@rubytech/create-sitedesk-code 0.1.530 → 0.1.532

package/payload/server/{chunk-2YMGNYA3.js → chunk-UH6GCQO4.js}

@@ -249,6 +249,13 @@ function listCredentialAccountIds(configDir2) {
     return [];
   }
 }
+function listCredentialSelfPhones(credsRoot) {
+  try {
+    return fsSync.readdirSync(credsRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && hasCredsSync(path.join(credsRoot, e.name))).map((e) => ({ accountId: e.name, selfPhone: readSelfId(path.join(credsRoot, e.name)).e164 }));
+  } catch {
+    return [];
+  }
+}
 
 // app/lib/whatsapp/session.ts
 import { randomUUID } from "crypto";
@@ -1642,20 +1649,32 @@ function isAdminPhone(phone, adminPhones) {
   return adminPhones.some((entry2) => phonesMatch(entry2, normalized));
 }
 function checkDmAccess(params) {
-  const { senderPhone, selfPhone, accountId } = params;
+  const { senderPhone, selfPhone, accountId, houseAccountId } = params;
   const cfg = resolveAccountConfig(params.config, params.accountConfig);
   if (phonesMatch(senderPhone, selfPhone)) {
     return { allowed: true, reason: "self-phone", agentType: "admin", effectiveAccountId: accountId };
   }
-  if (isAdminPhone(senderPhone, cfg.adminPhones)) {
-    return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
-  }
   const managed = managedAccountFor(cfg.accountManagers, senderPhone);
-  if (managed) {
-    if (params.isValidAccount && !params.isValidAccount(managed.account)) {
+  const managerAdmit = (bound) => {
+    if (params.isValidAccount && !params.isValidAccount(bound.account)) {
       return { allowed: false, reason: "account-manager-unresolved", agentType: "admin" };
     }
-    return { allowed: true, reason: "account-manager", agentType: "admin", effectiveAccountId: managed.account, passive: managed.mode === "passive" };
+    return {
+      allowed: true,
+      reason: "account-manager",
+      agentType: "admin",
+      effectiveAccountId: bound.account,
+      passive: bound.mode === "passive"
+    };
+  };
+  if (managed && accountId !== void 0 && managed.account === accountId) {
+    return managerAdmit(managed);
+  }
+  if (isAdminPhone(senderPhone, cfg.adminPhones)) {
+    return { allowed: true, reason: "admin-binding", agentType: "admin", effectiveAccountId: accountId };
+  }
+  if (managed && houseAccountId !== void 0 && accountId === houseAccountId) {
+    return managerAdmit(managed);
   }
   switch (cfg.dmPolicy) {
     case "open":
@@ -2710,6 +2729,12 @@ function enumerateValidAccountIds(accountsDir) {
   cache2.set(accountsDir, valid);
   return valid;
 }
+function isProvisionedAccount(accountsDir, id) {
+  const cached = cache2.get(accountsDir);
+  if (cached?.includes(id)) return true;
+  cache2.delete(accountsDir);
+  return enumerateValidAccountIds(accountsDir).includes(id);
+}
 function resolveHouseOrSoleAccountId(accountsDir) {
   const valid = enumerateValidAccountIds(accountsDir);
   const houses = [];
@@ -2784,10 +2809,19 @@ function readChannelRoutingOverride(accountsDir, houseId) {
   }
   return target;
 }
-function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
+function resolvePlatformAccountIdWithSource(accountsDir = ACCOUNTS_DIR) {
   const houseId = resolveHouseId(accountsDir);
   const routed = readChannelRoutingOverride(accountsDir, houseId);
-  return routed ?? houseId;
+  return routed !== null ? { accountId: routed, source: "routing" } : { accountId: houseId, source: "house" };
+}
+function resolvePlatformAccountId(accountsDir = ACCOUNTS_DIR) {
+  return resolvePlatformAccountIdWithSource(accountsDir).accountId;
+}
+function resolveConnectionPlatformAccountId(credentialAccountId, accountsDir = ACCOUNTS_DIR) {
+  if (isProvisionedAccount(accountsDir, credentialAccountId)) {
+    return { accountId: credentialAccountId, source: "self" };
+  }
+  return resolvePlatformAccountIdWithSource(accountsDir);
 }
 function resolveHouseAccountId(accountsDir = ACCOUNTS_DIR) {
   return resolveHouseId(accountsDir);
@@ -3964,22 +3998,14 @@ async function init(opts) {
     });
   }
 }
-async function startConnection(accountId) {
-  if (!configDir) throw new Error("WhatsApp manager not initialized");
-  const authDir = resolveAuthDir(configDir, accountId);
-  const hasAuth = await authExists(authDir);
-  if (!hasAuth) {
-    console.error(`${TAG17} no credentials for account=${accountId}`);
-    throw new Error(`no credentials for account=${accountId}`);
-  }
-  let platformAccountId;
-  let houseAccountId;
+function resolveConnectionAccountIds(accountId, accountsDir) {
   try {
-    platformAccountId = resolvePlatformAccountId();
-    houseAccountId = resolveHouseAccountId();
+    const resolved = resolveConnectionPlatformAccountId(accountId, accountsDir);
+    const houseAccountId = resolveHouseAccountId(accountsDir);
     console.error(
-      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId} house=${houseAccountId}`
+      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${resolved.accountId} house=${houseAccountId} source=${resolved.source}`
     );
+    return { platformAccountId: resolved.accountId, houseAccountId };
   } catch (err) {
     const reason = err instanceof Error ? err.message : String(err);
     console.error(
@@ -3987,6 +4013,16 @@ async function startConnection(accountId) {
     );
     throw err;
   }
+}
+async function startConnection(accountId) {
+  if (!configDir) throw new Error("WhatsApp manager not initialized");
+  const authDir = resolveAuthDir(configDir, accountId);
+  const hasAuth = await authExists(authDir);
+  if (!hasAuth) {
+    console.error(`${TAG17} no credentials for account=${accountId}`);
+    throw new Error(`no credentials for account=${accountId}`);
+  }
+  const { platformAccountId, houseAccountId } = resolveConnectionAccountIds(accountId);
   await stopConnection(accountId);
   const conn = {
     accountId,
@@ -4095,6 +4131,11 @@ function resolveConversationPersistAccount(sendAccountId, counterpartyPhone) {
     // to `effectiveAccountId` for every non-manager admit, and that value reaches
     // the graph and the spawn; the dirname is a credential path, not an account.
     accountId: conn.platformAccountId,
+    // Task 2227 — arm 4. The task named only the two inbound call sites; without
+    // it here a non-admin manager's REPLY persists under the connection account
+    // while their inbound persisted under the bound sub-account: one thread, two
+    // accounts, the split Task 1786 exists to prevent.
+    houseAccountId: conn.houseAccountId,
     isValidAccount: (id) => isValidAccountId(id)
   });
   return resolveInboundPersistAccount({
@@ -4111,23 +4152,15 @@ function isAnyConnected() {
 function listConnectionPlatformAccountIds() {
   return [...connections.values()].map((conn) => conn.platformAccountId);
 }
+function listConnectionAccountStamps() {
+  return [...connections.values()].map((conn) => ({
+    accountId: conn.accountId,
+    platformAccountId: conn.platformAccountId
+  }));
+}
 async function registerLoginSocket(accountId, sock, authDir) {
   if (!configDir) throw new Error("WhatsApp manager not initialized");
-  let platformAccountId;
-  let houseAccountId;
-  try {
-    platformAccountId = resolvePlatformAccountId();
-    houseAccountId = resolveHouseAccountId();
-    console.error(
-      `[whatsapp-persist] resolved-account-id waname=${accountId} uuid=${platformAccountId} house=${houseAccountId}`
-    );
-  } catch (err) {
-    const reason = err instanceof Error ? err.message : String(err);
-    console.error(
-      `[whatsapp-persist] resolved-account-id FAIL waname=${accountId} reason=${reason}`
-    );
-    throw err;
-  }
+  const { platformAccountId, houseAccountId } = resolveConnectionAccountIds(accountId);
   await stopConnection(accountId);
   const conn = {
     accountId,
@@ -4591,6 +4624,8 @@ function monitorInbound(conn) {
             // Task 1850 — the account SCOPE is the platform UUID, never the
             // dirname. See resolveConversationPersistAccount.
             accountId: conn.platformAccountId,
+            // Task 2227 — the account of the number messaged decides the arm.
+            houseAccountId: conn.houseAccountId,
             isValidAccount: (id) => isValidAccountId(id)
           });
           const persistAccountId = resolveInboundPersistAccount({
@@ -5021,12 +5056,14 @@ async function handleInboundMessage(conn, msg) {
       config: whatsAppConfig,
       accountConfig: whatsAppConfig.accounts?.[conn.accountId],
       accountId: conn.platformAccountId,
+      // Task 2227 — the account of the number messaged decides the arm.
+      houseAccountId: conn.houseAccountId,
       isValidAccount: (id) => isValidAccountId(id),
       resolvePersonByPhone
     });
   }
   console.error(
-    `${TAG17} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
+    `${TAG17} inbound account=${conn.accountId} from=${senderPhone} group=${isGroup} access=${accessResult.allowed ? "allowed" : "blocked"}(${accessResult.reason}) agent=${accessResult.agentType} effectiveAccount=${accessResult.effectiveAccountId ?? ""} destAccount=${conn.platformAccountId}` + (extracted.mediaType ? ` media=${extracted.mediaType}` : "") + (extracted.quotedMessage ? ` replyTo=${extracted.quotedMessage.id}` : "")
   );
   if (!accessResult.allowed && accessResult.reason === "account-manager-unresolved") {
     console.error(
@@ -5189,6 +5226,7 @@ export {
   getAuthAgeMs,
   clearAuth,
   discardAuthDirSync,
+  listCredentialSelfPhones,
   startVersionDriftCensus,
   drainCredsSaveQueue,
   createWaSocket,
@@ -5269,6 +5307,7 @@ export {
   deriveCacheKey,
   buildSelfChatDispatch,
   init,
+  resolveConnectionAccountIds,
   startConnection,
   stopConnection,
   getStatus,
@@ -5282,6 +5321,7 @@ export {
   resolveConversationPersistAccount,
   isAnyConnected,
   listConnectionPlatformAccountIds,
+  listConnectionAccountStamps,
   registerLoginSocket,
   reloadConfig,
   getMessages,

package/payload/server/{manager-XPRN5UF5.js → manager-H34562SN.js}

@@ -11,6 +11,7 @@ import {
   isAnyConnected,
   isManagerRoutedToHouse,
   isObserveAccount,
+  listConnectionAccountStamps,
   listConnectionPlatformAccountIds,
   listConnections,
   listConversationJids,
@@ -18,6 +19,7 @@ import {
   messageStoreKey,
   registerLoginSocket,
   reloadConfig,
+  resolveConnectionAccountIds,
   resolveConversationPersistAccount,
   resolveInboundPersistAccount,
   resolveReadStoreKey,
@@ -28,7 +30,7 @@ import {
   startConnection,
   stopConnection,
   storeMessage
-} from "./chunk-2YMGNYA3.js";
+} from "./chunk-UH6GCQO4.js";
 import "./chunk-BP7LH7MC.js";
 import "./chunk-PFF6I7KP.js";
 export {
@@ -43,6 +45,7 @@ export {
   isAnyConnected,
   isManagerRoutedToHouse,
   isObserveAccount,
+  listConnectionAccountStamps,
   listConnectionPlatformAccountIds,
   listConnections,
   listConversationJids,
@@ -50,6 +53,7 @@ export {
   messageStoreKey,
   registerLoginSocket,
   reloadConfig,
+  resolveConnectionAccountIds,
   resolveConversationPersistAccount,
   resolveInboundPersistAccount,
   resolveReadStoreKey,

package/payload/server/server.js

@@ -124,8 +124,10 @@ import {
   isUserJid,
   isWithinOwnAccountPartition,
   jidToE164,
+  listConnectionAccountStamps,
   listConnectionPlatformAccountIds,
   listConnections,
+  listCredentialSelfPhones,
   listLedgerAccounts,
   listStoreAccountKeys,
   listStoredAccountIds,
@@ -183,7 +185,7 @@ import {
   waitForConnection,
   warnNonUuidAccount,
   writeChatMetadataMerged
-} from "./chunk-2YMGNYA3.js";
+} from "./chunk-UH6GCQO4.js";
 import {
   ACCOUNTS_DIR,
   BIN_DIR,
@@ -1586,7 +1588,11 @@ var require_dist5 = __commonJS({
       "Risk",
       "Source",
       "Finding",
-      "Hypothesis"
+      "Hypothesis",
+      // Task 2220 — :Learning carries learning_embedding, which learnings-derive
+      // queries by name to reconcile a claim against an existing learning. Without
+      // it here the chokepoint cannot detect a null-embedding Learning write.
+      "Learning"
     ]);
     exports.DOCUMENT_ARCHIVE_LABELS = /* @__PURE__ */ new Set([
       "KnowledgeDocument",
@@ -4999,7 +5005,7 @@ async function defaultHttpGet(url) {
   }
 }
 async function defaultResolve(accountId) {
-  const { resolveSocket: resolveSocket2 } = await import("./manager-XPRN5UF5.js");
+  const { resolveSocket: resolveSocket2 } = await import("./manager-H34562SN.js");
   return resolveSocket2(accountId);
 }
 async function fetchAvatar(accountId, jid, deps = {}) {
@@ -5309,13 +5315,27 @@ function persistAfterPairing(accountDir, accountId, selfPhone) {
     }
     if (selfPhone) {
       const normalized = selfPhone.startsWith("+") ? selfPhone : `+${selfPhone}`;
-      if (!Array.isArray(wa.adminPhones)) {
-        wa.adminPhones = [];
+      let houseId = null;
+      try {
+        houseId = resolveHouseOrSoleAccountId(dirname2(resolve5(accountDir)));
+      } catch (err) {
+        console.error(
+          `${TAG10} op=selfphone-skipped account=${accountId} phone=${normalized} house=unresolved reason=house-unresolved err=${err instanceof Error ? err.message : String(err)}`
+        );
       }
-      const adminPhones = wa.adminPhones;
-      if (!adminPhones.includes(normalized)) {
-        adminPhones.push(normalized);
-        console.error(`${TAG10} added selfPhone=${normalized} to adminPhones`);
+      if (houseId !== null) {
+        if (accountId === "default" || accountId === houseId) {
+          if (!Array.isArray(wa.adminPhones)) {
+            wa.adminPhones = [];
+          }
+          const adminPhones = wa.adminPhones;
+          if (!adminPhones.includes(normalized)) {
+            adminPhones.push(normalized);
+          }
+          console.error(`${TAG10} op=selfphone-registered account=${accountId} phone=${normalized} house=${houseId}`);
+        } else {
+          console.error(`${TAG10} op=selfphone-skipped account=${accountId} phone=${normalized} house=${houseId} reason=non-house`);
+        }
       }
     } else {
       console.error(`${TAG10} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
@@ -5365,9 +5385,6 @@ function addAdminPhone(accountDir, phone) {
     if (adminPhones.includes(normalized)) {
       return { ok: true, message: `Phone ${normalized} is already in the admin list.` };
     }
-    if (managedAccountFor(readAccountManagers(accountDir), normalized)) {
-      return { ok: false, error: `${normalized} is bound as an account manager. Remove the account-manager binding before adding it as a house admin \u2014 a phone is a house admin or a sub-account manager, never both.` };
-    }
     adminPhones.push(normalized);
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
@@ -5563,12 +5580,6 @@ function setAccountManager(accountDir, phone, subAccountId, mode = "active") {
     }
     const wa = config.whatsapp;
     const adminPhones = Array.isArray(wa.adminPhones) ? wa.adminPhones.filter((p) => typeof p === "string") : [];
-    if (isAdminPhone(normalized, adminPhones)) {
-      return {
-        ok: false,
-        error: `${normalized} is a house admin phone. Remove it from admin phones before binding it as an account manager \u2014 a phone is a house admin or a sub-account manager, never both.`
-      };
-    }
     if (!wa.accountManagers || typeof wa.accountManagers !== "object") {
       wa.accountManagers = {};
     }
@@ -5580,7 +5591,9 @@ function setAccountManager(accountDir, phone, subAccountId, mode = "active") {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG10} bound account manager phone=${normalized} managesAccount=${sub} mode=${mode}`);
+    console.error(
+      `${TAG10} bound account manager phone=${normalized} managesAccount=${sub} mode=${mode} alsoAdmin=${isAdminPhone(normalized, adminPhones)}`
+    );
     reloadManagerConfig(accountDir);
     const behaviour = mode === "passive" ? `Their WhatsApp messages will each file one task scoped to that sub-account; the agent sends nothing back.` : `Their WhatsApp messages will reach that sub-account's admin agent; replies still go out over this account's WhatsApp device.`;
     return { ok: true, message: `Bound ${normalized} as ${mode} account manager for sub-account ${sub}. ${behaviour}` };
@@ -6144,6 +6157,32 @@ function reconcileMessageStoreAccountKeys(input) {
   return { ok: orphanLiveKeys.length === 0, orphanLiveKeys };
 }
 
+// app/lib/whatsapp/connection-account-reconcile.ts
+function reconcileConnectionAccountStamps(input) {
+  const registered = new Set(input.registeredAccountIds);
+  const mismatches = input.connections.filter(
+    (c) => registered.has(c.accountId) && c.platformAccountId !== c.accountId
+  );
+  return { ok: mismatches.length === 0, mismatches };
+}
+
+// app/lib/whatsapp/self-phone-admin-reconcile.ts
+var HOUSE_CREDENTIAL_DIRNAME = "default";
+function reconcileSelfPhoneAdmins(input) {
+  const nonHouse = input.credentials.filter(
+    (c) => c.accountId !== HOUSE_CREDENTIAL_DIRNAME && c.accountId !== input.houseAccountId
+  );
+  const matches = [];
+  for (const cred of nonHouse) {
+    const selfPhone = cred.selfPhone;
+    if (!selfPhone) continue;
+    if (input.adminPhones.some((entry) => phonesMatch(entry, selfPhone))) {
+      matches.push({ accountId: cred.accountId, phone: selfPhone });
+    }
+  }
+  return { ok: matches.length === 0, checked: nonHouse.length, matches };
+}
+
 // app/lib/whatsapp/outbound/send-document.ts
 import { realpathSync } from "fs";
 import { readFile as readFile3, stat as stat2 } from "fs/promises";
@@ -6513,20 +6552,39 @@ function houseSocketScopeDenial(c, op) {
   console.error(`${TAG14} op=authz-deny route=${op} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
   return c.json({ ok: false, error: "Not authorized. The WhatsApp connection and its settings are house-scoped; this session may only act on its own account." }, 403);
 }
-function selfOrHouseScopeDenial(c, targetAccountId, op) {
+function selfOrHouseScopeDenial(c, targetAccountId, op, targetSource = "explicit") {
   const { decision, callerAccountId, houseAdminScope } = evaluateCallerScope(c, targetAccountId);
+  const tail = `target=${targetAccountId} targetSource=${targetSource} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`;
   if (decision.authorized) {
-    console.error(`${TAG14} op=authz-ok route=${op} target=${targetAccountId} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
+    console.error(`${TAG14} op=authz-ok route=${op} ${tail}`);
     return null;
   }
-  console.error(`${TAG14} op=authz-deny route=${op} target=${targetAccountId} caller=${callerAccountId ?? "none"} houseAdmin=${houseAdminScope ? "y" : "n"}`);
+  console.error(`${TAG14} op=authz-deny route=${op} ${tail}`);
   return c.json({ ok: false, error: "Not authorized. This session may only pair or manage its own account." }, 403);
 }
+function resolveLifecycleAccountId(c, raw) {
+  if (typeof raw === "string" && raw.trim().length > 0) {
+    return { accountId: validateAccountId(raw), targetSource: "explicit" };
+  }
+  const callerAccountId = c.req.header("x-maxy-caller-account")?.trim() || null;
+  const houseAdminScope = c.req.header("x-maxy-house-admin-scope")?.trim() || null;
+  const houseAccountId = resolveAccount()?.accountId ?? "";
+  const callerIsHouse = !!houseAdminScope || !!callerAccountId && callerAccountId === houseAccountId;
+  if (callerIsHouse || !callerAccountId) {
+    return { accountId: "default", targetSource: "house-default" };
+  }
+  return { accountId: validateAccountId(callerAccountId), targetSource: "caller-default" };
+}
 var app3 = new Hono();
 app3.get("/status", (c) => {
   try {
-    const denial = houseSocketScopeDenial(c, "status");
-    if (denial) return denial;
+    const houseAccountId = resolveAccount()?.accountId ?? "";
+    const { decision, callerAccountId, houseAdminScope } = evaluateCallerScope(c, houseAccountId);
+    const houseScoped = decision.authorized;
+    if (!houseScoped && !callerAccountId) {
+      console.error(`${TAG14} op=authz-deny route=status caller=none houseAdmin=${houseAdminScope ? "y" : "n"}`);
+      return c.json({ ok: false, error: "Not authorized. The WhatsApp connection and its settings are house-scoped; this session may only act on its own account." }, 403);
+    }
     const live = getStatus();
     const liveIds = new Set(live.map((a) => a.accountId));
     const activeLoginIds = new Set(listActiveLoginAccountIds());
@@ -6540,6 +6598,11 @@ app3.get("/status", (c) => {
     }));
     const summary = accounts.map((a) => `${a.accountId}:${a.connected ? "up" : a.linkedUnconfigured ? "linked-unconfigured" : "down"}:${a.dispatchInbound ? "dispatch" : "observe"}`).join(", ");
     console.error(`${TAG14} status accounts=${accounts.length} [${summary}]`);
+    if (!houseScoped) {
+      const own = accounts.filter((a) => a.accountId === callerAccountId);
+      console.error(`${TAG14} op=status-projection caller=${callerAccountId.slice(0, 8)} scope=self rows=${own.length}`);
+      return c.json({ accounts: own });
+    }
     const reachableAccountIds = [
       .../* @__PURE__ */ new Set([...listStoredAccountIds(), ...listConnectionPlatformAccountIds()])
     ];
@@ -6550,7 +6613,25 @@ app3.get("/status", (c) => {
     if (!storeKeyReconcile.ok) {
       console.warn(`${TAG14} store-key-drift orphanLiveKeys=[${storeKeyReconcile.orphanLiveKeys.join(",")}] \u2014 in-memory cache keyed by a value with no disk account; read tools will miss`);
     }
-    return c.json({ accounts, storeKeyReconcile });
+    const connectionAccountReconcile = reconcileConnectionAccountStamps({
+      connections: listConnectionAccountStamps(),
+      registeredAccountIds: listValidAccounts().map((a) => a.accountId)
+    });
+    if (!connectionAccountReconcile.ok) {
+      const pairs = connectionAccountReconcile.mismatches.map((m) => `${m.accountId}:${m.platformAccountId}`).join(",");
+      console.warn(`${TAG14} connection-account-drift mismatches=[${pairs}] \u2014 a socket keyed by a registered account is stamping a different one; its messages persist and read under that account`);
+    }
+    const selfPhoneAdminReconcile = reconcileSelfPhoneAdmins({
+      credentials: listCredentialSelfPhones(credsRoot),
+      houseAccountId,
+      adminPhones: accountDir ? readAdminPhones(accountDir) : []
+    });
+    console.error(`${TAG14} op=selfphone-admin-reconcile checked=${selfPhoneAdminReconcile.checked} matched=${selfPhoneAdminReconcile.matches.length} ok=${selfPhoneAdminReconcile.ok}`);
+    for (const match of selfPhoneAdminReconcile.matches) {
+      console.warn(`${TAG14} selfphone-admin-drift account=${match.accountId} phone=${match.phone} \u2014 this sub-account's own handset is a house admin on the house number; remove it with whatsapp-config action:"remove-admin-phone"`);
+    }
+    console.error(`${TAG14} op=status-projection caller=${callerAccountId?.slice(0, 8) ?? "none"} scope=house rows=${accounts.length}`);
+    return c.json({ accounts, storeKeyReconcile, connectionAccountReconcile, selfPhoneAdminReconcile });
   } catch (err) {
     console.error(`${TAG14} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
@@ -6559,8 +6640,8 @@ app3.get("/status", (c) => {
 app3.post("/login/start", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "login/start");
+    const { accountId, targetSource } = resolveLifecycleAccountId(c, body.accountId);
+    const denial = selfOrHouseScopeDenial(c, accountId, "login/start", targetSource);
     if (denial) return denial;
     const force = body.force ?? false;
     const phone = typeof body.phone === "string" ? body.phone.trim() : "";
@@ -6580,8 +6661,8 @@ app3.post("/login/start", async (c) => {
 app3.post("/login/wait", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "login/wait");
+    const { accountId, targetSource } = resolveLifecycleAccountId(c, body.accountId);
+    const denial = selfOrHouseScopeDenial(c, accountId, "login/wait", targetSource);
     if (denial) return denial;
     const timeoutMs = body.timeoutMs ?? 6e4;
     const result = await waitForLogin({ accountId, timeoutMs });
@@ -6600,8 +6681,8 @@ app3.post("/login/wait", async (c) => {
 app3.post("/disconnect", async (c) => {
   try {
     const body = await c.req.json().catch(() => ({}));
-    const accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "disconnect");
+    const { accountId, targetSource } = resolveLifecycleAccountId(c, body.accountId);
+    const denial = selfOrHouseScopeDenial(c, accountId, "disconnect", targetSource);
     if (denial) return denial;
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
@@ -6614,8 +6695,9 @@ app3.post("/reconnect", async (c) => {
   let accountId = "(unresolved)";
   try {
     const body = await c.req.json().catch(() => ({}));
-    accountId = validateAccountId(body.accountId);
-    const denial = selfOrHouseScopeDenial(c, accountId, "reconnect");
+    const resolved = resolveLifecycleAccountId(c, body.accountId);
+    accountId = resolved.accountId;
+    const denial = selfOrHouseScopeDenial(c, accountId, "reconnect", resolved.targetSource);
     if (denial) return denial;
     await startConnection(accountId);
     console.error(
@@ -29644,14 +29726,12 @@ async function resolveClientOwnerUserId(accountId, deps = {}) {
 }
 
 // app/lib/whatsapp/inbound/channel-admin-binding-drift.ts
-function findAccountManagerDrift(accountManagers, adminPhones, validAccountIds) {
+function findAccountManagerDrift(accountManagers, validAccountIds) {
   const drift = [];
   for (const [phone, entry] of Object.entries(accountManagers)) {
     const managesAccount = typeof entry === "string" ? entry : entry.managesAccount;
     if (!validAccountIds.includes(managesAccount)) {
       drift.push({ phone, managesAccount, reason: "not-in-registry" });
-    } else if (adminPhones.some((a) => phonesMatch(a, phone))) {
-      drift.push({ phone, managesAccount, reason: "phone-also-admin" });
     }
   }
   return drift;
@@ -29709,7 +29789,7 @@ function warnOnChannelAdminBindingDrift() {
         `[admin-identity] binding-drift accountId=${acct.accountId} phone=${d.phone} reason=${d.reason}${tail}`
       );
     }
-    const managerDrift = findAccountManagerDrift(readAccountManagers(acct.accountDir), adminPhones, validAccountIds);
+    const managerDrift = findAccountManagerDrift(readAccountManagers(acct.accountDir), validAccountIds);
     for (const d of managerDrift) {
       console.error(
         `[admin-identity] account-manager-drift accountId=${acct.accountId} phone=${d.phone} managesAccount=${d.managesAccount} reason=${d.reason}`
@@ -29720,6 +29800,9 @@ function warnOnChannelAdminBindingDrift() {
 
 // server/routes/channel/effective-account.ts
 function resolveScheduledEffectiveAccount(deps, accountDir, destination) {
+  if (isAdminPhone(destination, deps.readAdminPhones(accountDir))) {
+    return deps.resolvePlatformAccountId();
+  }
   const managed = managedAccountFor(deps.readAccountManagers(accountDir), destination);
   if (managed === null) return deps.resolvePlatformAccountId();
   if (managed.mode === "passive") return null;
@@ -29728,7 +29811,7 @@ function resolveScheduledEffectiveAccount(deps, accountDir, destination) {
 }
 function resolveScheduledEffectiveAccountForInstall(accountDir, destination) {
   return resolveScheduledEffectiveAccount(
-    { readAccountManagers, resolvePlatformAccountId, isValidAccountId },
+    { readAccountManagers, readAdminPhones, resolvePlatformAccountId, isValidAccountId },
     accountDir,
     destination
   );

package/payload/platform/plugins/linkedin-extension/extension/assets/pill.css

@@ -1,52 +0,0 @@
-/* "Add to SiteDesk" pill injected into LinkedIn profile and DM thread pages. */
-
-#maxy-linkedin-pill.maxy-pill {
-  position: relative;
-  z-index: 9999;
-  display: inline-flex;
-  align-items: center;
-  gap: 6px;
-  margin: 12px;
-  padding: 6px 14px;
-  border: 1px solid #0a66c2;
-  border-radius: 999px;
-  background: #ffffff;
-  color: #0a66c2;
-  font: 600 13px/1.2 -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-  cursor: pointer;
-  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.06);
-  transition: background 120ms ease, color 120ms ease, border-color 120ms ease;
-}
-
-#maxy-linkedin-pill.maxy-pill:hover {
-  background: #0a66c2;
-  color: #ffffff;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="busy"] {
-  background: #f4f7fb;
-  border-color: #a3b6c9;
-  color: #46596d;
-  cursor: progress;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="ok"] {
-  background: #e6f4ea;
-  border-color: #2e7d32;
-  color: #2e7d32;
-  cursor: default;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="error"] {
-  background: #fdecea;
-  border-color: #b00020;
-  color: #b00020;
-  cursor: pointer;
-}
-
-#maxy-linkedin-pill.maxy-pill[data-state="auth"] {
-  background: #fff7e0;
-  border-color: #b8860b;
-  color: #b8860b;
-  cursor: pointer;
-}