@rubytech/create-sitedesk-code 0.1.508 → 0.1.510

package/payload/server/server.js

@@ -1601,233 +1601,11 @@ var require_dist5 = __commonJS({
   }
 });
 
-// node_modules/hono/dist/utils/mime.js
-var getMimeType = (filename, mimes = baseMimes) => {
-  const regexp = /\.([a-zA-Z0-9]+?)$/;
-  const match = filename.match(regexp);
-  if (!match) {
-    return;
-  }
-  let mimeType = mimes[match[1].toLowerCase()];
-  if (mimeType && mimeType.startsWith("text")) {
-    mimeType += "; charset=utf-8";
-  }
-  return mimeType;
-};
-var _baseMimes = {
-  aac: "audio/aac",
-  avi: "video/x-msvideo",
-  avif: "image/avif",
-  av1: "video/av1",
-  bin: "application/octet-stream",
-  bmp: "image/bmp",
-  css: "text/css",
-  csv: "text/csv",
-  eot: "application/vnd.ms-fontobject",
-  epub: "application/epub+zip",
-  gif: "image/gif",
-  gz: "application/gzip",
-  htm: "text/html",
-  html: "text/html",
-  ico: "image/x-icon",
-  ics: "text/calendar",
-  jpeg: "image/jpeg",
-  jpg: "image/jpeg",
-  js: "text/javascript",
-  json: "application/json",
-  jsonld: "application/ld+json",
-  map: "application/json",
-  mid: "audio/x-midi",
-  midi: "audio/x-midi",
-  mjs: "text/javascript",
-  mp3: "audio/mpeg",
-  mp4: "video/mp4",
-  mpeg: "video/mpeg",
-  oga: "audio/ogg",
-  ogv: "video/ogg",
-  ogx: "application/ogg",
-  opus: "audio/opus",
-  otf: "font/otf",
-  pdf: "application/pdf",
-  png: "image/png",
-  rtf: "application/rtf",
-  svg: "image/svg+xml",
-  tif: "image/tiff",
-  tiff: "image/tiff",
-  ts: "video/mp2t",
-  ttf: "font/ttf",
-  txt: "text/plain",
-  wasm: "application/wasm",
-  webm: "video/webm",
-  weba: "audio/webm",
-  webmanifest: "application/manifest+json",
-  webp: "image/webp",
-  woff: "font/woff",
-  woff2: "font/woff2",
-  xhtml: "application/xhtml+xml",
-  xml: "application/xml",
-  zip: "application/zip",
-  "3gp": "video/3gpp",
-  "3g2": "video/3gpp2",
-  gltf: "model/gltf+json",
-  glb: "model/gltf-binary"
-};
-var baseMimes = _baseMimes;
-
-// node_modules/@hono/node-server/dist/serve-static.mjs
-import { createReadStream, statSync, existsSync } from "fs";
-import { join } from "path";
-import { versions } from "process";
-import { Readable } from "stream";
-var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
-var ENCODINGS = {
-  br: ".br",
-  zstd: ".zst",
-  gzip: ".gz"
-};
-var ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
-var pr54206Applied = () => {
-  const [major, minor] = versions.node.split(".").map((component) => parseInt(component));
-  return major >= 23 || major === 22 && minor >= 7 || major === 20 && minor >= 18;
-};
-var useReadableToWeb = pr54206Applied();
-var createStreamBody = (stream2) => {
-  if (useReadableToWeb) {
-    return Readable.toWeb(stream2);
-  }
-  const body = new ReadableStream({
-    start(controller) {
-      stream2.on("data", (chunk) => {
-        controller.enqueue(chunk);
-      });
-      stream2.on("error", (err) => {
-        controller.error(err);
-      });
-      stream2.on("end", () => {
-        controller.close();
-      });
-    },
-    cancel() {
-      stream2.destroy();
-    }
-  });
-  return body;
-};
-var getStats = (path3) => {
-  let stats;
-  try {
-    stats = statSync(path3);
-  } catch {
-  }
-  return stats;
-};
-var tryDecode = (str, decoder) => {
-  try {
-    return decoder(str);
-  } catch {
-    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
-      try {
-        return decoder(match);
-      } catch {
-        return match;
-      }
-    });
-  }
-};
-var tryDecodeURI = (str) => tryDecode(str, decodeURI);
-var serveStatic = (options = { root: "" }) => {
-  const root = options.root || "";
-  const optionPath = options.path;
-  if (root !== "" && !existsSync(root)) {
-    console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
-  }
-  return async (c, next) => {
-    if (c.finalized) {
-      return next();
-    }
-    let filename;
-    if (optionPath) {
-      filename = optionPath;
-    } else {
-      try {
-        filename = tryDecodeURI(c.req.path);
-        if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
-          throw new Error();
-        }
-      } catch {
-        await options.onNotFound?.(c.req.path, c);
-        return next();
-      }
-    }
-    let path3 = join(
-      root,
-      !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename
-    );
-    let stats = getStats(path3);
-    if (stats && stats.isDirectory()) {
-      const indexFile2 = options.index ?? "index.html";
-      path3 = join(path3, indexFile2);
-      stats = getStats(path3);
-    }
-    if (!stats) {
-      await options.onNotFound?.(path3, c);
-      return next();
-    }
-    const mimeType = getMimeType(path3);
-    c.header("Content-Type", mimeType || "application/octet-stream");
-    if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
-      const acceptEncodingSet = new Set(
-        c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim())
-      );
-      for (const encoding of ENCODINGS_ORDERED_KEYS) {
-        if (!acceptEncodingSet.has(encoding)) {
-          continue;
-        }
-        const precompressedStats = getStats(path3 + ENCODINGS[encoding]);
-        if (precompressedStats) {
-          c.header("Content-Encoding", encoding);
-          c.header("Vary", "Accept-Encoding", { append: true });
-          stats = precompressedStats;
-          path3 = path3 + ENCODINGS[encoding];
-          break;
-        }
-      }
-    }
-    let result;
-    const size = stats.size;
-    const range = c.req.header("range") || "";
-    if (c.req.method == "HEAD" || c.req.method == "OPTIONS") {
-      c.header("Content-Length", size.toString());
-      c.status(200);
-      result = c.body(null);
-    } else if (!range) {
-      c.header("Content-Length", size.toString());
-      result = c.body(createStreamBody(createReadStream(path3)), 200);
-    } else {
-      c.header("Accept-Ranges", "bytes");
-      c.header("Date", stats.birthtime.toUTCString());
-      const parts = range.replace(/bytes=/, "").split("-", 2);
-      const start = parseInt(parts[0], 10) || 0;
-      let end = parseInt(parts[1], 10) || size - 1;
-      if (size < end - start + 1) {
-        end = size - 1;
-      }
-      const chunksize = end - start + 1;
-      const stream2 = createReadStream(path3, { start, end });
-      c.header("Content-Length", chunksize.toString());
-      c.header("Content-Range", `bytes ${start}-${end}/${stats.size}`);
-      result = c.body(createStreamBody(stream2), 206);
-    }
-    await options.onFound?.(path3, c);
-    return result;
-  };
-};
-
 // server/index.ts
 import { readFileSync as readFileSync48, existsSync as existsSync47, watchFile, readdirSync as readdirSync29, statSync as statSync21 } from "fs";
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash8 } from "crypto";
-import { resolve as resolve45, join as join48, basename as basename14 } from "path";
+import { resolve as resolve45, join as join49, basename as basename14 } from "path";
 import { homedir as homedir4 } from "os";
 
 // server/lib/route-cache-watchers.ts
@@ -1950,21 +1728,21 @@ function onInvalidate(fn) {
 }
 
 // app/lib/whatsapp/message-store.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync, appendFileSync, readdirSync, statSync as statSync2 } from "fs";
-import { dirname, join as join2 } from "path";
+import { existsSync, mkdirSync, readFileSync, appendFileSync, readdirSync, statSync } from "fs";
+import { dirname, join } from "path";
 function isReactionRecord(r) {
   return r.kind === "reaction";
 }
-var STORE_ROOT = () => join2(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
+var STORE_ROOT = () => join(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-messages");
 function conversationFile(platformAccountId, remoteJid) {
-  return join2(STORE_ROOT(), platformAccountId, `${remoteJid}.jsonl`);
+  return join(STORE_ROOT(), platformAccountId, `${remoteJid}.jsonl`);
 }
 function listStoredAccountIds() {
   const root = STORE_ROOT();
-  if (!existsSync2(root)) return [];
+  if (!existsSync(root)) return [];
   return readdirSync(root).filter((name) => {
     try {
-      return statSync2(join2(root, name)).isDirectory();
+      return statSync(join(root, name)).isDirectory();
     } catch {
       return false;
     }
@@ -2000,7 +1778,7 @@ function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
   try {
     const filesToCheck = [file, ...altDedupeRemoteJids.filter((jid) => jid && jid !== record.remoteJid).map((jid) => conversationFile(platformAccountId, jid))];
     for (const candidate of new Set(filesToCheck)) {
-      if (!existsSync2(candidate)) continue;
+      if (!existsSync(candidate)) continue;
       const existing = parseLines(readFileSync(candidate, "utf8"));
       if (existing.some((r) => r.messageId === record.messageId)) {
         return { created: false };
@@ -2023,7 +1801,7 @@ function appendMessage(platformAccountId, record, altDedupeRemoteJids = []) {
 function readConversation(platformAccountId, remoteJid) {
   const file = conversationFile(platformAccountId, remoteJid);
   try {
-    if (!existsSync2(file)) return [];
+    if (!existsSync(file)) return [];
     return parseLines(readFileSync(file, "utf8")).sort(byDateSentAsc);
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
@@ -2048,7 +1826,7 @@ function appendReaction(platformAccountId, record) {
 function readReactions(platformAccountId, remoteJid) {
   const file = conversationFile(platformAccountId, remoteJid);
   try {
-    if (!existsSync2(file)) return [];
+    if (!existsSync(file)) return [];
     const out = [];
     for (const line of readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) continue;
@@ -2094,23 +1872,23 @@ function summariseRecords(records) {
   };
 }
 function readConversationSummaries(platformAccountId) {
-  const dir = join2(STORE_ROOT(), platformAccountId);
+  const dir = join(STORE_ROOT(), platformAccountId);
   const out = /* @__PURE__ */ new Map();
   const seen = /* @__PURE__ */ new Set();
   let fullReads = 0;
   let cacheHits = 0;
   let bytesRead = 0;
   try {
-    if (!existsSync2(dir)) return out;
+    if (!existsSync(dir)) return out;
     for (const entry of readdirSync(dir)) {
       if (!entry.endsWith(".jsonl")) continue;
       const remoteJid = entry.slice(0, -".jsonl".length);
-      const file = join2(dir, entry);
+      const file = join(dir, entry);
       seen.add(file);
       let size;
       let mtimeMs;
       try {
-        const st = statSync2(file);
+        const st = statSync(file);
         size = st.size;
         mtimeMs = st.mtimeMs;
       } catch {
@@ -2150,10 +1928,10 @@ function readConversationSummaries(platformAccountId) {
   return out;
 }
 function readAllConversations(platformAccountId) {
-  const dir = join2(STORE_ROOT(), platformAccountId);
+  const dir = join(STORE_ROOT(), platformAccountId);
   const out = /* @__PURE__ */ new Map();
   try {
-    if (!existsSync2(dir)) return out;
+    if (!existsSync(dir)) return out;
     for (const entry of readdirSync(dir)) {
       if (!entry.endsWith(".jsonl")) continue;
       const remoteJid = entry.slice(0, -".jsonl".length);
@@ -2281,110 +2059,417 @@ function attachRouteCacheWatchers() {
   watchDirInto(resolve2(PLATFORM_ROOT, "templates", "specialists", "agents"), "sidebar-artefacts", null);
   let houseId = null;
   try {
-    houseId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+    houseId = resolveHouseOrSoleAccountId(ACCOUNTS_DIR);
+  } catch {
+    houseId = null;
+  }
+  if (houseId) {
+    watchDirInto(STORE_ROOT(), "conversations-all", houseId);
+  } else {
+    console.error("[admin-events] op=watch-failed resource=conversations-all reason=house-account-unresolved");
+  }
+}
+
+// server/lib/manager-events-subscriber.ts
+var TAG = "[webchat-pointer]";
+var TURN_EVENTS = /* @__PURE__ */ new Set(["row-updated", "row-created"]);
+var MAX_BACKOFF_MS = 3e4;
+var STABLE_CONNECTION_MS = 3e4;
+var lastStatusBySession = /* @__PURE__ */ new Map();
+function handleManagerFrame(raw) {
+  const lines = raw.split("\n");
+  const eventLine = lines.find((l) => l.startsWith("event: "));
+  const dataLine = lines.find((l) => l.startsWith("data: "));
+  if (!eventLine || !dataLine) return null;
+  if (!TURN_EVENTS.has(eventLine.slice("event: ".length).trim())) return null;
+  let body;
+  try {
+    body = JSON.parse(dataLine.slice("data: ".length));
+  } catch {
+    console.error(`${TAG} op=skip reason=unparseable-frame`);
+    return null;
+  }
+  const sessionId = String(body.sessionId ?? "unknown").slice(0, 8);
+  const accountId = typeof body.accountId === "string" && body.accountId ? body.accountId : null;
+  if (!accountId) {
+    console.error(`${TAG} op=skip reason=no-account sessionId=${sessionId}`);
+    return null;
+  }
+  const status = String(body.status ?? "unknown");
+  const fullSessionId = String(body.sessionId ?? "");
+  if (fullSessionId && lastStatusBySession.get(fullSessionId) === status) {
+    return null;
+  }
+  if (fullSessionId) lastStatusBySession.set(fullSessionId, status);
+  console.log(
+    `${TAG} op=event sessionId=${sessionId} accountId=${accountId.slice(0, 8)} activity=${status}`
+  );
+  notify("webchat-pointer", accountId);
+  return { resource: "webchat-pointer", accountId };
+}
+var connections = 0;
+var started = false;
+var abort = null;
+function startManagerEventsSubscriber() {
+  if (started) return;
+  started = true;
+  abort = new AbortController();
+  void connectLoop(abort.signal);
+}
+async function connectLoop(signal) {
+  let backoffMs = 1e3;
+  for (; ; ) {
+    if (signal.aborted) return;
+    let port2;
+    try {
+      port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "webchat-pointer" });
+    } catch {
+      console.error(`${TAG} op=drop reason=manager-port-unset`);
+      return;
+    }
+    const connectedAt = Date.now();
+    try {
+      const res = await fetch(`http://127.0.0.1:${port2}/events`, { signal });
+      if (!res.ok || !res.body) throw new Error(`status ${res.status}`);
+      connections += 1;
+      console.log(`${TAG} op=subscribe upstream-count=${connections}`);
+      const reader = res.body.getReader();
+      const decoder = new TextDecoder();
+      let buffer = "";
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        buffer += decoder.decode(value, { stream: true });
+        let cut = buffer.indexOf("\n\n");
+        while (cut !== -1) {
+          handleManagerFrame(buffer.slice(0, cut));
+          buffer = buffer.slice(cut + 2);
+          cut = buffer.indexOf("\n\n");
+        }
+      }
+      connections -= 1;
+    } catch (err) {
+      if (connections > 0) connections -= 1;
+      if (signal.aborted) return;
+      console.error(`${TAG} op=drop reason=${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (signal.aborted) return;
+    if (Date.now() - connectedAt >= STABLE_CONNECTION_MS) backoffMs = 1e3;
+    console.log(`${TAG} op=reconnect inMs=${backoffMs} upstream-count=${connections}`);
+    await new Promise((r) => setTimeout(r, backoffMs));
+    backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
+  }
+}
+
+// server/index.ts
+import { monitorEventLoopDelay } from "perf_hooks";
+
+// server/lib/event-loop-lag.ts
+function readAndResetWindow(hist, windowMs) {
+  const toMs = (ns) => Math.round(ns / 1e6);
+  const w = {
+    p50Ms: toMs(hist.percentile(50)),
+    p99Ms: toMs(hist.percentile(99)),
+    maxMs: toMs(hist.max),
+    // Read before the reset.
+    count: hist.count,
+    windowMs
+  };
+  hist.reset();
+  return w;
+}
+function formatLagWindow(w) {
+  return `[event-loop] op=lag-window p50=${w.p50Ms} p99=${w.p99Ms} max=${w.maxMs} n=${w.count} windowMs=${w.windowMs}`;
+}
+
+// node_modules/hono/dist/utils/mime.js
+var getMimeType = (filename, mimes = baseMimes) => {
+  const regexp = /\.([a-zA-Z0-9]+?)$/;
+  const match = filename.match(regexp);
+  if (!match) {
+    return;
+  }
+  let mimeType = mimes[match[1].toLowerCase()];
+  if (mimeType && mimeType.startsWith("text")) {
+    mimeType += "; charset=utf-8";
+  }
+  return mimeType;
+};
+var _baseMimes = {
+  aac: "audio/aac",
+  avi: "video/x-msvideo",
+  avif: "image/avif",
+  av1: "video/av1",
+  bin: "application/octet-stream",
+  bmp: "image/bmp",
+  css: "text/css",
+  csv: "text/csv",
+  eot: "application/vnd.ms-fontobject",
+  epub: "application/epub+zip",
+  gif: "image/gif",
+  gz: "application/gzip",
+  htm: "text/html",
+  html: "text/html",
+  ico: "image/x-icon",
+  ics: "text/calendar",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  js: "text/javascript",
+  json: "application/json",
+  jsonld: "application/ld+json",
+  map: "application/json",
+  mid: "audio/x-midi",
+  midi: "audio/x-midi",
+  mjs: "text/javascript",
+  mp3: "audio/mpeg",
+  mp4: "video/mp4",
+  mpeg: "video/mpeg",
+  oga: "audio/ogg",
+  ogv: "video/ogg",
+  ogx: "application/ogg",
+  opus: "audio/opus",
+  otf: "font/otf",
+  pdf: "application/pdf",
+  png: "image/png",
+  rtf: "application/rtf",
+  svg: "image/svg+xml",
+  tif: "image/tiff",
+  tiff: "image/tiff",
+  ts: "video/mp2t",
+  ttf: "font/ttf",
+  txt: "text/plain",
+  wasm: "application/wasm",
+  webm: "video/webm",
+  weba: "audio/webm",
+  webmanifest: "application/manifest+json",
+  webp: "image/webp",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  xhtml: "application/xhtml+xml",
+  xml: "application/xml",
+  zip: "application/zip",
+  "3gp": "video/3gpp",
+  "3g2": "video/3gpp2",
+  gltf: "model/gltf+json",
+  glb: "model/gltf-binary"
+};
+var baseMimes = _baseMimes;
+
+// node_modules/@hono/node-server/dist/serve-static.mjs
+import { createReadStream, statSync as statSync2, existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { versions } from "process";
+import { Readable } from "stream";
+var COMPRESSIBLE_CONTENT_TYPE_REGEX = /^\s*(?:text\/[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-virtualbox-hdd|x-virtualbox-ova|x-virtualbox-ovf|x-virtualbox-vbox|x-virtualbox-vdi|x-virtualbox-vhd|x-virtualbox-vmdk|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i;
+var ENCODINGS = {
+  br: ".br",
+  zstd: ".zst",
+  gzip: ".gz"
+};
+var ENCODINGS_ORDERED_KEYS = Object.keys(ENCODINGS);
+var pr54206Applied = () => {
+  const [major, minor] = versions.node.split(".").map((component) => parseInt(component));
+  return major >= 23 || major === 22 && minor >= 7 || major === 20 && minor >= 18;
+};
+var useReadableToWeb = pr54206Applied();
+var createStreamBody = (stream2) => {
+  if (useReadableToWeb) {
+    return Readable.toWeb(stream2);
+  }
+  const body = new ReadableStream({
+    start(controller) {
+      stream2.on("data", (chunk) => {
+        controller.enqueue(chunk);
+      });
+      stream2.on("error", (err) => {
+        controller.error(err);
+      });
+      stream2.on("end", () => {
+        controller.close();
+      });
+    },
+    cancel() {
+      stream2.destroy();
+    }
+  });
+  return body;
+};
+var getStats = (path3) => {
+  let stats;
+  try {
+    stats = statSync2(path3);
+  } catch {
+  }
+  return stats;
+};
+var tryDecode = (str, decoder) => {
+  try {
+    return decoder(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decoder(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+};
+var tryDecodeURI = (str) => tryDecode(str, decodeURI);
+var serveStatic = (options = { root: "" }) => {
+  const root = options.root || "";
+  const optionPath = options.path;
+  if (root !== "" && !existsSync2(root)) {
+    console.error(`serveStatic: root path '${root}' is not found, are you sure it's correct?`);
+  }
+  return async (c, next) => {
+    if (c.finalized) {
+      return next();
+    }
+    let filename;
+    if (optionPath) {
+      filename = optionPath;
+    } else {
+      try {
+        filename = tryDecodeURI(c.req.path);
+        if (/(?:^|[\/\\])\.\.(?:$|[\/\\])/.test(filename)) {
+          throw new Error();
+        }
+      } catch {
+        await options.onNotFound?.(c.req.path, c);
+        return next();
+      }
+    }
+    let path3 = join2(
+      root,
+      !optionPath && options.rewriteRequestPath ? options.rewriteRequestPath(filename, c) : filename
+    );
+    let stats = getStats(path3);
+    if (stats && stats.isDirectory()) {
+      const indexFile2 = options.index ?? "index.html";
+      path3 = join2(path3, indexFile2);
+      stats = getStats(path3);
+    }
+    if (!stats) {
+      await options.onNotFound?.(path3, c);
+      return next();
+    }
+    const mimeType = getMimeType(path3);
+    c.header("Content-Type", mimeType || "application/octet-stream");
+    if (options.precompressed && (!mimeType || COMPRESSIBLE_CONTENT_TYPE_REGEX.test(mimeType))) {
+      const acceptEncodingSet = new Set(
+        c.req.header("Accept-Encoding")?.split(",").map((encoding) => encoding.trim())
+      );
+      for (const encoding of ENCODINGS_ORDERED_KEYS) {
+        if (!acceptEncodingSet.has(encoding)) {
+          continue;
+        }
+        const precompressedStats = getStats(path3 + ENCODINGS[encoding]);
+        if (precompressedStats) {
+          c.header("Content-Encoding", encoding);
+          c.header("Vary", "Accept-Encoding", { append: true });
+          stats = precompressedStats;
+          path3 = path3 + ENCODINGS[encoding];
+          break;
+        }
+      }
+    }
+    let result;
+    const size = stats.size;
+    const range = c.req.header("range") || "";
+    if (c.req.method == "HEAD" || c.req.method == "OPTIONS") {
+      c.header("Content-Length", size.toString());
+      c.status(200);
+      result = c.body(null);
+    } else if (!range) {
+      c.header("Content-Length", size.toString());
+      result = c.body(createStreamBody(createReadStream(path3)), 200);
+    } else {
+      c.header("Accept-Ranges", "bytes");
+      c.header("Date", stats.birthtime.toUTCString());
+      const parts = range.replace(/bytes=/, "").split("-", 2);
+      const start = parseInt(parts[0], 10) || 0;
+      let end = parseInt(parts[1], 10) || size - 1;
+      if (size < end - start + 1) {
+        end = size - 1;
+      }
+      const chunksize = end - start + 1;
+      const stream2 = createReadStream(path3, { start, end });
+      c.header("Content-Length", chunksize.toString());
+      c.header("Content-Range", `bytes ${start}-${end}/${stats.size}`);
+      result = c.body(createStreamBody(stream2), 206);
+    }
+    await options.onFound?.(path3, c);
+    return result;
+  };
+};
+
+// server/lib/static-cache.ts
+import { statSync as statSync3 } from "fs";
+import { join as join3 } from "path";
+var IMMUTABLE = "public, max-age=31536000, immutable";
+var REVALIDATE = "public, no-cache";
+function statOrNull(path3) {
+  try {
+    return statSync3(path3);
   } catch {
-    houseId = null;
-  }
-  if (houseId) {
-    watchDirInto(STORE_ROOT(), "conversations-all", houseId);
-  } else {
-    console.error("[admin-events] op=watch-failed resource=conversations-all reason=house-account-unresolved");
+    return null;
   }
 }
-
-// server/lib/manager-events-subscriber.ts
-var TAG = "[webchat-pointer]";
-var TURN_EVENTS = /* @__PURE__ */ new Set(["row-updated", "row-created"]);
-var MAX_BACKOFF_MS = 3e4;
-var STABLE_CONNECTION_MS = 3e4;
-var lastStatusBySession = /* @__PURE__ */ new Map();
-function handleManagerFrame(raw) {
-  const lines = raw.split("\n");
-  const eventLine = lines.find((l) => l.startsWith("event: "));
-  const dataLine = lines.find((l) => l.startsWith("data: "));
-  if (!eventLine || !dataLine) return null;
-  if (!TURN_EVENTS.has(eventLine.slice("event: ".length).trim())) return null;
-  let body;
+function tryDecodeURI2(str) {
   try {
-    body = JSON.parse(dataLine.slice("data: ".length));
+    return decodeURI(str);
   } catch {
-    console.error(`${TAG} op=skip reason=unparseable-frame`);
-    return null;
-  }
-  const sessionId = String(body.sessionId ?? "unknown").slice(0, 8);
-  const accountId = typeof body.accountId === "string" && body.accountId ? body.accountId : null;
-  if (!accountId) {
-    console.error(`${TAG} op=skip reason=no-account sessionId=${sessionId}`);
-    return null;
-  }
-  const status = String(body.status ?? "unknown");
-  const fullSessionId = String(body.sessionId ?? "");
-  if (fullSessionId && lastStatusBySession.get(fullSessionId) === status) {
-    return null;
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decodeURI(match);
+      } catch {
+        return match;
+      }
+    });
   }
-  if (fullSessionId) lastStatusBySession.set(fullSessionId, status);
-  console.log(
-    `${TAG} op=event sessionId=${sessionId} accountId=${accountId.slice(0, 8)} activity=${status}`
-  );
-  notify("webchat-pointer", accountId);
-  return { resource: "webchat-pointer", accountId };
 }
-var connections = 0;
-var started = false;
-var abort = null;
-function startManagerEventsSubscriber() {
-  if (started) return;
-  started = true;
-  abort = new AbortController();
-  void connectLoop(abort.signal);
+function resolveStaticFile(root, reqPath) {
+  const filename = tryDecodeURI2(reqPath);
+  if (/(?:^|[/\\])\.\.(?:$|[/\\])/.test(filename)) return null;
+  let path3 = join3(root, filename);
+  let stats = statOrNull(path3);
+  if (stats?.isDirectory()) {
+    path3 = join3(path3, "index.html");
+    stats = statOrNull(path3);
+  }
+  if (!stats?.isFile()) return null;
+  return { path: path3, stats, filename };
 }
-async function connectLoop(signal) {
-  let backoffMs = 1e3;
-  for (; ; ) {
-    if (signal.aborted) return;
-    let port2;
-    try {
-      port2 = requirePortEnv("CLAUDE_SESSION_MANAGER_PORT", { tag: "webchat-pointer" });
-    } catch {
-      console.error(`${TAG} op=drop reason=manager-port-unset`);
-      return;
-    }
-    const connectedAt = Date.now();
-    try {
-      const res = await fetch(`http://127.0.0.1:${port2}/events`, { signal });
-      if (!res.ok || !res.body) throw new Error(`status ${res.status}`);
-      connections += 1;
-      console.log(`${TAG} op=subscribe upstream-count=${connections}`);
-      const reader = res.body.getReader();
-      const decoder = new TextDecoder();
-      let buffer = "";
-      for (; ; ) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        buffer += decoder.decode(value, { stream: true });
-        let cut = buffer.indexOf("\n\n");
-        while (cut !== -1) {
-          handleManagerFrame(buffer.slice(0, cut));
-          buffer = buffer.slice(cut + 2);
-          cut = buffer.indexOf("\n\n");
-        }
-      }
-      connections -= 1;
-    } catch (err) {
-      if (connections > 0) connections -= 1;
-      if (signal.aborted) return;
-      console.error(`${TAG} op=drop reason=${err instanceof Error ? err.message : String(err)}`);
+function staticCacheHeaders(root) {
+  return async (c, next) => {
+    if (c.finalized) return next();
+    const hit = resolveStaticFile(root, c.req.path);
+    if (!hit) return next();
+    if (hit.filename.startsWith("/assets/")) {
+      c.header("Cache-Control", IMMUTABLE);
+      return next();
     }
-    if (signal.aborted) return;
-    if (Date.now() - connectedAt >= STABLE_CONNECTION_MS) backoffMs = 1e3;
-    console.log(`${TAG} op=reconnect inMs=${backoffMs} upstream-count=${connections}`);
-    await new Promise((r) => setTimeout(r, backoffMs));
-    backoffMs = Math.min(backoffMs * 2, MAX_BACKOFF_MS);
-  }
+    const etag = `"${hit.stats.size}-${hit.stats.mtimeMs}"`;
+    c.header("Cache-Control", REVALIDATE);
+    c.header("Last-Modified", hit.stats.mtime.toUTCString());
+    c.header("ETag", etag);
+    if (c.req.header("If-None-Match") === etag) return c.body(null, 304);
+    return next();
+  };
 }
 
-// server/index.ts
-import { monitorEventLoopDelay } from "perf_hooks";
+// server/lib/static-mounts.ts
+function mountStaticFiles(app70, root) {
+  app70.use("/*", staticCacheHeaders(root));
+  app70.use("/assets/*", assetsVary);
+  app70.use("/assets/*", serveStatic({ root, precompressed: true }));
+  app70.use("/*", serveStatic({ root }));
+}
+var assetsVary = async (c, next) => {
+  await next();
+  if (!c.res.headers.has("Vary")) c.res.headers.set("Vary", "Accept-Encoding");
+};
 
 // app/lib/whatsapp/inbound/media-download-guard.ts
 var TAG2 = "[media-guard]";
@@ -2452,14 +2537,14 @@ function installMediaDownloadGuard() {
 }
 
 // app/lib/whatsapp/ingest-audit.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
-import { join as join4 } from "path";
+import { readdirSync as readdirSync4, readFileSync as readFileSync4, statSync as statSync4 } from "fs";
+import { join as join5 } from "path";
 
 // app/lib/whatsapp/ingest-ledger.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, appendFileSync as appendFileSync2, readFileSync as readFileSync3, writeFileSync, readdirSync as readdirSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var TAG3 = "[wa-ingest-ledger]";
-var LEDGER_ROOT = () => join3(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
+var LEDGER_ROOT = () => join4(process.env.MAXY_DIR_OVERRIDE ?? MAXY_DIR, "data", "whatsapp-ingest-ledger");
 var ensuredRoots = /* @__PURE__ */ new Set();
 function ledgerFilePath(account) {
   const root = LEDGER_ROOT();
@@ -2467,7 +2552,7 @@ function ledgerFilePath(account) {
     if (!existsSync3(root)) mkdirSync2(root, { recursive: true });
     ensuredRoots.add(root);
   }
-  return join3(root, `${account}.jsonl`);
+  return join4(root, `${account}.jsonl`);
 }
 function appendStanza(entry) {
   try {
@@ -2573,21 +2658,21 @@ function readAllConversationsCached(accountId) {
   const out = /* @__PURE__ */ new Map();
   let dir;
   try {
-    dir = readdirSync4(join4(STORE_ROOT(), accountId));
+    dir = readdirSync4(join5(STORE_ROOT(), accountId));
   } catch {
     return out;
   }
   for (const file of dir) {
     if (!file.endsWith(".jsonl")) continue;
-    const path3 = join4(STORE_ROOT(), accountId, file);
-    let stat11;
+    const path3 = join5(STORE_ROOT(), accountId, file);
+    let stat12;
     try {
-      stat11 = statSync3(path3);
+      stat12 = statSync4(path3);
     } catch {
       continue;
     }
     const hit = idCache.get(path3);
-    if (hit && hit.size === stat11.size && hit.mtimeMs === stat11.mtimeMs) {
+    if (hit && hit.size === stat12.size && hit.mtimeMs === stat12.mtimeMs) {
       out.set(file, hit.ids);
       continue;
     }
@@ -2604,7 +2689,7 @@ function readAllConversationsCached(accountId) {
     } catch {
       continue;
     }
-    idCache.set(path3, { size: stat11.size, mtimeMs: stat11.mtimeMs, ids: parsed });
+    idCache.set(path3, { size: stat12.size, mtimeMs: stat12.mtimeMs, ids: parsed });
     out.set(file, parsed);
   }
   return out;
@@ -2756,12 +2841,12 @@ function pwaCensus(d) {
 }
 
 // server/webchat-descriptor.ts
-import { resolve as resolve3, join as join5 } from "path";
+import { resolve as resolve3, join as join6 } from "path";
 function webchatGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function webchatServerPath() {
-  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join5(__dirname, ".."), "services/webchat-channel/dist/server.js");
+  return process.env.MAXY_WEBCHAT_CHANNEL_SERVER_PATH ?? resolve3(process.env.MAXY_PLATFORM_ROOT ?? join6(__dirname, ".."), "services/webchat-channel/dist/server.js");
 }
 function webchatChannelDescriptor(key) {
   return { key, gatewayUrl: webchatGatewayUrl(), serverPath: webchatServerPath() };
@@ -4983,7 +5068,7 @@ function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
 }
 
 // app/lib/managed-service.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { readFileSync as readFileSync9 } from "fs";
 function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
   let houseId;
@@ -4994,7 +5079,7 @@ function isHouseManagedService(accountsDir = ACCOUNTS_DIR) {
   }
   try {
     const cfg = JSON.parse(
-      readFileSync9(join6(accountsDir, houseId, "account.json"), "utf-8")
+      readFileSync9(join7(accountsDir, houseId, "account.json"), "utf-8")
     );
     return cfg.managedService === true;
   } catch {
@@ -5008,7 +5093,7 @@ function isCustomerTurnSuppressed(role, managedService) {
 // app/lib/whatsapp/inbound/media.ts
 import { randomUUID as randomUUID4, createHash } from "crypto";
 import { writeFile as writeFile2, mkdir as mkdir2 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import {
   downloadMediaMessage,
   downloadContentFromMessage,
@@ -5023,7 +5108,7 @@ import { resolve as resolve7, extname } from "path";
 
 // app/lib/data-path.ts
 import { realpathSync } from "fs";
-import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join7 } from "path";
+import { resolve as resolve6, normalize, sep as sep2, relative, basename, join as join8 } from "path";
 var PLATFORM_ROOT3 = process.env.MAXY_PLATFORM_ROOT ?? resolve6(process.cwd(), "../platform");
 var DATA_ROOT = resolve6(PLATFORM_ROOT3, "..", "data");
 var CLAUDE_UPLOADS_ROOT = process.env.CLAUDE_CONFIG_DIR ? resolve6(process.env.CLAUDE_CONFIG_DIR, "uploads") : null;
@@ -5091,7 +5176,7 @@ function scratchpadTmpBase() {
 }
 function sessionScratchpadRoot(projectDir, sessionId) {
   const uid = typeof process.geteuid === "function" ? process.geteuid() : 0;
-  return join7(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
+  return join8(scratchpadTmpBase(), `claude-${uid}`, basename(projectDir), sessionId, "scratchpad");
 }
 function resolveScratchpadPath(raw, scratchpadRootAbs) {
   return resolveUnderRoot(raw, scratchpadRootAbs, "scratchpad");
@@ -5634,7 +5719,7 @@ async function downloadInboundMedia(msg, sock, opts) {
   if (!res) return void 0;
   await mkdir2(MEDIA_DIR, { recursive: true });
   const ext = mimeToExt(res.mimetype);
-  const filePath = join8(MEDIA_DIR, `${randomUUID4()}.${ext}`);
+  const filePath = join9(MEDIA_DIR, `${randomUUID4()}.${ext}`);
   await writeFile2(filePath, res.buffer);
   const sizeKB = (res.buffer.length / 1024).toFixed(0);
   console.error(`${TAG14} media downloaded type=${res.mimetype} size=${sizeKB}KB path=${filePath}`);
@@ -7436,7 +7521,7 @@ var health_default = app;
 // app/lib/stt/voice-note.ts
 import { writeFile as writeFile3, mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 
 // app/lib/stt/audio-mime.ts
 var AUDIO_MIME_TYPES = /* @__PURE__ */ new Set([
@@ -7490,9 +7575,9 @@ async function transcribeVoiceNote(file, source) {
   let tempDir;
   let tempPath;
   try {
-    tempDir = await mkdtemp(join9(tmpdir(), "voice-"));
+    tempDir = await mkdtemp(join10(tmpdir(), "voice-"));
     const ext = audioExtension(mimeType);
-    tempPath = join9(tempDir, `recording${ext}`);
+    tempPath = join10(tempDir, `recording${ext}`);
     const buffer = Buffer.from(await file.arrayBuffer());
     await writeFile3(tempPath, buffer);
   } catch (err) {
@@ -8068,7 +8153,7 @@ async function sendTelegramText(botToken, chatId, text) {
 }
 
 // server/routes/whatsapp.ts
-import { join as join12, resolve as resolve11 } from "path";
+import { join as join13, resolve as resolve11 } from "path";
 import { readdirSync as readdirSync7, readFileSync as readFileSync14, existsSync as existsSync8 } from "fs";
 
 // app/lib/whatsapp/login.ts
@@ -8076,7 +8161,7 @@ import { randomUUID as randomUUID6 } from "crypto";
 
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync13, writeFileSync as writeFileSync5, existsSync as existsSync7 } from "fs";
-import { resolve as resolve9, join as join10, dirname as dirname2, basename as basename2 } from "path";
+import { resolve as resolve9, join as join11, dirname as dirname2, basename as basename2 } from "path";
 var TAG22 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve9(accountDir, "account.json");
@@ -8423,7 +8508,7 @@ function setPublicAgent(accountDir, slug) {
   if (!trimmed) {
     return { ok: false, error: "Agent slug cannot be empty." };
   }
-  const agentConfigPath = join10(accountDir, "agents", trimmed, "config.json");
+  const agentConfigPath = join11(accountDir, "agents", trimmed, "config.json");
   if (!existsSync7(agentConfigPath)) {
     return { ok: false, error: `Agent "${trimmed}" not found \u2014 no config.json at ${agentConfigPath}. Check the agent slug and try again.` };
   }
@@ -9060,12 +9145,12 @@ function serializeWhatsAppSchema() {
 
 // app/lib/whatsapp/status-reconcile.ts
 import { readdirSync as readdirSync6 } from "fs";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 var TAG25 = "[whatsapp:reconcile]";
 var HALF_REGISTERED_MIN_AGE_MS = 5 * 6e4;
 function listCredsAccountIds(credsRoot) {
   try {
-    return readdirSync6(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join11(credsRoot, e.name))).map((e) => e.name);
+    return readdirSync6(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(join12(credsRoot, e.name))).map((e) => e.name);
   } catch {
     return [];
   }
@@ -9080,7 +9165,7 @@ function reconcileCredsOnDisk(opts) {
   const entries2 = [];
   for (const accountId of listCredsAccountIds(credsRoot)) {
     if (liveAccountIds.has(accountId)) continue;
-    const authDir = join11(credsRoot, accountId);
+    const authDir = join12(credsRoot, accountId);
     const census = credsCensus(authDir);
     if (census.registered && !census.hasAccountSignature) {
       const inFlight3 = activeLoginAccountIds.has(accountId);
@@ -9317,7 +9402,7 @@ app2.get("/status", (c) => {
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
     const activeLoginIds = new Set(listActiveLoginAccountIds());
-    const credsRoot = join12(MAXY_DIR, "credentials", "whatsapp");
+    const credsRoot = join13(MAXY_DIR, "credentials", "whatsapp");
     const accountDir = resolveAccount()?.accountDir ?? null;
     const reconciled = reconcileCredsOnDisk({ credsRoot, accountDir, liveAccountIds: liveIds, activeLoginAccountIds: activeLoginIds });
     const cfg = getWhatsAppConfig();
@@ -9354,7 +9439,7 @@ app2.post("/login/start", async (c) => {
     if (!phone) {
       return c.json({ error: 'Missing required field "phone" (E.164, e.g. +441234567890).' }, 400);
     }
-    const authDir = join12(MAXY_DIR, "credentials", "whatsapp", accountId);
+    const authDir = join13(MAXY_DIR, "credentials", "whatsapp", accountId);
     const accountDir = resolveAccount()?.accountDir ?? null;
     const result = await startLogin({ accountId, authDir, phone, accountDir, force });
     console.error(`${TAG26} login/start result account=${accountId} hasCode=${!!result.pairingCode}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
@@ -10001,12 +10086,12 @@ var bodyLimit = (options) => {
 };
 
 // server/routes/storage-broker.ts
-import { join as join13, resolve as resolve12 } from "path";
+import { join as join14, resolve as resolve12 } from "path";
 import { readdirSync as readdirSync8, readFileSync as readFileSync15, existsSync as existsSync9, realpathSync as realpathSync4 } from "fs";
 import { randomUUID as randomUUID7 } from "crypto";
 var app3 = new Hono();
 function platformRoot() {
-  return process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? join13(__dirname, "..", "..");
+  return process.env.MAXY_PLATFORM_ROOT ?? process.env.PLATFORM_ROOT ?? join14(__dirname, "..", "..");
 }
 function caller(c) {
   return c.req.header("x-maxy-caller-account")?.trim() || null;
@@ -10541,7 +10626,7 @@ async function runStorageAudit(root) {
       if (!existsSync9(accountsDir)) return [];
       const files = [];
       for (const accountId of readdirSync8(accountsDir)) {
-        const p = join13(accountsDir, accountId, "secrets", "cloudflare.env");
+        const p = join14(accountsDir, accountId, "secrets", "cloudflare.env");
         if (existsSync9(p)) files.push({ accountId, path: p, contents: readFileSync15(p, "utf8") });
       }
       return files;
@@ -10640,7 +10725,7 @@ function discoverPortalAccounts(accountsDir) {
   if (!existsSync9(accountsDir)) return [];
   const found = [];
   for (const accountId of readdirSync8(accountsDir)) {
-    const configPath2 = join13(accountsDir, accountId, "data-portal.json");
+    const configPath2 = join14(accountsDir, accountId, "data-portal.json");
     if (!existsSync9(configPath2)) continue;
     try {
       const cfg = JSON.parse(readFileSync15(configPath2, "utf-8"));
@@ -10723,7 +10808,7 @@ async function runDataPortalAudit(root) {
 // server/portal-uploads-pull.ts
 import { existsSync as existsSync10 } from "fs";
 import { mkdir as mkdir3, readFile as readFile2, rename, stat as stat3, unlink as unlink2, writeFile as writeFile4 } from "fs/promises";
-import { basename as basename4, dirname as dirname4, join as join14, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
+import { basename as basename4, dirname as dirname4, join as join15, relative as relative2, resolve as resolve13, sep as sep3 } from "path";
 
 // ../plugins/cloudflare/bin/schema-exposed-dirs.mjs
 var ONT_START = "<!-- ontology-buckets:start -->";
@@ -10821,19 +10906,19 @@ function resolveDestination(accountDir, row, exposed) {
     if (!segments.every(safeSegment)) return { ok: false, reason: "bad-target" };
     if (!exposed.includes(segments[0])) return { ok: false, reason: "bad-target" };
     root = resolve13(accountDir);
-    dir = join14(root, ...segments);
+    dir = join15(root, ...segments);
   } else {
     root = resolve13(accountDir, "uploads");
-    dir = join14(root, row.ownerId);
+    dir = join15(root, row.ownerId);
   }
-  const final = join14(dir, row.filename);
+  const final = join15(dir, row.filename);
   if (!final.startsWith(root + sep3)) {
     return { ok: false, reason: row.targetPath ? "bad-target" : "bad-filename" };
   }
   return {
     ok: true,
     dir,
-    tmp: join14(dir, ".uploads-tmp", row.filename),
+    tmp: join15(dir, ".uploads-tmp", row.filename),
     final,
     relative: relative2(resolve13(accountDir), final).split(sep3).join("/")
   };
@@ -10846,7 +10931,7 @@ function nextFreePath(final) {
   const stem = dot > 0 ? base.slice(0, dot) : base;
   const ext = dot > 0 ? base.slice(dot) : "";
   for (let n = 2; ; n++) {
-    const candidate = join14(dir, `${stem} (${n})${ext}`);
+    const candidate = join15(dir, `${stem} (${n})${ext}`);
     if (!existsSync10(candidate)) return candidate;
   }
 }
@@ -10950,7 +11035,7 @@ async function withdrawRow(opts) {
     log2(`${head} removed=false result=bad-path`);
     return false;
   }
-  const absolute = join14(resolve13(accountDir), ...segments);
+  const absolute = join15(resolve13(accountDir), ...segments);
   if (!absolute.startsWith(resolve13(accountDir) + sep3)) {
     log2(`${head} removed=false result=bad-path`);
     return false;
@@ -11015,13 +11100,13 @@ function parsePendingRows(raw) {
 async function readExposedDirs(accountDir) {
   let schemaText = null;
   try {
-    schemaText = await readFile2(join14(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile2(join15(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
   let exposeFolders = [];
   try {
-    const cfg = JSON.parse(await readFile2(join14(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile2(join15(accountDir, "data-portal.json"), "utf8"));
     exposeFolders = Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     exposeFolders = [];
@@ -11046,7 +11131,7 @@ async function runPortalUploadsPull(root) {
         console.error(`${TAG27} op=malformed account=${portal.accountId} rows=${malformed}`);
       }
       if (rows.length === 0) continue;
-      const accountDir = join14(accountsRoot, portal.accountId);
+      const accountDir = join15(accountsRoot, portal.accountId);
       const r = await pullAccount({
         accountDir,
         accountId: portal.accountId,
@@ -11079,7 +11164,7 @@ async function runPortalUploadsPull(root) {
 import { readFile as readFile3, readdir, stat as stat4 } from "fs/promises";
 import { existsSync as existsSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
 import { execFileSync as execFileSync2 } from "child_process";
-import { join as join15, resolve as resolve14 } from "path";
+import { join as join16, resolve as resolve14 } from "path";
 import { fileURLToPath } from "url";
 
 // ../plugins/cloudflare/bin/d1-http.mjs
@@ -11155,7 +11240,7 @@ function readEnvFile(path3) {
 }
 async function readExposeFolders(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile3(join15(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile3(join16(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -11166,12 +11251,12 @@ async function walkExposed(accountDir, exposed) {
   async function walk(rel) {
     let entries2;
     try {
-      entries2 = await readdir(join15(accountDir, rel), { withFileTypes: true });
+      entries2 = await readdir(join16(accountDir, rel), { withFileTypes: true });
     } catch {
       return;
     }
     try {
-      const st = await stat4(join15(accountDir, rel));
+      const st = await stat4(join16(accountDir, rel));
       out.push({ relPath: rel, sizeBytes: 0, modifiedAt: st.mtime.toISOString(), isDir: true });
     } catch {
     }
@@ -11182,7 +11267,7 @@ async function walkExposed(accountDir, exposed) {
         await walk(childRel);
       } else if (e.isFile()) {
         try {
-          const st = await stat4(join15(accountDir, childRel));
+          const st = await stat4(join16(accountDir, childRel));
           out.push({
             relPath: childRel,
             sizeBytes: st.size,
@@ -11201,7 +11286,7 @@ async function pushAccount(opts) {
   const { accountDir, accountId, client, log: log2, nowIso } = opts;
   let schemaText = null;
   try {
-    schemaText = await readFile3(join15(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile3(join16(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -11231,19 +11316,11 @@ async function pushAccount(opts) {
     [accountId]
   );
   const current = Number(state[0]?.currentGeneration ?? 0);
-  const next = current + 1;
-  const orphan = await client.query(
-    "SELECT COUNT(*) AS n FROM directory WHERE accountId = ? AND generation = ?",
-    [accountId, next]
+  const staged = await client.query(
+    "SELECT MAX(generation) AS g FROM directory WHERE accountId = ?",
+    [accountId]
   );
-  const orphanCount = Number(orphan[0]?.n ?? 0);
-  if (orphanCount > 0) {
-    await client.query("DELETE FROM directory WHERE accountId = ? AND generation = ?", [
-      accountId,
-      next
-    ]);
-    log2(`${TAG28} op=stage-clear account=${accountId} generation=${next} cleared=${orphanCount}`);
-  }
+  const next = Math.max(current, Number(staged[0]?.g ?? 0)) + 1;
   for (const row of rows) {
     await client.query(
       "INSERT INTO directory (accountId, relPath, sizeBytes, modifiedAt, indexedAt, isDir, generation) VALUES (?, ?, ?, ?, ?, ?, ?)",
@@ -11252,12 +11329,29 @@ async function pushAccount(opts) {
   }
   log2(`${TAG28} op=stage account=${accountId} generation=${next} inserted=${rows.length}`);
   await client.query(
-    "INSERT INTO directory_state (accountId, currentGeneration) VALUES (?, ?) ON CONFLICT (accountId) DO UPDATE SET currentGeneration = excluded.currentGeneration",
+    "INSERT INTO directory_state (accountId, currentGeneration) VALUES (?, ?) ON CONFLICT (accountId) DO UPDATE SET currentGeneration = excluded.currentGeneration WHERE excluded.currentGeneration > directory_state.currentGeneration",
     [accountId, next]
   );
+  const flipped = await client.query(
+    "SELECT currentGeneration FROM directory_state WHERE accountId = ?",
+    [accountId]
+  );
+  const pointer = Number(flipped[0]?.currentGeneration ?? 0);
+  if (pointer !== next) {
+    log2(
+      `${TAG28} op=stage-contended account=${accountId} generation=${next} pointer=${pointer} action=superseded`
+    );
+    return {
+      exposed: r.exposed,
+      rows: rows.length,
+      schemaPresent: true,
+      generation: next,
+      superseded: true
+    };
+  }
   log2(`${TAG28} op=flip account=${accountId} generation=${next}`);
   try {
-    await client.query("DELETE FROM directory WHERE accountId = ? AND generation != ?", [
+    await client.query("DELETE FROM directory WHERE accountId = ? AND generation < ?", [
       accountId,
       next
     ]);
@@ -11309,9 +11403,9 @@ async function portalAccounts(accountsRoot) {
     return out;
   }
   for (const accountId of names) {
-    const accountDir = join15(accountsRoot, accountId);
+    const accountDir = join16(accountsRoot, accountId);
     try {
-      const cfg = JSON.parse(await readFile3(join15(accountDir, "data-portal.json"), "utf8"));
+      const cfg = JSON.parse(await readFile3(join16(accountDir, "data-portal.json"), "utf8"));
       if (typeof cfg?.portalDbName === "string" && cfg.portalDbName) {
         const exposeFolders = Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
         out.push({ accountDir, accountId, dbName: cfg.portalDbName, exposeFolders });
@@ -11324,11 +11418,11 @@ async function portalAccounts(accountsRoot) {
   return out;
 }
 function resolveCloudflareCredentials(platformRoot5) {
-  const houseEnvPath = join15(platformRoot5, "config", "cloudflare-house.env");
+  const houseEnvPath = join16(platformRoot5, "config", "cloudflare-house.env");
   const house = readEnvFile(houseEnvPath);
   if (!house.CLOUDFLARE_API_TOKEN) return { error: "no-house-cloudflare-credential" };
   if (!house.CLOUDFLARE_ACCOUNT_ID) return { error: "no-house-cloudflare-account-id" };
-  const cfTokenSh = join15(platformRoot5, "plugins", "cloudflare", "bin", "cf-token.sh");
+  const cfTokenSh = join16(platformRoot5, "plugins", "cloudflare", "bin", "cf-token.sh");
   if (!existsSync11(cfTokenSh)) return { error: "cf-token-sh-missing" };
   let keyName;
   try {
@@ -11434,17 +11528,17 @@ async function runPortalIndexPush(root) {
 }
 
 // server/google-pending-audit.ts
-import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync4 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, readdirSync as readdirSync9, statSync as statSync5 } from "fs";
+import { join as join17 } from "path";
 var GOOGLE_PENDING_LIFETIME_SEC = 600;
 var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync4(path3).mtimeMs) {
+function runGooglePendingAudit(accountsDir, nowMs, emit, readMtimeMs = (path3) => statSync5(path3).mtimeMs) {
   let scanned = 0;
   let stranded = 0;
   if (existsSync12(accountsDir)) {
     for (const accountId of readdirSync9(accountsDir)) {
       if (!UUID_RE2.test(accountId)) continue;
-      const pendingPath2 = join16(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
+      const pendingPath2 = join17(accountsDir, accountId, "secrets", "google", "pending-oauth.enc");
       try {
         if (!existsSync12(pendingPath2)) continue;
         const ageSec = Math.max(0, Math.floor((nowMs - readMtimeMs(pendingPath2)) / 1e3));
@@ -11502,18 +11596,19 @@ function runReconcileLivenessAudit(statePath, nowMs, intervalMs, emit) {
 
 // server/routes/whatsapp-reader.ts
 import { readFileSync as readFileSync21, watch as watch2, statSync as statSync8, openSync, readSync, closeSync, existsSync as existsSync17, readdirSync as readdirSync14, realpathSync as realpathSync6 } from "fs";
-import { basename as basename6, dirname as dirname7, isAbsolute, join as join21, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
+import { basename as basename6, dirname as dirname7, isAbsolute, join as join22, relative as relative3, resolve as resolve17, sep as sep5 } from "path";
 
 // server/routes/admin/sidebar-sessions.ts
-import { readdirSync as readdirSync12, readFileSync as readFileSync19, statSync as statSync6 } from "fs";
-import { dirname as dirname5, join as join19, resolve as resolve15 } from "path";
+import { readdirSync as readdirSync12, readFileSync as readFileSync19 } from "fs";
+import { readFile as readFile4, stat as stat5 } from "fs/promises";
+import { dirname as dirname5, join as join20, resolve as resolve15 } from "path";
 
 // ../services/claude-session-manager/src/jsonl-path.ts
 import { existsSync as existsSync14, readdirSync as readdirSync10 } from "fs";
 import { homedir } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
-  const projectsRoot = join17(claudeConfigDir2, "projects");
+  const projectsRoot = join18(claudeConfigDir2, "projects");
   if (!existsSync14(projectsRoot)) return null;
   let slugs;
   try {
@@ -11523,9 +11618,9 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
   }
   const basename15 = `${sessionId}.jsonl`;
   for (const slug of slugs) {
-    const live = join17(projectsRoot, slug, basename15);
+    const live = join18(projectsRoot, slug, basename15);
     if (existsSync14(live)) return live;
-    const archived = join17(projectsRoot, slug, "archive", basename15);
+    const archived = join18(projectsRoot, slug, "archive", basename15);
     if (existsSync14(archived)) return archived;
   }
   return null;
@@ -11533,8 +11628,8 @@ function findExistingJsonlForSessionId(claudeConfigDir2, sessionId) {
 
 // app/lib/admin-identity/pin-validator.ts
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync5 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync18, readdirSync as readdirSync11, statSync as statSync6 } from "fs";
+import { join as join19 } from "path";
 function hashPin(pin) {
   return createHash3("sha256").update(pin).digest("hex");
 }
@@ -11665,7 +11760,7 @@ function enumerateJsonls(projectsRoot) {
     throw err;
   }
   for (const slug of slugs) {
-    const slugDir = join19(projectsRoot, slug);
+    const slugDir = join20(projectsRoot, slug);
     let entries2;
     try {
       entries2 = readdirSync12(slugDir, { withFileTypes: true });
@@ -11676,9 +11771,9 @@ function enumerateJsonls(projectsRoot) {
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_ID_RE.test(entry.name)) {
-        out.push({ path: join19(slugDir, entry.name), isSubagent: false, archived: false });
+        out.push({ path: join20(slugDir, entry.name), isSubagent: false, archived: false });
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join19(slugDir, entry.name);
+        const subDir = join20(slugDir, entry.name);
         let subEntries;
         try {
           subEntries = readdirSync12(subDir, { withFileTypes: true });
@@ -11689,11 +11784,11 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const sub of subEntries) {
           if (sub.isFile() && SESSION_ID_RE.test(sub.name)) {
-            out.push({ path: join19(subDir, sub.name), isSubagent: true, archived: false });
+            out.push({ path: join20(subDir, sub.name), isSubagent: true, archived: false });
           }
         }
       } else if (entry.isDirectory() && entry.name === "archive") {
-        const archiveDir = join19(slugDir, entry.name);
+        const archiveDir = join20(slugDir, entry.name);
         let archiveEntries;
         try {
           archiveEntries = readdirSync12(archiveDir, { withFileTypes: true });
@@ -11704,7 +11799,7 @@ function enumerateJsonls(projectsRoot) {
         }
         for (const arc of archiveEntries) {
           if (arc.isFile() && SESSION_ID_RE.test(arc.name)) {
-            out.push({ path: join19(archiveDir, arc.name), isSubagent: false, archived: true });
+            out.push({ path: join20(archiveDir, arc.name), isSubagent: false, archived: true });
           }
         }
       }
@@ -11735,15 +11830,27 @@ async function fetchLiveSessions() {
   return out;
 }
 function loadUserTitles(accountDir) {
-  const out = /* @__PURE__ */ new Map();
-  if (!accountDir) return out;
-  const path3 = join19(accountDir, "session-titles.json");
+  if (!accountDir) return /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = readFileSync19(path3, "utf8");
+    raw = readFileSync19(join20(accountDir, "session-titles.json"), "utf8");
   } catch {
-    return out;
+    return /* @__PURE__ */ new Map();
+  }
+  return parseUserTitles(raw);
+}
+async function loadUserTitlesAsync(accountDir) {
+  if (!accountDir) return /* @__PURE__ */ new Map();
+  let raw;
+  try {
+    raw = await readFile4(join20(accountDir, "session-titles.json"), "utf8");
+  } catch {
+    return /* @__PURE__ */ new Map();
   }
+  return parseUserTitles(raw);
+}
+function parseUserTitles(raw) {
+  const out = /* @__PURE__ */ new Map();
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -11763,20 +11870,34 @@ function loadUserTitles(accountDir) {
   return out;
 }
 function readSidecarMeta(metaPath) {
-  const empty = { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null, accountId: null };
   let raw;
   try {
     raw = readFileSync19(metaPath, "utf8");
   } catch {
-    return empty;
+    return emptySidecarMeta();
+  }
+  return parseSidecarMeta(raw);
+}
+function emptySidecarMeta() {
+  return { bridgeIds: [], role: null, channel: null, senderId: null, startedAt: null, personId: null, adminUserId: null, visitorId: null, agentSlug: null, accountId: null };
+}
+async function readSidecarMetaAsync(metaPath) {
+  let raw;
+  try {
+    raw = await readFile4(metaPath, "utf8");
+  } catch {
+    return emptySidecarMeta();
   }
+  return parseSidecarMeta(raw);
+}
+function parseSidecarMeta(raw) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch {
-    return empty;
+    return emptySidecarMeta();
   }
-  if (!parsed || typeof parsed !== "object") return empty;
+  if (!parsed || typeof parsed !== "object") return emptySidecarMeta();
   const r = parsed;
   const bridgeIds = Array.isArray(r.bridgeIds) ? r.bridgeIds.filter((b) => typeof b === "string" && b.length > 0) : [];
   return {
@@ -11877,12 +11998,12 @@ async function computeSessionList(scopeAccountId) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
     return { sessions: [], accountId: scopeAccountId };
   }
-  const projectsRoot = join19(configDir2, "projects");
+  const projectsRoot = join20(configDir2, "projects");
   const jsonls = enumerateJsonls(projectsRoot);
   const liveSessions = await fetchLiveSessions();
   const accountDir = scopeAccountId ? resolve15(ACCOUNTS_DIR, scopeAccountId) : null;
-  const userTitles = loadUserTitles(accountDir);
-  const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : resolveAccount();
+  const userTitles = await loadUserTitlesAsync(accountDir);
+  const account = multiAccount ? validAccounts.find((a) => a.accountId === scopeAccountId) ?? null : validAccounts[0] ?? null;
   let channelUsers = [];
   if (account) {
     try {
@@ -11921,8 +12042,8 @@ async function computeSessionList(scopeAccountId) {
     let body;
     let mtimeMs;
     try {
-      body = readFileSync19(path3, "utf8");
-      mtimeMs = statSync6(path3).mtimeMs;
+      body = await readFile4(path3, "utf8");
+      mtimeMs = (await stat5(path3)).mtimeMs;
     } catch {
       continue;
     }
@@ -11930,8 +12051,8 @@ async function computeSessionList(scopeAccountId) {
     const pid = live ? liveSessions.get(sessionId) ?? null : null;
     const resolved = resolveTitle(body, sessionId, userTitles);
     titleSourceCounts[resolved.source] += 1;
-    const metaPath = join19(projectDir, `${sessionId}.meta.json`);
-    const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = readSidecarMeta(metaPath);
+    const metaPath = join20(projectDir, `${sessionId}.meta.json`);
+    const { bridgeIds, role, channel: sidecarChannel, senderId, personId, adminUserId, accountId: rowAccountId } = await readSidecarMetaAsync(metaPath);
     if (multiAccount) {
       if (rowAccountId === null) untaggedCount += 1;
       if (rowAccountId !== scopeAccountId) continue;
@@ -12333,7 +12454,7 @@ function parseTranscript(lines, queuedPendingSuppress = /* @__PURE__ */ new Map(
 
 // app/lib/whatsapp-reader/enrich-attachments.ts
 import { readFileSync as readFileSync20, readdirSync as readdirSync13, existsSync as existsSync16, statSync as statSync7, realpathSync as realpathSync5 } from "fs";
-import { basename as basename5, dirname as dirname6, join as join20, resolve as resolve16, sep as sep4 } from "path";
+import { basename as basename5, dirname as dirname6, join as join21, resolve as resolve16, sep as sep4 } from "path";
 var ADMIN_UPLOAD_PATH = /\/uploads\/(?!public\/)([0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12})\//gi;
 function adminAttachmentIds(text) {
   const ids = [];
@@ -12346,7 +12467,7 @@ function adminAttachmentIds(text) {
 function adminAttachmentsFromText(text, uploadsBase) {
   const out = [];
   for (const id of adminAttachmentIds(text)) {
-    const meta = readAttachmentMeta(join20(uploadsBase, id));
+    const meta = readAttachmentMeta(join21(uploadsBase, id));
     if (meta) out.push(meta);
   }
   return out;
@@ -12396,7 +12517,7 @@ function claudeUploadAttachmentsFromText(text, sessionId) {
 function readSidecar(dir, attachmentId) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync20(join20(dir, `${attachmentId}.meta.json`), "utf8"));
+    parsed = JSON.parse(readFileSync20(join21(dir, `${attachmentId}.meta.json`), "utf8"));
   } catch {
     return null;
   }
@@ -12425,7 +12546,7 @@ function listSessionAttachmentsInDir(dir) {
   }
   const sidecars = [];
   for (const name of entries2) {
-    const sidecar = readSidecar(join20(dir, name), name);
+    const sidecar = readSidecar(join21(dir, name), name);
     if (sidecar) sidecars.push(sidecar);
   }
   sidecars.sort((a, b) => a.storedAt.localeCompare(b.storedAt));
@@ -12585,14 +12706,14 @@ app5.get("/conversations", requireAdminSession, async (c) => {
   }
   const cfg = claudeConfigDir();
   if (!cfg) return c.json({ conversations: [] });
-  const projectsRoot = join21(cfg, "projects");
+  const projectsRoot = join22(cfg, "projects");
   const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
   const rows = [];
   let sessionRowsExcludedUntagged = 0;
   for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
     const sessionId = basename6(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname7(path3);
-    const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
     if (!isReaderChannelSession(meta.role, meta.channel)) continue;
     if (multiAccount) {
       if (meta.accountId === null) sessionRowsExcludedUntagged += 1;
@@ -12723,7 +12844,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
   const { value, state } = await getOrCompute("conversations-all", houseId, async () => {
     const cfg = claudeConfigDir();
     if (!cfg) return { conversations: [] };
-    const projectsRoot = join21(cfg, "projects");
+    const projectsRoot = join22(cfg, "projects");
     const userTitles = loadUserTitles(ACCOUNTS_DIR ?? null);
     const validAccounts = listValidAccounts();
     const validIds = new Set(validAccounts.map((a) => a.accountId));
@@ -12732,7 +12853,7 @@ app5.get("/conversations-all", requireAdminSession, async (c) => {
     for (const { path: path3 } of enumerateJsonls(projectsRoot)) {
       const sessionId = basename6(path3).replace(/\.jsonl$/, "");
       const projectDir = dirname7(path3);
-      const meta = readSidecarMeta(join21(projectDir, `${sessionId}.meta.json`));
+      const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
       if (!isReaderChannelSession(meta.role, meta.channel)) continue;
       if (meta.accountId === null || !validIds.has(meta.accountId)) continue;
       let body = "";
@@ -12897,7 +13018,7 @@ function openTaskKey(turns) {
 }
 function readSubagentMeta(dir, hex) {
   try {
-    const m = JSON.parse(readFileSync21(join21(dir, `agent-${hex}.meta.json`), "utf8"));
+    const m = JSON.parse(readFileSync21(join22(dir, `agent-${hex}.meta.json`), "utf8"));
     if (typeof m.agentType === "string" && typeof m.description === "string" && typeof m.toolUseId === "string") {
       return { agentType: m.agentType, description: m.description, toolUseId: m.toolUseId };
     }
@@ -12929,7 +13050,7 @@ function runActivityTick(c) {
     let size = 0;
     let mtimeMs = 0;
     try {
-      const st = statSync8(join21(c.subagentsDir, name));
+      const st = statSync8(join22(c.subagentsDir, name));
       size = st.size;
       mtimeMs = st.mtimeMs;
     } catch {
@@ -12974,11 +13095,11 @@ app5.get("/stream", requireAdminSession, (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve17(join21(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve17(join22(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve17(join21(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve17(join22(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep5)) {
     return c.json({ error: "bad session reference" }, 400);
   }
@@ -13005,7 +13126,7 @@ data: ${JSON.stringify(turn)}
       let offset = resumeOffset(lastEventId, fileEnd0);
       console.log(`[wa-stream] op=open conn=${connId} sessionId=${sessionId} channel=reader resume=${offset}`);
       const sessionKey = c.req.query("session_key") ?? "";
-      const subagentsDir = resolve17(join21(projectDir, sessionId, "subagents"));
+      const subagentsDir = resolve17(join22(projectDir, sessionId, "subagents"));
       console.log(
         `[webchat-activity] op=watch-subagents key=${sessionKey} dir=${subagentsDir} exists=${existsSync17(subagentsDir)}`
       );
@@ -13134,7 +13255,7 @@ app5.get("/directives", requireAdminSession, (c) => {
     const pid = Number(pidPart);
     let len = 0;
     try {
-      len = statSync8(join21(dir, name)).size;
+      len = statSync8(join22(dir, name)).size;
     } catch {
     }
     return { name, secs, pid, ts: Number.isFinite(secs) ? new Date(secs * 1e3).toISOString() : null, len };
@@ -13149,7 +13270,7 @@ app5.get("/directive", requireAdminSession, (c) => {
   }
   const dir = directiveStoreDir(sessionId);
   if (!dir) return c.json({ error: "no account" }, 404);
-  const path3 = resolve17(join21(dir, name));
+  const path3 = resolve17(join22(dir, name));
   if (!path3.startsWith(dir + sep5)) return c.json({ error: "bad reference" }, 400);
   let body;
   try {
@@ -13207,7 +13328,7 @@ app5.get("/store-stream", requireAdminSession, (c) => {
       console.log(`[wa-reader] op=store-quote msgId=${r.msgKeyId} quoted=${!!q2}`);
     }
     if (r.attachmentId) {
-      const meta = readAttachmentMeta(join21(uploadsBase, r.attachmentId));
+      const meta = readAttachmentMeta(join22(uploadsBase, r.attachmentId));
       if (meta) return { ...turn, attachments: [meta] };
     }
     return turn;
@@ -13588,7 +13709,7 @@ var whatsapp_reader_default = app5;
 
 // server/routes/public-reader.ts
 import { statSync as statSync9, openSync as openSync2, readSync as readSync2, closeSync as closeSync2, watch as watch3, readFileSync as readFileSync22, readdirSync as readdirSync15 } from "fs";
-import { basename as basename7, dirname as dirname8, join as join22, resolve as resolve18, sep as sep6 } from "path";
+import { basename as basename7, dirname as dirname8, join as join23, resolve as resolve18, sep as sep6 } from "path";
 
 // app/lib/whatsapp-reader/delivered-kinds.ts
 var PUBLIC_DELIVERED_KINDS = /* @__PURE__ */ new Set([
@@ -13662,10 +13783,10 @@ function enumeratePublicRows() {
   const cfg = claudeConfigDir();
   if (!cfg) return [];
   const rows = [];
-  for (const { path: path3 } of enumerateJsonls(join22(cfg, "projects"))) {
+  for (const { path: path3 } of enumerateJsonls(join23(cfg, "projects"))) {
     const sessionId = basename7(path3).replace(/\.jsonl$/, "");
     const projectDir = dirname8(path3);
-    const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
     rows.push({
       sessionId,
       projectDir,
@@ -13741,15 +13862,15 @@ app6.get("/stream", (c) => {
   const sessionId = c.req.query("sessionId") ?? "";
   const projectDir = c.req.query("projectDir") ?? "";
   const cfg = claudeConfigDir();
-  const projectsRoot = cfg ? resolve18(join22(cfg, "projects")) : null;
+  const projectsRoot = cfg ? resolve18(join23(cfg, "projects")) : null;
   if (!cfg || !projectsRoot || !SESSION_ID_RE2.test(sessionId)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const jsonlPath = resolve18(join22(projectDir, `${sessionId}.jsonl`));
+  const jsonlPath = resolve18(join23(projectDir, `${sessionId}.jsonl`));
   if (!jsonlPath.startsWith(projectsRoot + sep6)) {
     return c.json({ error: "bad session reference" }, 400);
   }
-  const meta = readSidecarMeta(join22(projectDir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join23(projectDir, `${sessionId}.meta.json`));
   const isPublicWebchat = meta.role === "public" && meta.channel === "webchat";
   const owns = visitor.kind === "person" ? meta.personId === visitor.personId : meta.personId === null && meta.visitorId === visitor.visitorId;
   if (!(isPublicWebchat && owns)) {
@@ -13886,16 +14007,16 @@ var public_reader_default = app6;
 
 // server/routes/webchat.ts
 import { basename as basename8, dirname as dirname9 } from "path";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 import { existsSync as existsSync19, readdirSync as readdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, statSync as statSync10, writeFileSync as writeFileSync9 } from "fs";
 
 // server/canonical-webchat-override.ts
 import { readFileSync as readFileSync23, writeFileSync as writeFileSync7, renameSync as renameSync2 } from "fs";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 var FILE = "canonical-webchat-session.json";
 var UUID2 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function canonicalOverridePath(accountDir) {
-  return join23(accountDir, FILE);
+  return join24(accountDir, FILE);
 }
 function readRaw(accountDir) {
   try {
@@ -13931,6 +14052,31 @@ function writeCanonicalOverrideId(accountDir, userId, sessionId) {
   renameSync2(tmp, path3);
 }
 
+// server/routes/admin/_account-scope.ts
+function accountDirForSession(cacheKey) {
+  const accountId = getAccountIdForSession(cacheKey);
+  if (!accountId) return null;
+  const match = listValidAccounts().find((a) => a.accountId === accountId);
+  return match ? { accountId, accountDir: match.accountDir, config: match.config } : null;
+}
+function validateAccountId2(accountId) {
+  if (!accountId) return null;
+  const match = listValidAccounts().find((a) => a.accountId === accountId);
+  return match ? { accountId, accountDir: match.accountDir, config: match.config } : null;
+}
+async function authorizeAccountWrite(c, accountId) {
+  const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
+  const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
+  if (peerIsLoopback && !c.req.header("x-forwarded-for")) return { ok: true, via: "on-device" };
+  const { fingerprint, signedSessionToken } = await resolveCacheKey(c);
+  if (!fingerprint || !validateSession(fingerprint, "admin", signedSessionToken).ok) {
+    return { ok: false, reason: "no-session" };
+  }
+  const acct = accountDirForSession(fingerprint);
+  if (!acct || acct.accountId !== accountId) return { ok: false, reason: "account-mismatch" };
+  return { ok: true, via: "session" };
+}
+
 // ../lib/models/src/index.ts
 var OPUS_MODEL = "claude-opus-5[1m]";
 var SONNET_MODEL = "claude-sonnet-5";
@@ -13975,7 +14121,7 @@ function isNewSessionEffortLevel(value) {
 
 // ../services/claude-session-manager/src/sidecar-store.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync4, readdirSync as readdirSync16, readFileSync as readFileSync24, renameSync as renameSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function escapeRegExp(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -13983,7 +14129,7 @@ function createSidecarStore(config) {
   const { suffix, validate: validate2 } = config;
   const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
   function pathFor(sessionsDir, id) {
-    return join24(sessionsDir, `${id}${suffix}`);
+    return join25(sessionsDir, `${id}${suffix}`);
   }
   function write(sessionsDir, id, record) {
     mkdirSync4(sessionsDir, { recursive: true });
@@ -14027,7 +14173,7 @@ function createSidecarStore(config) {
     const out = [];
     for (const name of names) {
       if (!suffixRe.test(name)) continue;
-      const path3 = join24(sessionsDir, name);
+      const path3 = join25(sessionsDir, name);
       let raw;
       try {
         raw = readFileSync24(path3, "utf8");
@@ -14104,13 +14250,13 @@ var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9
 function locateSession(sessionId) {
   const dir = findSessionProjectDir(sessionId);
   if (!dir) return { projectDir: null, channel: null, accountId: null };
-  const meta = readSidecarMeta(join25(dir, `${sessionId}.meta.json`));
+  const meta = readSidecarMeta(join26(dir, `${sessionId}.meta.json`));
   return { projectDir: dir, channel: meta.channel, accountId: meta.accountId };
 }
 function locateSidecar(sessionId) {
   const cfg = claudeConfigDir();
   if (!cfg) return null;
-  const projectsRoot = join25(cfg, "projects");
+  const projectsRoot = join26(cfg, "projects");
   let slugs;
   try {
     slugs = readdirSync17(projectsRoot, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name);
@@ -14118,7 +14264,7 @@ function locateSidecar(sessionId) {
     return null;
   }
   for (const slug of slugs) {
-    const metaPath = join25(projectsRoot, slug, `${sessionId}.meta.json`);
+    const metaPath = join26(projectsRoot, slug, `${sessionId}.meta.json`);
     if (existsSync19(metaPath)) return readSidecarMeta(metaPath);
   }
   return null;
@@ -14128,7 +14274,7 @@ function readTargetOwner(sessionId) {
   if (sidecar !== null) return { found: true, owner: sidecar.adminUserId };
   const { projectDir } = locateSession(sessionId);
   if (projectDir !== null) {
-    return { found: true, owner: readSidecarMeta(join25(projectDir, `${sessionId}.meta.json`)).adminUserId };
+    return { found: true, owner: readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`)).adminUserId };
   }
   return { found: false, owner: null };
 }
@@ -14136,7 +14282,7 @@ function readSourceRowMeta(sessionId) {
   const sidecar = locateSidecar(sessionId);
   if (sidecar !== null) return sidecar;
   const { projectDir } = locateSession(sessionId);
-  if (projectDir !== null) return readSidecarMeta(join25(projectDir, `${sessionId}.meta.json`));
+  if (projectDir !== null) return readSidecarMeta(join26(projectDir, `${sessionId}.meta.json`));
   return null;
 }
 function ownedByRequester(owner, requesterUserId, primaryUserId) {
@@ -14149,7 +14295,7 @@ function sessionSidecarExists(sessionId) {
 function jsonlSizeBytes(projectDir, sessionId) {
   if (projectDir === null) return null;
   try {
-    return statSync10(join25(projectDir, `${sessionId}.jsonl`)).size;
+    return statSync10(join26(projectDir, `${sessionId}.jsonl`)).size;
   } catch {
     return null;
   }
@@ -14252,15 +14398,7 @@ async function managerInterrupt(sessionId, trigger, escalate = false) {
   }
 }
 var MODEL_ID_PATTERN = /^claude-[a-z0-9][a-z0-9.-]*(\[1m\])?$/;
-function readLevers(preResolved) {
-  let account = preResolved;
-  if (account === void 0) {
-    try {
-      account = resolveAccount();
-    } catch {
-      return { leverModel: null, leverEffort: null, leverMode: null };
-    }
-  }
+function readLevers(account) {
   if (!account) return { leverModel: null, leverEffort: null, leverMode: null };
   const model = account.config.adminModel;
   const effort = account.config.effort;
@@ -14285,10 +14423,10 @@ function latestAdminWebchatSessionId(requesterUserId, primaryUserId, scopeAccoun
   const cfg = claudeConfigDir();
   if (!cfg) return null;
   let best = null;
-  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join25(cfg, "projects"))) {
+  for (const { path: path3, isSubagent, archived } of enumerateJsonls(join26(cfg, "projects"))) {
     if (isSubagent || archived) continue;
     const id = basename8(path3).slice(0, -".jsonl".length);
-    const meta = readSidecarMeta(join25(dirname9(path3), `${id}.meta.json`));
+    const meta = readSidecarMeta(join26(dirname9(path3), `${id}.meta.json`));
     if (meta.role !== "admin" || meta.channel !== "webchat") continue;
     if (multiAccount && meta.accountId !== scopeAccountId) continue;
     let mtimeMs;
@@ -14526,12 +14664,7 @@ ${note}` : note;
     const sendId = sendIdFromResolve ?? ++sendSeq;
     let turnSessionId = deliverySessionId;
     if (turnSessionId === void 0) {
-      let canonAccount;
-      try {
-        canonAccount = resolveAccount();
-      } catch {
-        canonAccount = null;
-      }
+      const canonAccount = scopeAccountId ? validateAccountId2(scopeAccountId) : null;
       turnSessionId = resolveCanonical(accountId, canonAccount?.accountDir ?? null, requesterUserId, primaryUserId, scopeAccountId, multiAccount).sessionId;
     }
     const keyDisplay2 = deliveryKey.startsWith("session:") ? deliveryKey.slice(0, "session:".length + 8) : WEBCHAT_ADMIN_KEY;
@@ -14591,17 +14724,13 @@ ${note}` : note;
       console.error(`[webchat:settings] op=${op} outcome=refused value=${JSON.stringify(value)} reason=invalid-value`);
       return c.json({ error: `invalid ${op} value` }, 400);
     }
-    let account;
-    try {
-      account = resolveAccount();
-    } catch {
-      account = null;
-    }
+    const cacheKey = c.get("cacheKey");
+    const account = cacheKey ? accountDirForSession(cacheKey) : null;
     if (!account) {
-      console.error(`[webchat:settings] op=${op} outcome=refused value=${value} reason=account-unresolved`);
+      console.error(`[webchat:settings] op=${op} outcome=refused value=${value} accountId=none reason=no-account-for-session`);
       return c.json({ error: "account unresolved" }, 503);
     }
-    const accountJsonPath = join25(account.accountDir, "account.json");
+    const accountJsonPath = join26(account.accountDir, "account.json");
     try {
       const parsed = JSON.parse(readFileSync25(accountJsonPath, "utf8"));
       if (op === "model") parsed.adminModel = value;
@@ -14616,7 +14745,7 @@ ${note}` : note;
       return c.json({ error: "persist failed" }, 500);
     }
     const settingsApplied = await reapplyLeversViaManager();
-    console.log(`[webchat:settings] op=${op} outcome=accepted value=${value} settingsApplied=${settingsApplied}`);
+    console.log(`[webchat:settings] op=${op} outcome=accepted accountId=${account.accountId.slice(0, 8)} value=${value} settingsApplied=${settingsApplied}`);
     return c.json({ ok: true, settingsApplied });
   });
   app70.get("/session", requireAdminSession, async (c) => {
@@ -14649,7 +14778,7 @@ ${note}` : note;
         const cfg2 = claudeConfigDir();
         if (cfg2) {
           const source2 = resolveBridgeSource(
-            join25(cfg2, "sessions"),
+            join26(cfg2, "sessions"),
             target,
             (id) => locateSession(id).projectDir !== null
           );
@@ -14662,14 +14791,9 @@ ${note}` : note;
       }
       const known = resolvedProjectDir !== null || sessionSidecarExists(target);
       const indicators2 = await fetchComposerIndicators(target);
-      return c.json({ sessionId: target, projectDir: resolvedProjectDir, transcriptSessionId, channelBinding: conflictingBinding(channel), known, sizeBytes: jsonlSizeBytes(projectDir2, target), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${target}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${target}`) ?? null, ...indicators2, ...readLevers() });
-    }
-    let account;
-    try {
-      account = resolveAccount();
-    } catch {
-      account = null;
+      return c.json({ sessionId: target, projectDir: resolvedProjectDir, transcriptSessionId, channelBinding: conflictingBinding(channel), known, sizeBytes: jsonlSizeBytes(projectDir2, target), pendingPermissionPrompt: deps.pendingPromptFor?.(`session:${target}`) ?? null, deliveryFailure: deps.deliveryFailureFor?.(`session:${target}`) ?? null, ...indicators2, ...readLevers(scopeAccountId ? validateAccountId2(scopeAccountId) : null) });
     }
+    const account = scopeAccountId ? validateAccountId2(scopeAccountId) : null;
     const { sessionId, source } = resolveCanonical(accountId, account?.accountDir ?? null, requesterUserId, primaryUserId, scopeAccountId, multiAccount);
     if (requesterUserId === null) {
       console.error(`[webchat:inbound] op=session-resolve-no-identity key=${sessionId.slice(0, 8)}`);
@@ -14681,7 +14805,7 @@ ${note}` : note;
     const cfg = claudeConfigDir();
     let projectDir = null;
     if (cfg) {
-      for (const { path: path3 } of enumerateJsonls(join25(cfg, "projects"))) {
+      for (const { path: path3 } of enumerateJsonls(join26(cfg, "projects"))) {
         if (basename8(path3) === `${sessionId}.jsonl`) {
           projectDir = dirname9(path3);
           break;
@@ -14689,7 +14813,7 @@ ${note}` : note;
       }
     }
     if (source === "latest" && requesterUserId !== null) {
-      const owner = readSidecarMeta(join25(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
+      const owner = readSidecarMeta(join26(projectDir ?? "", `${sessionId}.meta.json`)).adminUserId;
       if (owner !== null && owner !== requesterUserId && requesterUserId !== primaryUserId) {
         console.error(`[webchat:inbound] op=session-resolve-foreign key=${sessionId.slice(0, 8)} owner=${owner.slice(0, 8)} requester=${requesterUserId.slice(0, 8)}`);
       }
@@ -14722,7 +14846,7 @@ import { resolve as resolve19 } from "path";
 
 // app/lib/claude-agent/specialist-roster.ts
 import { existsSync as existsSync20, readFileSync as readFileSync26, readdirSync as readdirSync18 } from "fs";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function field(fm, name) {
   const m = fm.match(new RegExp(`^${name}:\\s*(.*?)\\r?$`, "m"));
   if (!m) return null;
@@ -14741,7 +14865,7 @@ function readSpecialistRoster(specialistsDir) {
     if (!file.endsWith(".md")) continue;
     let raw;
     try {
-      raw = readFileSync26(join26(specialistsDir, file), "utf-8");
+      raw = readFileSync26(join27(specialistsDir, file), "utf-8");
     } catch (err) {
       skipped.push({ file, reason: err instanceof Error ? err.message : String(err) });
       continue;
@@ -14858,7 +14982,7 @@ var webchat_greeting_default = app7;
 
 // server/routes/telegram.ts
 import { homedir as homedir2 } from "os";
-import { resolve as resolve20, join as join27 } from "path";
+import { resolve as resolve20, join as join28 } from "path";
 import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
 
 // app/lib/telegram/gateway/instance.ts
@@ -14918,7 +15042,7 @@ function routeTelegramUpdate(input) {
 var TAG30 = "[telegram-inbound]";
 function configDirName() {
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT ?? resolve20(process.cwd(), "..");
-  const brandPath = join27(platformRoot5, "config", "brand.json");
+  const brandPath = join28(platformRoot5, "config", "brand.json");
   if (existsSync21(brandPath)) {
     try {
       return JSON.parse(readFileSync27(brandPath, "utf-8")).configDir ?? ".maxy";
@@ -15007,16 +15131,16 @@ app8.post("/", async (c) => {
 var telegram_default = app8;
 
 // server/routes/quickbooks.ts
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 import { existsSync as existsSync22, readFileSync as readFileSync28, writeFileSync as writeFileSync10, mkdirSync as mkdirSync5, rmSync, renameSync as renameSync5 } from "fs";
 var TAG31 = "[quickbooks]";
 var INTUIT_TOKEN_URL = "https://oauth.platform.intuit.com/oauth2/v1/tokens/bearer";
 var STATE_RE = /^[A-Za-z0-9_-]+$/;
 function pendingPath(accountDir, state) {
-  return join28(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
+  return join29(accountDir, "secrets", "quickbooks-pending", `${state}.json`);
 }
 function storePath(accountDir) {
-  return join28(accountDir, "secrets", "quickbooks.json");
+  return join29(accountDir, "secrets", "quickbooks.json");
 }
 async function completeConsent(args) {
   const { accountDir, code, realmId } = args;
@@ -15083,7 +15207,7 @@ async function completeConsent(args) {
       refreshTokenExpiry: now + (body.x_refresh_token_expires_in ?? 864e4) * 1e3,
       lastRefresh: now
     };
-    mkdirSync5(join28(accountDir, "secrets"), { recursive: true });
+    mkdirSync5(join29(accountDir, "secrets"), { recursive: true });
     writeFileSync10(storePath(accountDir), JSON.stringify(store2, null, 2), { mode: 384 });
     const persisted = JSON.parse(readFileSync28(storePath(accountDir), "utf-8")).connections?.[realmId]?.refreshToken === body.refresh_token;
     console.error(`${TAG31} op=token-exchange realmId=${realmId} persisted=${persisted}`);
@@ -15125,7 +15249,7 @@ function claudeBin() {
 }
 
 // server/routes/onboarding.ts
-import { dirname as dirname11, join as join30 } from "path";
+import { dirname as dirname11, join as join31 } from "path";
 
 // app/lib/claude-keychain.ts
 import { execFileSync as execFileSync3 } from "child_process";
@@ -15255,7 +15379,7 @@ function readHostCredsBlob(service) {
 
 // ../lib/admins-write/src/index.ts
 import { existsSync as existsSync23, readFileSync as readFileSync29, writeFileSync as writeFileSync11, renameSync as renameSync6, mkdirSync as mkdirSync6, readdirSync as readdirSync19, statSync as statSync11, appendFileSync as appendFileSync3 } from "fs";
-import { dirname as dirname10, join as join29 } from "path";
+import { dirname as dirname10, join as join30 } from "path";
 function id8(value) {
   return value.slice(0, 8);
 }
@@ -15328,7 +15452,7 @@ function writeAdminEntry(input) {
     return result;
   }
   try {
-    const accountJsonPath = join29(input.accountDir, "account.json");
+    const accountJsonPath = join30(input.accountDir, "account.json");
     if (!existsSync23(accountJsonPath)) {
       throw new Error(`account.json not found at ${accountJsonPath}`);
     }
@@ -15376,13 +15500,13 @@ function computeAdminStoreDivergence(input) {
     }
     for (const entry of entries2) {
       if (entry.startsWith(".")) continue;
-      const accountDir = join29(input.accountsDir, entry);
+      const accountDir = join30(input.accountsDir, entry);
       try {
         if (!statSync11(accountDir).isDirectory()) continue;
       } catch {
         continue;
       }
-      const accountJsonPath = join29(accountDir, "account.json");
+      const accountJsonPath = join30(accountDir, "account.json");
       if (!existsSync23(accountJsonPath)) continue;
       let admins = [];
       try {
@@ -15560,7 +15684,7 @@ app10.post("/claude-auth", async (c) => {
       });
       persistKeychainService(
         writebackResult,
-        (service) => writeFileSync12(join30(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
+        (service) => writeFileSync12(join31(dirname11(CLAUDE_CREDENTIALS_FILE), ".keychain-service"), service, { mode: 384 }),
         (line) => console.log(line)
       );
       if (darwinAuthChild === claudeProc2) darwinAuthChild = null;
@@ -15826,8 +15950,8 @@ var onboarding_default = app10;
 
 // server/routes/client-error.ts
 import { appendFileSync as appendFileSync4, existsSync as existsSync25, renameSync as renameSync8, statSync as statSync12 } from "fs";
-import { join as join31 } from "path";
-var CLIENT_ERRORS_LOG = join31(LOG_DIR, "client-errors.log");
+import { join as join32 } from "path";
+var CLIENT_ERRORS_LOG = join32(LOG_DIR, "client-errors.log");
 var MAX_LOG_SIZE = 10 * 1024 * 1024;
 var MAX_BODY_SIZE = 8 * 1024;
 var MAX_STACK_LEN = 2e3;
@@ -15971,7 +16095,7 @@ app11.post("/", async (c) => {
       const safe = typeof v === "string" ? truncate(v, 200) : typeof v === "number" || typeof v === "boolean" ? String(v) : JSON.stringify(v).slice(0, 200);
       return `${k}=${safe}`;
     }).join(" ");
-    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle"]);
+    const TAGGED_PREFIX_SOURCES = /* @__PURE__ */ new Set(["stream-log-click", "pwa", "graph-settle", "dashboard-load"]);
     if (TAGGED_PREFIX_SOURCES.has(source)) {
       console.log(
         `[${source}] ts=${ts} ip=${ip} version=${version || "unknown"}${extra ? " " + extra : ""}`
@@ -16026,7 +16150,7 @@ async function resolveUserIdentity(accountId, userId) {
   return { userName, avatar: null };
 }
 async function createAdminSession(accountId, thinkingView, userId, userName, role, avatar) {
-  const account = resolveAccount();
+  const account = validateAccountId2(accountId);
   const effectiveThinkingView = thinkingView ?? account?.config.thinkingView ?? "default";
   const signedSessionToken = randomUUID9();
   const cacheKey = fingerprintSessionKey(signedSessionToken);
@@ -16102,11 +16226,11 @@ app12.get("/", async (c) => {
   if (!accountId) {
     return c.json({ error: "Session has no account binding" }, 401);
   }
-  const account = resolveAccount();
+  const account = validateAccountId2(accountId);
   const thinkingView = account?.config.thinkingView ?? "default";
   const businessName = await fetchAccountName(accountId) || void 0;
   const role = getRoleForSession(cacheKey);
-  console.log(`[admin-session] role=${role ?? "null"} cacheKey=${cacheKey.slice(0, 8)} phase=restore`);
+  console.log(`[admin-session] role=${role ?? "null"} accountId=${accountId.slice(0, 8)} cacheKey=${cacheKey.slice(0, 8)} phase=restore`);
   const restoredUserId = getUserIdForSession(cacheKey);
   let restoredUserName = getUserNameForSession(cacheKey);
   let restoredAvatar = null;
@@ -16216,12 +16340,12 @@ import { resolve as resolve21, basename as basename9 } from "path";
 
 // app/lib/logs-read-resolve.ts
 import { existsSync as existsSync26 } from "fs";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 function resolveSessionLogPaths(filename, logDirs) {
   const tried = [filename];
   const hits = [];
   for (const dir of logDirs) {
-    const fullPath = join32(dir, filename);
+    const fullPath = join33(dir, filename);
     if (existsSync26(fullPath)) {
       hits.push({ path: fullPath, dir });
     }
@@ -16238,10 +16362,7 @@ app14.get("/", async (c) => {
   const sessionIdParam = c.req.query("sessionId");
   const cacheKeyParam = c.req.query("cacheKey");
   const download = c.req.query("download") === "1";
-  const account = resolveAccount();
-  const accountLogDir = account ? resolve21(account.accountDir, "logs") : null;
-  const logDirs = [];
-  if (accountLogDir) logDirs.push(accountLogDir);
+  const logDirs = listValidAccounts().slice().sort((a, b) => a.accountId.localeCompare(b.accountId)).map((a) => resolve21(a.accountDir, "logs"));
   logDirs.push(LOG_DIR);
   if (fileParam) {
     const safe = basename9(fileParam);
@@ -16257,7 +16378,7 @@ app14.get("/", async (c) => {
           "Content-Length": String(buffer.byteLength)
         };
         if (download) headers["Content-Disposition"] = `attachment; filename="${safe}"`;
-        console.info(`[stream-log-download] file=${safe} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
+        console.info(`[stream-log-download] file=${safe} dir=${dir} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
         return new Response(buffer, { headers });
       } catch (err) {
         const reason = err instanceof Error ? err.message : String(err);
@@ -16322,7 +16443,7 @@ app14.get("/", async (c) => {
           "Content-Length": String(buffer.byteLength)
         };
         if (download) headers["Content-Disposition"] = `attachment; filename="${filename}"`;
-        console.info(`[stream-log-download] file=${filename} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
+        console.info(`[stream-log-download] file=${filename} dir=${hit.dir} bytesServed=${buffer.byteLength} onDiskBytes=${onDiskBytes}`);
         return new Response(buffer, { headers });
       } catch (err) {
         const reason2 = err instanceof Error ? err.message : String(err);
@@ -16379,7 +16500,12 @@ var logs_default = app14;
 // server/routes/admin/claude-info.ts
 import { execFileSync as execFileSync5 } from "child_process";
 var app15 = new Hono();
-app15.get("/", (c) => {
+app15.get("/", requireAdminSession, (c) => {
+  const account = accountDirForSession(c.var.cacheKey);
+  if (!account) {
+    console.error("[admin/claude-info] auth-rejected reason=no-account-for-session accountId=none");
+    return c.json({ error: "no account for session", reason: "no-account-for-session" }, 401);
+  }
   const claudeEnv = { ...process.env };
   let version = "unknown";
   try {
@@ -16387,21 +16513,21 @@ app15.get("/", (c) => {
     version = raw.trim().replace(" (Claude Code)", "");
   } catch {
   }
-  let account = {};
+  let claudeAccount = {};
   try {
     const raw = execFileSync5(claudeBin(), ["auth", "status"], { env: claudeEnv, encoding: "utf-8", timeout: 5e3 });
-    account = JSON.parse(raw);
+    claudeAccount = JSON.parse(raw);
   } catch {
   }
-  const resolvedAccount = resolveAccount();
-  const model = resolvedAccount?.config.adminModel ?? "unknown";
-  const thinkingView = resolvedAccount?.config.thinkingView ?? "default";
-  return c.json({ version, account, model, thinkingView });
+  const model = account.config.adminModel ?? "unknown";
+  const thinkingView = account.config.thinkingView ?? "default";
+  console.log(`[admin/claude-info] op=read accountId=${account.accountId.slice(0, 8)} model=${model}`);
+  return c.json({ version, account: claudeAccount, model, thinkingView });
 });
 var claude_info_default = app15;
 
 // server/routes/admin/attachment.ts
-import { readFile as readFile4, readdir as readdir2 } from "fs/promises";
+import { readFile as readFile5, readdir as readdir2 } from "fs/promises";
 import { existsSync as existsSync28 } from "fs";
 import { resolve as resolve22 } from "path";
 var app16 = new Hono();
@@ -16450,7 +16576,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
   }
   let meta;
   try {
-    meta = JSON.parse(await readFile4(metaPath, "utf-8"));
+    meta = JSON.parse(await readFile5(metaPath, "utf-8"));
   } catch {
     return new Response("Not found", { status: 404 });
   }
@@ -16460,7 +16586,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
     return new Response("Not found", { status: 404 });
   }
   const filePath = resolve22(dir, dataFile);
-  const buffer = await readFile4(filePath);
+  const buffer = await readFile5(filePath);
   const inlineSafe = isInlineSafeMime(meta.mimeType);
   const safeName = meta.filename.replace(/["\\\r\n]/g, "_");
   if (!inlineSafe) {
@@ -16478,7 +16604,7 @@ app16.get("/:attachmentId", requireAdminSession, async (c) => {
 var attachment_default = app16;
 
 // server/routes/admin/session-upload.ts
-import { readFile as readFile5 } from "fs/promises";
+import { readFile as readFile6 } from "fs/promises";
 import { existsSync as existsSync29, statSync as statSync14 } from "fs";
 var app17 = new Hono();
 app17.get("/", requireAdminSession, async (c) => {
@@ -16508,7 +16634,7 @@ app17.get("/", requireAdminSession, async (c) => {
   const inlineSafe = isInlineSafeMime(mimeType);
   const safeName = file.replace(/["\\\r\n]/g, "_");
   console.log(`[session-upload] op=served session=${short2} file=${file} disposition=${inlineSafe ? "inline" : "attachment"} mime=${mimeType}`);
-  const buffer = await readFile5(resolution.absolute);
+  const buffer = await readFile6(resolution.absolute);
   return new Response(new Uint8Array(buffer), {
     headers: {
       "Content-Type": mimeType,
@@ -16524,35 +16650,10 @@ var session_upload_default = app17;
 import { resolve as resolve23 } from "path";
 import { readdirSync as readdirSync22, readFileSync as readFileSync33, existsSync as existsSync31, rmSync as rmSync2, renameSync as renameSync9, mkdirSync as mkdirSync7, writeFileSync as writeFileSync13 } from "fs";
 
-// server/routes/admin/_account-scope.ts
-function accountDirForSession(cacheKey) {
-  const accountId = getAccountIdForSession(cacheKey);
-  if (!accountId) return null;
-  const match = listValidAccounts().find((a) => a.accountId === accountId);
-  return match ? { accountId, accountDir: match.accountDir } : null;
-}
-function validateAccountId2(accountId) {
-  if (!accountId) return null;
-  const match = listValidAccounts().find((a) => a.accountId === accountId);
-  return match ? { accountId, accountDir: match.accountDir } : null;
-}
-async function authorizeAccountWrite(c, accountId) {
-  const remote = c.env?.incoming?.socket?.remoteAddress ?? "";
-  const peerIsLoopback = remote === "127.0.0.1" || remote === "::1" || remote === "::ffff:127.0.0.1";
-  if (peerIsLoopback && !c.req.header("x-forwarded-for")) return { ok: true, via: "on-device" };
-  const { fingerprint, signedSessionToken } = await resolveCacheKey(c);
-  if (!fingerprint || !validateSession(fingerprint, "admin", signedSessionToken).ok) {
-    return { ok: false, reason: "no-session" };
-  }
-  const acct = accountDirForSession(fingerprint);
-  if (!acct || acct.accountId !== accountId) return { ok: false, reason: "account-mismatch" };
-  return { ok: true, via: "session" };
-}
-
 // ../services/claude-session-manager/src/tool-surface.ts
 import { readFileSync as readFileSync32, readdirSync as readdirSync21, statSync as statSync15, existsSync as existsSync30 } from "fs";
 import { createHash as createHash5 } from "crypto";
-import { join as join33 } from "path";
+import { join as join34 } from "path";
 
 // ../services/claude-session-manager/src/canonical-tool-names.ts
 function canonicalToolName(plugin, tool) {
@@ -16805,13 +16906,13 @@ function loadToolSurface(pluginsRoots) {
   const riskByTool = /* @__PURE__ */ new Map();
   const manifestPaths = /* @__PURE__ */ new Map();
   const loadOne = (pluginsRoot, plugin) => {
-    const pluginDir = join33(pluginsRoot, plugin);
+    const pluginDir = join34(pluginsRoot, plugin);
     try {
       if (!statSync15(pluginDir).isDirectory()) return;
     } catch {
       return;
     }
-    const manifestPath = join33(pluginDir, "PLUGIN.md");
+    const manifestPath = join34(pluginDir, "PLUGIN.md");
     if (!existsSync30(manifestPath)) return;
     const raw = readFileSync32(manifestPath, "utf-8");
     const frontmatter = extractFrontmatter(raw, plugin);
@@ -16857,9 +16958,9 @@ function loadToolSurface(pluginsRoots) {
   for (const root of roots) {
     const entries2 = readdirSync21(root).sort();
     for (const plugin of entries2) {
-      const pluginDir = join33(root, plugin);
+      const pluginDir = join34(root, plugin);
       loadOne(root, plugin);
-      const subRoot = join33(pluginDir, "plugins");
+      const subRoot = join34(pluginDir, "plugins");
       let subEntries;
       try {
         if (!statSync15(subRoot).isDirectory()) continue;
@@ -16905,7 +17006,7 @@ function agentRiskClass(tools, riskByTool) {
   const byTool = [];
   const unresolved = [];
   let worst = null;
-  let worstTool = null;
+  let riskiestTool = null;
   for (const tool of tools) {
     const cls = BUILTIN_TOOL_RISK[tool] ?? riskByTool.get(tool) ?? null;
     byTool.push({ tool, risk: cls });
@@ -16915,16 +17016,16 @@ function agentRiskClass(tools, riskByTool) {
     }
     if (worst === null || SEVERITY[cls] > SEVERITY[worst]) {
       worst = cls;
-      worstTool = tool;
+      riskiestTool = tool;
     }
   }
   if (unresolved.length > 0) {
-    return { risk: "red", worstTool: unresolved[0], unresolved, byTool };
+    return { risk: "red", riskiestTool: unresolved[0], unresolved, byTool };
   }
   if (worst === null) {
-    return { risk: "red", worstTool: null, unresolved, byTool };
+    return { risk: "red", riskiestTool: null, unresolved, byTool };
   }
-  return { risk: AGENT_CLASS[worst], worstTool, unresolved, byTool };
+  return { risk: AGENT_CLASS[worst], riskiestTool, unresolved, byTool };
 }
 
 // server/routes/admin/agents.ts
@@ -17024,7 +17125,7 @@ function listShipped(accountDir, riskByTool, disabled, riskSurfaceFailed) {
         plugin: "",
         description: fm.description ?? "",
         risk: r.risk,
-        worstTool: r.worstTool,
+        riskiestTool: r.riskiestTool,
         unresolved: r.unresolved,
         toolCount: tools.length,
         // The DIRECTORY is the ground truth, not the store. `spawn-context.ts`
@@ -17046,7 +17147,7 @@ function parseToolsLine(raw) {
 }
 function classify(tools, riskByTool, riskSurfaceFailed) {
   if (riskSurfaceFailed) {
-    return { risk: "red", worstTool: null, unresolved: [], byTool: tools.map((t) => ({ tool: t, risk: null })) };
+    return { risk: "red", riskiestTool: null, unresolved: [], byTool: tools.map((t) => ({ tool: t, risk: null })) };
   }
   return agentRiskClass(tools, riskByTool);
 }
@@ -17082,7 +17183,7 @@ function listSpecialists(accountDir, riskByTool, riskSurfaceFailed) {
           plugin,
           description: fm.description ?? "",
           risk: r.risk,
-          worstTool: r.worstTool,
+          riskiestTool: r.riskiestTool,
           unresolved: r.unresolved,
           toolCount: specialistTools.length,
           // A user-created specialist lives under the account plugins tree,
@@ -17133,7 +17234,7 @@ app18.get("/", requireAdminSession, (c) => {
             kind: "public",
             origin: "public",
             risk: null,
-            worstTool: null,
+            riskiestTool: null,
             unresolved: [],
             disabled: false
           });
@@ -17153,7 +17254,7 @@ app18.get("/", requireAdminSession, (c) => {
   for (const row of rows) {
     if (row.risk === null) continue;
     console.log(
-      `[admin/agents] op=classify account=${acct} agent=${row.slug} origin=${row.origin} risk=${row.risk} worstTool=${row.worstTool ?? "none"} tools=${row.toolCount} unresolved=${row.unresolved.length > 0 ? row.unresolved.join(",") : "none"} disabled=${row.disabled}`
+      `[admin/agents] op=classify account=${acct} agent=${row.slug} origin=${row.origin} risk=${row.risk} riskiestTool=${row.riskiestTool ?? "none"} tools=${row.toolCount} unresolved=${row.unresolved.length > 0 ? row.unresolved.join(",") : "none"} disabled=${row.disabled}`
     );
   }
   console.log(`[admin/agents] op=list accountId=${acct} agents=${agents.length} specialists=${specialists.length} shipped=${shipped.length} skipped=${skipped} specialistsSkipped=${specialistsSkipped} shippedSkipped=${shippedSkipped}`);
@@ -17196,7 +17297,7 @@ app18.get("/:slug", requireAdminSession, (c) => {
         systemPrompt: body.trim(),
         skills: [],
         risk: r.risk,
-        worstTool: r.worstTool,
+        riskiestTool: r.riskiestTool,
         unresolved: r.unresolved,
         byTool: r.byTool,
         disabled: readDisabledStore(account.accountDir).has(`${slug}.md`)
@@ -17227,7 +17328,7 @@ app18.get("/:slug", requireAdminSession, (c) => {
         systemPrompt: body.trim(),
         skills,
         risk: r.risk,
-        worstTool: r.worstTool,
+        riskiestTool: r.riskiestTool,
         unresolved: r.unresolved,
         byTool: r.byTool,
         disabled: false
@@ -18127,7 +18228,7 @@ var sessions_default = app19;
 
 // app/lib/claude-agent/spawn-context.ts
 import { existsSync as existsSync33, readFileSync as readFileSync34, readdirSync as readdirSync23, statSync as statSync16 } from "fs";
-import { dirname as dirname12, resolve as resolve24, join as join34 } from "path";
+import { dirname as dirname12, resolve as resolve24, join as join35 } from "path";
 async function resolveOwnerProfileBlock(accountId, userId) {
   if (!userId) return { ok: false, reason: "missing-user-id" };
   try {
@@ -18168,8 +18269,8 @@ function frontmatterField(manifest, field2) {
 function extractPluginToolDescriptions(pluginDir) {
   const out = /* @__PURE__ */ new Map();
   const candidates = [
-    join34(pluginDir, "mcp/dist/index.js"),
-    join34(pluginDir, "mcp/src/index.ts")
+    join35(pluginDir, "mcp/dist/index.js"),
+    join35(pluginDir, "mcp/src/index.ts")
   ];
   let raw = null;
   for (const path3 of candidates) {
@@ -18227,7 +18328,7 @@ function listPluginDirs(accountPluginsDir) {
   const platformPlugins = resolve24(PLATFORM_ROOT, "plugins");
   if (existsSync33(platformPlugins)) {
     for (const name of readdirSync23(platformPlugins)) {
-      const dir = join34(platformPlugins, name);
+      const dir = join35(platformPlugins, name);
       try {
         if (statSync16(dir).isDirectory()) out.set(name, dir);
       } catch {
@@ -18237,11 +18338,11 @@ function listPluginDirs(accountPluginsDir) {
   const premiumRoot = resolve24(dirname12(PLATFORM_ROOT), "premium-plugins");
   if (existsSync33(premiumRoot)) {
     for (const bundle of readdirSync23(premiumRoot)) {
-      const bundlePlugins = join34(premiumRoot, bundle, "plugins");
+      const bundlePlugins = join35(premiumRoot, bundle, "plugins");
       if (!existsSync33(bundlePlugins)) continue;
       try {
         for (const name of readdirSync23(bundlePlugins)) {
-          const dir = join34(bundlePlugins, name);
+          const dir = join35(bundlePlugins, name);
           try {
             if (statSync16(dir).isDirectory()) out.set(name, dir);
           } catch {
@@ -18255,7 +18356,7 @@ function listPluginDirs(accountPluginsDir) {
     try {
       for (const name of readdirSync23(accountPluginsDir)) {
         if (out.has(name)) continue;
-        const dir = join34(accountPluginsDir, name);
+        const dir = join35(accountPluginsDir, name);
         try {
           if (statSync16(dir).isDirectory()) out.set(name, dir);
         } catch {
@@ -18274,7 +18375,7 @@ function listAccountPluginNames(accountPluginsDir) {
   try {
     return readdirSync23(accountPluginsDir).filter((name) => {
       try {
-        return statSync16(join34(accountPluginsDir, name)).isDirectory();
+        return statSync16(join35(accountPluginsDir, name)).isDirectory();
       } catch {
         return false;
       }
@@ -18317,7 +18418,7 @@ function computeActivePlugins(accountId) {
   for (const name of emitNames) {
     const dir = pluginDirs.get(name);
     if (!dir) continue;
-    const fm = readFrontmatter(join34(dir, "PLUGIN.md"));
+    const fm = readFrontmatter(join35(dir, "PLUGIN.md"));
     if (!fm) continue;
     const description = frontmatterField(`---
 ${fm}
@@ -18334,7 +18435,7 @@ ${fm}
       `plugin-manifest-tool-coverage plugin=${name} tools=${tools.length} with-desc=${withDesc}`
     );
     if (toolNames.length > 0 && descMap.size === 0) {
-      const hasSource = existsSync33(join34(dir, "mcp/dist/index.js")) || existsSync33(join34(dir, "mcp/src/index.ts"));
+      const hasSource = existsSync33(join35(dir, "mcp/dist/index.js")) || existsSync33(join35(dir, "mcp/src/index.ts"));
       if (hasSource) {
         console.warn(
           `[spawn-context] WARN plugin=${name} mcp source present but tool-description regex matched zero entries \u2014 SDK upgrade may have changed the registration shape`
@@ -18344,7 +18445,7 @@ ${fm}
     const skillPaths = parseSkillPathsFromFrontmatter(fm);
     const skills = [];
     for (const relPath of skillPaths) {
-      const skillPath = join34(dir, relPath);
+      const skillPath = join35(dir, relPath);
       const skillFm = readFrontmatter(skillPath);
       if (!skillFm) continue;
       const skillName = frontmatterField(`---
@@ -18388,7 +18489,7 @@ function computeSpecialistDomains(accountId) {
   const out = [];
   for (const file of entries2.sort()) {
     if (!file.endsWith(".md")) continue;
-    const fm = readFrontmatter(join34(specialistsDir, file));
+    const fm = readFrontmatter(join35(specialistsDir, file));
     if (!fm) continue;
     const wrapped = `---
 ${fm}
@@ -18784,10 +18885,10 @@ var events_default = app22;
 
 // server/routes/admin/files.ts
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, existsSync as existsSync35 } from "fs";
-import { readdir as readdir4, readFile as readFile7, stat as stat6, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
+import { readdir as readdir4, readFile as readFile8, stat as stat7, mkdir as mkdir4, unlink as unlink3, rename as rename2, rmdir } from "fs/promises";
 import { realpathSync as realpathSync7 } from "fs";
 import { randomUUID as randomUUID10 } from "crypto";
-import { basename as basename11, dirname as dirname13, join as join36, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
+import { basename as basename11, dirname as dirname13, join as join37, relative as relative5, resolve as resolve27, sep as sep8 } from "path";
 import { Readable as Readable2 } from "stream";
 
 // ../lib/graph-trash/src/index.ts
@@ -19105,7 +19206,7 @@ async function cascadeDeleteDocument(params) {
 
 // app/lib/file-index.ts
 import * as fsp from "fs/promises";
-import { resolve as resolve26, relative as relative4, join as join35, basename as basename10, extname as extname2, sep as sep7 } from "path";
+import { resolve as resolve26, relative as relative4, join as join36, basename as basename10, extname as extname2, sep as sep7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { execFile as execFile2 } from "child_process";
 import { promisify as promisify2 } from "util";
@@ -19187,7 +19288,7 @@ async function extractPdf(absolute) {
   return stdout.trim();
 }
 async function ocrPdf(absolute) {
-  const outPdf = join35(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
+  const outPdf = join36(tmpdir2(), `file-index-ocr-${process.pid}-${Date.now()}.pdf`);
   try {
     await execFileAsync2(
       "ocrmypdf",
@@ -19249,7 +19350,7 @@ async function readDisplayName(absolute) {
   const stem = dot === -1 ? base : base.slice(0, dot);
   if (base === `${stem}.meta.json`) return null;
   try {
-    const raw = await fsp.readFile(join35(dir, `${stem}.meta.json`), "utf-8");
+    const raw = await fsp.readFile(join36(dir, `${stem}.meta.json`), "utf-8");
     const meta = JSON.parse(raw);
     const dn = meta.displayName ?? meta.filename;
     return typeof dn === "string" && dn.length > 0 ? dn : null;
@@ -19270,7 +19371,7 @@ async function walkSubtree(root, dataRoot, out) {
   for (const entry of entries2) {
     if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory() && entry.name === ".uploads-tmp") continue;
-    const abs = join35(root, entry.name);
+    const abs = join36(root, entry.name);
     if (entry.isDirectory()) {
       const sub = await walkSubtree(abs, dataRoot, out);
       if (!sub.clean) clean = false;
@@ -19643,7 +19744,7 @@ var UPLOAD_TMP_DIR = ".uploads-tmp";
 var UUID_RE4 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function readMeta(absDir, baseName) {
   try {
-    const raw = await readFile7(join36(absDir, `${baseName}.meta.json`), "utf8");
+    const raw = await readFile8(join37(absDir, `${baseName}.meta.json`), "utf8");
     const parsed = JSON.parse(raw);
     if (typeof parsed?.filename === "string") {
       return { filename: parsed.filename, mimeType: typeof parsed.mimeType === "string" ? parsed.mimeType : void 0 };
@@ -19665,7 +19766,7 @@ async function readAccountNames() {
     if (!UUID_RE4.test(name)) continue;
     const configPath2 = resolve27(accountsDir, name, "account.json");
     try {
-      const raw = await readFile7(configPath2, "utf8");
+      const raw = await readFile8(configPath2, "utf8");
       const parsed = JSON.parse(raw);
       if (typeof parsed?.name === "string" && parsed.name.length > 0) {
         map.set(name, parsed.name);
@@ -19698,7 +19799,7 @@ async function servableFilesIn(dirAbs, uuid) {
 }
 async function enrich(absolute, entry, accountNames) {
   if (entry.kind === "directory" && UUID_RE4.test(entry.name)) {
-    const dirAbs = join36(absolute, entry.name);
+    const dirAbs = join37(absolute, entry.name);
     const meta = await readMeta(dirAbs, entry.name);
     if (meta?.filename) {
       const servable = await servableFilesIn(dirAbs, entry.name);
@@ -19707,7 +19808,7 @@ async function enrich(absolute, entry, accountNames) {
         let size = null;
         let modifiedAt = entry.modifiedAt;
         try {
-          const st = await stat6(join36(dirAbs, innerName));
+          const st = await stat7(join37(dirAbs, innerName));
           size = st.size;
           modifiedAt = st.mtime.toISOString();
         } catch {
@@ -19882,7 +19983,7 @@ app23.get("/", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   try {
-    const info = await stat6(absolute);
+    const info = await stat7(absolute);
     if (!info.isDirectory()) {
       return c.json({ error: "Path is not a directory \u2014 use /api/admin/files/download for files" }, 400);
     }
@@ -19900,8 +20001,8 @@ app23.get("/", requireAdminSession, async (c) => {
       const childRel = relPath === "" || relPath === "." ? name : `${relPath}/${name}`;
       const protectedEntry = isProtectedFromDeletion(childRel).protected;
       try {
-        const entryPath = join36(absolute, name);
-        const s = await stat6(entryPath);
+        const entryPath = join37(absolute, name);
+        const s = await stat7(entryPath);
         entries2.push({
           name,
           kind: s.isDirectory() ? "directory" : s.isFile() ? "file" : "other",
@@ -19929,7 +20030,7 @@ app23.get("/", requireAdminSession, async (c) => {
     const displayPath = buildDisplayPath(relPath, accountNames);
     if (groupReq || isAccountRoot(relPath)) {
       const acctId = relPath.split("/")[1] ?? accountId;
-      const schemaMd = await readFile7(join36(absolute, "SCHEMA.md"), "utf8").catch(() => null);
+      const schemaMd = await readFile8(join37(absolute, "SCHEMA.md"), "utf8").catch(() => null);
       const groups = classifyAccountRoot(schemaMd, entries2.map((e) => e.name));
       console.error(
         `[data-schema] op=classify account=${acctId} status=${groups.parsed ? "ok" : "parse-failed"} reason=${groups.reason} entries=${entries2.length} home=${groups.home.join(",") || "none"} system=${groups.system.length} unknown=${groups.unknown.join(",") || "none"}`
@@ -19967,7 +20068,7 @@ app23.get("/", requireAdminSession, async (c) => {
       for (const name of homeDirs) {
         const base = byName.get(name);
         try {
-          const dirents = await readdir4(join36(absolute, name), { withFileTypes: true });
+          const dirents = await readdir4(join37(absolute, name), { withFileTypes: true });
           const visible = dirents.filter((d) => !d.name.startsWith("."));
           visible.sort((a, b) => {
             const ad = a.isDirectory() ? 0 : 1;
@@ -20032,7 +20133,7 @@ app23.get("/download", requireAdminSession, async (c) => {
       console.error(`[data] op=scratchpad-no-session sessionId="${sessionId.slice(0, 8)}\u2026"`);
       return c.json({ error: "Not found" }, 404);
     }
-    const meta = readSidecarMeta(join36(projectDir, `${sessionId}.meta.json`));
+    const meta = readSidecarMeta(join37(projectDir, `${sessionId}.meta.json`));
     if (!meta.accountId || meta.accountId !== accountId) {
       console.error(`[data] account-scope-blocked root="scratchpad" sessionId="${sessionId.slice(0, 8)}\u2026" account=${accountId.slice(0, 8)}\u2026`);
       return c.json({ error: "Not found" }, 404);
@@ -20059,7 +20160,7 @@ app23.get("/download", requireAdminSession, async (c) => {
     return c.json({ error: "Not found" }, 404);
   }
   try {
-    const info = await stat6(absolute);
+    const info = await stat7(absolute);
     if (!info.isFile()) {
       return c.json({ error: "Path is not a file" }, 400);
     }
@@ -20127,7 +20228,7 @@ async function* walkRegularFiles(dirAbsolute) {
   const dirents = await readdir4(dirAbsolute, { withFileTypes: true });
   for (const d of dirents) {
     if (d.isSymbolicLink()) continue;
-    const child = join36(dirAbsolute, d.name);
+    const child = join37(dirAbsolute, d.name);
     if (d.isDirectory()) {
       yield* walkRegularFiles(child);
       continue;
@@ -20156,7 +20257,7 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
     if (entries2.length >= maxFiles) return c.json({ error: `Too many files (max ${maxFiles})` }, 413);
     total += size;
     if (total > maxTotalBytes) return c.json({ error: "Selection too large to zip" }, 413);
-    entries2.push({ name: member, data: await readFile7(absolute) });
+    entries2.push({ name: member, data: await readFile8(absolute) });
     return null;
   };
   for (const rawPath of rawPaths) {
@@ -20173,7 +20274,7 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
       return c.json({ error: "Not found" }, 404);
     }
     try {
-      const info = await stat6(absolute);
+      const info = await stat7(absolute);
       if (info.isDirectory()) {
         dirsWalked++;
         const parentAbs = dirname13(absolute);
@@ -20181,7 +20282,7 @@ app23.get("/download-zip", requireAdminSession, async (c) => {
           const within = relative5(absolute, fileAbs).split(sep8).join("/");
           const fileRel = relPath === "" || relPath === "." ? within : `${relPath}/${within}`;
           if (crossesForeignAccountPartition(fileRel, accountId)) continue;
-          const fileInfo = await stat6(fileAbs);
+          const fileInfo = await stat7(fileAbs);
           const member = relative5(parentAbs, fileAbs).split(sep8).join("/");
           const over = await addFile(fileAbs, fileInfo.size, member);
           if (over) return over;
@@ -20237,7 +20338,7 @@ async function resolveUploadTarget(c, accountId, uid) {
   const base = resolveOwnAccountWrite(rawDir, accountId, "POST /api/admin/files/upload");
   if (!base.ok) return { ok: false, status: base.status, error: base.error };
   const relDir = relpath ? dirname13(relpath) : ".";
-  const destRel = relDir === "." ? base.relative : join36(base.relative, relDir);
+  const destRel = relDir === "." ? base.relative : join37(base.relative, relDir);
   if (crossesForeignAccountPartition(destRel, accountId)) {
     console.error(`[data] account-scope-blocked endpoint="POST /api/admin/files/upload" path="${destRel}" account=${accountId.slice(0, 8)}\u2026`);
     return { ok: false, status: 404, error: "Not found" };
@@ -20252,7 +20353,7 @@ async function resolveUploadTarget(c, accountId, uid) {
     const firstCreated = await mkdir4(destDir, { recursive: true });
     if (firstCreated) console.error(`[data-upload] op=mkdir uid=${uid} token=${token} dir="${destRel}"`);
   } else {
-    const info = await stat6(destDir).catch(() => null);
+    const info = await stat7(destDir).catch(() => null);
     if (!info || !info.isDirectory()) return { ok: false, status: 400, error: "Upload destination is not a directory" };
   }
   const dataRootReal = realpathSync7(DATA_ROOT);
@@ -20604,7 +20705,7 @@ app23.delete("/", requireAdminSession, async (c) => {
     return c.json({ error: "Protected file \u2014 refusing to delete" }, 403);
   }
   try {
-    const info = await stat6(absolute);
+    const info = await stat7(absolute);
     if (info.isDirectory()) {
       return c.json({ error: "Directory deletion not supported" }, 400);
     }
@@ -20614,7 +20715,7 @@ app23.delete("/", requireAdminSession, async (c) => {
     const dot = base.lastIndexOf(".");
     const stem = dot === -1 ? base : base.slice(0, dot);
     const containerDir = dirname13(absolute);
-    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join36(containerDir, `${stem}.meta.json`) : null;
+    const sidecarPath = UUID_RE4.test(stem) && base !== `${stem}.meta.json` ? join37(containerDir, `${stem}.meta.json`) : null;
     const isAttachmentContainer = UUID_RE4.test(stem) && basename11(containerDir) === stem;
     await unlink3(absolute);
     if (sidecarPath) {
@@ -20624,7 +20725,7 @@ app23.delete("/", requireAdminSession, async (c) => {
       }
     }
     if (isAttachmentContainer) {
-      await unlink3(join36(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
+      await unlink3(join37(containerDir, `${stem}${EXTRACTED_TEXT_SUFFIX}`)).catch(() => {
       });
       await rmdir(containerDir).catch(() => {
       });
@@ -20681,7 +20782,7 @@ app23.post("/folder", requireAdminSession, async (c) => {
   const newAbs = resolve27(parent.absolute, name);
   const newRel = `${parent.relative}/${name}`;
   try {
-    const info = await stat6(parent.absolute);
+    const info = await stat7(parent.absolute);
     if (!info.isDirectory()) return c.json({ error: "Parent is not a directory" }, 400);
     await mkdir4(newAbs, { recursive: false });
   } catch (err) {
@@ -20726,7 +20827,7 @@ app23.post("/rename", requireAdminSession, async (c) => {
   try {
     let collision = true;
     try {
-      await stat6(destAbs);
+      await stat7(destAbs);
     } catch (e) {
       if (e.code === "ENOENT") collision = false;
     }
@@ -21734,7 +21835,7 @@ function isHiddenByDefault(label) {
 // server/lib/top-level-labels.ts
 var import_dist5 = __toESM(require_dist4(), 1);
 import { readdirSync as readdirSync24, readFileSync as readFileSync36 } from "fs";
-import { join as join37, resolve as resolve28 } from "path";
+import { join as join38, resolve as resolve28 } from "path";
 var STATIC_TOP_LEVEL_LABELS = Object.freeze(
   /* @__PURE__ */ new Set([
     // Base-schema infra (schema-base.md has no top-level section).
@@ -21838,7 +21939,7 @@ function parseTopLevelLabels(content) {
 }
 function resolveReferencesDir() {
   if (process.env.MAXY_PLATFORM_ROOT) {
-    return join37(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
+    return join38(process.env.MAXY_PLATFORM_ROOT, "plugins", "memory", "references");
   }
   return resolve28(import.meta.dirname, "../../../plugins/memory/references");
 }
@@ -21848,7 +21949,7 @@ function parseTableTopLevelLabels(referencesDir) {
   try {
     const fileNames = readdirSync24(referencesDir).filter((f) => f.startsWith("schema-") && f.endsWith(".md")).sort();
     for (const fileName of fileNames) {
-      const content = readFileSync36(join37(referencesDir, fileName), "utf-8");
+      const content = readFileSync36(join38(referencesDir, fileName), "utf-8");
       const parsed = parseTopLevelLabels(content);
       if (parsed.length > 0) contributingFiles.push(fileName);
       for (const label of parsed) labels.add(label);
@@ -23004,7 +23105,7 @@ var WRITE_CYPHER = `
 var graph_default_view_default = app29;
 
 // server/routes/admin/sidebar-artefacts.ts
-import { readdir as readdir5, stat as stat7 } from "fs/promises";
+import { readdir as readdir5, stat as stat8 } from "fs/promises";
 import { resolve as resolve29, relative as relative6, isAbsolute as isAbsolute2, sep as sep9, basename as basename12 } from "path";
 import { existsSync as existsSync36 } from "fs";
 var LIMIT = 50;
@@ -23155,7 +23256,7 @@ async function readAgentTemplateRow(inp) {
   }
   if (!chosenPath) return null;
   try {
-    const st = await stat7(chosenPath);
+    const st = await stat8(chosenPath);
     const dlPath = toDataRootRelPath(chosenPath);
     return {
       id: inp.id,
@@ -23187,11 +23288,11 @@ var sidebar_artefacts_default = app30;
 
 // server/channel-session-override.ts
 import { readFileSync as readFileSync37, writeFileSync as writeFileSync14, renameSync as renameSync10 } from "fs";
-import { join as join38 } from "path";
+import { join as join39 } from "path";
 var FILE2 = "channel-session-override.json";
 var UUID3 = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 function channelOverridePath(accountDir) {
-  return join38(accountDir, FILE2);
+  return join39(accountDir, FILE2);
 }
 function senderKey(channel, senderId) {
   return `${channel}:${senderId}`;
@@ -23587,24 +23688,24 @@ var session_rc_spawn_default = app36;
 import { randomUUID as randomUUID12 } from "crypto";
 
 // server/wa-descriptor.ts
-import { resolve as resolve30, join as join39 } from "path";
+import { resolve as resolve30, join as join40 } from "path";
 function waGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function waServerPath() {
-  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join39(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
+  return process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve30(process.env.MAXY_PLATFORM_ROOT ?? join40(__dirname, ".."), "services/whatsapp-channel/dist/server.js");
 }
 function waChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: waGatewayUrl(), serverPath: waServerPath() };
 }
 
 // server/telegram-descriptor.ts
-import { resolve as resolve31, join as join40 } from "path";
+import { resolve as resolve31, join as join41 } from "path";
 function telegramGatewayUrl() {
   return `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`;
 }
 function telegramServerPath() {
-  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join40(__dirname, ".."), "services/telegram-channel/dist/server.js");
+  return process.env.MAXY_TELEGRAM_CHANNEL_SERVER_PATH ?? resolve31(process.env.MAXY_PLATFORM_ROOT ?? join41(__dirname, ".."), "services/telegram-channel/dist/server.js");
 }
 function telegramChannelDescriptor(senderId) {
   return { senderId, gatewayUrl: telegramGatewayUrl(), serverPath: telegramServerPath() };
@@ -23721,16 +23822,18 @@ app37.post("/", requireAdminSession, async (c) => {
       return c.json(parsed ?? { error: text }, res.status);
     }
     try {
-      const account = resolveAccount();
+      const account = cacheKey ? accountDirForSession(cacheKey) : null;
       if (account && adminUserId) {
-        const accountId2 = resolvePlatformAccountId();
+        const platformAccountId = resolvePlatformAccountId();
         const primaryUserId = resolvePrimaryAdminUserId();
-        const canonicalId = adminSessionIdFor(accountId2, WEBCHAT_ADMIN_KEY, adminUserId);
+        const canonicalId = adminSessionIdFor(platformAccountId, WEBCHAT_ADMIN_KEY, adminUserId);
         const currentOverride = readCanonicalOverrideId(account.accountDir, adminUserId, primaryUserId);
         if (fromSessionId === canonicalId || fromSessionId === currentOverride) {
           writeCanonicalOverrideId(account.accountDir, adminUserId, plan.sessionId);
-          console.log(`[chat-reseat] op=canonical-forward reseatReqId=${reseatReqId} from=${fromSessionId} to=${plan.sessionId}`);
+          console.log(`[chat-reseat] op=canonical-forward reseatReqId=${reseatReqId} accountId=${account.accountId.slice(0, 8)} from=${fromSessionId} to=${plan.sessionId}`);
         }
+      } else if (!account) {
+        console.error(`[chat-reseat] op=canonical-forward-skipped reseatReqId=${reseatReqId} accountId=none reason=no-account-for-session`);
       }
     } catch (err) {
       console.error(`[session-reseat] canonical-forward-failed err=${err instanceof Error ? err.message : String(err)}`);
@@ -23767,7 +23870,7 @@ app37.post("/", requireAdminSession, async (c) => {
 var session_reseat_default = app37;
 
 // server/routes/admin/system-stats.ts
-import { readFile as readFile8 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 import { cpus, loadavg, totalmem, freemem } from "os";
 function parseCpuStat(blob) {
   const line = blob.split("\n", 1)[0] ?? "";
@@ -23811,11 +23914,11 @@ function parseMeminfo(blob) {
 }
 var SAMPLE_DELAY_MS = 100;
 async function sampleLinux() {
-  const a = parseCpuStat(await readFile8("/proc/stat", "utf-8"));
+  const a = parseCpuStat(await readFile9("/proc/stat", "utf-8"));
   await new Promise((r) => setTimeout(r, SAMPLE_DELAY_MS));
-  const b = parseCpuStat(await readFile8("/proc/stat", "utf-8"));
-  const meminfo = parseMeminfo(await readFile8("/proc/meminfo", "utf-8"));
-  const loadavgRaw = (await readFile8("/proc/loadavg", "utf-8")).trim();
+  const b = parseCpuStat(await readFile9("/proc/stat", "utf-8"));
+  const meminfo = parseMeminfo(await readFile9("/proc/meminfo", "utf-8"));
+  const loadavgRaw = (await readFile9("/proc/loadavg", "utf-8")).trim();
   const [l1, l5, l15] = loadavgRaw.split(/\s+/, 3).map(Number);
   if (![l1, l5, l15].every(Number.isFinite)) {
     throw new Error(`malformed /proc/loadavg: ${loadavgRaw}`);
@@ -23889,10 +23992,10 @@ var system_stats_default = app38;
 
 // server/routes/admin/health.ts
 import { existsSync as existsSync37, readFileSync as readFileSync38 } from "fs";
-import { resolve as resolve32, join as join41 } from "path";
+import { resolve as resolve32, join as join42 } from "path";
 var PLATFORM_ROOT6 = process.env.MAXY_PLATFORM_ROOT ?? resolve32(process.cwd(), "..");
 var brandHostname = "maxy";
-var brandJsonPath = join41(PLATFORM_ROOT6, "config", "brand.json");
+var brandJsonPath = join42(PLATFORM_ROOT6, "config", "brand.json");
 if (existsSync37(brandJsonPath)) {
   try {
     const brand = JSON.parse(readFileSync38(brandJsonPath, "utf-8"));
@@ -24682,7 +24785,7 @@ var browser_default = app46;
 
 // server/routes/admin/calendar.ts
 import { existsSync as existsSync38 } from "fs";
-import { join as join43 } from "path";
+import { join as join44 } from "path";
 
 // server/lib/calendar-ics.ts
 var CRLF = "\r\n";
@@ -24782,7 +24885,7 @@ function countVEvents(ics) {
 
 // server/lib/calendar-availability.ts
 import { readFileSync as readFileSync39 } from "fs";
-import { join as join42 } from "path";
+import { join as join43 } from "path";
 var AVAILABILITY_FILENAME = "calendar-availability.json";
 var REQUIRED_KEYS = [
   "timezone",
@@ -24791,7 +24894,7 @@ var REQUIRED_KEYS = [
   "weekly"
 ];
 function readAvailabilityConfig(accountDir) {
-  const path3 = join42(accountDir, AVAILABILITY_FILENAME);
+  const path3 = join43(accountDir, AVAILABILITY_FILENAME);
   let raw;
   try {
     raw = readFileSync39(path3, "utf-8");
@@ -25147,25 +25250,26 @@ app47.delete("/meetings/:id", requireAdminSession, async (c) => {
   }
 });
 app47.get("/booking-link", requireAdminSession, (c) => {
+  const account = accountDirForSession(c.var.cacheKey);
+  if (!account) {
+    console.error("[calendar] op=booking-link auth-rejected reason=no-account-for-session accountId=none");
+    return c.json({ error: "no account for session", reason: "no-account-for-session" }, 401);
+  }
+  const id82 = account.accountId.slice(0, 8);
   try {
-    const account = resolveAccount();
-    if (!account) {
-      console.error('[calendar] op=booking-link-fail err="no account configured"');
-      return c.json({ bookingDomain: null });
-    }
-    if (!existsSync38(join43(account.accountDir, AVAILABILITY_FILENAME))) {
-      console.log("[calendar] op=booking-link bookingDomain=none source=availability-config");
+    if (!existsSync38(join44(account.accountDir, AVAILABILITY_FILENAME))) {
+      console.log(`[calendar] op=booking-link accountId=${id82} bookingDomain=none source=availability-config`);
       return c.json({ bookingDomain: null });
     }
     const config = readAvailabilityConfig(account.accountDir);
     const bookingDomain = typeof config.bookingDomain === "string" && config.bookingDomain.trim() ? config.bookingDomain.trim() : null;
     console.log(
-      `[calendar] op=booking-link bookingDomain=${bookingDomain ?? "none"} source=availability-config`
+      `[calendar] op=booking-link accountId=${id82} bookingDomain=${bookingDomain ?? "none"} source=availability-config`
     );
     return c.json({ bookingDomain });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(`[calendar] op=booking-link-fail err="${message}"`);
+    console.error(`[calendar] op=booking-link-fail accountId=${id82} err="${message}"`);
     return c.json({ bookingDomain: null });
   }
 });
@@ -26550,13 +26654,13 @@ app62.get("/:rel{.*}", (c) => {
     console.error(`[sites] path-traversal-rejected path=${reqPath} reason=escape status=403`);
     return c.text("Forbidden", 403);
   }
-  let stat11;
+  let stat12;
   try {
-    stat11 = existsSync41(filePath) ? statSync18(filePath) : null;
+    stat12 = existsSync41(filePath) ? statSync18(filePath) : null;
   } catch {
-    stat11 = null;
+    stat12 = null;
   }
-  if (stat11?.isDirectory() && !reqPath.endsWith("/")) {
+  if (stat12?.isDirectory() && !reqPath.endsWith("/")) {
     const search = new URL(c.req.url).search;
     const target = `${reqPath}/${search}`;
     console.log(
@@ -26564,7 +26668,7 @@ app62.get("/:rel{.*}", (c) => {
     );
     return c.redirect(target, 301);
   }
-  if (stat11?.isDirectory()) {
+  if (stat12?.isDirectory()) {
     filePath = resolve36(filePath, "index.html");
   }
   if (!filePath.startsWith(rootDir + "/")) {
@@ -26703,7 +26807,7 @@ var VISITOR_COOKIE_MAX_AGE_SECONDS = Math.floor(DEFAULT_TTL_MS / 1e3);
 
 // app/lib/brand-config.ts
 import { existsSync as existsSync42, readFileSync as readFileSync44 } from "fs";
-import { join as join44 } from "path";
+import { join as join45 } from "path";
 var cached2 = null;
 var cachedAttempted = false;
 function readBrandConfig() {
@@ -26711,7 +26815,7 @@ function readBrandConfig() {
   cachedAttempted = true;
   const platformRoot5 = process.env.MAXY_PLATFORM_ROOT;
   if (!platformRoot5) return null;
-  const brandPath = join44(platformRoot5, "config", "brand.json");
+  const brandPath = join45(platformRoot5, "config", "brand.json");
   if (!existsSync42(brandPath)) return null;
   try {
     cached2 = JSON.parse(readFileSync44(brandPath, "utf-8"));
@@ -27555,8 +27659,8 @@ var calendar_public_default = app67;
 
 // server/routes/portal-fetch.ts
 import { createReadStream as createReadStream3 } from "fs";
-import { stat as stat8, readFile as readFile9, realpath } from "fs/promises";
-import { join as join45, resolve as resolve38, sep as sep10 } from "path";
+import { stat as stat9, readFile as readFile10, realpath } from "fs/promises";
+import { join as join46, resolve as resolve38, sep as sep10 } from "path";
 import { Readable as Readable3 } from "stream";
 var app68 = new Hono();
 var TAG50 = "[portal-fetch]";
@@ -27612,7 +27716,7 @@ async function readAccountSecret(accountId) {
   const path3 = resolve38(DATA_ROOT, "accounts", accountId, "secrets", "data-portal.env");
   let text;
   try {
-    text = await readFile9(path3, "utf8");
+    text = await readFile10(path3, "utf8");
   } catch {
     console.error(`${TAG50} op=no-secret account="${accountId}" path="${path3}"`);
     return "";
@@ -27629,7 +27733,7 @@ function isValidAccountId2(value) {
 }
 async function readExposeFolders2(accountDir) {
   try {
-    const cfg = JSON.parse(await readFile9(join45(accountDir, "data-portal.json"), "utf8"));
+    const cfg = JSON.parse(await readFile10(join46(accountDir, "data-portal.json"), "utf8"));
     return Array.isArray(cfg?.exposeFolders) ? cfg.exposeFolders.filter((f) => typeof f === "string") : [];
   } catch {
     return [];
@@ -27638,7 +27742,7 @@ async function readExposeFolders2(accountDir) {
 async function resolveFetchTarget(accountDir, relPath, ownerId) {
   let schemaText = null;
   try {
-    schemaText = await readFile9(join45(accountDir, "SCHEMA.md"), "utf8");
+    schemaText = await readFile10(join46(accountDir, "SCHEMA.md"), "utf8");
   } catch {
     schemaText = null;
   }
@@ -27664,7 +27768,7 @@ async function resolveFetchTarget(accountDir, relPath, ownerId) {
     return { ok: false, reason: "not-exposed" };
   }
   try {
-    const st = await stat8(absolute);
+    const st = await stat9(absolute);
     if (!st.isFile()) return { ok: false, reason: "enoent" };
     return { ok: true, absolute, sizeBytes: st.size };
   } catch {
@@ -27809,7 +27913,7 @@ function startTimeEntryCensus(openSession, opts = {}) {
 
 // app/lib/ledger-census.ts
 import { readdirSync as readdirSync28, readFileSync as readFileSync45, statSync as statSync19 } from "fs";
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 
 // ../lib/ledger-core/dist/reconcile.js
 var LEDGER_INDEX_NAMES = [
@@ -27863,7 +27967,7 @@ function countWriteRejects24h(logDir, now) {
   }
   let total = 0;
   for (const name of entries2) {
-    const path3 = join46(logDir, name);
+    const path3 = join47(logDir, name);
     try {
       if (now - statSync19(path3).mtimeMs > DAY_MS) continue;
       for (const line of readFileSync45(path3, "utf8").split("\n")) {
@@ -28360,9 +28464,9 @@ async function migrateUploads(opts = {}) {
 }
 
 // app/lib/migrate-admin-webchat-sidecars.ts
-import { readdir as readdir7, readFile as readFile10, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
+import { readdir as readdir7, readFile as readFile11, rename as rename4, writeFile as writeFile5, unlink as unlink4 } from "fs/promises";
 import { existsSync as existsSync44 } from "fs";
-import { join as join47 } from "path";
+import { join as join48 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
@@ -28373,7 +28477,7 @@ var defaultResolveName = async (_accountId, userId) => {
 async function readRaw3(path3) {
   let raw;
   try {
-    raw = await readFile10(path3, "utf8");
+    raw = await readFile11(path3, "utf8");
   } catch {
     return null;
   }
@@ -28407,7 +28511,7 @@ async function collectLiveSidecars(projectsRoot) {
   }
   for (const slug of slugs) {
     if (!slug.isDirectory()) continue;
-    const slugDir = join47(projectsRoot, slug.name);
+    const slugDir = join48(projectsRoot, slug.name);
     let entries2;
     try {
       entries2 = await readdir7(slugDir, { withFileTypes: true });
@@ -28416,9 +28520,9 @@ async function collectLiveSidecars(projectsRoot) {
     }
     for (const entry of entries2) {
       if (entry.isFile() && SESSION_META_RE.test(entry.name)) {
-        out.push(join47(slugDir, entry.name));
+        out.push(join48(slugDir, entry.name));
       } else if (entry.isDirectory() && entry.name === "subagents") {
-        const subDir = join47(slugDir, entry.name);
+        const subDir = join48(slugDir, entry.name);
         let subs;
         try {
           subs = await readdir7(subDir, { withFileTypes: true });
@@ -28426,7 +28530,7 @@ async function collectLiveSidecars(projectsRoot) {
           continue;
         }
         for (const s of subs) {
-          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join47(subDir, s.name));
+          if (s.isFile() && SESSION_META_RE.test(s.name)) out.push(join48(subDir, s.name));
         }
       }
     }
@@ -28438,7 +28542,7 @@ function shortId(path3) {
   return base.slice(0, 8);
 }
 async function migrateAdminWebchatSidecars(opts = {}) {
-  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join47(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
+  const projectsRoot = opts.projectsRoot ?? (process.env.CLAUDE_CONFIG_DIR ? join48(process.env.CLAUDE_CONFIG_DIR, "projects") : null) ?? "";
   const usersFile = opts.usersFile ?? USERS_FILE;
   const accountId = opts.accountId ?? resolveAccount()?.accountId ?? null;
   const resolveName = opts.resolveName ?? defaultResolveName;
@@ -30737,7 +30841,7 @@ function buildTelegramSpawnRequest(input) {
 
 // app/lib/telegram/outbound/send-document.ts
 import { realpathSync as realpathSync10 } from "fs";
-import { readFile as readFile11, stat as stat10 } from "fs/promises";
+import { readFile as readFile12, stat as stat11 } from "fs/promises";
 import { resolve as resolve42, basename as basename13 } from "path";
 var TAG56 = "[telegram:outbound]";
 var TELEGRAM_DOCUMENT_MAX_BYTES = 50 * 1024 * 1024;
@@ -30778,7 +30882,7 @@ async function sendTelegramDocument(input) {
     console.error(`${TAG56} document REJECTED reason=outside_account_directory maxyAccountId=${maxyAccountId}`);
     return { ok: false, status: 403, error: "Access denied: file is outside the account directory" };
   }
-  const fileStat = await stat10(resolvedPath);
+  const fileStat = await stat11(resolvedPath);
   if (fileStat.size > TELEGRAM_DOCUMENT_MAX_BYTES) {
     return {
       ok: false,
@@ -30787,7 +30891,7 @@ async function sendTelegramDocument(input) {
     };
   }
   const filename = basename13(resolvedPath);
-  const buffer = Buffer.from(await readFile11(resolvedPath));
+  const buffer = Buffer.from(await readFile12(resolvedPath));
   const form = new FormData();
   form.append("chat_id", String(chatId));
   if (caption) form.append("caption", caption);
@@ -31238,8 +31342,8 @@ function resolveEntitlement(brand, account) {
   if (!existsSync46(entitlementPath)) {
     return logResolved(anonymousFallback("missing"), { reason: "missing" });
   }
-  const stat11 = statSync20(entitlementPath);
-  const key = memoKey(stat11.mtimeMs, account);
+  const stat12 = statSync20(entitlementPath);
+  const key = memoKey(stat12.mtimeMs, account);
   if (memo && memo.key === key) {
     return memo.result;
   }
@@ -31426,7 +31530,7 @@ function clientFrom(c) {
 }
 installMediaDownloadGuard();
 var PLATFORM_ROOT8 = process.env.MAXY_PLATFORM_ROOT || "";
-var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join48(PLATFORM_ROOT8, "config", "brand.json") : "";
+var BRAND_JSON_PATH = PLATFORM_ROOT8 ? join49(PLATFORM_ROOT8, "config", "brand.json") : "";
 var BRAND = { productName: "Maxy", hostname: "maxy", configDir: ".maxy", marketingUrl: "https://getmaxy.com" };
 if (BRAND_JSON_PATH && !existsSync47(BRAND_JSON_PATH)) {
   console.error(`[brand] WARNING: brand.json not found at ${BRAND_JSON_PATH} \u2014 using Maxy defaults`);
@@ -31465,7 +31569,7 @@ var brandLoginOpts = {
   appleTouchIconPath: brandAppIcon512Path,
   themeColor: BRAND.defaultColors?.primary
 };
-var ALIAS_DOMAINS_PATH = join48(homedir4(), BRAND.configDir, "alias-domains.json");
+var ALIAS_DOMAINS_PATH = join49(homedir4(), BRAND.configDir, "alias-domains.json");
 function loadAliasDomains() {
   try {
     if (!existsSync47(ALIAS_DOMAINS_PATH)) return null;
@@ -31544,7 +31648,7 @@ var waGateway = new WaGateway({
   fetchStandingRules: fetchAccountStandingRules,
   resolveSessionOverride: (accountId, senderId) => resolveChannelOverride(accountId, "whatsapp", senderId),
   gatewayUrl: `http://127.0.0.1:${process.env.MAXY_UI_INTERNAL_PORT ?? ""}`,
-  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
+  serverPath: process.env.MAXY_WA_CHANNEL_SERVER_PATH ?? resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."), "services/whatsapp-channel/dist/server.js"),
   // Task 751 / 1390 — file delivery on the native channel. `maxyAccountId` (the
   // path-validation scope) is the sender's effective SESSION account, resolved
   // once at the inbound gate and threaded here via the gateway's per-sender doc
@@ -31559,7 +31663,7 @@ var waGateway = new WaGateway({
       caption,
       accountId,
       maxyAccountId,
-      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, ".."))
+      platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, ".."))
     });
     return result.ok ? { ok: true, messageId: result.messageId } : { ok: false, error: result.error };
   },
@@ -31677,7 +31781,7 @@ function runDuplicateSenderAudit() {
   try {
     const configDir2 = process.env.CLAUDE_CONFIG_DIR;
     if (!configDir2) return;
-    const projectsRoot = join48(configDir2, "projects");
+    const projectsRoot = join49(configDir2, "projects");
     const records = [];
     for (const { path: jsonlPath, isSubagent, archived } of enumerateJsonls(projectsRoot)) {
       if (isSubagent || archived) continue;
@@ -32343,7 +32447,7 @@ var SW_SOURCE = (() => {
 function readInstalledVersion() {
   try {
     if (!PLATFORM_ROOT8) return "unknown";
-    const versionFile = join48(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
+    const versionFile = join49(PLATFORM_ROOT8, "config", `.${BRAND.hostname}-version`);
     if (!existsSync47(versionFile)) return "unknown";
     const content = readFileSync48(versionFile, "utf-8").trim();
     return content || "unknown";
@@ -32403,11 +32507,11 @@ ${clientErrorReporterScript}
   return html;
 }
 function loadBrandingCache(agentSlug) {
-  const configDir2 = join48(homedir4(), BRAND.configDir);
+  const configDir2 = join49(homedir4(), BRAND.configDir);
   try {
     const accountId = getDefaultAccountId();
     if (!accountId) return null;
-    const cachePath = join48(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
+    const cachePath = join49(configDir2, "branding-cache", accountId, `${agentSlug}.json`);
     if (!existsSync47(cachePath)) return null;
     return JSON.parse(readFileSync48(cachePath, "utf-8"));
   } catch {
@@ -32638,7 +32742,7 @@ if (brandFaviconPath !== "/favicon.ico") {
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app69.use("/*", serveStatic({ root: "./public" }));
+mountStaticFiles(app69, "./public");
 app69.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path3 = c.req.path;
@@ -32656,7 +32760,7 @@ var hostname = process.env.HOSTNAME ?? "127.0.0.1";
 var httpServer = serve({ fetch: app69.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 {
-  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const reconcilePlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const reconcileScript = resolve45(reconcilePlatformRoot, "plugins/scheduling/mcp/dist/scripts/reconcile-bookings.js");
   const runReconcile = (ctx) => {
     if (!existsSync47(reconcileScript)) return;
@@ -32679,7 +32783,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
     detached: true,
     run: runReconcile
   });
-  const reconcileStatePath = join48(MAXY_DIR, "booking-reconcile-state.json");
+  const reconcileStatePath = join49(MAXY_DIR, "booking-reconcile-state.json");
   registerLoop({
     name: "calendar-reconcile-liveness",
     intervalMs: 6e5,
@@ -32697,7 +32801,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 }
 {
   const DREAM_CYCLE_SWEEP_INTERVAL_MS = 36e5;
-  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const dreamPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const dreamSweepScript = resolve45(dreamPlatformRoot, "plugins/memory/mcp/dist/scripts/dream-cycle-sweep.js");
   registerLoop({
     name: "dream-cycle-sweep",
@@ -32721,7 +32825,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const outlookPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const outlookScript = resolve45(outlookPlatformRoot, "plugins/outlook/mcp/dist/scripts/complete-registration.js");
   const OUTLOOK_COMPLETE_INTERVAL_MS = 3e4;
   const runOutlookComplete = (ctx) => {
@@ -32747,7 +32851,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const auditRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const strandedAccountsDir = resolve45(auditRoot, "..", "data/accounts");
   const STRANDED_AUDIT_INTERVAL_MS = 3e5;
   const STRANDED_AGE_MS = 16 * 6e4;
@@ -32777,7 +32881,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const googleRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const googleAccountsDir = resolve45(googleRoot, "..", "data/accounts");
   const GOOGLE_PENDING_AUDIT_INTERVAL_MS = 3e5;
   const runGooglePendingAuditSafe = () => {
@@ -32821,7 +32925,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const STORAGE_AUDIT_INTERVAL_MS = 3e5;
   const runStorageAuditSafe = () => runStorageAudit(auditPlatformRoot).catch((err) => {
     console.error(`[storage-audit] error="${err.message}"`);
@@ -32867,7 +32971,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
   });
 }
 {
-  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const publishPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const publishScript = resolve45(publishPlatformRoot, "plugins/scheduling/mcp/dist/scripts/publish-availability.js");
   const PUBLISH_INTERVAL_MS = 3e5;
   const bookingAccounts = () => {
@@ -32944,7 +33048,7 @@ console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startTimeEntryCensus(() => getSession());
 startLedgerCensus(() => getSession());
 {
-  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..");
+  const auditPlatformRoot = process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..");
   const auditScript = resolve45(auditPlatformRoot, "plugins/connector/mcp/dist/scripts/audit-connectors.js");
   const auditLogDir = process.env.LOG_DIR ?? LOG_DIR;
   const CONNECTOR_AUDIT_INTERVAL_MS = 3e5;
@@ -32989,19 +33093,17 @@ startAuthHealthHeartbeat();
 {
   const loopHist = monitorEventLoopDelay({ resolution: 50 });
   loopHist.enable();
-  const LOG_THRESHOLD_MS = 1e3;
+  const LOUD_THRESHOLD_MS = 1e3;
   const WINDOW_MS2 = 3e4;
   registerLoop({
     name: "event-loop-lag",
     intervalMs: WINDOW_MS2,
     run: () => {
-      const maxMs = loopHist.max / 1e6;
-      const p99Ms = loopHist.percentile(99) / 1e6;
-      loopHist.reset();
-      if (maxMs >= LOG_THRESHOLD_MS) {
-        console.error(`[event-loop] lag p99=${Math.round(p99Ms)} max=${Math.round(maxMs)} window=${WINDOW_MS2 / 1e3}s`);
-      }
-      return `p99 ${Math.round(p99Ms)}ms, max ${Math.round(maxMs)}ms`;
+      const w = readAndResetWindow(loopHist, WINDOW_MS2);
+      const line = formatLagWindow(w);
+      if (w.maxMs >= LOUD_THRESHOLD_MS) console.error(line);
+      else console.log(line);
+      return `p99 ${w.p99Ms}ms, max ${w.maxMs}ms`;
     }
   });
 }
@@ -33254,7 +33356,7 @@ if (bootAccountConfig?.whatsapp) {
 }
 init({
   configDir: configDirForWhatsApp,
-  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join48(__dirname, "..")),
+  platformRoot: resolve45(process.env.MAXY_PLATFORM_ROOT ?? join49(__dirname, "..")),
   accountConfig: bootAccountConfig,
   onMessage: async (msg) => {
     if (isObserveAccount(msg.accountId)) {