UDS_FALLBACK_USER is HttpOnly so the client never saw it; also accept UDS_FALLBACK_UI and data-uds-logged-in.
Co-authored-by: Cursor <cursoragent@cursor.com>
List/run/pause/resume/delete now return 401 without UDS cookies; hide sidebar chrome when logged out. uds-auth still validates the session store on the same routes.
Co-authored-by: Cursor <cursoragent@cursor.com>
Cron jobs created from WhatsApp can omit bot/target ids and reuse chat overrides; sidebar/agent preset pins persist on fire.
Co-authored-by: Cursor <cursoragent@cursor.com>
Agent cron_* jobs default to IM when created from a WhatsApp session with a matching delivery target; otherwise DSH sidebar sessions. Fire path soft-calls ctx.dshIm.send for summaries.
Co-authored-by: Cursor <cursoragent@cursor.com>