@rubytech/create-siteoffice-code 0.1.259 → 0.1.264

package/payload/server/server.js

@@ -93,7 +93,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-76HRO7NX.js";
+} from "./chunk-ZC63DFWF.js";
 import {
   __commonJS,
   __require,
@@ -9268,11 +9268,34 @@ async function managerDelete(sessionId) {
   await fetch(`${managerBase()}/${sessionId}`, { method: "DELETE" }).catch(() => {
   });
 }
+async function managerLogDownload(sessionId) {
+  const res = await fetch(`${managerBase()}/${sessionId}/log?download=1`).catch(() => null);
+  if (!res || !res.ok) return null;
+  return res.text().catch(() => null);
+}
 function managerLogFollowUrl(sessionId, opts) {
   const base = `${managerBase()}/${sessionId}/log?follow=1`;
   return opts?.boundary ? `${base}&boundary=1` : base;
 }
 
+// app/lib/channel-pty-bridge/timeout-classify.ts
+function classifyTimeout(ndjson, writeAtMs) {
+  for (const line of ndjson.split("\n")) {
+    if (!line) continue;
+    let rec;
+    try {
+      rec = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (rec.type !== "assistant") continue;
+    if (rec.message?.stop_reason !== "end_turn") continue;
+    const ts = rec.timestamp ? Date.parse(rec.timestamp) : NaN;
+    if (Number.isFinite(ts) && ts > writeAtMs) return "relay-missed";
+  }
+  return "no-turn";
+}
+
 // app/lib/channel-pty-bridge/admin-session-id.ts
 import { createHash } from "crypto";
 function adminSessionIdFor(accountId, senderId) {
@@ -9970,6 +9993,7 @@ async function dispatchOnce(input) {
     resolve27(text);
   };
   entry.subscribers.add(listener);
+  const writeAtMs = Date.now();
   const writeOk = await writeInput(entry, input.text);
   if (!writeOk) {
     entry.subscribers.delete(listener);
@@ -9991,6 +10015,14 @@ async function dispatchOnce(input) {
     return { turnText };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
+    if (message === "timeout") {
+      const ndjson = await managerLogDownload(entry.sessionId) ?? "";
+      const cause = classifyTimeout(ndjson, writeAtMs);
+      console.error(
+        `${tag} op=turn-timeout cause=${cause} senderId=${input.senderId} sessionId=${entry.sessionId.slice(0, 8)}`
+      );
+      return { error: "timeout", cause };
+    }
     console.error(
       `${tag} reject reason=turn-${message} senderId=${input.senderId} sessionId=${entry.sessionId.slice(0, 8)}`
     );
@@ -10060,6 +10092,21 @@ function handlePublicSessionExit(sessionId) {
   });
 }
 
+// app/lib/channel-pty-bridge/inbound-outcome.ts
+var TAG17 = "[whatsapp-adaptor]";
+var tallies = /* @__PURE__ */ new Map();
+function recordInboundOutcome(senderId, outcome) {
+  let t = tallies.get(senderId);
+  if (!t) {
+    t = { "relay-ok": 0, "timeout-no-turn": 0, "timeout-relay-missed": 0 };
+    tallies.set(senderId, t);
+  }
+  t[outcome] += 1;
+  console.error(
+    `${TAG17} op=inbound-outcome sender=${senderId} relay-ok=${t["relay-ok"]} timeout-no-turn=${t["timeout-no-turn"]} timeout-relay-missed=${t["timeout-relay-missed"]}`
+  );
+}
+
 // app/lib/access-session-store.ts
 import { randomUUID as randomUUID5 } from "crypto";
 var sessions = /* @__PURE__ */ new Map();
@@ -10332,12 +10379,12 @@ import { readdirSync as readdirSync2, readFileSync as readFileSync6, existsSync
 // app/lib/whatsapp/login.ts
 var import_qrcode = __toESM(require_lib(), 1);
 import { randomUUID as randomUUID6 } from "crypto";
-var TAG17 = "[whatsapp:login]";
+var TAG18 = "[whatsapp:login]";
 async function renderQrTerminal(qr) {
   try {
     return await import_qrcode.default.toString(qr, { type: "utf8" });
   } catch (err) {
-    console.error(`${TAG17} terminal QR render failed: ${String(err)}`);
+    console.error(`${TAG18} terminal QR render failed: ${String(err)}`);
     return void 0;
   }
 }
@@ -10347,7 +10394,7 @@ function closeSocket(sock) {
   try {
     sock.ws?.close?.();
   } catch (err) {
-    console.warn(`${TAG17} socket close error during cleanup: ${String(err)}`);
+    console.warn(`${TAG18} socket close error during cleanup: ${String(err)}`);
   }
 }
 function resetActiveLogin(accountId) {
@@ -10370,7 +10417,7 @@ async function loginConnectionLoop(accountId, login) {
       const current = activeLogins.get(accountId);
       if (current?.id === login.id) {
         current.connected = true;
-        console.error(`${TAG17} loginConnectionLoop: connected account=${accountId} attempt=${attempt}`);
+        console.error(`${TAG18} loginConnectionLoop: connected account=${accountId} attempt=${attempt}`);
       }
       return;
     } catch (err) {
@@ -10380,7 +10427,7 @@ async function loginConnectionLoop(accountId, login) {
       if (!classification.shouldRetry || attempt >= LOGIN_MAX_RECONNECTS) {
         if (attempt >= LOGIN_MAX_RECONNECTS) {
           console.error(
-            `${TAG17} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
+            `${TAG18} login reconnect attempts exhausted (${attempt}/${LOGIN_MAX_RECONNECTS}) \u2014 surfacing error to agent`
           );
           current.error = `Login failed after ${attempt} reconnect attempts: ${formatError(err)}`;
         } else {
@@ -10392,7 +10439,7 @@ async function loginConnectionLoop(accountId, login) {
       attempt++;
       const delay = LOGIN_RECONNECT_DELAYS[attempt - 1] ?? 8e3;
       console.error(
-        `${TAG17} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
+        `${TAG18} status=${classification.statusCode ?? "unknown"} restart required \u2014 reconnecting with saved creds (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}) delay=${delay}ms`
       );
       closeSocket(current.sock);
       await new Promise((r) => setTimeout(r, delay));
@@ -10403,7 +10450,7 @@ async function loginConnectionLoop(accountId, login) {
         current.sock = newSock;
       } catch (sockErr) {
         console.error(
-          `${TAG17} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
+          `${TAG18} reconnect socket creation failed (attempt ${attempt}/${LOGIN_MAX_RECONNECTS}): ${String(sockErr)}`
         );
         current.error = `Reconnection failed: ${String(sockErr)}`;
         return;
@@ -10417,7 +10464,7 @@ async function startLogin(opts) {
   const hasAuth = await authExists(authDir);
   const selfId = readSelfId(authDir);
   console.error(
-    `${TAG17} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasQr=${!!existing0.qr}}` : " activeLogin=none")
+    `${TAG18} startLogin account=${accountId} force=${!!force} hasAuth=${hasAuth}` + (existing0 ? ` activeLogin={id=${existing0.id.slice(0, 8)},age=${Math.round((Date.now() - existing0.startedAt) / 1e3)}s,hasQr=${!!existing0.qr}}` : " activeLogin=none")
   );
   if (hasAuth && !force) {
     const who = selfId.e164 ?? selfId.jid ?? "unknown";
@@ -10429,7 +10476,7 @@ async function startLogin(opts) {
   await clearAuth(authDir);
   const existing = activeLogins.get(accountId);
   if (existing && isLoginFresh(existing) && existing.qrDataUrl && !force) {
-    console.error(`${TAG17} startLogin account=${accountId} guard: returning existing QR (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
+    console.error(`${TAG18} startLogin account=${accountId} guard: returning existing QR (age=${Math.round((Date.now() - existing.startedAt) / 1e3)}s)`);
     return {
       qrDataUrl: existing.qrDataUrl,
       qrRaw: existing.qr,
@@ -10438,7 +10485,7 @@ async function startLogin(opts) {
     };
   }
   if (existing) {
-    console.error(`${TAG17} startLogin account=${accountId} ${force ? "force override" : "stale/no-QR"}, resetting active login`);
+    console.error(`${TAG18} startLogin account=${accountId} ${force ? "force override" : "stale/no-QR"}, resetting active login`);
   }
   resetActiveLogin(accountId);
   let resolveQr = null;
@@ -10460,14 +10507,14 @@ async function startLogin(opts) {
       onQr: (qr2) => {
         loginQrCount++;
         if (pendingQr) {
-          console.error(`${TAG17} QR rotation #${loginQrCount} received for account=${accountId} \u2014 not forwarded (initial QR already captured)`);
+          console.error(`${TAG18} QR rotation #${loginQrCount} received for account=${accountId} \u2014 not forwarded (initial QR already captured)`);
           return;
         }
         pendingQr = qr2;
         const current = activeLogins.get(accountId);
         if (current && !current.qr) current.qr = qr2;
         clearTimeout(qrTimer);
-        console.error(`${TAG17} QR #${loginQrCount} received for account=${accountId} \u2014 forwarding to caller`);
+        console.error(`${TAG18} QR #${loginQrCount} received for account=${accountId} \u2014 forwarding to caller`);
         resolveQr?.(qr2);
       }
     });
@@ -10487,7 +10534,7 @@ async function startLogin(opts) {
   activeLogins.set(accountId, login);
   if (pendingQr && !login.qr) login.qr = pendingQr;
   loginConnectionLoop(accountId, login).catch((err) => {
-    console.error(`${TAG17} loginConnectionLoop unexpected error: ${String(err)}`);
+    console.error(`${TAG18} loginConnectionLoop unexpected error: ${String(err)}`);
     const current = activeLogins.get(accountId);
     if (current?.id === login.id) {
       current.error = `Unexpected login error: ${String(err)}`;
@@ -10513,7 +10560,7 @@ async function waitForLogin(opts) {
   const { accountId, timeoutMs = 6e4 } = opts;
   const login = activeLogins.get(accountId);
   console.error(
-    `${TAG17} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasQr=${!!login.qr}}` : " login=none")
+    `${TAG18} waitForLogin account=${accountId} timeout=${timeoutMs}ms` + (login ? ` login={id=${login.id.slice(0, 8)},age=${Math.round((Date.now() - login.startedAt) / 1e3)}s,connected=${login.connected},hasQr=${!!login.qr}}` : " login=none")
   );
   if (!login) {
     return { connected: false, message: "No active WhatsApp login in progress." };
@@ -10526,7 +10573,7 @@ async function waitForLogin(opts) {
   while (Date.now() < deadline) {
     if (login.connected) {
       const selfId = readSelfId(login.authDir);
-      console.error(`${TAG17} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
+      console.error(`${TAG18} login complete for account=${accountId} phone=${selfId.e164 ?? "unknown"}`);
       const sock = login.sock;
       const authDir = login.authDir;
       activeLogins.delete(accountId);
@@ -10546,7 +10593,7 @@ async function waitForLogin(opts) {
     await new Promise((r) => setTimeout(r, 1e3));
   }
   const elapsed = Math.round((Date.now() - (deadline - timeoutMs)) / 1e3);
-  console.error(`${TAG17} waitForLogin timeout account=${accountId} elapsed=${elapsed}s \u2014 cleaning up active login`);
+  console.error(`${TAG18} waitForLogin timeout account=${accountId} elapsed=${elapsed}s \u2014 cleaning up active login`);
   resetActiveLogin(accountId);
   return { connected: false, message: "Login timed out. Try generating a new QR." };
 }
@@ -10554,7 +10601,7 @@ async function waitForLogin(opts) {
 // app/lib/whatsapp/config-persist.ts
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync3, existsSync as existsSync3 } from "fs";
 import { resolve as resolve6, join as join4 } from "path";
-var TAG18 = "[whatsapp:config]";
+var TAG19 = "[whatsapp:config]";
 function configPath(accountDir) {
   return resolve6(accountDir, "account.json");
 }
@@ -10571,9 +10618,9 @@ function reloadManagerConfig(accountDir) {
   try {
     const config = readConfig(accountDir);
     reloadConfig(config);
-    console.error(`${TAG18} reloaded manager config`);
+    console.error(`${TAG19} reloaded manager config`);
   } catch (err) {
-    console.error(`${TAG18} manager config reload failed: ${String(err)}`);
+    console.error(`${TAG19} manager config reload failed: ${String(err)}`);
   }
 }
 var E164_PATTERN = /^\+\d{7,15}$/;
@@ -10599,25 +10646,25 @@ function persistAfterPairing(accountDir, accountId, selfPhone) {
       const adminPhones = wa.adminPhones;
       if (!adminPhones.includes(normalized)) {
         adminPhones.push(normalized);
-        console.error(`${TAG18} added selfPhone=${normalized} to adminPhones`);
+        console.error(`${TAG19} added selfPhone=${normalized} to adminPhones`);
       }
     } else {
-      console.error(`${TAG18} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
+      console.error(`${TAG19} skipping adminPhones \u2014 selfPhone is null account=${accountId}`);
     }
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG18} validation failed after pairing: ${msg}`);
+      console.error(`${TAG19} validation failed after pairing: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG18} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
+    console.error(`${TAG19} persisted after pairing account=${accountId} phone=${selfPhone ?? "null"}`);
     reloadManagerConfig(accountDir);
     return { ok: true };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG18} persist failed account=${accountId}: ${msg}`);
+    console.error(`${TAG19} persist failed account=${accountId}: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10647,12 +10694,12 @@ function addAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG18} added admin phone=${normalized}`);
+    console.error(`${TAG19} added admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Added ${normalized} as admin phone. Messages from this number will route to the admin agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG18} addAdminPhone failed: ${msg}`);
+    console.error(`${TAG19} addAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10680,12 +10727,12 @@ function removeAdminPhone(accountDir, phone) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG18} removed admin phone=${normalized}`);
+    console.error(`${TAG19} removed admin phone=${normalized}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Removed ${normalized} from admin phones. Messages from this number will now route to the public agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG18} removeAdminPhone failed: ${msg}`);
+    console.error(`${TAG19} removeAdminPhone failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10723,12 +10770,12 @@ function setPublicAgent(accountDir, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG18} publicAgent set to ${trimmed}`);
+    console.error(`${TAG19} publicAgent set to ${trimmed}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Public agent set to "${trimmed}". WhatsApp messages from non-admin phones will be handled by this agent.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG18} setPublicAgent failed: ${msg}`);
+    console.error(`${TAG19} setPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10792,12 +10839,12 @@ function setGroupPublicAgent(accountDir, accountId, groupJid, slug) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG18} setGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup} slug=${trimmedSlug}`);
+    console.error(`${TAG19} setGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup} slug=${trimmedSlug}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Per-group public agent set to "${trimmedSlug}" for group ${trimmedGroup}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG18} setGroupPublicAgent failed: ${msg}`);
+    console.error(`${TAG19} setGroupPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10824,12 +10871,12 @@ function unsetGroupPublicAgent(accountDir, accountId, groupJid) {
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG18} unsetGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup}`);
+    console.error(`${TAG19} unsetGroupPublicAgent account=${trimmedAccount} groupJid=${trimmedGroup}`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Per-group public agent override removed for group ${trimmedGroup}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG18} unsetGroupPublicAgent failed: ${msg}`);
+    console.error(`${TAG19} unsetGroupPublicAgent failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10850,17 +10897,17 @@ function updateConfig(accountDir, fields) {
     const parsed = WhatsAppConfigSchema.safeParse(wa);
     if (!parsed.success) {
       const msg = parsed.error.issues.map((i) => `${i.path.join(".")}: ${i.message}`).join("; ");
-      console.error(`${TAG18} update validation failed: ${msg}`);
+      console.error(`${TAG19} update validation failed: ${msg}`);
       return { ok: false, error: `Validation failed: ${msg}` };
     }
     config.whatsapp = parsed.data;
     writeConfig(accountDir, config);
-    console.error(`${TAG18} updated fields=[${fieldNames.join(",")}]`);
+    console.error(`${TAG19} updated fields=[${fieldNames.join(",")}]`);
     reloadManagerConfig(accountDir);
     return { ok: true, message: `Updated WhatsApp config: ${fieldNames.join(", ")}.` };
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG18} updateConfig failed: ${msg}`);
+    console.error(`${TAG19} updateConfig failed: ${msg}`);
     return { ok: false, error: msg };
   }
 }
@@ -10986,17 +11033,17 @@ function serializeWhatsAppSchema() {
 }
 
 // server/routes/whatsapp.ts
-var TAG19 = "[whatsapp:api]";
+var TAG20 = "[whatsapp:api]";
 var PLATFORM_ROOT4 = process.env.MAXY_PLATFORM_ROOT || "";
 var app3 = new Hono();
 app3.get("/status", (c) => {
   try {
     const status = getStatus();
     const summary = status.map((a) => `${a.accountId}:${a.connected ? "up" : "down"}`).join(", ");
-    console.error(`${TAG19} status accounts=${status.length} [${summary}]`);
+    console.error(`${TAG20} status accounts=${status.length} [${summary}]`);
     return c.json({ accounts: status });
   } catch (err) {
-    console.error(`${TAG19} status error: ${String(err)}`);
+    console.error(`${TAG20} status error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11007,10 +11054,10 @@ app3.post("/login/start", async (c) => {
     const force = body.force ?? false;
     const authDir = join5(MAXY_DIR, "credentials", "whatsapp", accountId);
     const result = await startLogin({ accountId, authDir, force });
-    console.error(`${TAG19} login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
+    console.error(`${TAG20} login/start result account=${accountId} hasQr=${!!result.qrRaw}${result.selfPhone ? ` phone=${result.selfPhone}` : ""}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG19} login/start error: ${String(err)}`);
+    console.error(`${TAG20} login/start error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11025,7 +11072,7 @@ app3.post("/login/wait", async (c) => {
       try {
         await registerLoginSocket(accountId, result.sock, result.authDir);
       } catch (regErr) {
-        console.error(`${TAG19} registerLoginSocket failed account=${accountId}: ${String(regErr)}`);
+        console.error(`${TAG20} registerLoginSocket failed account=${accountId}: ${String(regErr)}`);
       }
       try {
         const account = resolveAccount();
@@ -11033,16 +11080,16 @@ app3.post("/login/wait", async (c) => {
           const persistResult = persistAfterPairing(account.accountDir, accountId, result.selfPhone ?? null);
           configPersisted = persistResult.ok;
           if (!persistResult.ok) {
-            console.error(`${TAG19} config persist failed account=${accountId}: ${persistResult.error}`);
+            console.error(`${TAG20} config persist failed account=${accountId}: ${persistResult.error}`);
           }
         } else {
-          console.error(`${TAG19} config persist skipped \u2014 no account resolved`);
+          console.error(`${TAG20} config persist skipped \u2014 no account resolved`);
         }
       } catch (persistErr) {
-        console.error(`${TAG19} config persist error account=${accountId}: ${String(persistErr)}`);
+        console.error(`${TAG20} config persist error account=${accountId}: ${String(persistErr)}`);
       }
     }
-    console.error(`${TAG19} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${configPersisted}`);
+    console.error(`${TAG20} login/wait result account=${accountId} connected=${result.connected}${result.selfPhone ? ` phone=${result.selfPhone}` : ""} configPersisted=${configPersisted}`);
     return c.json({
       connected: result.connected,
       message: result.message,
@@ -11050,7 +11097,7 @@ app3.post("/login/wait", async (c) => {
       configPersisted
     });
   } catch (err) {
-    console.error(`${TAG19} login/wait error: ${String(err)}`);
+    console.error(`${TAG20} login/wait error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11061,7 +11108,7 @@ app3.post("/disconnect", async (c) => {
     await stopConnection(accountId);
     return c.json({ disconnected: true, accountId });
   } catch (err) {
-    console.error(`${TAG19} disconnect error: ${String(err)}`);
+    console.error(`${TAG20} disconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11072,7 +11119,7 @@ app3.post("/reconnect", async (c) => {
     await startConnection(accountId);
     return c.json({ reconnecting: true, accountId });
   } catch (err) {
-    console.error(`${TAG19} reconnect error: ${String(err)}`);
+    console.error(`${TAG20} reconnect error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11091,7 +11138,7 @@ app3.post("/send", async (c) => {
     const result = await sendTextMessage(sock, to, text, { accountId });
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG19} send error: ${String(err)}`);
+    console.error(`${TAG20} send error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11112,7 +11159,7 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone" (E.164 format, e.g. +441234567890).' }, 400);
         }
         const result = addAdminPhone(account.accountDir, phone);
-        console.error(`${TAG19} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG20} config action=add-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "remove-admin-phone": {
@@ -11120,12 +11167,12 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "phone".' }, 400);
         }
         const result = removeAdminPhone(account.accountDir, phone);
-        console.error(`${TAG19} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
+        console.error(`${TAG20} config action=remove-admin-phone phone=${phone} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-admin-phones": {
         const phones = readAdminPhones(account.accountDir);
-        console.error(`${TAG19} config action=list-admin-phones count=${phones.length}`);
+        console.error(`${TAG20} config action=list-admin-phones count=${phones.length}`);
         return c.json({ ok: true, phones });
       }
       case "set-public-agent": {
@@ -11133,14 +11180,14 @@ app3.post("/config", async (c) => {
           return c.json({ ok: false, error: 'Missing required field "slug" (the agent directory name, e.g. "my-agent").' }, 400);
         }
         const result = setPublicAgent(account.accountDir, slug);
-        console.error(`${TAG19} config action=set-public-agent slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG20} config action=set-public-agent slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-public-agent": {
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const targetGroup = typeof groupJid === "string" && groupJid.trim() ? groupJid.trim() : void 0;
         const resolved = resolvePublicAgent(account.accountDir, { accountId: targetAccount, groupJid: targetGroup });
-        console.error(`${TAG19} config action=get-public-agent accountId=${targetAccount} groupJid=${targetGroup ?? "none"} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
+        console.error(`${TAG20} config action=get-public-agent accountId=${targetAccount} groupJid=${targetGroup ?? "none"} slug=${resolved?.slug ?? "none"} source=${resolved?.source ?? "none"}`);
         return c.json({ ok: true, slug: resolved?.slug ?? null, source: resolved?.source ?? null });
       }
       case "set-group-public-agent": {
@@ -11152,7 +11199,7 @@ app3.post("/config", async (c) => {
         }
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const result = setGroupPublicAgent(account.accountDir, targetAccount, groupJid, slug);
-        console.error(`${TAG19} config action=set-group-public-agent accountId=${targetAccount} groupJid=${groupJid} slug=${slug} ok=${result.ok}`);
+        console.error(`${TAG20} config action=set-group-public-agent accountId=${targetAccount} groupJid=${groupJid} slug=${slug} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "unset-group-public-agent": {
@@ -11161,7 +11208,7 @@ app3.post("/config", async (c) => {
         }
         const targetAccount = typeof accountId === "string" && accountId.trim() ? accountId.trim() : "default";
         const result = unsetGroupPublicAgent(account.accountDir, targetAccount, groupJid);
-        console.error(`${TAG19} config action=unset-group-public-agent accountId=${targetAccount} groupJid=${groupJid} ok=${result.ok}`);
+        console.error(`${TAG20} config action=unset-group-public-agent accountId=${targetAccount} groupJid=${groupJid} ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "list-public-agents": {
@@ -11178,26 +11225,26 @@ app3.post("/config", async (c) => {
                 const config = JSON.parse(readFileSync6(configPath2, "utf-8"));
                 agents.push({ slug: entry.name, displayName: config.displayName ?? entry.name });
               } catch {
-                console.error(`${TAG19} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
+                console.error(`${TAG20} config action=list-public-agents error="failed to parse config.json for agent ${entry.name}" \u2014 skipping`);
               }
             }
           } catch (err) {
-            console.error(`${TAG19} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
+            console.error(`${TAG20} config action=list-public-agents error="failed to scan agents directory: ${String(err)}"`);
           }
         }
-        console.error(`${TAG19} config action=list-public-agents count=${agents.length}`);
+        console.error(`${TAG20} config action=list-public-agents count=${agents.length}`);
         return c.json({ ok: true, agents });
       }
       case "schema": {
         const text = serializeWhatsAppSchema();
-        console.error(`${TAG19} config action=schema`);
+        console.error(`${TAG20} config action=schema`);
         return c.json({ ok: true, text });
       }
       case "list-groups": {
         const groupAccountId = accountId ?? "default";
         const sock = getSocket(groupAccountId);
         if (!sock) {
-          console.error(`${TAG19} config action=list-groups error="not connected" accountId=${groupAccountId}`);
+          console.error(`${TAG20} config action=list-groups error="not connected" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `WhatsApp account "${groupAccountId}" is not connected. Connect first, then retry.` });
         }
         try {
@@ -11207,10 +11254,10 @@ app3.post("/config", async (c) => {
             name: g.subject ?? g.id,
             participantCount: Array.isArray(g.participants) ? g.participants.length : 0
           }));
-          console.error(`${TAG19} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
+          console.error(`${TAG20} config action=list-groups count=${groups.length} accountId=${groupAccountId}`);
           return c.json({ ok: true, groups });
         } catch (err) {
-          console.error(`${TAG19} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
+          console.error(`${TAG20} config action=list-groups error="${String(err)}" accountId=${groupAccountId}`);
           return c.json({ ok: false, error: `Failed to fetch groups: ${String(err)}` });
         }
       }
@@ -11220,12 +11267,12 @@ app3.post("/config", async (c) => {
         }
         const result = updateConfig(account.accountDir, fields);
         const fieldNames = Object.keys(fields);
-        console.error(`${TAG19} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
+        console.error(`${TAG20} config action=update-config fields=[${fieldNames.join(",")}] ok=${result.ok}`);
         return c.json(result, result.ok ? 200 : 400);
       }
       case "get-config": {
         const waConfig = getConfig(account.accountDir);
-        console.error(`${TAG19} config action=get-config`);
+        console.error(`${TAG20} config action=get-config`);
         return c.json({ ok: true, config: waConfig });
       }
       default:
@@ -11235,7 +11282,7 @@ app3.post("/config", async (c) => {
         );
     }
   } catch (err) {
-    console.error(`${TAG19} config error: ${String(err)}`);
+    console.error(`${TAG20} config error: ${String(err)}`);
     return c.json({ ok: false, error: String(err) }, 500);
   }
 });
@@ -11256,7 +11303,7 @@ app3.post("/send-document", async (c) => {
     recordRouteDocumentOutbound(to, filePath);
     return c.json({ success: true, messageId: result.messageId });
   } catch (err) {
-    console.error(`${TAG19} send-document error: ${String(err)}`);
+    console.error(`${TAG20} send-document error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11266,11 +11313,11 @@ app3.get("/activity", (c) => {
     const result = getChannelActivity(accountId);
     const total = result.accounts.reduce((sum, a) => sum + a.total, 0);
     console.error(
-      `${TAG19} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
+      `${TAG20} activity accounts=${result.accounts.length} total=${total} recentEvents=${result.recentEvents.length}` + (accountId ? ` filter=${accountId}` : "")
     );
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG19} activity error: ${String(err)}`);
+    console.error(`${TAG20} activity error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11289,10 +11336,10 @@ app3.get("/conversations", (c) => {
       };
     });
     conversations.sort((a, b) => (b.lastMessageTimestamp ?? 0) - (a.lastMessageTimestamp ?? 0));
-    console.error(`${TAG19} conversations account=${accountId} count=${conversations.length}`);
+    console.error(`${TAG20} conversations account=${accountId} count=${conversations.length}`);
     return c.json({ conversations });
   } catch (err) {
-    console.error(`${TAG19} conversations error: ${String(err)}`);
+    console.error(`${TAG20} conversations error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11307,10 +11354,10 @@ app3.get("/messages", (c) => {
     const limit = limitParam ? parseInt(limitParam, 10) : void 0;
     const effectiveLimit = limit && !Number.isNaN(limit) && limit > 0 ? limit : void 0;
     const messages = getMessages(accountId, jid, effectiveLimit);
-    console.error(`${TAG19} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
+    console.error(`${TAG20} messages account=${accountId} jid=${jid} limit=${effectiveLimit ?? "all"} returned=${messages.length}`);
     return c.json({ messages });
   } catch (err) {
-    console.error(`${TAG19} messages error: ${String(err)}`);
+    console.error(`${TAG20} messages error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11391,7 +11438,7 @@ app3.get("/conversation-graph-state", async (c) => {
       }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
-      console.error(`${TAG19} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
+      console.error(`${TAG20} conversation-graph-state ERR cacheKey=${cacheKey} reason=${msg}`);
       return c.json({ error: `Graph query failed: ${msg}`, cacheKey, cypher: cypher.trim() }, 500);
     }
     const ms = Date.now() - t0;
@@ -11404,7 +11451,7 @@ app3.get("/conversation-graph-state", async (c) => {
       ms
     });
   } catch (err) {
-    console.error(`${TAG19} conversation-graph-state error: ${String(err)}`);
+    console.error(`${TAG20} conversation-graph-state error: ${String(err)}`);
     return c.json({ error: String(err) }, 500);
   }
 });
@@ -11416,12 +11463,12 @@ app3.get("/group-info", async (c) => {
       return c.json({ error: "Missing required parameter: jid" }, 400);
     }
     if (!isGroupJid(jid)) {
-      console.error(`${TAG19} group-info error="not a group JID" jid=${jid} account=${accountId}`);
+      console.error(`${TAG20} group-info error="not a group JID" jid=${jid} account=${accountId}`);
       return c.json({ error: `"${jid}" is not a group JID. Group JIDs end with @g.us.` }, 400);
     }
     const sock = getSocket(accountId);
     if (!sock) {
-      console.error(`${TAG19} group-info error="not connected" account=${accountId}`);
+      console.error(`${TAG20} group-info error="not connected" account=${accountId}`);
       return c.json({ error: `WhatsApp account "${accountId}" is not connected. Connect first, then retry.` }, 400);
     }
     const meta = await sock.groupMetadata(jid);
@@ -11434,10 +11481,10 @@ app3.get("/group-info", async (c) => {
       participantCount: meta.participants.length,
       participants: meta.participants.map((p) => ({ jid: p.id, admin: p.admin ?? null }))
     };
-    console.error(`${TAG19} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
+    console.error(`${TAG20} group-info jid=${jid} subject="${meta.subject}" participants=${meta.participants.length} account=${accountId}`);
     return c.json(result);
   } catch (err) {
-    console.error(`${TAG19} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
+    console.error(`${TAG20} group-info error="${String(err)}" jid=${jid} account=${accountId}`);
     return c.json({ error: `Failed to fetch group info: ${String(err)}` }, 500);
   }
 });
@@ -12095,7 +12142,7 @@ async function createAdminSession(accountId, thinkingView, userId, userName, rol
   } catch (err) {
     console.error(`[session] eager-ensureConversation FAILED at boot: ${err instanceof Error ? err.message : String(err)}`);
   }
-  console.log(`[session] ${(/* @__PURE__ */ new Date()).toISOString()} admin session created: userId=${userId ?? "\u2013"} userName=${userName ?? "\u2013"} accountId=${accountId} sessionId=${initialSessionId ?? "unbound"} cacheKey=${cacheKey.slice(0, 8)}`);
+  console.log(`[session] admin session created: userId=${userId ?? "\u2013"} userName=${userName ?? "\u2013"} accountId=${accountId} sessionId=${initialSessionId ?? "unbound"} cacheKey=${cacheKey.slice(0, 8)}`);
   console.log(`[admin-session] role=${role ?? "null"} cacheKey=${cacheKey.slice(0, 8)} phase=create eager-ensured=${initialSessionId ? "true" : "false"}`);
   return {
     session_key: signedSessionToken,
@@ -12997,7 +13044,7 @@ app11.post("/:id/resume", async (c) => {
   try {
     neo4jMessages = await getRecentMessages(sessionId);
   } catch (err) {
-    console.error(`[admin-resume] ${(/* @__PURE__ */ new Date()).toISOString()} getRecentMessages failed: sessionId=${sessionId.slice(0, 8)}\u2026 error=${err instanceof Error ? err.message : String(err)}`);
+    console.error(`[admin-resume] getRecentMessages failed: sessionId=${sessionId.slice(0, 8)}\u2026 error=${err instanceof Error ? err.message : String(err)}`);
     return c.json({ error: "Failed to load conversation messages" }, 500);
   }
   if (persistedAgentSessionId) {
@@ -13191,7 +13238,7 @@ app11.post("/:id/resume", async (c) => {
   } catch {
   }
   const age = formatAge(updatedAt);
-  console.log(`[admin-resume] ${(/* @__PURE__ */ new Date()).toISOString()} reason=${reason} sessionId=${sessionId.slice(0, 8)}\u2026 age=${age} loaded=${messages.length} messages ${tag} components=${totalComponents} attachments=${totalAttachments} syntheticHidden=${syntheticHidden} jsonlMissing=${jsonlMissing} healMissing=${jsonlHealMissing} cacheKey=${cacheKey.slice(0, 8)}\u2026`);
+  console.log(`[admin-resume] reason=${reason} sessionId=${sessionId.slice(0, 8)}\u2026 age=${age} loaded=${messages.length} messages ${tag} components=${totalComponents} attachments=${totalAttachments} syntheticHidden=${syntheticHidden} jsonlMissing=${jsonlMissing} healMissing=${jsonlHealMissing} cacheKey=${cacheKey.slice(0, 8)}\u2026`);
   console.log(`[admin-session-restore] cacheKey=${cacheKey.slice(0, 8)} sessionId=${sessionId.slice(0, 8)} messageCount=${rehydrated.length} ms=${Date.now() - t0}`);
   return c.json({
     sessionId,
@@ -13544,7 +13591,7 @@ function resolveTunnelUrl() {
   if (!state) return null;
   return `https://${hostname2}.${state.domain}`;
 }
-var TAG20 = "[claude-session-manager:wrapper]";
+var TAG21 = "[claude-session-manager:wrapper]";
 async function refuseIfClaudeAuthDead(c, route, sessionId) {
   const auth = await ensureAuth();
   if (auth.status !== "dead" && auth.status !== "missing") return null;
@@ -13566,12 +13613,12 @@ async function performSpawnWithInitialMessage(args) {
   const aboutOwner = await resolveOwnerProfileBlock(args.senderId, args.userId);
   const ownerMs = Date.now() - ownerStart;
   const aboutOwnerStatus = aboutOwner == null ? "absent" : "ok" in aboutOwner && aboutOwner.ok === false ? `unresolved:${aboutOwner.reason}` : "ok";
-  console.log(`${TAG20} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
+  console.log(`${TAG21} about-owner-resolved status=${aboutOwnerStatus} ms=${ownerMs}`);
   const dormantPlugins = computeDormantPlugins(args.senderId);
   const activePlugins = computeActivePlugins(args.senderId);
   const specialistDomains = computeSpecialistDomains(args.senderId);
   const tunnelUrl = resolveTunnelUrl();
-  console.log(`${TAG20} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
+  console.log(`${TAG21} tunnel-url-resolved value=${tunnelUrl ?? "null"}`);
   const upstreamPayload = JSON.stringify({
     senderId: args.senderId,
     // Task 205 — pass userId through to the manager so it lands as
@@ -13598,24 +13645,24 @@ async function performSpawnWithInitialMessage(args) {
     // unshapely values.
     conversationNodeId: args.conversationNodeId
   });
-  console.log(`${TAG20} forward-spawn-start managerBase=${managerBase3()} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
+  console.log(`${TAG21} forward-spawn-start managerBase=${managerBase3()} bytes=${upstreamPayload.length} hidden=${args.hidden} specialist=${args.specialist ?? "none"}`);
   const forwardStart = Date.now();
   const upstream = await fetch(`${managerBase3()}/public-spawn`, {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: upstreamPayload
   }).catch((err) => {
-    console.error(`${TAG20} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
+    console.error(`${TAG21} fetch-failed op=spawn message=${err instanceof Error ? err.message : String(err)} ms=${Date.now() - forwardStart}`);
     return null;
   });
   if (!upstream) return {
     response: new Response(JSON.stringify({ error: "manager-unreachable" }), { status: 503, headers: { "content-type": "application/json" } }),
     claudeSessionId: null
   };
-  console.log(`${TAG20} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
+  console.log(`${TAG21} forward-spawn-done status=${upstream.status} ms=${Date.now() - forwardStart}`);
   if (args.initialMessage) {
     const inputBytes = Buffer.byteLength(args.initialMessage, "utf8");
-    console.log(`${TAG20} initial-message-inlined bytes=${inputBytes}`);
+    console.log(`${TAG21} initial-message-inlined bytes=${inputBytes}`);
   }
   const bodyText = await upstream.text().catch(() => "");
   let claudeSessionId = null;
@@ -13650,7 +13697,7 @@ app12.post("/", async (c) => {
   if (refusal) return refusal;
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(`${TAG20} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
+    console.error(`${TAG21} reject reason=no-account-id cacheKey-prefix=${cacheKey.slice(0, 8)}`);
     return c.json({ error: "admin-account-not-resolved" }, 500);
   }
   const userId = getUserIdForSession(cacheKey) ?? void 0;
@@ -13659,7 +13706,7 @@ app12.post("/", async (c) => {
   const permissionMode = typeof body.permissionMode === "string" ? body.permissionMode : void 0;
   const specialist = typeof body.specialist === "string" && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist) ? body.specialist : void 0;
   const model = typeof body.model === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(body.model) ? body.model : void 0;
-  console.log(`${TAG20} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
+  console.log(`${TAG21} spawn-request-in surface=cookie accountId=${senderId.slice(0, 8)} userId=${userId ? userId.slice(0, 8) : "absent"} channel=${channel} permissionMode=${permissionMode ?? "default"} specialist=${specialist ?? "none"} model=${model ?? "default"} initialMessage=${initialMessage ? "yes" : "no"}`);
   const conversationNodeId = cacheKey ? getSessionIdForSession(cacheKey) : void 0;
   const { response, claudeSessionId } = await performSpawnWithInitialMessage({
     senderId,
@@ -13678,13 +13725,13 @@ app12.post("/", async (c) => {
     claudeSessionId,
     senderId
   );
-  console.log(`${TAG20} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
+  console.log(`${TAG21} route-done surface=cookie status=${response.status} route-ms=${Date.now() - routeStart}`);
   return response;
 });
 var claude_sessions_default = app12;
 
 // server/routes/admin/log-ingest.ts
-var TAG21 = "[log-ingest]";
+var TAG22 = "[log-ingest]";
 var TAG_PATTERN = /^[A-Za-z0-9_:-]{1,32}$/;
 var LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error"]);
 var MAX_LINE_BYTES = 4096;
@@ -13695,7 +13742,7 @@ function isLoopbackAddr(addr) {
 app13.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr(remoteAddr)) {
-    console.error(`${TAG21} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG22} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "log-ingest-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -13704,7 +13751,7 @@ app13.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr(t));
     if (offender !== void 0) {
-      console.error(`${TAG21} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG22} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "log-ingest-loopback-only" }, 403);
     }
   }
@@ -13746,18 +13793,18 @@ var ALLOWED_EVENTS = /* @__PURE__ */ new Set([
 ]);
 var app14 = new Hono();
 app14.post("/", async (c) => {
-  const TAG31 = "[admin:events]";
+  const TAG32 = "[admin:events]";
   let body;
   try {
     body = await c.req.json();
   } catch (err) {
     const detail = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG31} reject reason=body-not-json detail=${detail}`);
+    console.error(`${TAG32} reject reason=body-not-json detail=${detail}`);
     return c.json({ ok: false, detail: "Request body was not valid JSON" }, 400);
   }
   const event = typeof body.event === "string" ? body.event : "";
   if (!ALLOWED_EVENTS.has(event)) {
-    console.error(`${TAG31} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
+    console.error(`${TAG32} reject reason=event-not-allowed event=${JSON.stringify(event)}`);
     return c.json({ ok: false, detail: `Event "${event}" is not allowed` }, 400);
   }
   const rawFields = body.fields && typeof body.fields === "object" ? body.fields : {};
@@ -17783,7 +17830,7 @@ var health_default2 = app27;
 
 // server/routes/admin/linkedin-ingest.ts
 import { randomUUID as randomUUID9 } from "crypto";
-var TAG22 = "[linkedin-ingest-route]";
+var TAG23 = "[linkedin-ingest-route]";
 var UUID = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
 var ISO = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
 var LINKEDIN_URL = /^https:\/\/www\.linkedin\.com\//;
@@ -17887,29 +17934,29 @@ app28.post("/", requireAdminSession, async (c) => {
   try {
     body = await c.req.json();
   } catch {
-    console.error(TAG22 + " rejected status=400 reason=schema:body-not-json");
+    console.error(TAG23 + " rejected status=400 reason=schema:body-not-json");
     return c.json({ ok: false, error: "schema", reason: "body-not-json" }, 400);
   }
   const v = validate(body);
   if (!v.ok) {
-    console.error(TAG22 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
+    console.error(TAG23 + " rejected status=" + v.status + " reason=" + v.reason + " missing=" + v.missing.join(","));
     return c.json({ ok: false, error: v.error, reason: v.reason, missing: v.missing }, v.status);
   }
   const envelope = v.envelope;
   const cacheKey = c.var.cacheKey ?? "";
   const senderId = getAccountIdForSession(cacheKey) ?? "";
   if (!senderId) {
-    console.error(TAG22 + " rejected status=500 reason=admin-account-not-resolved");
+    console.error(TAG23 + " rejected status=500 reason=admin-account-not-resolved");
     return c.json({ ok: false, error: "admin-account-not-resolved" }, 500);
   }
   const payloadBytes = JSON.stringify(envelope).length;
   console.log(
-    TAG22 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
+    TAG23 + " received kind=" + envelope.kind + " account=" + senderId.slice(0, 8) + " pageUrl=" + envelope.pageUrl + " dispatchId=" + envelope.dispatchId + " payloadBytes=" + payloadBytes
   );
   const initialMessage = buildInitialMessage(envelope);
   const spawnStart = Date.now();
   const sessionId = randomUUID9();
-  console.log(TAG22 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
+  console.log(TAG23 + " route target=rc-spawn dispatchId=" + envelope.dispatchId + " sessionId=" + sessionId.slice(0, 8));
   const spawned = await managerRcSpawn({
     sessionId,
     initialMessage,
@@ -17918,12 +17965,12 @@ app28.post("/", requireAdminSession, async (c) => {
   });
   if ("error" in spawned) {
     console.error(
-      TAG22 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
+      TAG23 + " dispatch-failed dispatchId=" + envelope.dispatchId + " status=" + spawned.status + " ms=" + (Date.now() - spawnStart) + " message=" + spawned.error
     );
     return c.json({ ok: false, error: "dispatch-failed", upstreamStatus: spawned.status, detail: spawned.error }, 502);
   }
   console.log(
-    TAG22 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
+    TAG23 + " dispatched dispatchId=" + envelope.dispatchId + " taskId=" + spawned.sessionId + " ms=" + (Date.now() - spawnStart)
   );
   return c.json({ ok: true, dispatchId: envelope.dispatchId, taskId: spawned.sessionId }, 202);
 });
@@ -17931,7 +17978,7 @@ var linkedin_ingest_default = app28;
 
 // server/routes/admin/post-turn-context.ts
 import neo4j2 from "neo4j-driver";
-var TAG23 = "[post-turn-context]";
+var TAG24 = "[post-turn-context]";
 var STRIPPED_PROPERTIES2 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -17973,7 +18020,7 @@ var app29 = new Hono();
 app29.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr2(remoteAddr)) {
-    console.error(`${TAG23} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "post-turn-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -17982,7 +18029,7 @@ app29.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr2(t));
     if (offender !== void 0) {
-      console.error(`${TAG23} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "post-turn-context-loopback-only" }, 403);
     }
   }
@@ -18014,7 +18061,7 @@ app29.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG23} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
+      `${TAG24} sessionId=${sessionId} accountId=${accountId} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -18023,7 +18070,7 @@ app29.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG23} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
+      `${TAG24} neo4j-unreachable sessionId=${sessionId} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `post-turn-context unavailable: ${message}` }, 503);
   } finally {
@@ -18034,7 +18081,7 @@ var post_turn_context_default = app29;
 
 // server/routes/admin/public-session-context.ts
 import neo4j3 from "neo4j-driver";
-var TAG24 = "[public-session-context]";
+var TAG25 = "[public-session-context]";
 var STRIPPED_PROPERTIES3 = /* @__PURE__ */ new Set([
   "embedding",
   "passwordHash",
@@ -18076,7 +18123,7 @@ var app30 = new Hono();
 app30.get("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr3(remoteAddr)) {
-    console.error(`${TAG24} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-context-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -18085,7 +18132,7 @@ app30.get("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr3(t));
     if (offender !== void 0) {
-      console.error(`${TAG24} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-context-loopback-only" }, 403);
     }
   }
@@ -18116,7 +18163,7 @@ app30.get("/", async (c) => {
     writes.sort((a, b) => a.sortKey.localeCompare(b.sortKey));
     const total = Date.now() - started;
     console.log(
-      `${TAG24} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
+      `${TAG25} sliceToken=${sliceToken.slice(0, 8)} writes=${writes.length} ms=${total}`
     );
     return c.json({
       writes: writes.map(({ elementId, labels, properties }) => ({ elementId, labels, properties }))
@@ -18125,7 +18172,7 @@ app30.get("/", async (c) => {
     const elapsed = Date.now() - started;
     const message = err instanceof Error ? err.message : String(err);
     console.error(
-      `${TAG24} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
+      `${TAG25} neo4j-unreachable sliceToken=${sliceToken.slice(0, 8)} ms=${elapsed} err="${message}"`
     );
     return c.json({ error: `public-session-context unavailable: ${message}` }, 503);
   } finally {
@@ -18135,7 +18182,7 @@ app30.get("/", async (c) => {
 var public_session_context_default = app30;
 
 // server/routes/admin/public-session-exit.ts
-var TAG25 = "[public-session-exit-route]";
+var TAG26 = "[public-session-exit-route]";
 function isLoopbackAddr4(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -18143,7 +18190,7 @@ var app31 = new Hono();
 app31.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr4(remoteAddr)) {
-    console.error(`${TAG25} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "public-session-exit-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -18152,7 +18199,7 @@ app31.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr4(t));
     if (offender !== void 0) {
-      console.error(`${TAG25} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "public-session-exit-loopback-only" }, 403);
     }
   }
@@ -18170,7 +18217,7 @@ app31.post("/", async (c) => {
 var public_session_exit_default = app31;
 
 // server/routes/admin/access-session-evict.ts
-var TAG26 = "[access-session-evict]";
+var TAG27 = "[access-session-evict]";
 function isLoopbackAddr5(addr) {
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1";
 }
@@ -18178,7 +18225,7 @@ var app32 = new Hono();
 app32.post("/", async (c) => {
   const remoteAddr = c.env?.incoming?.socket?.remoteAddress ?? "";
   if (!isLoopbackAddr5(remoteAddr)) {
-    console.error(`${TAG26} reject reason=non-loopback remoteAddr=${remoteAddr}`);
+    console.error(`${TAG27} reject reason=non-loopback remoteAddr=${remoteAddr}`);
     return c.json({ error: "access-session-evict-loopback-only" }, 403);
   }
   const xffHeader = c.env?.incoming?.headers?.["x-forwarded-for"];
@@ -18187,7 +18234,7 @@ app32.post("/", async (c) => {
     const tokens = xffRaw.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
     const offender = tokens.find((t) => !isLoopbackAddr5(t));
     if (offender !== void 0) {
-      console.error(`${TAG26} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
+      console.error(`${TAG27} reject reason=xff-non-loopback xff=${JSON.stringify(xffRaw)}`);
       return c.json({ error: "access-session-evict-loopback-only" }, 403);
     }
   }
@@ -18200,7 +18247,7 @@ app32.post("/", async (c) => {
   const grantId = typeof body.grantId === "string" ? body.grantId.trim() : "";
   if (!grantId) return c.json({ error: "grantId required" }, 400);
   const dropped = evictAccessSessionsByGrant(grantId);
-  console.log(`${TAG26} grantId=${grantId} dropped=${dropped}`);
+  console.log(`${TAG27} grantId=${grantId} dropped=${dropped}`);
   return c.json({ ok: true, dropped });
 });
 var access_session_evict_default = app32;
@@ -18208,7 +18255,7 @@ var access_session_evict_default = app32;
 // server/routes/admin/identity.ts
 var import_dist4 = __toESM(require_dist3(), 1);
 var app33 = new Hono();
-var TAG27 = "[admin-identity]";
+var TAG28 = "[admin-identity]";
 function managerBase5() {
   const port2 = (0, import_dist4.requirePortEnv)("CLAUDE_SESSION_MANAGER_PORT", { tag: "admin-identity" });
   return `http://127.0.0.1:${port2}`;
@@ -18239,55 +18286,88 @@ app33.post("/validate", async (c) => {
   const verdict = validatePin(pin, USERS_FILE);
   if (verdict.kind !== "match") {
     if (verdict.kind === "miss") fireStop();
-    console.log(`${TAG27} op=endpoint-validate result=${verdict.kind}${sessionId ? ` sessionId=${sessionId.slice(0, 8)}` : ""}`);
+    console.log(`${TAG28} op=endpoint-validate result=${verdict.kind}${sessionId ? ` sessionId=${sessionId.slice(0, 8)}` : ""}`);
     return c.json({ kind: verdict.kind });
   }
   const { userId } = verdict;
   const accounts = resolveUserAccounts(userId);
   if (accounts.length === 0) {
     fireStop();
-    console.log(`${TAG27} op=endpoint-validate result=no-account userId=${userId.slice(0, 8)}`);
+    console.log(`${TAG28} op=endpoint-validate result=no-account userId=${userId.slice(0, 8)}`);
     return c.json({ kind: "miss" });
   }
   const accountId = accounts[0].accountId;
   const { userName } = await resolveUserIdentity(accountId, userId);
   const aboutOwner = await resolveOwnerProfileBlock(accountId, userId);
-  console.log(`${TAG27} op=endpoint-validate result=match userId=${userId.slice(0, 8)} aboutOwner=${aboutOwner.ok ? "ok" : `unresolved:${aboutOwner.reason}`}`);
+  console.log(`${TAG28} op=endpoint-validate result=match userId=${userId.slice(0, 8)} aboutOwner=${aboutOwner.ok ? "ok" : `unresolved:${aboutOwner.reason}`}`);
   return c.json({ kind: "match", userId, userName, aboutOwner });
 });
 var identity_default = app33;
 
-// server/routes/admin/index.ts
+// server/routes/admin/browser.ts
 var app34 = new Hono();
-app34.route("/session", session_default);
-app34.route("/identity", identity_default);
-app34.route("/logs", logs_default);
-app34.route("/claude-info", claude_info_default);
-app34.route("/attachment", attachment_default);
-app34.route("/agents", agents_default);
-app34.route("/sessions", sessions_default);
-app34.route("/claude-sessions", claude_sessions_default);
-app34.route("/log-ingest", log_ingest_default);
-app34.route("/events", events_default);
-app34.route("/files", files_default);
-app34.route("/graph-search", graph_search_default);
-app34.route("/graph-subgraph", graph_subgraph_default);
-app34.route("/graph-delete", graph_delete_default);
-app34.route("/graph-restore", graph_restore_default);
-app34.route("/graph-labels-in-graph", graph_labels_in_graph_default);
-app34.route("/graph-default-view", graph_default_view_default);
-app34.route("/sidebar-artefacts", sidebar_artefacts_default);
-app34.route("/sidebar-sessions", sidebar_sessions_default);
-app34.route("/session-delete", session_delete_default);
-app34.route("/session-rc-spawn", session_rc_spawn_default);
-app34.route("/system-stats", system_stats_default);
-app34.route("/health-brand", health_default2);
-app34.route("/linkedin-ingest", linkedin_ingest_default);
-app34.route("/post-turn-context", post_turn_context_default);
-app34.route("/public-session-context", public_session_context_default);
-app34.route("/public-session-exit", public_session_exit_default);
-app34.route("/access-session-evict", access_session_evict_default);
-var admin_default = app34;
+app34.post("/launch", requireAdminSession, async (c) => {
+  try {
+    const transport = resolveBrowserTransport(c.req.raw, c.env?.incoming?.socket?.remoteAddress);
+    console.error(`[admin/browser/launch] op=request transport=${transport}`);
+    if (transport === "vnc") {
+      const vncOk = await ensureVnc();
+      console.error(`[admin/browser/launch] op=vnc-ensured ok=${vncOk}`);
+      if (!vncOk) {
+        console.error("[admin/browser/launch] op=vnc-failed");
+        return c.json({ ok: false, error: "VNC failed to start" }, 502);
+      }
+    }
+    const cdpOk = await ensureCdp(transport);
+    console.error(`[admin/browser/launch] op=cdp-ensured ok=${cdpOk}`);
+    if (!cdpOk) {
+      console.error("[admin/browser/launch] op=cdp-failed");
+      return c.json({ ok: false, error: "Chrome failed to start" }, 502);
+    }
+    console.error(`[admin/browser/launch] op=ready transport=${transport}`);
+    return c.json({ ok: true, transport });
+  } catch (err) {
+    console.error("[admin/browser/launch] Failed to start browser:", err);
+    return c.json(
+      { ok: false, error: err instanceof Error ? err.message : "Unknown error" },
+      500
+    );
+  }
+});
+var browser_default = app34;
+
+// server/routes/admin/index.ts
+var app35 = new Hono();
+app35.route("/session", session_default);
+app35.route("/identity", identity_default);
+app35.route("/logs", logs_default);
+app35.route("/claude-info", claude_info_default);
+app35.route("/attachment", attachment_default);
+app35.route("/agents", agents_default);
+app35.route("/sessions", sessions_default);
+app35.route("/claude-sessions", claude_sessions_default);
+app35.route("/log-ingest", log_ingest_default);
+app35.route("/events", events_default);
+app35.route("/files", files_default);
+app35.route("/graph-search", graph_search_default);
+app35.route("/graph-subgraph", graph_subgraph_default);
+app35.route("/graph-delete", graph_delete_default);
+app35.route("/graph-restore", graph_restore_default);
+app35.route("/graph-labels-in-graph", graph_labels_in_graph_default);
+app35.route("/graph-default-view", graph_default_view_default);
+app35.route("/sidebar-artefacts", sidebar_artefacts_default);
+app35.route("/sidebar-sessions", sidebar_sessions_default);
+app35.route("/session-delete", session_delete_default);
+app35.route("/browser", browser_default);
+app35.route("/session-rc-spawn", session_rc_spawn_default);
+app35.route("/system-stats", system_stats_default);
+app35.route("/health-brand", health_default2);
+app35.route("/linkedin-ingest", linkedin_ingest_default);
+app35.route("/post-turn-context", post_turn_context_default);
+app35.route("/public-session-context", public_session_context_default);
+app35.route("/public-session-exit", public_session_exit_default);
+app35.route("/access-session-evict", access_session_evict_default);
+var admin_default = app35;
 
 // app/lib/access-gate.ts
 import neo4j4 from "neo4j-driver";
@@ -18498,11 +18578,11 @@ async function generateNewMagicToken(grantId) {
 }
 
 // server/routes/access/verify-token.ts
-var TAG28 = "[access-verify]";
+var TAG29 = "[access-verify]";
 var MINT_TAG = "[access-session-mint]";
 var COOKIE_NAME = "__access_session";
-var app35 = new Hono();
-app35.post("/", async (c) => {
+var app36 = new Hono();
+app36.post("/", async (c) => {
   const ip = c.var.clientIp || "unknown";
   let body;
   try {
@@ -18517,39 +18597,39 @@ app35.post("/", async (c) => {
   }
   const rateMsg = checkAccessRateLimit(ip, agentSlug);
   if (rateMsg) {
-    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
+    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=rate-limited ip=${ip}`);
     return c.json({ error: rateMsg }, 429);
   }
   const grant = await findGrantByMagicToken(token);
   if (!grant) {
     recordAccessFailedAttempt(ip, agentSlug);
-    console.error(`${TAG28} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
+    console.error(`${TAG29} grantId=- agentSlug=${agentSlug} result=notfound ip=${ip}`);
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.agentSlug !== agentSlug) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=agent-mismatch grantAgent=${grant.agentSlug} ip=${ip}`
     );
     return c.json({ error: "invalid-or-expired-link" }, 401);
   }
   if (grant.status === "expired" || grant.status === "revoked") {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired status=${grant.status} ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (grant.expiresAt !== null && grant.expiresAt < Date.now()) {
     recordAccessFailedAttempt(ip, agentSlug);
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=expired reason=expiresAt-past ip=${ip}`
     );
     return c.json({ error: "access-no-longer-valid" }, 401);
   }
   if (!grant.sliceToken) {
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=no-slice-token reason=schema-violation`
     );
     return c.json({ error: "grant-misconfigured" }, 500);
   }
@@ -18565,12 +18645,12 @@ app35.post("/", async (c) => {
     await consumeMagicTokenAndActivate(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=consume-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ error: "verification-failed" }, 500);
   }
   clearAccessRateLimit(ip, agentSlug);
-  console.log(`${TAG28} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
+  console.log(`${TAG29} grantId=${grant.grantId} agentSlug=${agentSlug} result=ok ip=${ip}`);
   console.log(
     `${MINT_TAG} grantId=${grant.grantId} sliceToken=${grant.sliceToken.slice(0, 8)} agentSlug=${agentSlug} personId=${grant.personId ?? "none"}`
   );
@@ -18584,7 +18664,7 @@ app35.post("/", async (c) => {
     displayName: grant.displayName
   });
 });
-var verify_token_default = app35;
+var verify_token_default = app36;
 
 // app/lib/access-email.ts
 import { spawn as spawn2 } from "child_process";
@@ -18646,10 +18726,10 @@ async function sendMagicLinkEmail(payload) {
 }
 
 // server/routes/access/request-magic-link.ts
-var TAG29 = "[access-request-link]";
-var app36 = new Hono();
+var TAG30 = "[access-request-link]";
+var app37 = new Hono();
 var VISITOR_MESSAGE = "If that email is on the invite list, a fresh link is on the way.";
-app36.post("/", async (c) => {
+app37.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -18663,18 +18743,18 @@ app36.post("/", async (c) => {
   }
   const rateMsg = checkRequestLinkRateLimit(contactValue);
   if (rateMsg) {
-    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=rate-limited`);
+    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=rate-limited`);
     return c.json({ error: rateMsg }, 429);
   }
   recordRequestLinkAttempt(contactValue);
   const accountId = process.env.ACCOUNT_ID ?? "";
   if (!accountId) {
-    console.error(`${TAG29} contactValue=${maskContact(contactValue)} result=no-account-id`);
+    console.error(`${TAG30} contactValue=${maskContact(contactValue)} result=no-account-id`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   const grant = await findActiveGrantByContact(contactValue, agentSlug, accountId);
   if (!grant) {
-    console.log(`${TAG29} contactValue=${maskContact(contactValue)} result=notfound`);
+    console.log(`${TAG30} contactValue=${maskContact(contactValue)} result=notfound`);
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   let token;
@@ -18682,7 +18762,7 @@ app36.post("/", async (c) => {
     token = await generateNewMagicToken(grant.grantId);
   } catch (err) {
     console.error(
-      `${TAG29} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
+      `${TAG30} contactValue=${maskContact(contactValue)} result=mint-failed err="${err instanceof Error ? err.message : String(err)}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
@@ -18714,22 +18794,22 @@ app36.post("/", async (c) => {
   });
   if (!sendResult.ok) {
     console.error(
-      `${TAG29} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
+      `${TAG30} contactValue=${maskContact(contactValue)} result=send-failed err="${sendResult.error}"`
     );
     return c.json({ message: VISITOR_MESSAGE }, 200);
   }
   console.log(
-    `${TAG29} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
+    `${TAG30} contactValue=${maskContact(contactValue)} result=ok messageId=${sendResult.messageId}`
   );
   return c.json({ message: VISITOR_MESSAGE }, 200);
 });
-var request_magic_link_default = app36;
+var request_magic_link_default = app37;
 
 // server/routes/access/index.ts
-var app37 = new Hono();
-app37.route("/verify-token", verify_token_default);
-app37.route("/request-magic-link", request_magic_link_default);
-var access_default = app37;
+var app38 = new Hono();
+app38.route("/verify-token", verify_token_default);
+app38.route("/request-magic-link", request_magic_link_default);
+var access_default = app38;
 
 // server/routes/sites.ts
 import { existsSync as existsSync19, readFileSync as readFileSync18, realpathSync as realpathSync5, statSync as statSync8 } from "fs";
@@ -18764,8 +18844,8 @@ function getExt(p) {
   if (idx < p.lastIndexOf("/")) return "";
   return p.slice(idx).toLowerCase();
 }
-var app38 = new Hono();
-app38.get("/:rel{.*}", (c) => {
+var app39 = new Hono();
+app39.get("/:rel{.*}", (c) => {
   const reqPath = c.req.path;
   const rawRel = c.req.param("rel") ?? "";
   const trimmed = rawRel.replace(/^\/+/, "").replace(/\/+$/, "");
@@ -18868,7 +18948,7 @@ app38.get("/:rel{.*}", (c) => {
     "X-Content-Type-Options": "nosniff"
   });
 });
-var sites_default = app38;
+var sites_default = app39;
 
 // app/lib/visitor-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
@@ -18968,7 +19048,7 @@ function readBrandConfig() {
 }
 
 // server/routes/visitor-consent.ts
-var app39 = new Hono();
+var app40 = new Hono();
 var CONSENT_COOKIE_NAME = "mxy_consent";
 var CONSENT_COOKIE_MAX_AGE_SECONDS = 60 * 60 * 24 * 365;
 var DEFAULT_CONSENT_COPY = {
@@ -19013,17 +19093,17 @@ function siteSlugFromReferer(referer) {
     return "";
   }
 }
-app39.options("/consent", (c) => {
+app40.options("/consent", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app39.options("/brand-config", (c) => {
+app40.options("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   return c.body(null, 204);
 });
-app39.post("/consent", async (c) => {
+app40.post("/consent", async (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   let raw;
@@ -19063,7 +19143,7 @@ app39.post("/consent", async (c) => {
   console.log(`[consent] ${parsed.decision} site=${site} brand=${brandName} tokenBound=${tokenBound}`);
   return c.body(null, 204);
 });
-app39.get("/brand-config", (c) => {
+app40.get("/brand-config", (c) => {
   const origin = getOrigin(c);
   setCorsHeaders(c, origin);
   const brand = readBrandConfig();
@@ -19073,7 +19153,7 @@ app39.get("/brand-config", (c) => {
   c.header("Cache-Control", "public, max-age=300");
   return c.json({ consent: { copy, palette } });
 });
-var visitor_consent_default = app39;
+var visitor_consent_default = app40;
 
 // server/routes/listings.ts
 function getCookie(headerValue, name) {
@@ -19100,8 +19180,8 @@ function appendConsentParams(pageUrl, token) {
 }
 var SAFE_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]{0,118}[a-z0-9])?$/;
 var CHAT_SESSION_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{7,127}$/;
-var app40 = new Hono();
-app40.get("/:slug/click", async (c) => {
+var app41 = new Hono();
+app41.get("/:slug/click", async (c) => {
   const slug = c.req.param("slug") ?? "";
   const rawSession = c.req.query("session") ?? "";
   const sessionKey = CHAT_SESSION_KEY_RE.test(rawSession) ? rawSession : "invalid";
@@ -19165,10 +19245,10 @@ app40.get("/:slug/click", async (c) => {
   console.log(`[property-card-click] sessionKey=${sessionKey} listingSlug=${slug} consent=${consentCookie ?? "absent"} ts=${(/* @__PURE__ */ new Date()).toISOString()}`);
   return c.redirect(redirectUrl, 302);
 });
-var listings_default = app40;
+var listings_default = app41;
 
 // server/routes/visitor-event.ts
-var app41 = new Hono();
+var app42 = new Hono();
 var BOT_UA_RE = /\b(bot|crawl|spider|slurp|headlesschrome|phantomjs|googlebot|bingbot|yandex|baiduspider|ahrefsbot|semrushbot|mj12bot|dotbot|petalbot)\b/i;
 var buckets = /* @__PURE__ */ new Map();
 var RATE_LIMIT = 60;
@@ -19235,12 +19315,12 @@ function originAllowed(origin, allowlist) {
     return false;
   }
 }
-app41.options("/event", (c) => {
+app42.options("/event", (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   return c.body(null, 204);
 });
-app41.post("/event", async (c) => {
+app42.post("/event", async (c) => {
   const origin = getOrigin2(c);
   setCorsHeaders2(c, origin);
   const ua = c.req.header("user-agent") ?? "";
@@ -19445,7 +19525,7 @@ async function writeEvent(opts) {
     );
   }
 }
-var visitor_event_default = app41;
+var visitor_event_default = app42;
 
 // server/routes/session.ts
 import { resolve as resolve23 } from "path";
@@ -19482,8 +19562,8 @@ function withVisitorCookie(response, visitorId) {
     headers
   });
 }
-var app42 = new Hono();
-app42.post("/", async (c) => {
+var app43 = new Hono();
+app43.post("/", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -19687,7 +19767,7 @@ app42.post("/", async (c) => {
     newVisitorId
   );
 });
-var session_default2 = app42;
+var session_default2 = app43;
 
 // app/lib/graph-health.ts
 var import_dist5 = __toESM(require_dist4(), 1);
@@ -19910,7 +19990,7 @@ async function startFileWatcher(opts = {}) {
 }
 
 // app/lib/whatsapp/inbound/claude-bridge.ts
-var TAG30 = "[whatsapp-adaptor]";
+var TAG31 = "[whatsapp-adaptor]";
 function whatsappTurnTimeoutMs() {
   return Number(process.env.WHATSAPP_PTY_TURN_TIMEOUT_MS ?? String(5 * 6e4));
 }
@@ -19927,7 +20007,7 @@ ${note}` : note;
 async function dispatchToClaude(input) {
   const hasFileMedia = !!input.mediaPath && input.mediaType !== "audio";
   const mediaField = hasFileMedia ? `media=${input.mediaType} mediaPath=${input.mediaPath}` : input.mediaType === "audio" ? "media=audio mediaPath=transcribed" : "media=none";
-  console.error(`${TAG30} inbound-media ${mediaField} role=${input.role} senderId=${input.senderId}`);
+  console.error(`${TAG31} inbound-media ${mediaField} role=${input.role} senderId=${input.senderId}`);
   const text = composeTurn(input);
   if (!text.trim()) return;
   const result = await dispatchOnce({
@@ -19940,13 +20020,19 @@ async function dispatchToClaude(input) {
     timeoutMs: whatsappTurnTimeoutMs()
   });
   if ("error" in result) {
+    if (result.error === "timeout" && result.cause === "no-turn") {
+      recordInboundOutcome(input.senderId, "timeout-no-turn");
+    } else if (result.error === "timeout" && result.cause === "relay-missed") {
+      recordInboundOutcome(input.senderId, "timeout-relay-missed");
+    }
     return;
   }
+  recordInboundOutcome(input.senderId, "relay-ok");
   try {
     await input.reply(result.turnText);
   } catch (err) {
     const m = err instanceof Error ? err.message : String(err);
-    console.error(`${TAG30} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
+    console.error(`${TAG31} reject reason=reply-failed senderId=${input.senderId} message=${m}`);
   }
 }
 function startReaper2() {
@@ -20276,9 +20362,9 @@ watchFile(ALIAS_DOMAINS_PATH, { interval: 2e3 }, () => {
 function isPublicHost(host) {
   return host.startsWith("public.") || aliasDomains.has(host);
 }
-var app43 = new Hono();
-app43.use("*", clientIpMiddleware);
-app43.use("*", async (c, next) => {
+var app44 = new Hono();
+app44.use("*", clientIpMiddleware);
+app44.use("*", async (c, next) => {
   await next();
   c.header("X-Content-Type-Options", "nosniff");
   c.header("Referrer-Policy", "strict-origin-when-cross-origin");
@@ -20288,7 +20374,7 @@ app43.use("*", async (c, next) => {
   );
 });
 var HTTP_LOG_PATHS = /* @__PURE__ */ new Set(["/vnc-viewer.html", "/vnc-popout.html"]);
-app43.use("*", async (c, next) => {
+app44.use("*", async (c, next) => {
   if (!HTTP_LOG_PATHS.has(c.req.path)) {
     await next();
     return;
@@ -20306,7 +20392,7 @@ app43.use("*", async (c, next) => {
     });
   }
 });
-app43.use("*", async (c, next) => {
+app44.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (!isPublicHost(host)) {
     await next();
@@ -20337,7 +20423,7 @@ function resolveRemoteAuthOpts() {
   return brandLoginOpts;
 }
 var MAX_LOGIN_BODY = 8 * 1024;
-app43.post("/__remote-auth/login", async (c) => {
+app44.post("/__remote-auth/login", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   if (!requestIsTlsTerminated(c)) {
@@ -20382,7 +20468,7 @@ app43.post("/__remote-auth/login", async (c) => {
     }
   });
 });
-app43.get("/__remote-auth/logout", (c) => {
+app44.get("/__remote-auth/logout", (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   console.error(`[remote-auth] logout ip=${clientIp}`);
@@ -20395,7 +20481,7 @@ app43.get("/__remote-auth/logout", (c) => {
     }
   });
 });
-app43.post("/__remote-auth/change-password", async (c) => {
+app44.post("/__remote-auth/change-password", async (c) => {
   const client = clientFrom(c);
   const clientIp = client.ip || "unknown";
   const rateLimited = checkRateLimit(client);
@@ -20446,13 +20532,13 @@ app43.post("/__remote-auth/change-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "change", changeError: "Failed to save password", redirect }), 200);
   }
 });
-app43.get("/__remote-auth/setup", (c) => {
+app44.get("/__remote-auth/setup", (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup" }), 200);
 });
-app43.post("/__remote-auth/set-initial-password", async (c) => {
+app44.post("/__remote-auth/set-initial-password", async (c) => {
   if (isRemoteAuthConfigured()) {
     return c.redirect("/");
   }
@@ -20490,10 +20576,10 @@ app43.post("/__remote-auth/set-initial-password", async (c) => {
     return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), mode: "setup", setupError: "Failed to save password. Please try again." }), 200);
   }
 });
-app43.get("/api/remote-auth/status", (c) => {
+app44.get("/api/remote-auth/status", (c) => {
   return c.json({ configured: isRemoteAuthConfigured() });
 });
-app43.post("/api/remote-auth/set-password", async (c) => {
+app44.post("/api/remote-auth/set-password", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -20524,9 +20610,9 @@ app43.post("/api/remote-auth/set-password", async (c) => {
     return c.json({ error: "Failed to save password" }, 500);
   }
 });
-app43.route("/api/_client-error", client_error_default);
+app44.route("/api/_client-error", client_error_default);
 console.log("[client-error-route] mounted");
-app43.use("*", async (c, next) => {
+app44.use("*", async (c, next) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (path2 === "/favicon.ico" || path2.startsWith("/assets/") || path2.startsWith("/brand/")) {
@@ -20559,13 +20645,13 @@ app43.use("*", async (c, next) => {
   console.error(`[remote-auth] login required ip=${clientIp} path=${path2} ${disambig}`);
   return c.html(renderLoginPage({ ...resolveRemoteAuthOpts(), redirect: path2 }), 200);
 });
-app43.route("/api/health", health_default);
-app43.route("/api/chat", chat_default);
-app43.route("/api/whatsapp", whatsapp_default);
-app43.route("/api/onboarding", onboarding_default);
-app43.route("/api/admin", admin_default);
-app43.route("/api/access", access_default);
-app43.route("/api/session", session_default2);
+app44.route("/api/health", health_default);
+app44.route("/api/chat", chat_default);
+app44.route("/api/whatsapp", whatsapp_default);
+app44.route("/api/onboarding", onboarding_default);
+app44.route("/api/admin", admin_default);
+app44.route("/api/access", access_default);
+app44.route("/api/session", session_default2);
 var SAFE_SLUG_RE2 = /^[a-z][a-z0-9-]{2,49}$/;
 var SAFE_FILENAME_RE = /^[a-z0-9_][a-z0-9_.-]{0,99}$/i;
 var IMAGE_MIME = {
@@ -20577,7 +20663,7 @@ var IMAGE_MIME = {
   ".svg": "image/svg+xml",
   ".ico": "image/x-icon"
 };
-app43.get("/agent-assets/:slug/:filename", (c) => {
+app44.get("/agent-assets/:slug/:filename", (c) => {
   const slug = c.req.param("slug");
   const filename = c.req.param("filename");
   if (!SAFE_SLUG_RE2.test(slug)) {
@@ -20612,7 +20698,7 @@ app43.get("/agent-assets/:slug/:filename", (c) => {
     "Cache-Control": "public, max-age=3600"
   });
 });
-app43.get("/generated/:filename", (c) => {
+app44.get("/generated/:filename", (c) => {
   const filename = c.req.param("filename");
   if (!SAFE_FILENAME_RE.test(filename) || filename.includes("..")) {
     console.error(`[generated] serve file=${filename} status=403`);
@@ -20642,10 +20728,10 @@ app43.get("/generated/:filename", (c) => {
     "Cache-Control": "public, max-age=86400"
   });
 });
-app43.route("/sites", sites_default);
-app43.route("/listings", listings_default);
-app43.route("/v", visitor_event_default);
-app43.route("/v", visitor_consent_default);
+app44.route("/sites", sites_default);
+app44.route("/listings", listings_default);
+app44.route("/v", visitor_event_default);
+app44.route("/v", visitor_consent_default);
 var htmlCache = /* @__PURE__ */ new Map();
 var brandLogoPath = "/brand/maxy-monochrome.png";
 var brandIconPath = "/brand/maxy-monochrome.png";
@@ -20776,7 +20862,7 @@ function escapeHtml(s) {
 function agentUnavailableHtml() {
   return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escapeHtml(BRAND.productName)}</title></head><body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1.5rem;color:#222"><h1 style="font-size:1.25rem">Agent unavailable</h1><p>This agent isn't available right now. If you reached this page from a saved link, the agent may have been turned off.</p></body></html>`;
 }
-app43.get("/", (c) => {
+app44.get("/", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) {
     const defaultSlug = resolveDefaultSlug();
@@ -20792,12 +20878,12 @@ app43.get("/", (c) => {
   }
   return c.html(cachedHtml("index.html"));
 });
-app43.get("/public", (c) => {
+app44.get("/public", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
 });
-app43.get("/chat", (c) => {
+app44.get("/chat", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("public.html"));
@@ -20816,9 +20902,9 @@ async function logViewerFetch(c, next) {
     duration_ms: Date.now() - start
   });
 }
-app43.use("/vnc-viewer.html", logViewerFetch);
-app43.use("/vnc-popout.html", logViewerFetch);
-app43.get("/vnc-popout.html", (c) => {
+app44.use("/vnc-viewer.html", logViewerFetch);
+app44.use("/vnc-popout.html", logViewerFetch);
+app44.get("/vnc-popout.html", (c) => {
   let html = htmlCache.get("vnc-popout.html");
   if (!html) {
     html = readFileSync22(resolve26(process.cwd(), "public", "vnc-popout.html"), "utf-8");
@@ -20831,7 +20917,7 @@ app43.get("/vnc-popout.html", (c) => {
   }
   return c.html(html);
 });
-app43.post("/api/vnc/client-event", async (c) => {
+app44.post("/api/vnc/client-event", async (c) => {
   let body;
   try {
     body = await c.req.json();
@@ -20852,25 +20938,30 @@ app43.post("/api/vnc/client-event", async (c) => {
   });
   return c.json({ ok: true });
 });
-app43.get("/g/:slug", (c) => {
+app44.get("/g/:slug", (c) => {
   return c.html(brandedPublicHtml());
 });
-app43.get("/graph", (c) => {
+app44.get("/graph", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("graph.html"));
 });
-app43.get("/sessions", (c) => {
+app44.get("/sessions", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("sessions.html"));
 });
-app43.get("/data", (c) => {
+app44.get("/data", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   if (isPublicHost(host)) return c.text("Not found", 404);
   return c.html(cachedHtml("data.html"));
 });
-app43.get("/:slug", async (c, next) => {
+app44.get("/browser", (c) => {
+  const host = (c.req.header("host") ?? "").split(":")[0];
+  if (isPublicHost(host)) return c.text("Not found", 404);
+  return c.html(cachedHtml("browser.html"));
+});
+app44.get("/:slug", async (c, next) => {
   const slug = c.req.param("slug");
   if (AGENT_SLUG_PATTERN.test(`/${slug}`)) {
     const account = resolveAccount();
@@ -20885,13 +20976,13 @@ app43.get("/:slug", async (c, next) => {
   await next();
 });
 if (brandFaviconPath !== "/favicon.ico") {
-  app43.get("/favicon.ico", (c) => {
+  app44.get("/favicon.ico", (c) => {
     c.header("Cache-Control", "public, max-age=300");
     return c.redirect(brandFaviconPath, 302);
   });
 }
-app43.use("/*", serveStatic({ root: "./public" }));
-app43.all("*", (c) => {
+app44.use("/*", serveStatic({ root: "./public" }));
+app44.all("*", (c) => {
   const host = (c.req.header("host") ?? "").split(":")[0];
   const path2 = c.req.path;
   if (isPublicHost(host)) {
@@ -20905,7 +20996,7 @@ app43.all("*", (c) => {
 });
 var port = requirePortEnv("MAXY_UI_INTERNAL_PORT", { tag: "ui-server" });
 var hostname = process.env.HOSTNAME ?? "127.0.0.1";
-var httpServer = serve({ fetch: app43.fetch, port, hostname });
+var httpServer = serve({ fetch: app44.fetch, port, hostname });
 console.log(`${BRAND.productName} listening on http://${hostname}:${port}`);
 startAuthHealthHeartbeat();
 {
@@ -20942,7 +21033,7 @@ for (const m of SUBAPP_MANIFEST) {
 }
 try {
   const registered = [];
-  for (const r of app43.routes ?? []) {
+  for (const r of app44.routes ?? []) {
     if (typeof r.path !== "string" || r.path.includes(":") || r.path.includes("*")) continue;
     if (AGENT_SLUG_PATTERN.test(r.path)) {
       registered.push({ method: (r.method ?? "ALL").toUpperCase(), path: r.path });