0) return;
   const TAG19 = "[bundle-agent-deliver]";
-  const stagingRoot = resolve6(PLATFORM_ROOT3, "../premium-plugins");
-  const specialistsDir = resolve6(accountDir, "specialists", "agents");
+  const stagingRoot = resolve5(PLATFORM_ROOT3, "../premium-plugins");
+  const specialistsDir = resolve5(accountDir, "specialists", "agents");
   if (!existsSync5(stagingRoot)) return;
   if (!existsSync5(specialistsDir)) {
-    mkdirSync5(specialistsDir, { recursive: true });
+    mkdirSync4(specialistsDir, { recursive: true });
   }
-  const agentsmdPath = resolve6(accountDir, "agents", "admin", "AGENTS.md");
+  const agentsmdPath = resolve5(accountDir, "agents", "admin", "AGENTS.md");
   let agentsmd = "";
   try {
     agentsmd = existsSync5(agentsmdPath) ? readFileSync6(agentsmdPath, "utf-8") : "";
@@ -6860,7 +6551,7 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   }
   let delivered = 0;
   for (const pluginName of purchasedPlugins) {
-    const bundleAgentsDir = resolve6(stagingRoot, pluginName, "agents");
+    const bundleAgentsDir = resolve5(stagingRoot, pluginName, "agents");
     if (!existsSync5(bundleAgentsDir)) continue;
     let entries;
     try {
@@ -6869,9 +6560,9 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
       continue;
     }
     for (const filename of entries) {
-      const target = resolve6(specialistsDir, filename);
+      const target = resolve5(specialistsDir, filename);
       if (existsSync5(target)) continue;
-      const source = resolve6(bundleAgentsDir, filename);
+      const source = resolve5(bundleAgentsDir, filename);
       try {
         cpSync(source, target);
       } catch (err) {
@@ -6911,8 +6602,8 @@ function autoDeliverBundleAgents(accountDir, purchasedPlugins) {
   }
 }
 function assemblePublicPluginContent(pluginDir) {
-  const pluginRoot = resolve6(PLATFORM_ROOT3, "plugins", pluginDir);
-  const pluginPath = resolve6(pluginRoot, "PLUGIN.md");
+  const pluginRoot = resolve5(PLATFORM_ROOT3, "plugins", pluginDir);
+  const pluginPath = resolve5(pluginRoot, "PLUGIN.md");
   let raw2;
   try {
     raw2 = readFileSync6(pluginPath, "utf-8");
@@ -6924,7 +6615,7 @@ function assemblePublicPluginContent(pluginDir) {
   const parts = [pluginBody];
   let skillCount = 0;
   let refCount = 0;
-  const skillsDir = resolve6(pluginRoot, "skills");
+  const skillsDir = resolve5(pluginRoot, "skills");
   let skillDirs;
   try {
     skillDirs = readdirSync2(skillsDir).sort();
@@ -6932,8 +6623,8 @@ function assemblePublicPluginContent(pluginDir) {
     return { body: pluginBody, skillCount: 0, refCount: 0 };
   }
   for (const skillName of skillDirs) {
-    const skillDir = resolve6(skillsDir, skillName);
-    const skillMdPath = resolve6(skillDir, "SKILL.md");
+    const skillDir = resolve5(skillsDir, skillName);
+    const skillMdPath = resolve5(skillDir, "SKILL.md");
     let skillRaw;
     try {
       skillRaw = readFileSync6(skillMdPath, "utf-8");
@@ -6976,7 +6667,7 @@ function assemblePublicPluginContent(pluginDir) {
     parts.push(`
 <!-- skill: ${skillName} -->`);
     parts.push(skillBody);
-    const refsDir = resolve6(skillDir, "references");
+    const refsDir = resolve5(skillDir, "references");
     let refFiles;
     try {
       refFiles = readdirSync2(refsDir).filter((f) => f.endsWith(".md")).filter((f) => !publicExcludeReferences.includes(f)).sort();
@@ -6987,7 +6678,7 @@ function assemblePublicPluginContent(pluginDir) {
     }
     for (const refFile of refFiles) {
       try {
-        const refContent = readFileSync6(resolve6(refsDir, refFile), "utf-8").trim();
+        const refContent = readFileSync6(resolve5(refsDir, refFile), "utf-8").trim();
         if (refContent) {
           parts.push(`
 <!-- reference: ${refFile} -->`);
@@ -7005,7 +6696,7 @@ function assemblePublicPluginContent(pluginDir) {
   return { body: parts.join("\n"), skillCount, refCount };
 }
 function loadEmbeddedPlugins(agentType, selectedPlugins, enabledPlugins) {
-  const pluginsDir = resolve6(PLATFORM_ROOT3, "plugins");
+  const pluginsDir = resolve5(PLATFORM_ROOT3, "plugins");
   let dirs;
   try {
     dirs = readdirSync2(pluginsDir);
@@ -7058,7 +6749,7 @@ function loadEmbeddedPlugins(agentType, selectedPlugins, enabledPlugins) {
         console.log(`[plugins] loaded ${dir} for public (${assembled.body.length} chars, ${assembled.skillCount} skills, ${assembled.refCount} refs)`);
       }
     } else {
-      const pluginPath = resolve6(pluginsDir, dir, "PLUGIN.md");
+      const pluginPath = resolve5(pluginsDir, dir, "PLUGIN.md");
       let raw2;
       try {
         raw2 = readFileSync6(pluginPath, "utf-8");
@@ -7085,7 +6776,7 @@ var mcpToolsCache = /* @__PURE__ */ new Map();
 function fetchMcpToolsList(pluginDir) {
   const cached = mcpToolsCache.get(pluginDir);
   if (cached) return Promise.resolve(cached);
-  const serverPath = resolve6(PLATFORM_ROOT3, "plugins", pluginDir, "mcp/dist/index.js");
+  const serverPath = resolve5(PLATFORM_ROOT3, "plugins", pluginDir, "mcp/dist/index.js");
   if (!existsSync5(serverPath)) return Promise.resolve([]);
   const startMs = Date.now();
   return new Promise((resolvePromise) => {
@@ -7198,7 +6889,7 @@ var SPECIALIST_PLUGIN_DOMAINS = {
   // agent, so it retains a full manifest entry for routing clarity.
 };
 async function buildPluginManifest(enabledPlugins) {
-  const pluginsDir = resolve6(PLATFORM_ROOT3, "plugins");
+  const pluginsDir = resolve5(PLATFORM_ROOT3, "plugins");
   let dirs;
   try {
     dirs = readdirSync2(pluginsDir);
@@ -7285,16 +6976,16 @@ ${specialist}: ${plugins.join(", ")}`);
   for (let j = 0; j < adminPlugins.length; j++) {
     const { dir, parsed } = adminPlugins[j];
     const mcpTools = adminMcpResults[j];
-    const pluginRoot = resolve6(pluginsDir, dir);
+    const pluginRoot = resolve5(pluginsDir, dir);
     const skills = [];
     const references = [];
     const scanDir = (base, prefix, target) => {
-      const scanPath = resolve6(pluginRoot, base);
+      const scanPath = resolve5(pluginRoot, base);
       if (!existsSync5(scanPath)) return;
       try {
         const walk = (current, rel) => {
           for (const entry of readdirSync2(current)) {
-            const full = resolve6(current, entry);
+            const full = resolve5(current, entry);
             try {
               const stat5 = statSync3(full);
               if (stat5.isDirectory()) {
@@ -7322,7 +7013,7 @@ ${specialist}: ${plugins.join(", ")}`);
         toolLines.push(desc ? `  ${tool.name} \u2014 ${desc}` : `  ${tool.name}`);
       }
     } else if (parsed.tools.length > 0) {
-      const serverPath = resolve6(PLATFORM_ROOT3, "plugins", dir, "mcp/dist/index.js");
+      const serverPath = resolve5(PLATFORM_ROOT3, "plugins", dir, "mcp/dist/index.js");
       if (existsSync5(serverPath)) {
         fallbackSourced++;
         console.error(`[plugin-manifest] ${dir}: tools/list empty \u2014 fallback to frontmatter (${parsed.tools.length} tools)`);
@@ -7403,7 +7094,7 @@ function resolveUserAccounts(userId) {
   const entries = readdirSync2(ACCOUNTS_DIR, { withFileTypes: true });
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const configPath2 = resolve6(ACCOUNTS_DIR, entry.name, "account.json");
+    const configPath2 = resolve5(ACCOUNTS_DIR, entry.name, "account.json");
     if (!existsSync5(configPath2)) continue;
     let config;
     try {
@@ -7416,7 +7107,7 @@ function resolveUserAccounts(userId) {
     if (adminEntry) {
       results.push({
         accountId: config.accountId,
-        accountDir: resolve6(ACCOUNTS_DIR, entry.name),
+        accountDir: resolve5(ACCOUNTS_DIR, entry.name),
         config,
         role: adminEntry.role
       });
@@ -7477,8 +7168,75 @@ function clearSessionHistory(sessionKey) {
   session.stalledSubagents = void 0;
   session.pendingTrimmedMessages = void 0;
   session.pendingCommitmentOffers = void 0;
+  session.pendingTurns = void 0;
   return previousConversationId;
 }
+function bufferPendingTurn(sessionKey, turn) {
+  const session = sessionStore.get(sessionKey);
+  if (!session) {
+    console.error(`[conversation-gate] bufferPendingTurn: session not found sessionKey=${sessionKey.slice(0, 8)}\u2026`);
+    return;
+  }
+  if (!session.pendingTurns) session.pendingTurns = [];
+  session.pendingTurns.push(turn);
+  console.log(`[conversation-gate] ${(/* @__PURE__ */ new Date()).toISOString()} buffered sessionKey=${sessionKey.slice(0, 8)} role=${turn.role} turnCount=${session.pendingTurns.filter((t) => t.role === "user").length}`);
+}
+function getPendingTurnCount(sessionKey) {
+  const buf = sessionStore.get(sessionKey)?.pendingTurns;
+  if (!buf) return 0;
+  let n = 0;
+  for (const t of buf) if (t.role === "user") n++;
+  return n;
+}
+function drainPendingTurns(sessionKey) {
+  const session = sessionStore.get(sessionKey);
+  if (!session?.pendingTurns || session.pendingTurns.length === 0) return void 0;
+  const drained = session.pendingTurns;
+  session.pendingTurns = void 0;
+  return drained;
+}
+async function maybeFlushConversationBuffer(sessionKey, agentType, accountId) {
+  const session = sessionStore.get(sessionKey);
+  if (!session) return null;
+  if (session.conversationId) return session.conversationId;
+  if (getPendingTurnCount(sessionKey) < 2) return null;
+  if (session.flushInFlight) return session.flushInFlight;
+  const attempt = (async () => {
+    let conversationId = null;
+    if (agentType === "admin") {
+      const userId = session.userId;
+      if (!userId) {
+        console.error(`[conversation-gate] flush aborted: admin session missing userId sessionKey=${sessionKey.slice(0, 8)}\u2026`);
+        return null;
+      }
+      conversationId = await createNewAdminConversation(userId, accountId, sessionKey);
+    } else {
+      conversationId = await ensureConversation(accountId, "public", sessionKey, void 0, void 0, void 0);
+    }
+    if (!conversationId) return null;
+    session.conversationId = conversationId;
+    const buffered = drainPendingTurns(sessionKey) ?? [];
+    for (const turn of buffered) {
+      persistMessage(conversationId, turn.role, turn.content, accountId, turn.tokens, turn.timestamp, turn.sender).catch((err) => {
+        console.error(`[conversation-gate] replay persistMessage failed role=${turn.role}: ${err instanceof Error ? err.message : String(err)}`);
+      });
+    }
+    console.log(`[conversation-gate] ${(/* @__PURE__ */ new Date()).toISOString()} flushed sessionKey=${sessionKey.slice(0, 8)} conversationId=${conversationId.slice(0, 8)} bufferedMessages=${buffered.length} agentType=${agentType}`);
+    return conversationId;
+  })();
+  session.flushInFlight = attempt;
+  try {
+    return await attempt;
+  } finally {
+    if (session.flushInFlight === attempt) session.flushInFlight = void 0;
+  }
+}
+function isDmChannelSessionKey(sessionKey) {
+  return sessionKey.startsWith("whatsapp:") || sessionKey.startsWith("telegram:");
+}
+function preflushStreamLogKey(sessionKey) {
+  return `preflush-${sessionKey.slice(0, 12)}`;
+}
 function getAgentNameForSession(sessionKey) {
   return sessionStore.get(sessionKey)?.agentName;
 }
@@ -7633,8 +7391,8 @@ function consumeStalledSubagents(sessionKey) {
   return stalls && stalls.length > 0 ? stalls : void 0;
 }
 function streamLogPathFor(accountId, conversationId) {
-  const logDir = resolve6(ACCOUNTS_DIR, accountId, "logs");
-  const streamLogPath = resolve6(logDir, `claude-agent-stream-${conversationId}.log`);
+  const logDir = resolve5(ACCOUNTS_DIR, accountId, "logs");
+  const streamLogPath = resolve5(logDir, `claude-agent-stream-${conversationId}.log`);
   return { logDir, streamLogPath };
 }
 function buildSpawnEnv(accountId, accountDir, conversationId) {
@@ -7655,7 +7413,7 @@ var cachedBrandHostname = null;
 function readBrandHostname() {
   if (cachedBrandHostname !== null) return cachedBrandHostname;
   try {
-    const brandPath = resolve6(PLATFORM_ROOT3, "config", "brand.json");
+    const brandPath = resolve5(PLATFORM_ROOT3, "config", "brand.json");
     const parsed = JSON.parse(readFileSync6(brandPath, "utf-8"));
     cachedBrandHostname = typeof parsed.hostname === "string" && parsed.hostname.length > 0 ? parsed.hostname : "maxy";
   } catch {
@@ -7693,37 +7451,37 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
   const servers = {
     "memory": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/memory/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/memory/mcp/dist/index.js")],
       env: { ...baseEnv, ...userId ? { USER_ID: userId } : {} }
     },
     "contacts": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/contacts/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/contacts/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     "whatsapp": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/whatsapp/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/whatsapp/mcp/dist/index.js")],
       env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
     },
     "admin": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/admin/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/admin/mcp/dist/index.js")],
       env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200", ...userId ? { USER_ID: userId } : {} }
     },
     "scheduling": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/scheduling/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/scheduling/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     "tasks": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/tasks/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/tasks/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     "email": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/email/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/email/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     // Workflows MCP — persistent admin-session server for list/get/update/delete/
@@ -7734,7 +7492,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
     // ToolSearches fruitlessly before degrading to a task-create stand-in (Task 571).
     "workflows": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/workflows/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/workflows/mcp/dist/index.js")],
       env: { ...baseEnv }
     },
     // Playwright MCP server — browser automation for browser-specialist.
@@ -7756,7 +7514,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
     // MAXY-PRD.md:627, not in any application-layer filter).
     "graph": {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "lib/graph-mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "lib/graph-mcp/dist/index.js")],
       env: {
         ...baseEnv,
         BRAND: readBrandHostname(),
@@ -7772,7 +7530,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
   if (tgBotToken) {
     servers["telegram"] = {
       command: "node",
-      args: [resolve6(PLATFORM_ROOT3, "plugins/telegram/mcp/dist/index.js")],
+      args: [resolve5(PLATFORM_ROOT3, "plugins/telegram/mcp/dist/index.js")],
       env: { ...baseEnv, TELEGRAM_BOT_TOKEN: tgBotToken }
     };
   } else {
@@ -7780,11 +7538,11 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
   }
   servers["cloudflare"] = {
     command: "node",
-    args: [resolve6(PLATFORM_ROOT3, "plugins/cloudflare/mcp/dist/index.js")],
+    args: [resolve5(PLATFORM_ROOT3, "plugins/cloudflare/mcp/dist/index.js")],
     env: { ...baseEnv, PLATFORM_PORT: process.env.PORT ?? "19200" }
   };
   if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
-    const pluginsDir = resolve6(PLATFORM_ROOT3, "plugins");
+    const pluginsDir = resolve5(PLATFORM_ROOT3, "plugins");
     let dirs;
     try {
       dirs = readdirSync2(pluginsDir);
@@ -7807,7 +7565,7 @@ function getMcpServers(accountId, conversationId, userId, enabledPlugins) {
           continue;
         }
       }
-      const mcpEntry = resolve6(PLATFORM_ROOT3, "plugins", dir, "mcp/dist/index.js");
+      const mcpEntry = resolve5(PLATFORM_ROOT3, "plugins", dir, "mcp/dist/index.js");
       if (!existsSync5(mcpEntry)) continue;
       servers[dir] = {
         command: "node",
@@ -7943,7 +7701,7 @@ var ADMIN_CORE_TOOLS = [
 function getAdminAllowedTools(enabledPlugins) {
   const tools = [...ADMIN_CORE_TOOLS];
   if (Array.isArray(enabledPlugins) && enabledPlugins.length > 0) {
-    const pluginsDir = resolve6(PLATFORM_ROOT3, "plugins");
+    const pluginsDir = resolve5(PLATFORM_ROOT3, "plugins");
     let dirs;
     try {
       dirs = readdirSync2(pluginsDir);
@@ -8051,13 +7809,13 @@ ${message.slice(0, QUERY_CLASSIFIER_MSG_CAP)}`
   }
 }
 async function fetchMemoryContext(accountId, query, sessionKey, options) {
-  const serverPath = resolve6(PLATFORM_ROOT3, "plugins/memory/mcp/dist/index.js");
+  const serverPath = resolve5(PLATFORM_ROOT3, "plugins/memory/mcp/dist/index.js");
   if (!existsSync5(serverPath)) {
     console.error(`[fetchMemoryContext] MCP server not found: ${serverPath}`);
     return null;
   }
   const startMs = Date.now();
-  return new Promise((resolve29) => {
+  return new Promise((resolve28) => {
     const proc = spawn2(process.execPath, [serverPath], {
       env: {
         ...process.env,
@@ -8086,7 +7844,7 @@ async function fetchMemoryContext(accountId, query, sessionKey, options) {
       } else {
         console.error(`[fetchMemoryContext] failed: ${reason} (${elapsed}ms)${stderrBuf ? ` stderr: ${stderrBuf.slice(0, 500)}` : ""}`);
       }
-      resolve29(value);
+      resolve28(value);
     };
     proc.stdout.on("data", (chunk) => {
       buffer += chunk.toString();
@@ -8149,7 +7907,7 @@ async function fetchMemoryContext(accountId, query, sessionKey, options) {
 }
 async function compactTrimmedMessages(accountId, trimmedMessages) {
   if (trimmedMessages.length === 0) return true;
-  const serverPath = resolve6(PLATFORM_ROOT3, "plugins/memory/mcp/dist/index.js");
+  const serverPath = resolve5(PLATFORM_ROOT3, "plugins/memory/mcp/dist/index.js");
   if (!existsSync5(serverPath)) return false;
   const briefing = trimmedMessages.map((m) => `[${m.role.toUpperCase()}] ${m.content}`).join("\n\n");
   return new Promise((resolvePromise) => {
@@ -8467,7 +8225,7 @@ Then respond with only: [COMPACTED]`;
 var COMPACTION_TIMEOUT_MS = 45e3;
 async function* runCompactionTurn(accountDir, accountId, systemPrompt, resumeSessionId, adminModel, conversationId, enabledPlugins) {
   const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, conversationId, void 0, enabledPlugins) });
-  const specialistsDir = resolve6(accountDir, "specialists");
+  const specialistsDir = resolve5(accountDir, "specialists");
   if (!existsSync5(specialistsDir)) agentLogStream("claude-agent-compaction-stream", accountDir, conversationId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
@@ -8741,7 +8499,7 @@ async function* parseClaudeStream(proc, streamLog, adminModel, conversationId, a
               const { logDir } = streamLogPathFor(accountId, conversationId);
               const date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
               for (const s of failed) {
-                const stderrPath = resolve6(logDir, `mcp-${s.name}-stderr-${date}.log`);
+                const stderrPath = resolve5(logDir, `mcp-${s.name}-stderr-${date}.log`);
                 let tail = "(no stderr file)";
                 try {
                   const stats = statSync3(stderrPath);
@@ -9371,20 +9129,24 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
   const userTimestamp = clientTimestamp ?? (/* @__PURE__ */ new Date()).toISOString();
   const resumeSessionId = sessionKey ? getAgentSessionId(sessionKey) : void 0;
   const spawnConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
-  if (!spawnConvId) {
-    throw new Error(`invokeAdminAgent: conversationId missing for sessionKey=${sessionKey?.slice(0, 8) ?? "none"} \u2014 ensureConversation must run before invoking the agent`);
+  if (!spawnConvId && sessionKey && getPendingTurnCount(sessionKey) >= 2) {
+    throw new Error(`invokeAdminAgent: conversationId missing post-flush for sessionKey=${sessionKey.slice(0, 8)} \u2014 maybeFlushConversationBuffer must bind it before invoking the agent`);
+  }
+  const spawnLogKey = spawnConvId ?? (sessionKey ? preflushStreamLogKey(sessionKey) : void 0);
+  if (!spawnLogKey) {
+    throw new Error(`invokeAdminAgent: sessionKey required \u2014 cannot resolve log stream without one`);
   }
   const cdpOk = await ensureCdp();
   if (!cdpOk) {
-    const cdpLog = agentLogStream("claude-agent-stream", accountDir, spawnConvId);
+    const cdpLog = agentLogStream("claude-agent-stream", accountDir, spawnLogKey);
     cdpLog.write(`[${isoTs()}] [warn] ensureCdp failed \u2014 browser-specialist degraded
 `);
     cdpLog.end();
   }
   const ccUserId = sessionKey ? getUserIdForSession(sessionKey) : void 0;
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, spawnConvId, ccUserId, enabledPlugins) });
-  const specialistsDir = resolve6(accountDir, "specialists");
-  if (!existsSync5(specialistsDir)) agentLogStream("claude-agent-stream", accountDir, spawnConvId).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, spawnLogKey, ccUserId, enabledPlugins) });
+  const specialistsDir = resolve5(accountDir, "specialists");
+  if (!existsSync5(specialistsDir)) agentLogStream("claude-agent-stream", accountDir, spawnLogKey).write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const args = [
     "--print",
@@ -9415,19 +9177,19 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
     // Task 556: STREAM_LOG_PATH inherited by Bash-tool subprocesses.
-    env: buildSpawnEnv(accountId, accountDir, spawnConvId)
+    env: buildSpawnEnv(accountId, accountDir, spawnLogKey)
   });
-  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, spawnConvId);
+  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, spawnLogKey);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
-  const streamLog = agentLogStream("claude-agent-stream", accountDir, spawnConvId);
+  const streamLog = agentLogStream("claude-agent-stream", accountDir, spawnLogKey);
   streamLog.on("error", () => {
   });
   teeProcStderrToStreamLog(proc, streamLog);
   streamLog.write(`[${isoTs()}] [subproc-debug-unavailable] reason=bundled-bun-binary-ignores-node-debug pid=${proc.pid} cli=claude
 `);
-  streamLog.write(`[${isoTs()}] [spawn-env] STREAM_LOG_PATH=set pid=${proc.pid} conversationId=${spawnConvId} site=admin
+  streamLog.write(`[${isoTs()}] [spawn-env] STREAM_LOG_PATH=set pid=${proc.pid} conversationId=${spawnConvId ?? "preflush"} logKey=${spawnLogKey} site=admin
 `);
   if (sessionKey) {
     const prev = activeProcesses.get(sessionKey);
@@ -9437,7 +9199,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     }
     activeProcesses.set(sessionKey, { pid: proc.pid, spawnedAt: Date.now() });
   }
-  streamLog.write(`[${isoTs()}] [spawn] pid=${proc.pid} resume=${resumeSessionId ?? "none"} sessionKey=${sessionKey ?? "none"} conversationId=${spawnConvId} pluginDir=${specialistsDir}
+  streamLog.write(`[${isoTs()}] [spawn] pid=${proc.pid} resume=${resumeSessionId ?? "none"} sessionKey=${sessionKey ?? "none"} conversationId=${spawnConvId ?? "preflush"} logKey=${spawnLogKey} pluginDir=${specialistsDir}
 `);
   streamLog.write(`[${isoTs()}] [stdin] len=${fullMessage.length} preview=${JSON.stringify(fullMessage.slice(0, 80))}
 `);
@@ -9509,7 +9271,7 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
     }
     if (event.type === "usage" && sessionKey && currentAgentSessionId) {
       const peakReqPct = event.peak_request_pct ?? 0;
-      if (peakReqPct >= COMPACTION_THRESHOLD) {
+      if (peakReqPct >= COMPACTION_THRESHOLD && spawnConvId) {
         const compactionIter = runCompactionTurn(accountDir, accountId, systemPrompt, currentAgentSessionId, adminModel, spawnConvId, enabledPlugins);
         let step = await compactionIter.next();
         while (!step.done) {
@@ -9619,9 +9381,9 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
       } else {
         gotDone = true;
         if (!sessionWasReset) {
+          const assistantTimestamp = (/* @__PURE__ */ new Date()).toISOString();
           const convId = sessionKey ? sessionStore.get(sessionKey)?.conversationId : void 0;
           if (convId) {
-            const assistantTimestamp = (/* @__PURE__ */ new Date()).toISOString();
             persistMessage(convId, "user", fullMessage, accountId, void 0, userTimestamp).catch(() => {
             });
             autoLabelSession(convId, fullMessage).catch(() => {
@@ -9629,7 +9391,14 @@ async function* invokeAdminAgent(message, systemPrompt, accountDir, accountId, a
             if (responseText) persistMessage(convId, "assistant", responseText, accountId, capturedTokens, assistantTimestamp).catch(() => {
             });
           } else if (sessionKey) {
-            console.warn(`[persist] skipped: no conversationId for sessionKey=${sessionKey.slice(0, 12)}\u2026 (session registered=${sessionStore.has(sessionKey)})`);
+            bufferPendingTurn(sessionKey, { role: "user", content: fullMessage, timestamp: userTimestamp });
+            if (responseText) bufferPendingTurn(sessionKey, { role: "assistant", content: responseText, timestamp: assistantTimestamp, tokens: capturedTokens });
+            const flushedId = await maybeFlushConversationBuffer(sessionKey, "admin", accountId);
+            if (flushedId) {
+              autoLabelSession(flushedId, fullMessage).catch(() => {
+              });
+              yield { type: "conversation_attributed", conversationId: flushedId };
+            }
           }
           if (sessionKey) {
             const commitSession = sessionStore.get(sessionKey);
@@ -9692,9 +9461,10 @@ ${summary}`;
 async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accountId, adminModel, sessionKey, maxTurns = 20, attachments = [], retryCount = 0, enabledPlugins, clientTimestamp, adherenceConstraints, agentName) {
   const userTimestamp = clientTimestamp ?? (/* @__PURE__ */ new Date()).toISOString();
   const managedConvId = getConversationIdForSession(sessionKey);
-  if (!managedConvId) {
-    throw new Error(`invokeManagedAdminAgent: conversationId missing for sessionKey=${sessionKey.slice(0, 8)} \u2014 ensureConversation must run first`);
+  if (!managedConvId && getPendingTurnCount(sessionKey) >= 2) {
+    throw new Error(`invokeManagedAdminAgent: conversationId missing post-flush for sessionKey=${sessionKey.slice(0, 8)} \u2014 maybeFlushConversationBuffer must bind it first`);
   }
+  const managedLogKey = managedConvId ?? preflushStreamLogKey(sessionKey);
   const pendingTrimmed = consumePendingTrimmedMessages(sessionKey);
   if (pendingTrimmed && pendingTrimmed.length > 0) {
     const ok = await compactTrimmedMessages(accountId, pendingTrimmed);
@@ -9702,7 +9472,7 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
       storePendingTrimmedMessages(sessionKey, pendingTrimmed);
     }
   }
-  const streamLog = agentLogStream("claude-agent-stream", accountDir, managedConvId);
+  const streamLog = agentLogStream("claude-agent-stream", accountDir, managedLogKey);
   streamLog.on("error", () => {
   });
   const systemPromptTokens = estimateTokens(systemPrompt);
@@ -9733,8 +9503,8 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
   if (!cdpOk) streamLog.write(`[${isoTs()}] [warn] ensureCdp failed \u2014 browser-specialist degraded
 `);
   const managedUserId = getUserIdForSession(sessionKey);
-  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedConvId, managedUserId, enabledPlugins) });
-  const specialistsDir = resolve6(accountDir, "specialists");
+  const mcpConfig = JSON.stringify({ mcpServers: getMcpServers(accountId, managedLogKey, managedUserId, enabledPlugins) });
+  const specialistsDir = resolve5(accountDir, "specialists");
   if (!existsSync5(specialistsDir)) streamLog.write(`[${isoTs()}] [warn] specialists plugin dir missing: ${specialistsDir}
 `);
   const fullMessage = attachments.length > 0 ? message + buildAttachmentMetaText(attachments) : message;
@@ -9764,16 +9534,16 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
     cwd: accountDir,
     stdio: ["ignore", "pipe", "pipe"],
     // Task 556: STREAM_LOG_PATH inherited by Bash-tool subprocesses.
-    env: buildSpawnEnv(accountId, accountDir, managedConvId)
+    env: buildSpawnEnv(accountId, accountDir, managedLogKey)
   });
-  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, managedConvId);
+  const stderrLog = agentLogStream("claude-agent-stderr", accountDir, managedLogKey);
   stderrLog.on("error", () => {
   });
   proc.stderr?.pipe(stderrLog);
   teeProcStderrToStreamLog(proc, streamLog);
   streamLog.write(`[${isoTs()}] [subproc-debug-unavailable] reason=bundled-bun-binary-ignores-node-debug pid=${proc.pid} cli=claude
 `);
-  streamLog.write(`[${isoTs()}] [spawn-env] STREAM_LOG_PATH=set pid=${proc.pid} conversationId=${managedConvId} site=managed
+  streamLog.write(`[${isoTs()}] [spawn-env] STREAM_LOG_PATH=set pid=${proc.pid} conversationId=${managedConvId ?? "preflush"} logKey=${managedLogKey} site=managed
 `);
   if (sessionKey) {
     const prev = activeProcesses.get(sessionKey);
@@ -9783,13 +9553,13 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
     }
     activeProcesses.set(sessionKey, { pid: proc.pid, spawnedAt: Date.now() });
   }
-  streamLog.write(`[${isoTs()}] [managed-spawn] pid=${proc.pid} sessionKey=${sessionKey} conversationId=${managedConvId} historyMessages=${history.length} pluginDir=${specialistsDir}
+  streamLog.write(`[${isoTs()}] [managed-spawn] pid=${proc.pid} sessionKey=${sessionKey} conversationId=${managedConvId ?? "preflush"} logKey=${managedLogKey} historyMessages=${history.length} pluginDir=${specialistsDir}
 `);
   streamLog.write(`[${isoTs()}] [stdin] len=${fullMessage.length} preview=${JSON.stringify(fullMessage.slice(0, 80))}
 `);
   proc.on("exit", (code, signal) => {
-    console.log(`[process-exit] pid=${proc.pid} code=${code} signal=${signal} sessionKey=${sessionKey ?? "none"} conversationId=${managedConvId}`);
-    if (!streamLog.destroyed && !streamLog.writableEnded) streamLog.write(`[${isoTs()}] [process-exit] pid=${proc.pid} code=${code} signal=${signal} conversationId=${managedConvId}
+    console.log(`[process-exit] pid=${proc.pid} code=${code} signal=${signal} sessionKey=${sessionKey ?? "none"} conversationId=${managedConvId ?? "preflush"}`);
+    if (!streamLog.destroyed && !streamLog.writableEnded) streamLog.write(`[${isoTs()}] [process-exit] pid=${proc.pid} code=${code} signal=${signal} conversationId=${managedConvId ?? "preflush"}
 `);
     if (sessionKey) activeProcesses.delete(sessionKey);
   });
@@ -9939,17 +9709,24 @@ async function* invokeManagedAdminAgent(message, systemPrompt, accountDir, accou
 `);
           const successSession = sessionStore.get(sessionKey);
           if (successSession) successSession.lastPeakContextPct = peakContextPct;
+          const assistantTimestamp = (/* @__PURE__ */ new Date()).toISOString();
           const convId = sessionStore.get(sessionKey)?.conversationId;
           if (convId) {
-            const assistantTimestamp = (/* @__PURE__ */ new Date()).toISOString();
             persistMessage(convId, "user", fullMessage, accountId, void 0, userTimestamp).catch(() => {
             });
             autoLabelSession(convId, fullMessage).catch(() => {
             });
             if (responseText) persistMessage(convId, "assistant", responseText, accountId, capturedTokens, assistantTimestamp).catch(() => {
             });
-          } else if (sessionKey) {
-            console.warn(`[persist] skipped: no conversationId for sessionKey=${sessionKey.slice(0, 12)}\u2026 (session registered=${sessionStore.has(sessionKey)})`);
+          } else {
+            bufferPendingTurn(sessionKey, { role: "user", content: fullMessage, timestamp: userTimestamp });
+            if (responseText) bufferPendingTurn(sessionKey, { role: "assistant", content: responseText, timestamp: assistantTimestamp, tokens: capturedTokens });
+            const flushedId = await maybeFlushConversationBuffer(sessionKey, "admin", accountId);
+            if (flushedId) {
+              autoLabelSession(flushedId, fullMessage).catch(() => {
+              });
+              yield { type: "conversation_attributed", conversationId: flushedId };
+            }
           }
           const commitSession = sessionStore.get(sessionKey);
           if (commitSession?.pendingCommitmentOffers && commitSession.pendingCommitmentOffers.length > 0) {
@@ -10021,10 +9798,14 @@ async function* invokePublicAgent(message, systemPrompt, accountId, accountDir,
     return;
   }
   const publicConvId = sessionKey ? getConversationIdForSession(sessionKey) : void 0;
-  if (!publicConvId) {
-    throw new Error(`invokePublicAgent: conversationId missing for sessionKey=${sessionKey?.slice(0, 8) ?? "none"} \u2014 ensureConversation must run first`);
+  if (!publicConvId && sessionKey && getPendingTurnCount(sessionKey) >= 2) {
+    throw new Error(`invokePublicAgent: conversationId missing post-flush for sessionKey=${sessionKey.slice(0, 8)} \u2014 maybeFlushConversationBuffer must bind it first`);
   }
-  const streamLog = agentLogStream("public-agent-stream", accountDir, publicConvId);
+  const publicLogKey = publicConvId ?? (sessionKey ? preflushStreamLogKey(sessionKey) : void 0);
+  if (!publicLogKey) {
+    throw new Error(`invokePublicAgent: sessionKey required \u2014 cannot resolve log stream without one`);
+  }
+  const streamLog = agentLogStream("public-agent-stream", accountDir, publicLogKey);
   streamLog.write(`[${isoTs()}] [public-user-message] ${JSON.stringify(message)}
 `);
   if (sessionKey) {
@@ -10261,10 +10042,10 @@ User messages are prefixed with the sender's name in brackets. Address participa
 `);
     }
     const conversationId = sessionKey ? sessionStore.get(sessionKey)?.conversationId : void 0;
+    const assistantTimestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const sess = sessionKey ? sessionStore.get(sessionKey) : void 0;
+    const sender = sess?.groupSlug && sess.visitorId && sess.senderDisplayName ? { visitorId: sess.visitorId, displayName: sess.senderDisplayName } : void 0;
     if (conversationId) {
-      const assistantTimestamp = (/* @__PURE__ */ new Date()).toISOString();
-      const sess = sessionKey ? sessionStore.get(sessionKey) : void 0;
-      const sender = sess?.groupSlug && sess.visitorId && sess.senderDisplayName ? { visitorId: sess.visitorId, displayName: sess.senderDisplayName } : void 0;
       persistMessage(conversationId, "user", message, accountId, void 0, userTimestamp, sender).catch(() => {
       });
       autoLabelSession(conversationId, message).catch(() => {
@@ -10272,7 +10053,14 @@ User messages are prefixed with the sender's name in brackets. Address participa
       if (fullText) persistMessage(conversationId, "assistant", fullText, accountId, void 0, assistantTimestamp).catch(() => {
       });
     } else if (sessionKey) {
-      console.warn(`[persist] skipped: no conversationId for sessionKey=${sessionKey.slice(0, 12)}\u2026 (session registered=${sessionStore.has(sessionKey)})`);
+      bufferPendingTurn(sessionKey, { role: "user", content: message, timestamp: userTimestamp, sender });
+      if (fullText) bufferPendingTurn(sessionKey, { role: "assistant", content: fullText, timestamp: assistantTimestamp });
+      const flushedId = await maybeFlushConversationBuffer(sessionKey, "public", accountId);
+      if (flushedId) {
+        autoLabelSession(flushedId, message).catch(() => {
+        });
+        yield { type: "conversation_attributed", conversationId: flushedId };
+      }
     }
     streamLog.end();
   }
@@ -10428,7 +10216,7 @@ ${sessionContext}`;
       console.log(`[onboarding-inject] accountId=${accountId.slice(0, 8)}\u2026 error=neo4j-unreachable injected=false`);
     } else if (onboardingStep < 8) {
       const GENERIC_FALLBACK = "At every session start, call `onboarding-get`. If `currentStep` is less than 8, load the onboarding skill via `plugin-read` (find its path in the manifest under `admin`) and follow it \u2014 before any business setup. If `onboarding-get` fails (Neo4j unreachable), tell the user and skip onboarding for this session \u2014 it resumes automatically when the graph is available.";
-      const skillPath = resolve6(PLATFORM_ROOT3, "plugins/admin/skills/onboarding/SKILL.md");
+      const skillPath = resolve5(PLATFORM_ROOT3, "plugins/admin/skills/onboarding/SKILL.md");
       let skillContent = "";
       try {
         skillContent = readFileSync6(skillPath, "utf-8");
@@ -10481,7 +10269,7 @@ ${body}`;
 
 ${manifest}`;
     }
-    const graphRefPath = resolve6(PLATFORM_ROOT3, "plugins/memory/references/graph-primitives.md");
+    const graphRefPath = resolve5(PLATFORM_ROOT3, "plugins/memory/references/graph-primitives.md");
     try {
       const graphRef = readFileSync6(graphRefPath, "utf-8");
       baseSystemPrompt += `
@@ -10569,7 +10357,7 @@ Current session key: ${sessionKey}` : systemPromptBase;
 
 ${gwParts.join("\n")}`;
   }
-  if (sessionKey) {
+  if (sessionKey && isDmChannelSessionKey(sessionKey)) {
     try {
       await ensureConversation(accountId, agentType, sessionKey, void 0, void 0, sessionUserId);
     } catch (err) {
@@ -10699,7 +10487,7 @@ var clientIpMiddleware = async (c, next) => {
 
 // server/routes/health.ts
 import { existsSync as existsSync10, readFileSync as readFileSync11 } from "fs";
-import { createConnection as createConnection3 } from "net";
+import { createConnection as createConnection2 } from "net";
 
 // app/lib/network.ts
 import { networkInterfaces } from "os";
@@ -10723,8 +10511,8 @@ function getLanIp() {
 import { basename as basename2 } from "path";
 
 // app/lib/review-detector/rules.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync6, statSync as statSync4, mkdirSync as mkdirSync6, renameSync as renameSync2 } from "fs";
-import { resolve as resolve7, dirname as dirname3 } from "path";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync6, existsSync as existsSync6, statSync as statSync4, mkdirSync as mkdirSync5, renameSync as renameSync2 } from "fs";
+import { resolve as resolve6, dirname as dirname3 } from "path";
 var DEFAULT_SCAN_INTERVAL_MS = 5e3;
 var RATE_LIMIT_PATTERN = "rate[- ]?limit(?:ed| reached| hit)|(?:HTTP|status)[^a-z]{0,3}429|too many requests";
 var RATE_LIMIT_PATTERN_V1 = "\\b429\\b|rate.?limit|too.?many.?requests";
@@ -11153,12 +10941,12 @@ function defaultRules() {
   ];
 }
 function rulesFilePath(configDir2) {
-  return resolve7(configDir2, "review-rules.json");
+  return resolve6(configDir2, "review-rules.json");
 }
 function ensureRulesFile(configDir2) {
   const path2 = rulesFilePath(configDir2);
   if (existsSync6(path2)) return { created: false, path: path2 };
-  mkdirSync6(dirname3(path2), { recursive: true });
+  mkdirSync5(dirname3(path2), { recursive: true });
   const body = {
     scanIntervalMs: DEFAULT_SCAN_INTERVAL_MS,
     rules: defaultRules()
@@ -11336,10 +11124,10 @@ function validateRule(input, label, seenIds) {
 }
 
 // app/lib/review-detector/sources.ts
-import { existsSync as existsSync7, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync3, mkdirSync as mkdirSync7, openSync as openSync3, readSync as readSync3, closeSync as closeSync3, readFileSync as readFileSync8 } from "fs";
-import { resolve as resolve8, join as join4, basename, dirname as dirname4 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, statSync as statSync5, writeFileSync as writeFileSync7, renameSync as renameSync3, mkdirSync as mkdirSync6, openSync as openSync3, readSync as readSync3, closeSync as closeSync3, readFileSync as readFileSync8 } from "fs";
+import { resolve as resolve7, join as join4, basename, dirname as dirname4 } from "path";
 function tailStatePath(configDir2) {
-  return resolve8(configDir2, "review-state.json");
+  return resolve7(configDir2, "review-state.json");
 }
 function loadTailState(configDir2) {
   const path2 = tailStatePath(configDir2);
@@ -11363,25 +11151,25 @@ function loadTailState(configDir2) {
 }
 function saveTailState(configDir2, state) {
   const path2 = tailStatePath(configDir2);
-  mkdirSync7(dirname4(path2), { recursive: true });
+  mkdirSync6(dirname4(path2), { recursive: true });
   const tmp = `${path2}.tmp.${process.pid}.${Date.now()}`;
   writeFileSync7(tmp, JSON.stringify(state, null, 2) + "\n", "utf-8");
   renameSync3(tmp, path2);
 }
 function discoverSourceFiles(configDir2, accountLogDir2, logicalSource) {
   if (logicalSource === "server") {
-    const p = resolve8(configDir2, "logs", "server.log");
+    const p = resolve7(configDir2, "logs", "server.log");
     return existsSync7(p) ? [{ logicalSource: "server", filepath: p }] : [];
   }
   if (logicalSource === "vnc") {
-    const p = resolve8(configDir2, "logs", "vnc-boot.log");
+    const p = resolve7(configDir2, "logs", "vnc-boot.log");
     return existsSync7(p) ? [{ logicalSource: "vnc", filepath: p }] : [];
   }
   if (logicalSource === "cloudflared") {
     const files2 = [];
-    const daemon = resolve8(configDir2, "logs", "cloudflared.log");
+    const daemon = resolve7(configDir2, "logs", "cloudflared.log");
     if (existsSync7(daemon)) files2.push({ logicalSource: "cloudflared", filepath: daemon });
-    const login = resolve8(configDir2, "logs", "cloudflared-login.log");
+    const login = resolve7(configDir2, "logs", "cloudflared-login.log");
     if (existsSync7(login)) files2.push({ logicalSource: "cloudflared", filepath: login });
     return files2;
   }
@@ -11508,31 +11296,31 @@ function fileLastWriteMs(path2) {
   }
 }
 function accountLogDir(accountDir) {
-  return resolve8(accountDir, "logs");
+  return resolve7(accountDir, "logs");
 }
 function sourceKey(file) {
   return `${file.logicalSource}:${basename(file.filepath)}`;
 }
 
 // app/lib/review-detector/writer.ts
-import { appendFileSync as appendFileSync3, existsSync as existsSync8, mkdirSync as mkdirSync8, readFileSync as readFileSync9, writeFileSync as writeFileSync8, renameSync as renameSync4, statSync as statSync6 } from "fs";
-import { resolve as resolve9, dirname as dirname5 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync9, writeFileSync as writeFileSync8, renameSync as renameSync4, statSync as statSync6 } from "fs";
+import { resolve as resolve8, dirname as dirname5 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function reviewLogPath(configDir2) {
-  return resolve9(configDir2, "logs", "review.log");
+  return resolve8(configDir2, "logs", "review.log");
 }
 function pendingAlertsPath(configDir2) {
-  return resolve9(configDir2, "review-pending-alerts.jsonl");
+  return resolve8(configDir2, "review-pending-alerts.jsonl");
 }
 function reviewLog(configDir2, event) {
   const path2 = reviewLogPath(configDir2);
   try {
-    mkdirSync8(dirname5(path2), { recursive: true });
+    mkdirSync7(dirname5(path2), { recursive: true });
     const line = `${new Date(
       typeof event.ts === "number" ? event.ts : Date.now()
     ).toISOString()} [review] ${JSON.stringify(event)}
 `;
-    appendFileSync3(path2, line, "utf-8");
+    appendFileSync2(path2, line, "utf-8");
   } catch (err) {
     console.error(`[review] failed to write review log at ${path2}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -11644,9 +11432,9 @@ async function upsertReviewAlert(accountId, match2) {
 function queueAlert(configDir2, accountId, match2) {
   const path2 = pendingAlertsPath(configDir2);
   try {
-    mkdirSync8(dirname5(path2), { recursive: true });
+    mkdirSync7(dirname5(path2), { recursive: true });
     const line = JSON.stringify({ accountId, match: match2 }) + "\n";
-    appendFileSync3(path2, line, "utf-8");
+    appendFileSync2(path2, line, "utf-8");
   } catch (err) {
     console.error(`[review] failed to queue alert at ${path2}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -11777,7 +11565,7 @@ async function bootDetector() {
 }
 
 // app/lib/review-detector/scan-loop.ts
-import { resolve as resolve10 } from "path";
+import { resolve as resolve9 } from "path";
 
 // app/lib/review-detector/evaluator.ts
 var SAMPLE_MAX_CHARS = 500;
@@ -12071,14 +11859,14 @@ async function runScanCycle(runtime) {
           match2 = result.match;
         }
       } else if (rule.type === "file-write-storm") {
-        const dir = resolve10(runtime.configDir, rule.watchPath ?? "");
+        const dir = resolve9(runtime.configDir, rule.watchPath ?? "");
         const sinceMs = cycleStart - rule.thresholdWindowMinutes * 6e4;
         const count = countRecentWrites(dir, sinceMs);
         const result = evaluateFileWriteStormRule(rule, count, state, cycleStart);
         state = result.state;
         match2 = result.match;
       } else if (rule.type === "stale-log") {
-        const trackedPath = resolve10(runtime.configDir, rule.watchPath ?? "");
+        const trackedPath = resolve9(runtime.configDir, rule.watchPath ?? "");
         const lastMs = fileLastWriteMs(trackedPath);
         const result = evaluateStaleLogRule(rule, lastMs, state, cycleStart);
         state = result.state;
@@ -12318,10 +12106,10 @@ var WhatsAppConfigSchema = z.object({
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync10, writeFileSync as writeFileSync9, existsSync as existsSync9 } from "fs";
-import { resolve as resolve11, join as join5 } from "path";
+import { resolve as resolve10, join as join5 } from "path";
 var TAG3 = "[whatsapp:config]";
 function configPath(accountDir) {
-  return resolve11(accountDir, "account.json");
+  return resolve10(accountDir, "account.json");
 }
 function readConfig(accountDir) {
   const path2 = configPath(accountDir);
@@ -12776,7 +12564,7 @@ var credsSaveQueue = Promise.resolve();
 async function drainCredsSaveQueue(timeoutMs = 5e3) {
   console.error(`${TAG5} draining credential save queue\u2026`);
   const timer = new Promise(
-    (resolve29) => setTimeout(() => resolve29("timeout"), timeoutMs)
+    (resolve28) => setTimeout(() => resolve28("timeout"), timeoutMs)
   );
   const result = await Promise.race([
     credsSaveQueue.then(() => "drained"),
@@ -12904,11 +12692,11 @@ async function createWaSocket(opts) {
   return sock;
 }
 async function waitForConnection(sock) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve28, reject) => {
     const handler = (update) => {
       if (update.connection === "open") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve28();
       }
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
@@ -13022,14 +12810,14 @@ ${inspected}`;
   return inspect2(err, INSPECT_OPTS2);
 }
 function withTimeout(label, promise, timeoutMs) {
-  return new Promise((resolve29, reject) => {
+  return new Promise((resolve28, reject) => {
     const timer = setTimeout(() => {
       reject(new Error(`${label} timed out after ${timeoutMs}ms`));
     }, timeoutMs);
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve29(value);
+        resolve28(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -13971,6 +13759,14 @@ function deriveSessionKey(input) {
   if (input.isOwnerMirror || input.agentType === "admin") {
     return `whatsapp:${input.accountId}`;
   }
+  if (input.isGroup) {
+    if (!input.groupJid) {
+      throw new Error(
+        `deriveSessionKey: isGroup=true requires groupJid (accountId=${input.accountId}, senderPhone=${input.senderPhone})`
+      );
+    }
+    return `whatsapp:${input.accountId}:group:${input.groupJid}`;
+  }
   return `whatsapp:${input.accountId}:${input.senderPhone}`;
 }
 async function init(opts) {
@@ -14235,11 +14031,11 @@ async function connectWithReconnect(conn) {
       console.error(
         `${TAG13} reconnecting account=${conn.accountId} in ${delay}ms (attempt ${decision.nextAttempts}/${maxAttempts})`
       );
-      await new Promise((resolve29) => {
-        const timer = setTimeout(resolve29, delay);
+      await new Promise((resolve28) => {
+        const timer = setTimeout(resolve28, delay);
         conn.abortController.signal.addEventListener("abort", () => {
           clearTimeout(timer);
-          resolve29();
+          resolve28();
         }, { once: true });
       });
     }
@@ -14247,16 +14043,16 @@ async function connectWithReconnect(conn) {
   }
 }
 function waitForDisconnectEvent(conn) {
-  return new Promise((resolve29) => {
+  return new Promise((resolve28) => {
     if (!conn.sock) {
-      resolve29();
+      resolve28();
       return;
     }
     const sock = conn.sock;
     const handler = (update) => {
       if (update.connection === "close") {
         sock.ev.off("connection.update", handler);
-        resolve29();
+        resolve28();
       }
     };
     sock.ev.on("connection.update", handler);
@@ -14442,6 +14238,8 @@ async function handleInboundMessage(conn, msg) {
         agentType: "admin",
         accountId: conn.accountId,
         senderPhone: senderPhone2,
+        isGroup: isGroup2,
+        groupJid: isGroup2 ? remoteJid : void 0,
         isOwnerMirror: true
       }),
       isOwnerMirror: true
@@ -14471,8 +14269,8 @@ async function handleInboundMessage(conn, msg) {
     const conversationKey = isGroup ? remoteJid : senderPhone;
     const debounceKey = `${conn.accountId}:${conversationKey}:${senderPhone}`;
     let resolvePending;
-    const sttPending = new Promise((resolve29) => {
-      resolvePending = resolve29;
+    const sttPending = new Promise((resolve28) => {
+      resolvePending = resolve28;
     });
     if (conn.debouncer) conn.debouncer.registerPending(debounceKey, sttPending);
     try {
@@ -14525,7 +14323,9 @@ async function handleInboundMessage(conn, msg) {
   const sessionKey = deriveSessionKey({
     agentType: accessResult.agentType,
     accountId: conn.accountId,
-    senderPhone
+    senderPhone,
+    isGroup,
+    groupJid: isGroup ? remoteJid : void 0
   });
   conn.lastMessageAt = Date.now();
   const payload = {
@@ -14583,37 +14383,23 @@ async function probeApiKey() {
   return result.status;
 }
 function checkPort(port2, timeoutMs = 500) {
-  return new Promise((resolve29) => {
-    const socket = createConnection3(port2, "127.0.0.1");
+  return new Promise((resolve28) => {
+    const socket = createConnection2(port2, "127.0.0.1");
     socket.setTimeout(timeoutMs);
     socket.once("connect", () => {
       socket.destroy();
-      resolve29(true);
+      resolve28(true);
     });
     socket.once("error", () => {
       socket.destroy();
-      resolve29(false);
+      resolve28(false);
     });
     socket.once("timeout", () => {
       socket.destroy();
-      resolve29(false);
+      resolve28(false);
     });
   });
 }
-var TTYD_PROBE_CACHE_MS = 2e3;
-var TTYD_PROBE_TIMEOUT_MS = 200;
-var cachedTtydReady = null;
-async function probeTerminalReady() {
-  if (cachedTtydReady && Date.now() - cachedTtydReady.checkedAt < TTYD_PROBE_CACHE_MS) {
-    return cachedTtydReady.ok;
-  }
-  const ok = await checkPort(7681, TTYD_PROBE_TIMEOUT_MS);
-  if (!cachedTtydReady || cachedTtydReady.ok !== ok) {
-    console.log(`[health] terminal_ready: ${cachedTtydReady?.ok ?? "unknown"} \u2192 ${ok}`);
-  }
-  cachedTtydReady = { ok, checkedAt: Date.now() };
-  return ok;
-}
 var app = new Hono2();
 app.get("/", async (c) => {
   const browserTransport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
@@ -14637,7 +14423,6 @@ app.get("/", async (c) => {
   }
   const claudeAuthenticated = authHealth.status === "ok" || authHealth.status === "expiring";
   const vncRunning = await checkPort(6080);
-  const terminalReady = await probeTerminalReady();
   let apiKeyConfigured = false;
   try {
     apiKeyConfigured = existsSync10(keyFilePath());
@@ -14681,7 +14466,6 @@ app.get("/", async (c) => {
     claude_authenticated: claudeAuthenticated,
     ...onboardingComplete !== void 0 && { onboarding_complete: onboardingComplete },
     vnc_running: vncRunning,
-    terminal_ready: terminalReady,
     browser_transport: browserTransport,
     auth_status: authHealth.status,
     auth_expires_at: authHealth.expiresAt ?? null,
@@ -14709,14 +14493,14 @@ app.get("/", async (c) => {
 var health_default = app;
 
 // server/routes/session.ts
-import { resolve as resolve12 } from "path";
-import { existsSync as existsSync11, writeFileSync as writeFileSync10, mkdirSync as mkdirSync9 } from "fs";
+import { resolve as resolve11 } from "path";
+import { existsSync as existsSync11, writeFileSync as writeFileSync10, mkdirSync as mkdirSync8 } from "fs";
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function writeBrandingCache(accountId, agentSlug, branding) {
   try {
-    const cacheDir = resolve12(MAXY_DIR, "branding-cache", accountId);
-    mkdirSync9(cacheDir, { recursive: true });
-    writeFileSync10(resolve12(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
+    const cacheDir = resolve11(MAXY_DIR, "branding-cache", accountId);
+    mkdirSync8(cacheDir, { recursive: true });
+    writeFileSync10(resolve11(cacheDir, `${agentSlug}.json`), JSON.stringify(branding), "utf-8");
   } catch (err) {
     console.error(`[branding] cache write failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -14786,8 +14570,8 @@ app2.post("/", async (c) => {
   }
   let agentConfig = null;
   if (account) {
-    const agentDir = resolve12(account.accountDir, "agents", agentSlug);
-    const agentConfigPath = resolve12(agentDir, "config.json");
+    const agentDir = resolve11(account.accountDir, "agents", agentSlug);
+    const agentConfigPath = resolve11(agentDir, "config.json");
     if (!existsSync11(agentDir) || !existsSync11(agentConfigPath)) {
       return c.json({ error: "Agent not found" }, 404);
     }
@@ -14978,8 +14762,6 @@ app2.post("/", async (c) => {
   const newVisitorId = visitorId ?? crypto.randomUUID();
   const sessionKey = crypto.randomUUID();
   registerSession(sessionKey, "public", accountId, agentSlug);
-  ensureConversation(accountId, "public", sessionKey, newVisitorId, agentSlug).catch(() => {
-  });
   const hasImage = agentConfig?.image ? "yes" : "no";
   console.log(`[session] new-session visitor=${newVisitorId.slice(0, 8)}\u2026 session=${sessionKey.slice(0, 8)}\u2026 agent=${agentSlug} image=${hasImage} showAgentName=${agentConfig?.showAgentName ?? false}`);
   return withVisitorCookie(
@@ -15034,9 +14816,9 @@ ${raw2}`;
 import { randomUUID as randomUUID6 } from "crypto";
 import { mkdir as mkdir2, readFile, stat as stat2, writeFile as writeFile2 } from "fs/promises";
 import { realpathSync } from "fs";
-import { resolve as resolve13, extname, basename as basename3 } from "path";
-var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "../platform");
-var ATTACHMENTS_ROOT = resolve13(PLATFORM_ROOT4, "..", "data/uploads");
+import { resolve as resolve12, extname, basename as basename3 } from "path";
+var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT ?? resolve12(process.cwd(), "../platform");
+var ATTACHMENTS_ROOT = resolve12(PLATFORM_ROOT4, "..", "data/uploads");
 var SUPPORTED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/jpeg",
   "image/png",
@@ -15060,11 +14842,11 @@ function assertSupportedMime(mimeType) {
 }
 async function writeAttachment(scope, filename, mimeType, sizeBytes, buffer) {
   const attachmentId = randomUUID6();
-  const dir = resolve13(ATTACHMENTS_ROOT, scope, attachmentId);
+  const dir = resolve12(ATTACHMENTS_ROOT, scope, attachmentId);
   await mkdir2(dir, { recursive: true });
   const ext = extname(filename) || "";
-  const storagePath = resolve13(dir, `${attachmentId}${ext}`);
-  const metaPath = resolve13(dir, `${attachmentId}.meta.json`);
+  const storagePath = resolve12(dir, `${attachmentId}${ext}`);
+  const metaPath = resolve12(dir, `${attachmentId}.meta.json`);
   const meta = {
     attachmentId,
     scope,
@@ -15742,13 +15524,13 @@ var group_default = app4;
 // app/lib/access-gate.ts
 import neo4j2 from "neo4j-driver";
 import { readFileSync as readFileSync12 } from "fs";
-import { resolve as resolve14 } from "path";
+import { resolve as resolve13 } from "path";
 import { randomUUID as randomUUID7, randomInt } from "crypto";
-var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve14(process.cwd(), "..");
+var PLATFORM_ROOT5 = process.env.MAXY_PLATFORM_ROOT ?? resolve13(process.cwd(), "..");
 var driver2 = null;
 function readPassword2() {
   if (process.env.NEO4J_PASSWORD) return process.env.NEO4J_PASSWORD;
-  const passwordFile = resolve14(PLATFORM_ROOT5, "config/.neo4j-password");
+  const passwordFile = resolve13(PLATFORM_ROOT5, "config/.neo4j-password");
   try {
     return readFileSync12(passwordFile, "utf-8").trim();
   } catch {
@@ -16061,17 +15843,17 @@ async function findActiveGrantByContact(contactValue, agentSlug, accountId) {
 }
 
 // app/lib/brevo-sms.ts
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync11, mkdirSync as mkdirSync10, existsSync as existsSync12, chmodSync } from "fs";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, existsSync as existsSync12, chmodSync } from "fs";
 import { dirname as dirname6 } from "path";
-import { resolve as resolve15 } from "path";
-var BREVO_API_KEY_FILE = resolve15(MAXY_DIR, ".brevo-api-key");
+import { resolve as resolve14 } from "path";
+var BREVO_API_KEY_FILE = resolve14(MAXY_DIR, ".brevo-api-key");
 var BREVO_API_URL = "https://api.brevo.com/v3/transactionalSMS/sms";
 var BREVO_TIMEOUT_MS = 1e4;
 var BREVO_SENDER = "Maxy";
 var platformRoot = process.env.MAXY_PLATFORM_ROOT;
 if (platformRoot) {
   try {
-    const brandPath = resolve15(platformRoot, "config", "brand.json");
+    const brandPath = resolve14(platformRoot, "config", "brand.json");
     if (existsSync12(brandPath)) {
       const brand = JSON.parse(readFileSync13(brandPath, "utf-8"));
       if (brand.productName) BREVO_SENDER = brand.productName;
@@ -16708,7 +16490,7 @@ app6.post("/webhook", async (c) => {
 var telegram_default = app6;
 
 // server/routes/whatsapp.ts
-import { join as join8, resolve as resolve16, basename as basename4 } from "path";
+import { join as join8, resolve as resolve15, basename as basename4 } from "path";
 import { readFile as readFile2, stat as stat3 } from "fs/promises";
 import { realpathSync as realpathSync2, readdirSync as readdirSync4, readFileSync as readFileSync15, existsSync as existsSync14 } from "fs";
 
@@ -16816,8 +16598,8 @@ async function startLogin(opts) {
   resetActiveLogin(accountId);
   let resolveQr = null;
   let rejectQr = null;
-  const qrPromise = new Promise((resolve29, reject) => {
-    resolveQr = resolve29;
+  const qrPromise = new Promise((resolve28, reject) => {
+    resolveQr = resolve28;
     rejectQr = reject;
   });
   const qrTimer = setTimeout(
@@ -17188,14 +16970,14 @@ app7.post("/config", async (c) => {
         return c.json({ ok: true, slug: currentSlug });
       }
       case "list-public-agents": {
-        const agentsDir = resolve16(account.accountDir, "agents");
+        const agentsDir = resolve15(account.accountDir, "agents");
         const agents = [];
         if (existsSync14(agentsDir)) {
           try {
             const entries = readdirSync4(agentsDir, { withFileTypes: true });
             for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
               if (!entry.isDirectory() || entry.name === "admin") continue;
-              const configPath2 = resolve16(agentsDir, entry.name, "config.json");
+              const configPath2 = resolve15(agentsDir, entry.name, "config.json");
               if (!existsSync14(configPath2)) continue;
               try {
                 const config = JSON.parse(readFileSync15(configPath2, "utf-8"));
@@ -17273,7 +17055,7 @@ app7.post("/send-document", async (c) => {
     if (!maxyAccountId || !PLATFORM_ROOT6) {
       return c.json({ error: "Cannot validate file path: missing account or platform context" }, 400);
     }
-    const accountDir = resolve16(PLATFORM_ROOT6, "..", "data/accounts", maxyAccountId);
+    const accountDir = resolve15(PLATFORM_ROOT6, "..", "data/accounts", maxyAccountId);
     let resolvedPath;
     try {
       resolvedPath = realpathSync2(filePath);
@@ -17410,8 +17192,8 @@ var whatsapp_default = app7;
 
 // server/routes/onboarding.ts
 import { spawn as spawn3, execFileSync as execFileSync2 } from "child_process";
-import { openSync as openSync4, closeSync as closeSync4, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync15, mkdirSync as mkdirSync11, readFileSync as readFileSync16, unlinkSync as unlinkSync4 } from "fs";
-import { resolve as resolve17, dirname as dirname7 } from "path";
+import { openSync as openSync4, closeSync as closeSync4, writeFileSync as writeFileSync12, writeSync, existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync16, unlinkSync as unlinkSync4 } from "fs";
+import { resolve as resolve16, dirname as dirname7 } from "path";
 import { createHash, randomUUID as randomUUID9 } from "crypto";
 var PLATFORM_ROOT7 = process.env.MAXY_PLATFORM_ROOT || "";
 function hashPin(pin) {
@@ -17524,7 +17306,7 @@ app8.post("/set-pin", async (c) => {
   }
   const hash = hashPin(body.pin);
   const userId = randomUUID9();
-  mkdirSync11(dirname7(USERS_FILE), { recursive: true });
+  mkdirSync10(dirname7(USERS_FILE), { recursive: true });
   writeFileSync12(USERS_FILE, JSON.stringify([{ userId, name: "Owner", pin: hash }]), { mode: 384 });
   console.log(`[set-pin] created users.json: userId=${userId.slice(0, 8)}\u2026 hash=${hash.slice(0, 8)}\u2026`);
   const account = resolveAccount();
@@ -17585,7 +17367,7 @@ app8.post("/skip", async (c) => {
   }
   const { accountId, accountDir } = account;
   let agentName = "Maxy";
-  const brandPath = PLATFORM_ROOT7 ? resolve17(PLATFORM_ROOT7, "config", "brand.json") : "";
+  const brandPath = PLATFORM_ROOT7 ? resolve16(PLATFORM_ROOT7, "config", "brand.json") : "";
   if (brandPath && existsSync15(brandPath)) {
     try {
       const brand = JSON.parse(readFileSync16(brandPath, "utf-8"));
@@ -17594,9 +17376,9 @@ app8.post("/skip", async (c) => {
       console.error(`[onboarding-skip] brand.json read failed: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
-  const soulPath = resolve17(accountDir, "agents", "admin", "SOUL.md");
+  const soulPath = resolve16(accountDir, "agents", "admin", "SOUL.md");
   try {
-    mkdirSync11(dirname7(soulPath), { recursive: true });
+    mkdirSync10(dirname7(soulPath), { recursive: true });
     writeFileSync12(soulPath, `You are ${agentName}, an AI operations manager.
 `);
     console.log(`[onboarding-skip] wrote SOUL.md: ${soulPath}`);
@@ -17635,7 +17417,7 @@ app8.post("/skip", async (c) => {
 var onboarding_default = app8;
 
 // server/routes/client-error.ts
-import { appendFileSync as appendFileSync4, existsSync as existsSync16, renameSync as renameSync5, statSync as statSync7 } from "fs";
+import { appendFileSync as appendFileSync3, existsSync as existsSync16, renameSync as renameSync5, statSync as statSync7 } from "fs";
 import { join as join9 } from "path";
 var CLIENT_ERRORS_LOG = join9(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
@@ -17772,7 +17554,7 @@ app9.post("/", async (c) => {
       tag: typeof body.tag === "string" ? truncate2(body.tag, 32) : void 0,
       status: typeof body.status === "number" ? body.status : void 0
     };
-    appendFileSync4(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
+    appendFileSync3(CLIENT_ERRORS_LOG, JSON.stringify(payload) + "\n", "utf-8");
   } catch (err) {
     console.error(`[client-error] append failed: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -17811,11 +17593,7 @@ async function createAdminSession(accountId, thinkingView, userId, userName) {
     businessName = branding?.name || void 0;
   } catch {
   }
-  let conversationId = null;
-  if (userId) {
-    conversationId = await createNewAdminConversation(userId, accountId, sessionKey);
-  }
-  console.log(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} admin session created: userId=${userId ?? "\u2013"} userName=${userName ?? "\u2013"} accountId=${accountId} conversationId=${conversationId?.slice(0, 8) ?? "\u2013"} sessionKey=${sessionKey.slice(0, 8)}`);
+  console.log(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} admin session created: userId=${userId ?? "\u2013"} userName=${userName ?? "\u2013"} accountId=${accountId} conversationId=deferred sessionKey=${sessionKey.slice(0, 8)}`);
   return {
     session_key: sessionKey,
     agent_id: "admin",
@@ -17824,7 +17602,7 @@ async function createAdminSession(accountId, thinkingView, userId, userName) {
     thinkingView: effectiveThinkingView,
     onboardingComplete,
     businessName,
-    conversationId
+    conversationId: null
   };
 }
 var app10 = new Hono2();
@@ -17919,11 +17697,11 @@ app10.post("/", async (c) => {
 var session_default2 = app10;
 
 // server/routes/admin/chat.ts
-import { resolve as resolve18 } from "path";
+import { resolve as resolve17 } from "path";
 
 // app/lib/script-stream-tailer.ts
 import * as childProcess from "child_process";
-import { appendFileSync as appendFileSync5, createReadStream as createReadStream2, mkdirSync as mkdirSync12, statSync as statSync8 } from "fs";
+import { appendFileSync as appendFileSync4, createReadStream as createReadStream2, mkdirSync as mkdirSync11, statSync as statSync8 } from "fs";
 import { dirname as dirname8 } from "path";
 import { StringDecoder as StringDecoder2 } from "string_decoder";
 var SCRIPT_STREAM_RE = /^\[([^\]]+)\] \[script:([a-z][a-z0-9-]*)((?::[a-z0-9:_-]+)?)\] (.*)$/;
@@ -18033,8 +17811,8 @@ function writeRouteMilestone(streamLogPath, scope, line) {
   }
   const ts = (/* @__PURE__ */ new Date()).toISOString();
   try {
-    mkdirSync12(dirname8(streamLogPath), { recursive: true });
-    appendFileSync5(streamLogPath, `[${ts}] [script:${scope}] ${line}
+    mkdirSync11(dirname8(streamLogPath), { recursive: true });
+    appendFileSync4(streamLogPath, `[${ts}] [script:${scope}] ${line}
 `);
   } catch (err) {
     console.error(
@@ -18364,7 +18142,7 @@ app11.post("/", requireAdminSession, async (c) => {
       try {
         registerAdminSSE(sseEntry);
         if (sseConvId) {
-          const streamLogPath = resolve18(account.accountDir, "logs", `claude-agent-stream-${sseConvId}.log`);
+          const streamLogPath = resolve17(account.accountDir, "logs", `claude-agent-stream-${sseConvId}.log`);
           tailer = startScriptStreamTailer({
             path: streamLogPath,
             onEvent: (event) => {
@@ -18490,7 +18268,7 @@ var compact_default = app12;
 
 // server/routes/admin/logs.ts
 import { existsSync as existsSync18, readdirSync as readdirSync5, readFileSync as readFileSync18, statSync as statSync9 } from "fs";
-import { resolve as resolve19, basename as basename5 } from "path";
+import { resolve as resolve18, basename as basename5 } from "path";
 var TAIL_BYTES = 8192;
 var app13 = new Hono2();
 app13.get("/", async (c) => {
@@ -18499,13 +18277,13 @@ app13.get("/", async (c) => {
   const conversationIdParam = c.req.query("conversationId");
   const download = c.req.query("download") === "1";
   const account = resolveAccount();
-  const accountLogDir2 = account ? resolve19(account.accountDir, "logs") : null;
+  const accountLogDir2 = account ? resolve18(account.accountDir, "logs") : null;
   if (fileParam) {
     const safe = basename5(fileParam);
     const searched = [];
     for (const dir of [accountLogDir2, LOG_DIR]) {
       if (!dir) continue;
-      const filePath = resolve19(dir, safe);
+      const filePath = resolve18(dir, safe);
       searched.push(filePath);
       try {
         const content = readFileSync18(filePath, "utf-8");
@@ -18547,7 +18325,7 @@ app13.get("/", async (c) => {
     const searched = [];
     for (const dir of [accountLogDir2, LOG_DIR]) {
       if (!dir) continue;
-      const filePath = resolve19(dir, fileName);
+      const filePath = resolve18(dir, fileName);
       searched.push(filePath);
       try {
         const content = readFileSync18(filePath, "utf-8");
@@ -18574,10 +18352,10 @@ app13.get("/", async (c) => {
       console.warn(`[admin/logs] readdir-fail dir=${dir} reason=${reason}`);
       continue;
     }
-    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve19(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
+    files.filter((f) => !seen.has(f)).map((f) => ({ name: f, mtime: statSync9(resolve18(dir, f)).mtimeMs })).sort((a, b) => b.mtime - a.mtime).forEach(({ name }) => {
       seen.add(name);
       try {
-        const content = readFileSync18(resolve19(dir, name));
+        const content = readFileSync18(resolve18(dir, name));
         const tail = content.length > TAIL_BYTES ? content.subarray(content.length - TAIL_BYTES).toString("utf-8") : content.toString("utf-8");
         logs[name] = tail.trim() || "(empty)";
       } catch (err) {
@@ -18618,7 +18396,7 @@ var claude_info_default = app14;
 // server/routes/admin/attachment.ts
 import { readFile as readFile3, readdir } from "fs/promises";
 import { existsSync as existsSync19 } from "fs";
-import { resolve as resolve20 } from "path";
+import { resolve as resolve19 } from "path";
 var app15 = new Hono2();
 app15.get("/:attachmentId", requireAdminSession, async (c) => {
   const attachmentId = c.req.param("attachmentId");
@@ -18630,11 +18408,11 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(attachmentId)) {
     return new Response("Not found", { status: 404 });
   }
-  const dir = resolve20(ATTACHMENTS_ROOT, accountId, attachmentId);
+  const dir = resolve19(ATTACHMENTS_ROOT, accountId, attachmentId);
   if (!existsSync19(dir)) {
     return new Response("Not found", { status: 404 });
   }
-  const metaPath = resolve20(dir, `${attachmentId}.meta.json`);
+  const metaPath = resolve19(dir, `${attachmentId}.meta.json`);
   if (!existsSync19(metaPath)) {
     return new Response("Not found", { status: 404 });
   }
@@ -18649,7 +18427,7 @@ app15.get("/:attachmentId", requireAdminSession, async (c) => {
   if (!dataFile) {
     return new Response("Not found", { status: 404 });
   }
-  const filePath = resolve20(dir, dataFile);
+  const filePath = resolve19(dir, dataFile);
   const buffer = await readFile3(filePath);
   return new Response(new Uint8Array(buffer), {
     headers: {
@@ -18663,7 +18441,7 @@ var attachment_default = app15;
 
 // server/routes/admin/account.ts
 import { readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "fs";
-import { resolve as resolve21 } from "path";
+import { resolve as resolve20 } from "path";
 var VALID_CONTEXT_MODES = ["managed", "claude-code"];
 var app16 = new Hono2();
 app16.patch("/", requireAdminSession, async (c) => {
@@ -18679,7 +18457,7 @@ app16.patch("/", requireAdminSession, async (c) => {
   }
   const account = resolveAccount();
   if (!account) return c.json({ error: "No account configured" }, 500);
-  const configPath2 = resolve21(account.accountDir, "account.json");
+  const configPath2 = resolve20(account.accountDir, "account.json");
   try {
     const raw2 = readFileSync19(configPath2, "utf-8");
     const config = JSON.parse(raw2);
@@ -18695,13 +18473,13 @@ app16.patch("/", requireAdminSession, async (c) => {
 var account_default = app16;
 
 // server/routes/admin/agents.ts
-import { resolve as resolve22 } from "path";
+import { resolve as resolve21 } from "path";
 import { readdirSync as readdirSync6, readFileSync as readFileSync20, existsSync as existsSync20, rmSync as rmSync3 } from "fs";
 var app17 = new Hono2();
 app17.get("/", (c) => {
   const account = resolveAccount();
   if (!account) return c.json({ agents: [] });
-  const agentsDir = resolve22(account.accountDir, "agents");
+  const agentsDir = resolve21(account.accountDir, "agents");
   if (!existsSync20(agentsDir)) return c.json({ agents: [] });
   const agents = [];
   try {
@@ -18709,7 +18487,7 @@ app17.get("/", (c) => {
     for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
       if (!entry.isDirectory()) continue;
       if (entry.name === "admin") continue;
-      const configPath2 = resolve22(agentsDir, entry.name, "config.json");
+      const configPath2 = resolve21(agentsDir, entry.name, "config.json");
       if (!existsSync20(configPath2)) continue;
       try {
         const config = JSON.parse(readFileSync20(configPath2, "utf-8"));
@@ -18738,7 +18516,7 @@ app17.delete("/:slug", (c) => {
   if (slug.includes("/") || slug.includes("..") || slug.includes("\\")) {
     return c.json({ error: "Invalid agent slug" }, 400);
   }
-  const agentDir = resolve22(account.accountDir, "agents", slug);
+  const agentDir = resolve21(account.accountDir, "agents", slug);
   if (!existsSync20(agentDir)) {
     return c.json({ error: "Agent not found" }, 404);
   }
@@ -18755,8 +18533,8 @@ var agents_default = app17;
 
 // server/routes/admin/version.ts
 import { existsSync as existsSync21, readFileSync as readFileSync21 } from "fs";
-import { resolve as resolve23, join as join10 } from "path";
-var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve23(process.cwd(), "..");
+import { resolve as resolve22, join as join10 } from "path";
+var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT ?? resolve22(process.cwd(), "..");
 var brandHostname = "maxy";
 var brandNpmPackage = "@rubytech/create-maxy";
 var brandJsonPath = join10(PLATFORM_ROOT8, "config", "brand.json");
@@ -18768,7 +18546,7 @@ if (existsSync21(brandJsonPath)) {
   } catch {
   }
 }
-var VERSION_FILE = resolve23(PLATFORM_ROOT8, `config/.${brandHostname}-version`);
+var VERSION_FILE = resolve22(PLATFORM_ROOT8, `config/.${brandHostname}-version`);
 var NPM_PACKAGE = brandNpmPackage;
 var REGISTRY_URL = `https://registry.npmjs.org/${NPM_PACKAGE}/latest`;
 var FETCH_TIMEOUT_MS = 5e3;
@@ -18884,16 +18662,10 @@ app19.post("/new", requireAdminSession, async (c) => {
   const newSessionKey = crypto3.randomUUID();
   const userName = getUserNameForSession(oldSessionKey);
   registerSession(newSessionKey, "admin", accountId, void 0, userId, userName);
-  const conversationId = await createNewAdminConversation(userId, accountId, newSessionKey);
-  if (!conversationId) {
-    unregisterSession(newSessionKey);
-    console.error(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} new-conversation-failed: userId=${userId} accountId=${accountId.slice(0, 8)}\u2026 oldSessionKey=${oldSessionKey.slice(0, 8)}\u2026 newSessionKey=${newSessionKey.slice(0, 8)}\u2026`);
-    return c.json({ error: "Failed to create conversation" }, 500);
-  }
   const previousConversationId = clearSessionHistory(oldSessionKey);
   unregisterSession(oldSessionKey);
-  console.log(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} session reset for new conversation: oldSessionKey=${oldSessionKey.slice(0, 8)}\u2026 newSessionKey=${newSessionKey.slice(0, 8)}\u2026 previousConversationId=${previousConversationId?.slice(0, 8) ?? "none"}\u2026 newConversationId=${conversationId.slice(0, 8)}\u2026`);
-  return c.json({ session_key: newSessionKey, conversationId });
+  console.log(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} session reset for new conversation: oldSessionKey=${oldSessionKey.slice(0, 8)}\u2026 newSessionKey=${newSessionKey.slice(0, 8)}\u2026 previousConversationId=${previousConversationId?.slice(0, 8) ?? "none"}\u2026 newConversationId=deferred`);
+  return c.json({ session_key: newSessionKey, conversationId: null });
 });
 app19.delete("/:id", requireAdminSession, async (c) => {
   const conversationId = c.req.param("id");
@@ -19268,7 +19040,7 @@ var events_default = app23;
 
 // server/routes/admin/cloudflare.ts
 import { homedir as homedir3 } from "os";
-import { resolve as resolve25 } from "path";
+import { resolve as resolve24 } from "path";
 import { readFileSync as readFileSync23 } from "fs";
 
 // app/lib/dns-label.ts
@@ -19285,10 +19057,10 @@ function isValidDomain(value) {
 }
 
 // app/lib/alias-domains.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync12, readFileSync as readFileSync22, writeFileSync as writeFileSync14 } from "fs";
 import { dirname as dirname9 } from "path";
-import { resolve as resolve24 } from "path";
-var ALIAS_DOMAINS_PATH = resolve24(MAXY_DIR, "alias-domains.json");
+import { resolve as resolve23 } from "path";
+var ALIAS_DOMAINS_PATH = resolve23(MAXY_DIR, "alias-domains.json");
 function readExisting() {
   if (!existsSync22(ALIAS_DOMAINS_PATH)) return /* @__PURE__ */ new Set();
   try {
@@ -19303,7 +19075,7 @@ function addAliasDomain(hostname2) {
   const existing = readExisting();
   if (existing.has(hostname2)) return;
   existing.add(hostname2);
-  mkdirSync13(dirname9(ALIAS_DOMAINS_PATH), { recursive: true });
+  mkdirSync12(dirname9(ALIAS_DOMAINS_PATH), { recursive: true });
   writeFileSync14(ALIAS_DOMAINS_PATH, JSON.stringify([...existing], null, 2) + "\n", "utf-8");
 }
 
@@ -19311,8 +19083,8 @@ function addAliasDomain(hostname2) {
 var SETUP_TIMEOUT_MS = 10 * 60 * 1e3;
 var DOMAINS_TIMEOUT_MS = 40 * 1e3;
 function loadBrandInfo() {
-  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "..");
-  const brandPath = resolve25(platformRoot2, "config", "brand.json");
+  const platformRoot2 = process.env.MAXY_PLATFORM_ROOT ?? resolve24(process.cwd(), "..");
+  const brandPath = resolve24(platformRoot2, "config", "brand.json");
   try {
     const parsed = JSON.parse(readFileSync23(brandPath, "utf-8"));
     const hostname2 = typeof parsed.hostname === "string" && parsed.hostname ? parsed.hostname : "maxy";
@@ -19417,7 +19189,7 @@ app24.get("/domains", requireAdminSession, async (c) => {
   streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
   log2(`phase=stream-log-resolved path=${streamLogPath}`);
   const brand = loadBrandInfo();
-  const scriptPath = resolve25(homedir3(), "list-cf-domains.sh");
+  const scriptPath = resolve24(homedir3(), "list-cf-domains.sh");
   const result = await runFormSpawn({
     scriptPath,
     args: [brand.hostname],
@@ -19542,7 +19314,7 @@ app24.post("/setup", requireAdminSession, async (c) => {
   }
   streamLogPath = streamLogPathFor(accountId, correlationId).streamLogPath;
   log2(`phase=stream-log-resolved path=${streamLogPath}`);
-  const scriptPath = resolve25(homedir3(), "setup-tunnel.sh");
+  const scriptPath = resolve24(homedir3(), "setup-tunnel.sh");
   const args = [brand.hostname, String(port2), adminFqdn];
   if (publicFqdn) args.push(publicFqdn);
   if (apex) args.push(apex);
@@ -19611,17 +19383,17 @@ var cloudflare_default = app24;
 import { createReadStream as createReadStream3 } from "fs";
 import { readdir as readdir2, readFile as readFile4, stat as stat4, mkdir as mkdir3, writeFile as writeFile4, unlink as unlink2 } from "fs/promises";
 import { realpathSync as realpathSync4 } from "fs";
-import { basename as basename6, dirname as dirname10, join as join11, resolve as resolve27, sep as sep2 } from "path";
+import { basename as basename6, dirname as dirname10, join as join11, resolve as resolve26, sep as sep2 } from "path";
 import { Readable as Readable3 } from "stream";
 
 // app/lib/data-path.ts
 import { realpathSync as realpathSync3 } from "fs";
-import { resolve as resolve26, normalize, sep, relative } from "path";
-var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT ?? resolve26(process.cwd(), "../platform");
-var DATA_ROOT = resolve26(PLATFORM_ROOT9, "..", "data");
+import { resolve as resolve25, normalize, sep, relative } from "path";
+var PLATFORM_ROOT9 = process.env.MAXY_PLATFORM_ROOT ?? resolve25(process.cwd(), "../platform");
+var DATA_ROOT = resolve25(PLATFORM_ROOT9, "..", "data");
 function resolveDataPath(raw2) {
   const cleaned = normalize("/" + (raw2 ?? "").replace(/\\/g, "/")).replace(/^\/+/, "");
-  const absolute = resolve26(DATA_ROOT, cleaned);
+  const absolute = resolve25(DATA_ROOT, cleaned);
   let dataRootReal;
   try {
     dataRootReal = realpathSync3(DATA_ROOT);
@@ -19899,7 +19671,7 @@ async function readMeta(absDir, baseName) {
 }
 async function readAccountNames() {
   const map = /* @__PURE__ */ new Map();
-  const accountsDir = resolve27(DATA_ROOT, "accounts");
+  const accountsDir = resolve26(DATA_ROOT, "accounts");
   let names;
   try {
     names = await readdir2(accountsDir);
@@ -19908,7 +19680,7 @@ async function readAccountNames() {
   }
   for (const name of names) {
     if (!UUID_RE3.test(name)) continue;
-    const configPath2 = resolve27(accountsDir, name, "account.json");
+    const configPath2 = resolve26(accountsDir, name, "account.json");
     try {
       const raw2 = await readFile4(configPath2, "utf8");
       const parsed = JSON.parse(raw2);
@@ -20099,8 +19871,8 @@ app25.post("/upload", requireAdminSession, async (c) => {
   }
   const safeName = basename6(file.name).replace(/[\0/\\]/g, "_");
   const finalName = `${Date.now()}-${safeName}`;
-  const destDir = resolve27(DATA_ROOT, "uploads", accountId);
-  const destPath = resolve27(destDir, finalName);
+  const destDir = resolve26(DATA_ROOT, "uploads", accountId);
+  const destPath = resolve26(destDir, finalName);
   try {
     await mkdir3(destDir, { recursive: true });
     const dataRootReal = realpathSync4(DATA_ROOT);
@@ -20253,24 +20025,35 @@ var GRAPH_LABEL_COLOURS = {
   Review: "#059669",
   ImageObject: "#6EE7B7",
   // Conversational
+  //
+  // Task 649 palette — the four sublabelled conversation/message labels
+  // (AdminConversation, PublicConversation, UserMessage, AssistantMessage)
+  // are assigned four pairwise-distinguishable hues: indigo / purple /
+  // orange / yellow. The Task 633 violet-shade split (darker for admin,
+  // lighter for public) was indistinguishable on canvas and in the legend;
+  // hue-shift replaces lightness-shift.
+  //
+  // Constraints honoured:
+  //   - Pairwise distinct among the four in-family labels.
+  //   - UserMessage=#F97316 reserved (Person/Preference orange cue) —
+  //     the other three are non-orange.
+  //   - No collision with Task/Project/Event pinks (#DB2777/#BE185D/#EC4899),
+  //     Knowledge greens, Workflow cyans, LocalBusiness blues.
+  //   - Conversation base (#7C3AED) kept as pre-backfill fallback for
+  //     nodes that pre-date the AdminConversation/PublicConversation split.
+  //   - Message base reassigned away from old #A78BFA to avoid near-
+  //     collision with the new PublicConversation=#A855F7; slate signals
+  //     "legacy/system/tool" — nodes carrying only :Message without a
+  //     role-sublabel.
+  //   - Out of family (intentionally not touched): OnboardingState=#8B5CF6
+  //     sits in the violet neighbourhood; palette reassignment outside
+  //     the conversation/message family is out of scope for Task 649.
   Conversation: "#7C3AED",
-  // Task 633 — admin vs public disambiguation on /graph. Darker violet for
-  // admin conversations (the operator-facing side), lighter for public
-  // (customer-facing) so the operator can read chat topology by colour
-  // alone. Both within the Conversation family — the hue shift is subtle
-  // enough to stay legible on adjacent nodes yet distinct enough to be
-  // unmistakable in the popover legend.
-  AdminConversation: "#5B21B6",
-  PublicConversation: "#A78BFA",
-  Message: "#A78BFA",
-  // Task 633 — user vs assistant disambiguation on /graph. UserMessage
-  // picks up the Person/Preference orange family cue (the user is a
-  // person); AssistantMessage stays violet-adjacent to reinforce the
-  // AdminConversation cue (both are admin-side). system/tool Messages
-  // (not written by the persist path today; reserved shape) stay on the
-  // base `:Message` colour.
+  AdminConversation: "#4338CA",
+  PublicConversation: "#A855F7",
+  Message: "#64748B",
   UserMessage: "#F97316",
-  AssistantMessage: "#8B5CF6",
+  AssistantMessage: "#FACC15",
   ToolCall: "#C4B5FD",
   // Tasks / projects / events
   Task: "#DB2777",
@@ -21405,8 +21188,8 @@ app35.get("/agent-assets/:slug/:filename", (c) => {
     console.error(`[agent-assets] no-account slug=${slug} file=${filename}`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "agents", slug, "assets", filename);
-  const expectedDir = resolve28(account.accountDir, "agents", slug, "assets");
+  const filePath = resolve27(account.accountDir, "agents", slug, "assets", filename);
+  const expectedDir = resolve27(account.accountDir, "agents", slug, "assets");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[agent-assets] path-traversal-rejected slug=${slug} file=${filename}`);
     return c.text("Forbidden", 403);
@@ -21435,8 +21218,8 @@ app35.get("/generated/:filename", (c) => {
     console.error(`[generated] serve file=${filename} status=404`);
     return c.text("Not found", 404);
   }
-  const filePath = resolve28(account.accountDir, "generated", filename);
-  const expectedDir = resolve28(account.accountDir, "generated");
+  const filePath = resolve27(account.accountDir, "generated", filename);
+  const expectedDir = resolve27(account.accountDir, "generated");
   if (!filePath.startsWith(expectedDir + "/")) {
     console.error(`[generated] serve file=${filename} status=403`);
     return c.text("Forbidden", 403);
@@ -21519,7 +21302,7 @@ var clientErrorReporterScript = `<script>
 function cachedHtml(file) {
   let html = htmlCache.get(file);
   if (!html) {
-    html = readFileSync24(resolve28(process.cwd(), "public", file), "utf-8");
+    html = readFileSync24(resolve27(process.cwd(), "public", file), "utf-8");
     html = html.replace("<title>Maxy</title>", `<title>${escapeHtml(BRAND.productName)}</title>`);
     html = html.replace('href="/favicon.ico"', `href="${escapeHtml(brandFaviconPath)}"`);
     const headInjection = file === "index.html" ? `${brandScript}
@@ -21626,7 +21409,7 @@ app35.use("/vnc-popout.html", logViewerFetch);
 app35.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
-    html = readFileSync24(resolve28(process.cwd(), "public", "vnc-popout.html"), "utf-8");
+    html = readFileSync24(resolve27(process.cwd(), "public", "vnc-popout.html"), "utf-8");
     const name = escapeHtml(BRAND.productName);
     html = html.replace("<title>Browser \u2014 Maxy</title>", `<title>${name}</title>`);
     html = html.replace("</head>", `  ${brandScript}
@@ -21683,11 +21466,6 @@ app35.use("/*", serveStatic({ root: "./public" }));
 var port = parseInt(process.env.PORT ?? "19199", 10);
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app35.fetch, port, hostname });
-attachTerminalWsProxy(httpServer, {
-  isPublicHost,
-  upstreamHost: "127.0.0.1",
-  upstreamPort: 7681
-});
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 var SUBAPP_MANIFEST = [
   { prefix: "/api/health", file: "server/routes/health.ts", subapp: health_default },
@@ -21748,7 +21526,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve28(process.env.MAXY_PLATFORM_ROOT ?? join12(__dirname, "..")),
+  platformRoot: resolve27(process.env.MAXY_PLATFORM_ROOT ?? join12(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     try {