Merge branch 'develop' into codex/fix-inbox-finish-setup-guidance

fix: Preserve original filenames for WhatsApp cloud attachments (#14168 )
## Summary Preserves the original filename provided in the WhatsApp Cloud attachment payload when downloading media files. ## Problem Files containing accented or special characters could be saved with malformed names or incorrect extensions due to relying on remote download metadata. ## Changes Made - Uses attachment_payload[:filename] when present - Creates a tempfile using the original filename and extension - Preserves content type metadata - Falls back to existing behavior when no filename is provided ## Notes This should improve attachment downloads for filenames containing accented characters. Related to #10973 --------- Co-authored-by: Rorrick Smith <rorrick@bulksms.com> Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com> Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
2026-06-12 10:30:04 +04:00 · 2026-06-12 10:21:42 +04:00 · 2026-06-12 09:39:26 +04:00 · 2026-06-11 18:36:34 +05:30 · 2026-06-11 16:47:11 +05:30 · 2026-06-11 16:13:57 +05:30
81 changed files with 978 additions and 504 deletions
@@ -136,6 +136,8 @@ GEM
    audited (5.4.1)
      activerecord (>= 5.0, < 7.7)
      activesupport (>= 5.0, < 7.7)
+    auth-sanitizer (0.2.1)
+      version_gem (~> 1.1, >= 1.1.10)
    aws-actionmailbox-ses (0.1.0)
      actionmailbox (>= 7.1.0)
      aws-sdk-s3 (~> 1, >= 1.123.0)
@@ -168,7 +170,7 @@ GEM
    base64 (0.3.0)
    bcrypt (3.1.22)
    benchmark (0.4.1)
-    bigdecimal (3.2.2)
+    bigdecimal (3.3.1)
    bindex (0.8.1)
    bootsnap (1.16.0)
      msgpack (~> 1.2)
@@ -184,6 +186,7 @@ GEM
      bundler (>= 1.2.0, < 3)
      thor (~> 1.0)
    byebug (11.1.3)
+    cgi (0.5.1)
    childprocess (5.1.0)
      logger (~> 1.5)
    cld3 (3.7.0)
@@ -312,7 +315,7 @@ GEM
      hashie
    faraday-multipart (1.2.0)
      multipart-post (~> 2.0)
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
      net-http (~> 0.5)
    faraday-net_http_persistent (2.1.0)
      faraday (~> 2.5)
@@ -435,7 +438,8 @@ GEM
    hana (1.3.7)
    hash_diff (1.1.1)
    hashdiff (1.1.0)
-    hashie (5.0.0)
+    hashie (5.1.0)
+      logger
    html2text (0.4.0)
      nokogiri (>= 1.0, < 2.0)
    http (5.1.1)
@@ -470,7 +474,7 @@ GEM
      rails-dom-testing (>= 1, < 3)
      railties (>= 4.2.0)
      thor (>= 0.14, < 2.0)
-    json (2.19.5)
+    json (2.19.8)
    json_refs (0.1.8)
      hana
    json_schemer (0.2.24)
@@ -568,7 +572,7 @@ GEM
      ruby2_keywords
    msgpack (1.8.0)
    multi_json (1.15.0)
-    multi_xml (0.8.0)
+    multi_xml (0.9.1)
      bigdecimal (>= 3.1, < 5)
    multipart-post (2.4.1)
    mutex_m (0.3.0)
@@ -603,19 +607,26 @@ GEM
      racc (~> 1.4)
    nokogiri (1.19.3-x86_64-linux-gnu)
      racc (~> 1.4)
-    oauth (1.1.0)
-      oauth-tty (~> 1.0, >= 1.0.1)
-      snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
-    oauth-tty (1.0.5)
-      version_gem (~> 1.1, >= 1.1.1)
-    oauth2 (2.0.9)
-      faraday (>= 0.17.3, < 3.0)
-      jwt (>= 1.0, < 3.0)
+    oauth (1.1.6)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
+      base64 (~> 0.1)
+      cgi
+      oauth-tty (~> 1.0, >= 1.0.8)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
+    oauth-tty (1.0.8)
+      auth-sanitizer (~> 0.1, >= 0.1.3)
+      cgi
+      version_gem (~> 1.1, >= 1.1.9)
+    oauth2 (2.0.22)
+      auth-sanitizer (~> 0.2, >= 0.2.1)
+      faraday (>= 0.17.3, < 4.0)
+      jwt (>= 1.0, < 4.0)
+      logger (~> 1.2)
      multi_xml (~> 0.5)
      rack (>= 1.2, < 4)
-      snaky_hash (~> 2.0)
-      version_gem (~> 1.1)
+      snaky_hash (~> 2.0, >= 2.0.5)
+      version_gem (~> 1.1, >= 1.1.11)
    oj (3.16.10)
      bigdecimal (>= 3.0)
      ostruct (>= 0.2)
@@ -935,9 +946,9 @@ GEM
      gli
      hashie
      logger
-    snaky_hash (2.0.1)
-      hashie
-      version_gem (~> 1.1, >= 1.1.1)
+    snaky_hash (2.0.5)
+      hashie (>= 0.1.0, < 6)
+      version_gem (>= 1.1.8, < 3)
    sorbet-runtime (0.5.11934)
    spring (4.1.1)
    spring-watcher-listen (2.1.0)
@@ -995,7 +1006,7 @@ GEM
    valid_email2 (5.2.6)
      activemodel (>= 3.2)
      mail (~> 2.5)
-    version_gem (1.1.4)
+    version_gem (1.1.11)
    vite_rails (3.10.0)
      railties (>= 5.1, < 9)
      vite_ruby (~> 3.0, >= 3.2.2)
@@ -1 +1 @@
-4.14.1
+4.14.2
@@ -50,7 +50,7 @@ class ContactInboxWithContactBuilder

  def create_contact
    account.contacts.create!(
-      name: contact_attributes[:name] || ::Haikunator.haikunate(1000),
+      name: contact_name,
      phone_number: contact_attributes[:phone_number],
      email: contact_attributes[:email],
      identifier: contact_attributes[:identifier],
@@ -59,6 +59,11 @@ class ContactInboxWithContactBuilder
    )
  end

+  def contact_name
+    name = contact_attributes[:name] || ::Haikunator.haikunate(1000)
+    name.truncate(ApplicationRecord::MAX_STRING_COLUMN_LENGTH, omission: '')
+  end
+
  def find_contact
    contact = find_contact_by_identifier(contact_attributes[:identifier])
    contact ||= find_contact_by_email(contact_attributes[:email])
@@ -20,7 +20,7 @@ class Api::V1::Accounts::Channels::TwilioChannelsController < Api::V1::Accounts:
    ActiveRecord::Base.transaction do
      authenticate_twilio
      build_inbox
-      setup_webhooks if @twilio_channel.sms?
+      setup_webhooks
    end
  end

@@ -16,6 +16,10 @@ class Api::V1::Accounts::OnboardingsController < Api::V1::Accounts::BaseControll
    render 'api/v1/accounts/update', format: :json
  end

+  def help_center_generation
+    render json: help_center_generation_status
+  end
+
  private

  def finalizing_account_details?
@@ -33,4 +37,15 @@ class Api::V1::Accounts::OnboardingsController < Api::V1::Accounts::BaseControll
  def custom_attributes_params
    params.permit(:industry, :company_size, :timezone, :referral_source, :user_role, :website)
  end
+
+  def help_center_generation_status
+    {
+      generation_id: nil,
+      state: nil,
+      articles_count: 0,
+      categories_count: 0
+    }
+  end
 end
+
+Api::V1::Accounts::OnboardingsController.prepend_mod_with('Api::V1::Accounts::OnboardingsController')
@@ -40,7 +40,7 @@ class ConversationFinder
  def perform
    set_up

-    mine_count, unassigned_count, all_count, = set_count_for_all_conversations
+    mine_count, unassigned_count, all_count = set_count_for_all_conversations
    assigned_count = all_count - unassigned_count

    filter_by_assignee_type
@@ -184,6 +184,17 @@ class ConversationFinder
  end

  def set_count_for_all_conversations
+    return legacy_count_for_all_conversations if @conversations.limit_value || @conversations.offset_value || @conversations.eager_loading?
+
+    counts = @conversations.unscope(:order).pick(
+      Arel.sql("COUNT(*) FILTER (WHERE assignee_id = #{current_user.id})"),
+      Arel.sql('COUNT(*) FILTER (WHERE assignee_id IS NULL)'),
+      Arel.sql('COUNT(*)')
+    )
+    counts || [0, 0, 0]
+  end
+
+  def legacy_count_for_all_conversations
    [
      @conversations.assigned_to(current_user).count,
      @conversations.unassigned.count,
@@ -60,6 +60,12 @@ class Inboxes extends CacheEnabledApiClient {
  disableWhatsappCalling(inboxId) {
    return axios.post(`${this.url}/${inboxId}/disable_whatsapp_calling`);
  }
+
+  setInboundCalls(inboxId, enabled) {
+    return axios.post(`${this.url}/${inboxId}/set_inbound_calls`, {
+      inbound_calls_enabled: enabled,
+    });
+  }
 }

 export default new Inboxes();
@@ -9,6 +9,10 @@ class OnboardingAPI extends ApiClient {
  update(data) {
    return axios.patch(this.url, data);
  }
+
+  getHelpCenterGeneration() {
+    return axios.get(`${this.url}/help_center_generation`);
+  }
 }

 export default new OnboardingAPI();
@@ -175,6 +175,9 @@ useEventListener(document, 'touchend', onResizeEnd);

 const inboxes = useMapGetter('inboxes/getInboxes');
 const labels = useMapGetter('labels/getLabelsOnSidebar');
+const allUnreadCount = useMapGetter(
+  'conversationUnreadCounts/getAllUnreadCount'
+);
 const getInboxUnreadCount = useMapGetter(
  'conversationUnreadCounts/getInboxUnreadCount'
 );
@@ -297,6 +300,7 @@ const menuItems = computed(() => {
        {
          name: 'All',
          label: t('SIDEBAR.ALL_CONVERSATIONS'),
+          badgeCount: allUnreadCount.value,
          activeOn: ['inbox_conversation'],
          to: accountScopedRoute('home'),
        },
@@ -375,10 +375,10 @@ export default {
      return `draft-${this.conversationIdByRoute}-${this.replyType}`;
    },
    audioRecordFormat() {
-      if (this.isAWhatsAppChannel) {
+      if (this.isAWhatsAppCloudChannel) {
        return AUDIO_FORMATS.OGG;
      }
-      if (this.isATelegramChannel) {
+      if (this.isAWhatsAppChannel || this.isATelegramChannel) {
        return AUDIO_FORMATS.MP3;
      }
      if (this.isAPIInbox) {
@@ -70,7 +70,8 @@ describe('useFacebookPageConnect', () => {
      ACCOUNT_ID
    );
    expect(window.FB.login).toHaveBeenCalledWith(expect.any(Function), {
-      scope: expect.stringContaining('pages_show_list'),
+      scope:
+        'pages_manage_metadata,business_management,pages_messaging,pages_show_list,pages_read_engagement',
    });
  });

@@ -133,6 +133,7 @@ describe('useInbox', () => {
      });

      expect(wrapper.vm.isATwilioChannel).toBe(true);
+      expect(wrapper.vm.isATwilioSMSChannel).toBe(true);
      expect(wrapper.vm.isASmsInbox).toBe(true);
      expect(wrapper.vm.isAWhatsAppChannel).toBe(false);
    });
@@ -268,6 +269,7 @@ describe('useInbox', () => {
        'isASmsInbox',
        'isATelegramChannel',
        'isATwilioChannel',
+        'isATwilioSMSChannel',
        'isAWebWidgetInbox',
        'isAWhatsAppChannel',
        'isAMicrosoftInbox',
@@ -1,13 +1,9 @@
 import { ref } from 'vue';
 import { useMapGetter } from 'dashboard/composables/store';
 import ChannelApi from 'dashboard/api/channels';
+import { buildFacebookLoginScopes } from 'dashboard/helper/facebookScopes';
 import { setupFacebookSdk } from 'dashboard/routes/dashboard/settings/inbox/channels/whatsapp/utils';

-// Page-management + messaging scopes required to list pages and create a
-// Channel::FacebookPage inbox (mirrors the standalone settings flow).
-const FB_PAGE_SCOPES =
-  'pages_manage_metadata,business_management,pages_messaging,instagram_basic,pages_show_list,pages_read_engagement,instagram_manage_messages';
-
 // Headless half of the Facebook Page connect flow: load the Meta SDK, run
 // FB.login for page scopes, and fetch the user's pages. The caller owns the
 // page-picker UI and the channel creation, because choosing a page is an
@@ -51,7 +47,7 @@ export function useFacebookPageConnect() {
              : null
          );
        },
-        { scope: FB_PAGE_SCOPES }
+        { scope: buildFacebookLoginScopes() }
      );
    });

@@ -150,6 +150,7 @@ export const useInbox = (inboxId = null) => {
    isASmsInbox,
    isATelegramChannel,
    isATwilioChannel,
+    isATwilioSMSChannel,
    isAWebWidgetInbox,
    isAWhatsAppChannel,
    isAMicrosoftInbox,
@@ -0,0 +1,22 @@
+export const FACEBOOK_PAGE_SCOPES = [
+  'pages_manage_metadata',
+  'business_management',
+  'pages_messaging',
+  'pages_show_list',
+  'pages_read_engagement',
+];
+
+export const INSTAGRAM_SCOPES = [
+  'instagram_basic',
+  'instagram_manage_messages',
+];
+
+export const buildFacebookLoginScopes = ({
+  includeInstagramScopes = false,
+} = {}) => {
+  const scopes = [...FACEBOOK_PAGE_SCOPES];
+  if (includeInstagramScopes) {
+    scopes.push(...INSTAGRAM_SCOPES);
+  }
+  return scopes.join(',');
+};
@@ -134,7 +134,6 @@
      },
      "TWILIO": {
        "TITLE": "Twilio SMS/WhatsApp Channel",
-        "DESC": "Integrate Twilio and start supporting your customers via SMS or WhatsApp.",
        "ACCOUNT_SID": {
          "LABEL": "Account SID",
          "PLACEHOLDER": "Please enter your Twilio Account SID",
@@ -176,13 +175,13 @@
          "PLACEHOLDER": "Please enter the phone number from which message will be sent.",
          "ERROR": "Please provide a valid phone number that starts with a `+` sign and does not contain any spaces."
        },
-        "API_CALLBACK": {
-          "TITLE": "Callback URL",
-          "SUBTITLE": "You have to configure the message callback URL in Twilio with the URL mentioned here."
-        },
        "SUBMIT_BUTTON": "Create Twilio Channel",
        "API": {
          "ERROR_MESSAGE": "We were not able to authenticate Twilio credentials, please try again"
+        },
+        "API_CALLBACK": {
+          "TITLE": "Callback URL",
+          "SUBTITLE": "You have to configure the message callback URL in Twilio with the URL mentioned here."
        }
      },
      "SMS": {
@@ -559,6 +558,7 @@
      "MORE_SETTINGS": "More settings",
      "WEBSITE_SUCCESS": "You have successfully finished creating a website channel. Copy the code shown below and paste it on your website. Next time a customer use the live chat, the conversation will automatically appear on your inbox.",
      "WHATSAPP_QR_INSTRUCTION": "Scan the QR code above to quickly test your WhatsApp inbox",
+      "SMS_QR_INSTRUCTION": "Scan the QR code above to quickly test your SMS inbox",
      "MESSENGER_QR_INSTRUCTION": "Scan the QR code above to quickly test your Facebook Messenger inbox",
      "TELEGRAM_QR_INSTRUCTION": "Scan the QR code above to quickly test your Telegram inbox"
    },
@@ -653,6 +653,10 @@
      },
      "CREDENTIALS": {
        "DESCRIPTION": "Voice calling requires Twilio API Key credentials. These are used to generate tokens for agent voice connections."
+      },
+      "INBOUND": {
+        "LABEL": "Allow incoming calls",
+        "DESCRIPTION": "Let customers call this number. When turned off, incoming calls are declined automatically — agents aren't notified and no conversation is created. Agents can still place outgoing calls."
      }
    },
    "WHATSAPP_CALLING": {
@@ -94,8 +94,18 @@ export default {
      return this.getAccount(this.accountId) || {};
    },
  },
+  watch: {
+    'currentAccount.id'(id) {
+      if (id) {
+        this.initializeAccount();
+      }
+    },
+  },
  mounted() {
-    this.initializeAccount();
+    // Account already in the store (navigated in): seed immediately.
+    if (this.currentAccount.id) {
+      this.initializeAccount();
+    }
  },
  methods: {
    async initializeAccount() {
@@ -8,7 +8,7 @@ import SectionLayout from './SectionLayout.vue';
 const { t } = useI18n();
 const { currentAccount } = useAccount();

-const getAccountId = computed(() => currentAccount.value.id.toString());
+const getAccountId = computed(() => currentAccount.value?.id?.toString());
 </script>

 <template>
@@ -16,6 +16,7 @@ const route = useRoute();
 const store = useStore();

 const qrCodes = reactive({
+  sms: '',
  whatsapp: '',
  messenger: '',
  telegram: '',
@@ -28,14 +29,13 @@ const currentInbox = computed(() =>
 // Use useInbox composable with the inbox ID
 const {
  isAWhatsAppCloudChannel,
-  isATwilioChannel,
+  isAWhatsAppChannel,
  isASmsInbox,
  isALineChannel,
  isAnEmailChannel,
-  isAWhatsAppChannel,
  isAFacebookInbox,
  isATelegramChannel,
-  isATwilioWhatsAppChannel,
+  isATwilioSMSChannel,
 } = useInbox(route.params.inbox_id);

 const hasDuplicateInstagramInbox = computed(() => {
@@ -55,23 +55,28 @@ const shouldShowWhatsAppWebhookDetails = computed(() => {
  );
 });

-const isWhatsAppEmbeddedSignup = computed(() => {
-  return (
-    isAWhatsAppCloudChannel.value &&
-    currentInbox.value.provider_config?.source === 'embedded_signup'
-  );
+const whatsappPhoneNumber = computed(() => {
+  return (currentInbox.value?.phone_number || '').replace('whatsapp:', '');
+});
+
+const shouldShowWhatsAppQr = computed(() => {
+  return isAWhatsAppChannel.value && Boolean(whatsappPhoneNumber.value);
+});
+
+const shouldShowSmsQr = computed(() => {
+  return isATwilioSMSChannel.value && Boolean(currentInbox.value?.phone_number);
 });

 const message = computed(() => {
-  if (isATwilioChannel.value) {
+  if (shouldShowWhatsAppQr.value) {
    return `${t('INBOX_MGMT.FINISH.MESSAGE')}. ${t(
-      'INBOX_MGMT.ADD.TWILIO.API_CALLBACK.SUBTITLE'
+      'INBOX_MGMT.FINISH.WHATSAPP_QR_INSTRUCTION'
    )}`;
  }

-  if (isASmsInbox.value) {
+  if (shouldShowSmsQr.value) {
    return `${t('INBOX_MGMT.FINISH.MESSAGE')}. ${t(
-      'INBOX_MGMT.ADD.SMS.BANDWIDTH.API_CALLBACK.SUBTITLE'
+      'INBOX_MGMT.FINISH.SMS_QR_INSTRUCTION'
    )}`;
  }

@@ -91,12 +96,6 @@ const message = computed(() => {
    return t('INBOX_MGMT.FINISH.WEBSITE_SUCCESS');
  }

-  if (isWhatsAppEmbeddedSignup.value) {
-    return `${t('INBOX_MGMT.FINISH.MESSAGE')}. ${t(
-      'INBOX_MGMT.FINISH.WHATSAPP_QR_INSTRUCTION'
-    )}`;
-  }
-
  return t('INBOX_MGMT.FINISH.MESSAGE');
 });

@@ -109,6 +108,7 @@ async function generateQRCode(platform, identifier) {

  try {
    const platformUrls = {
+      sms: id => `sms:${id}`,
      whatsapp: id => `https://wa.me/${id}`,
      messenger: id => `https://m.me/${id}`,
      telegram: id => `https://t.me/${id}`,
@@ -127,15 +127,13 @@ async function generateQRCode(platform, identifier) {
 async function generateQRCodes() {
  if (!currentInbox.value) return;

-  // WhatsApp (both Cloud and Twilio)
-  if (currentInbox.value.phone_number && isAWhatsAppChannel.value) {
-    // For Twilio WhatsApp, phone_number format is "whatsapp:+1234567890"
-    // Extract just the phone number part for QR code generation
-    const phoneNumber = currentInbox.value.phone_number.replace(
-      'whatsapp:',
-      ''
-    );
-    await generateQRCode('whatsapp', phoneNumber);
+  // WhatsApp
+  if (shouldShowWhatsAppQr.value) {
+    await generateQRCode('whatsapp', whatsappPhoneNumber.value);
+  }
+
+  if (shouldShowSmsQr.value) {
+    await generateQRCode('sms', currentInbox.value.phone_number);
  }

  // Facebook Messenger
@@ -183,13 +181,6 @@ onMounted(() => {
            :script="currentInbox.web_widget_script"
          />
        </div>
-        <div class="w-[50%] max-w-[50%] ml-[25%]">
-          <woot-code
-            v-if="isATwilioWhatsAppChannel"
-            lang="html"
-            :script="currentInbox.callback_webhook_url"
-          />
-        </div>
        <div
          v-if="shouldShowWhatsAppWebhookDetails"
          class="w-[50%] max-w-[50%] ml-[25%]"
@@ -217,12 +208,32 @@ onMounted(() => {
            :script="currentInbox.callback_webhook_url"
          />
        </div>
-        <div class="w-[50%] max-w-[50%] ml-[25%]">
-          <woot-code
-            v-if="isASmsInbox"
-            lang="html"
-            :script="currentInbox.callback_webhook_url"
-          />
+        <div
+          v-if="isASmsInbox && !isATwilioSMSChannel"
+          class="w-[50%] max-w-[50%] ml-[25%]"
+        >
+          <p class="mt-8 font-medium text-n-slate-11">
+            {{ $t('INBOX_MGMT.ADD.SMS.BANDWIDTH.API_CALLBACK.TITLE') }}
+          </p>
+          <p class="mt-2 text-sm text-n-slate-9">
+            {{ $t('INBOX_MGMT.ADD.SMS.BANDWIDTH.API_CALLBACK.SUBTITLE') }}
+          </p>
+          <woot-code lang="html" :script="currentInbox.callback_webhook_url" />
+        </div>
+        <div
+          v-if="shouldShowSmsQr && qrCodes.sms"
+          class="flex flex-col gap-3 items-center mt-8"
+        >
+          <p class="mt-2 text-sm text-n-slate-9">
+            {{ $t('INBOX_MGMT.FINISH.SMS_QR_INSTRUCTION') }}
+          </p>
+          <div class="rounded-lg shadow outline-1 outline-n-strong outline">
+            <img
+              :src="qrCodes.sms"
+              alt="SMS QR Code"
+              class="rounded-lg size-48 dark:invert"
+            />
+          </div>
        </div>
        <EmailInboxFinish
          v-if="isAnEmailChannel && !currentInbox.provider"
@@ -230,7 +241,7 @@ onMounted(() => {
          :inbox-id="$route.params.inbox_id"
        />
        <div
-          v-if="isAWhatsAppChannel && qrCodes.whatsapp"
+          v-if="shouldShowWhatsAppQr && qrCodes.whatsapp"
          class="flex flex-col gap-3 items-center mt-8"
        >
          <p class="mt-2 text-sm text-n-slate-9">
@@ -4,6 +4,7 @@ import InboxReconnectionRequired from '../components/InboxReconnectionRequired.v
 import { useAlert } from 'dashboard/composables';

 import { loadScript } from 'dashboard/helper/DOMHelpers';
+import { buildFacebookLoginScopes } from 'dashboard/helper/facebookScopes';
 import * as Sentry from '@sentry/vue';

 export default {
@@ -20,6 +21,11 @@ export default {
    inboxId() {
      return this.inbox.id;
    },
+    facebookLoginScopes() {
+      return buildFacebookLoginScopes({
+        includeInstagramScopes: !!this.inbox.instagram_id,
+      });
+    },
  },
  mounted() {
    window.fbAsyncInit = this.runFBInit;
@@ -77,8 +83,7 @@ export default {
          }
        },
        {
-          scope:
-            'pages_manage_metadata,business_management,pages_messaging,instagram_basic,pages_show_list,pages_read_engagement,instagram_manage_messages',
+          scope: this.facebookLoginScopes,
          auth_type: 'reauthorize',
        }
      );
@@ -1,9 +1,11 @@
 <script>
 import { useAlert } from 'dashboard/composables';
+import InboxesAPI from 'dashboard/api/inboxes';
 import SettingsFieldSection from 'dashboard/components-next/Settings/SettingsFieldSection.vue';
 import SettingsToggleSection from 'dashboard/components-next/Settings/SettingsToggleSection.vue';
 import NextInput from 'dashboard/components-next/input/Input.vue';
 import NextButton from 'dashboard/components-next/button/Button.vue';
+import Spinner from 'dashboard/components-next/spinner/Spinner.vue';

 export default {
  components: {
@@ -11,6 +13,7 @@ export default {
    SettingsToggleSection,
    NextInput,
    NextButton,
+    Spinner,
  },
  props: {
    inbox: {
@@ -21,9 +24,11 @@ export default {
  data() {
    return {
      voiceEnabled: this.inbox.voice_enabled || false,
+      inboundCallsEnabled: this.inbox.inbound_calls_enabled !== false,
      apiKeySid: this.inbox.api_key_sid || '',
      apiKeySecret: '',
      isUpdating: false,
+      isTogglingInbound: false,
    };
  },
  computed: {
@@ -62,8 +67,27 @@ export default {
    'inbox.api_key_sid'(val) {
      this.apiKeySid = val || '';
    },
+    'inbox.inbound_calls_enabled'(val) {
+      this.inboundCallsEnabled = val !== false;
+    },
  },
  methods: {
+    async handleInboundToggle(newValue) {
+      if (this.isTogglingInbound) return;
+      const previousValue = this.inboundCallsEnabled;
+      this.inboundCallsEnabled = newValue;
+      this.isTogglingInbound = true;
+      try {
+        await InboxesAPI.setInboundCalls(this.inbox.id, newValue);
+        await this.$store.dispatch('inboxes/get', this.inbox.id);
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.SUCCESS_MESSAGE'));
+      } catch (_) {
+        this.inboundCallsEnabled = previousValue;
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.ERROR_MESSAGE'));
+      } finally {
+        this.isTogglingInbound = false;
+      }
+    },
    async updateVoiceSettings() {
      this.isUpdating = true;
      try {
@@ -123,6 +147,24 @@ export default {
      />
    </div>

+    <div
+      v-if="inbox.voice_enabled"
+      class="relative"
+      :class="{ 'pointer-events-none opacity-60': isTogglingInbound }"
+    >
+      <SettingsToggleSection
+        :model-value="inboundCallsEnabled"
+        :header="$t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.LABEL')"
+        :description="$t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.DESCRIPTION')"
+        :hide-toggle="isTogglingInbound"
+        @update:model-value="handleInboundToggle"
+      >
+        <template v-if="isTogglingInbound" #hiddenToggle>
+          <Spinner class="size-4 text-n-slate-11" />
+        </template>
+      </SettingsToggleSection>
+    </div>
+
    <div v-if="inbox.voice_enabled && inbox.voice_call_webhook_url">
      <SettingsFieldSection
        :label="$t('INBOX_MGMT.ADD.VOICE.CONFIGURATION.TWILIO_VOICE_URL_TITLE')"
@@ -24,10 +24,13 @@ export default {
  data() {
    return {
      callingEnabled: this.inbox.provider_config?.calling_enabled || false,
+      inboundCallsEnabled:
+        this.inbox.provider_config?.inbound_calls_enabled !== false,
      permissionRequestBody:
        this.inbox.provider_config?.call_permission_request_body || '',
      isUpdating: false,
      isTogglingCalling: false,
+      isTogglingInbound: false,
    };
  },
  computed: {
@@ -44,8 +47,27 @@ export default {
    'inbox.provider_config.call_permission_request_body'(val) {
      this.permissionRequestBody = val || '';
    },
+    'inbox.provider_config.inbound_calls_enabled'(val) {
+      this.inboundCallsEnabled = val !== false;
+    },
  },
  methods: {
+    async handleInboundToggle(newValue) {
+      if (this.isTogglingInbound) return;
+      const previousValue = this.inboundCallsEnabled;
+      this.inboundCallsEnabled = newValue;
+      this.isTogglingInbound = true;
+      try {
+        await InboxesAPI.setInboundCalls(this.inbox.id, newValue);
+        await this.$store.dispatch('inboxes/get', this.inbox.id);
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.SUCCESS_MESSAGE'));
+      } catch (_) {
+        this.inboundCallsEnabled = previousValue;
+        useAlert(this.$t('INBOX_MGMT.EDIT.API.ERROR_MESSAGE'));
+      } finally {
+        this.isTogglingInbound = false;
+      }
+    },
    async handleCallingToggle(newValue) {
      if (this.isTogglingCalling) return;
      const previousValue = this.callingEnabled;
@@ -117,6 +139,25 @@ export default {
    </div>

    <template v-if="callingEnabled">
+      <div
+        class="relative"
+        :class="{ 'pointer-events-none opacity-60': isTogglingInbound }"
+      >
+        <SettingsToggleSection
+          :model-value="inboundCallsEnabled"
+          :header="$t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.LABEL')"
+          :description="
+            $t('INBOX_MGMT.VOICE_CONFIGURATION.INBOUND.DESCRIPTION')
+          "
+          :hide-toggle="isTogglingInbound"
+          @update:model-value="handleInboundToggle"
+        >
+          <template v-if="isTogglingInbound" #hiddenToggle>
+            <Spinner class="size-4 text-n-slate-11" />
+          </template>
+        </SettingsToggleSection>
+      </div>
+
      <SettingsFieldSection
        v-if="phoneNumber"
        :label="$t('INBOX_MGMT.WHATSAPP_CALLING.PHONE_NUMBER.LABEL')"
@@ -2,15 +2,21 @@ import ConversationAPI from '../../api/conversations';
 import types from '../mutation-types';

 export const state = {
+  allCount: 0,
  inboxes: {},
  labels: {},
  teams: {},
 };

+const normalizeCount = count => {
+  const parsedCount = Number(count);
+  return Number.isFinite(parsedCount) && parsedCount > 0 ? parsedCount : 0;
+};
+
 const normalizeCounts = counts => {
  return Object.entries(counts || {}).reduce((result, [id, count]) => {
-    const parsedCount = Number(count);
-    if (Number.isFinite(parsedCount) && parsedCount > 0) {
+    const parsedCount = normalizeCount(count);
+    if (parsedCount > 0) {
      result[String(id)] = parsedCount;
    }

@@ -19,6 +25,9 @@ const normalizeCounts = counts => {
 };

 export const getters = {
+  getAllUnreadCount($state) {
+    return $state.allCount;
+  },
  getInboxUnreadCount: $state => inboxId => {
    return $state.inboxes[String(inboxId)] || 0;
  },
@@ -55,6 +64,7 @@ export const actions = {

 export const mutations = {
  [types.SET_CONVERSATION_UNREAD_COUNTS]($state, payload = {}) {
+    $state.allCount = normalizeCount(payload.all_count);
    $state.inboxes = normalizeCounts(payload.inboxes);
    $state.labels = normalizeCounts(payload.labels);
    $state.teams = normalizeCounts(payload.teams);
@@ -15,6 +15,7 @@ describe('#actions', () => {
  describe('#get', () => {
    it('commits unread counts when API is successful', async () => {
      const payload = {
+        all_count: 2,
        inboxes: { 1: '2' },
        labels: { 3: 4 },
        teams: { 5: 6 },
@@ -3,6 +3,7 @@ import { getters } from '../../conversationUnreadCounts';
 describe('#getters', () => {
  it('returns inbox unread count by id', () => {
    const state = {
+      allCount: 0,
      inboxes: { 1: 2 },
      labels: {},
      teams: {},
@@ -15,6 +16,7 @@ describe('#getters', () => {

  it('returns label unread count by id', () => {
    const state = {
+      allCount: 0,
      inboxes: {},
      labels: { 3: 4 },
      teams: {},
@@ -27,6 +29,7 @@ describe('#getters', () => {

  it('returns team unread count by id', () => {
    const state = {
+      allCount: 0,
      inboxes: {},
      labels: {},
      teams: { 5: 6 },
@@ -37,8 +40,20 @@ describe('#getters', () => {
    expect(getters.getTeamUnreadCount(state)(6)).toBe(0);
  });

+  it('returns all unread count', () => {
+    const state = {
+      allCount: 7,
+      inboxes: {},
+      labels: {},
+      teams: {},
+    };
+
+    expect(getters.getAllUnreadCount(state)).toBe(7);
+  });
+
  it('returns unread count maps', () => {
    const state = {
+      allCount: 0,
      inboxes: { 1: 2 },
      labels: { 3: 4 },
      teams: { 5: 6 },
@@ -4,9 +4,10 @@ import { mutations } from '../../conversationUnreadCounts';
 describe('#mutations', () => {
  describe('#SET_CONVERSATION_UNREAD_COUNTS', () => {
    it('normalizes unread count payload', () => {
-      const state = { inboxes: {}, labels: {}, teams: {} };
+      const state = { allCount: 0, inboxes: {}, labels: {}, teams: {} };

      mutations[types.SET_CONVERSATION_UNREAD_COUNTS](state, {
+        all_count: '3',
        inboxes: {
          1: '2',
          2: 0,
@@ -23,6 +24,7 @@ describe('#mutations', () => {
      });

      expect(state).toEqual({
+        allCount: 3,
        inboxes: { 1: 2 },
        labels: { 4: 5 },
        teams: { 6: 7 },
@@ -31,6 +33,7 @@ describe('#mutations', () => {

    it('clears counts when payload is empty', () => {
      const state = {
+        allCount: 2,
        inboxes: { 1: 2 },
        labels: { 4: 5 },
        teams: { 6: 7 },
@@ -39,10 +42,21 @@ describe('#mutations', () => {
      mutations[types.SET_CONVERSATION_UNREAD_COUNTS](state, {});

      expect(state).toEqual({
+        allCount: 0,
        inboxes: {},
        labels: {},
        teams: {},
      });
    });
+
+    it('normalizes invalid aggregate counts to zero', () => {
+      const state = { allCount: 2, inboxes: {}, labels: {}, teams: {} };
+
+      mutations[types.SET_CONVERSATION_UNREAD_COUNTS](state, {
+        all_count: 'invalid',
+      });
+
+      expect(state.allCount).toBe(0);
+    });
  });
 });
@@ -36,6 +36,9 @@ class ActionCableConnector extends BaseActionCableConnector {

  onReconnect = () => {
    this.syncLatestMessages();
+    // Re-fetch conversation attributes so a status change (e.g. auto-resolve)
+    // that happened while disconnected is reflected, keeping the reply box state correct.
+    this.app.$store.dispatch('conversationAttributes/getAttributes');
  };

  setLastMessageId = () => {
@@ -0,0 +1,53 @@
+import { describe, it, beforeEach, afterEach, expect, vi } from 'vitest';
+import ActionCableConnector from '../actionCable';
+
+vi.mock('@rails/actioncable', () => ({
+  createConsumer: () => ({
+    subscriptions: { create: () => ({}) },
+    disconnect: vi.fn(),
+  }),
+}));
+
+describe('Widget ActionCableConnector', () => {
+  let app;
+  let mockDispatch;
+  let connector;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    mockDispatch = vi.fn();
+    app = {
+      $store: {
+        dispatch: mockDispatch,
+        getters: {
+          getCurrentAccountId: 1,
+          getCurrentUserID: 1,
+        },
+      },
+    };
+    connector = new ActionCableConnector(app, 'test-token');
+    mockDispatch.mockClear();
+  });
+
+  afterEach(() => {
+    vi.clearAllMocks();
+    vi.useRealTimers();
+  });
+
+  it('registers the conversation.status_changed event handler', () => {
+    expect(connector.events['conversation.status_changed']).toBe(
+      connector.onStatusChange
+    );
+  });
+
+  it('re-fetches conversation attributes on reconnect so a status change missed while disconnected is reflected', () => {
+    connector.onReconnect();
+
+    expect(mockDispatch).toHaveBeenCalledWith(
+      'conversation/syncLatestMessages'
+    );
+    expect(mockDispatch).toHaveBeenCalledWith(
+      'conversationAttributes/getAttributes'
+    );
+  });
+});
@@ -1,4 +1,7 @@
 class ApplicationRecord < ActiveRecord::Base
+  MAX_STRING_COLUMN_LENGTH = 255
+  MAX_TEXT_COLUMN_LENGTH = 20_000
+
  include Events::Types
  self.abstract_class = true

@@ -37,7 +40,7 @@ class ApplicationRecord < ActiveRecord::Base
  end

  def validate_content_length(column)
-    max_length = column.type == :text ? 20_000 : 255
+    max_length = column.type == :text ? MAX_TEXT_COLUMN_LENGTH : MAX_STRING_COLUMN_LENGTH
    return if self[column.name].nil? || self[column.name].length <= max_length

    errors.add(column.name.to_sym, "is too long (maximum is #{max_length} characters)")
@@ -12,6 +12,7 @@
 #  medium                         :integer          default("sms")
 #  messaging_service_sid          :string
 #  phone_number                   :string
+#  provider_config                :jsonb
 #  twiml_app_sid                  :string
 #  voice_enabled                  :boolean          default(FALSE), not null
 #  created_at                     :datetime         not null
@@ -54,6 +55,11 @@ class Channel::TwilioSms < ApplicationRecord
    medium == 'sms' ? 'Twilio SMS' : 'Whatsapp'
  end

+  # Mutes only the incoming side of calling; default on, so only an explicit false disables inbound.
+  def inbound_calls_enabled?
+    provider_config['inbound_calls_enabled'] != false
+  end
+
  def send_message(to:, body:, media_url: nil)
    params = send_message_from.merge(to: to, body: body)
    params[:media_url] = media_url if media_url.present?
@@ -49,6 +49,11 @@ class Channel::Whatsapp < ApplicationRecord
      account.feature_enabled?('channel_voice')
  end

+  # Mutes only the incoming side of calling; default on, so only an explicit false disables inbound.
+  def inbound_calls_enabled?
+    provider_config['inbound_calls_enabled'] != false
+  end
+
  # Whether this inbox can do WhatsApp calling at all. Meta's Calling API is
  # reachable by any whatsapp_cloud inbox, so 360dialog inboxes can't be toggled
  # on even though calling_enabled would persist.
@@ -77,4 +77,8 @@ class InboxPolicy < ApplicationPolicy
  def disable_whatsapp_calling?
    @account_user.administrator?
  end
+
+  def set_inbound_calls?
+    @account_user.administrator?
+  end
 end
@@ -23,6 +23,8 @@ class BaseRefreshOauthTokenService
  # Refresh the access tokens using the refresh token
  # Refer: https://github.com/microsoftgraph/msgraph-sample-rubyrailsapp/tree/b4a6869fe4a438cde42b161196484a929f1bee46
  def refresh_tokens
+    raise 'A refresh_token is not available' if provider_config[:refresh_token].blank?
+
    oauth_strategy = build_oauth_strategy
    token_service = build_token_service(oauth_strategy)

@@ -19,8 +19,11 @@ class Conversations::UnreadCounts::Counter
    ensure_base_cache!
    ensure_assignment_cache! if assignment_mode?

+    inbox_counts = unread_inbox_counts
+
    {
-      inboxes: unread_inbox_counts,
+      all_count: inbox_counts.values.sum,
+      inboxes: inbox_counts,
      labels: unread_label_counts,
      teams: unread_team_counts
    }
@@ -191,7 +194,7 @@ class Conversations::UnreadCounts::Counter
  end

  def empty_counts
-    { inboxes: {}, labels: {}, teams: {} }
+    { all_count: 0, inboxes: {}, labels: {}, teams: {} }
  end

  def store
@@ -33,12 +33,16 @@ class Twilio::WebhookSetupService
    end
  end

+  def twilio_phone_number
+    channel.phone_number.delete_prefix('whatsapp:')
+  end
+
  def phonenumber_sid
    phone_numbers.first.sid
  end

  def phone_numbers
-    @phone_numbers ||= twilio_client.incoming_phone_numbers.list(phone_number: channel.phone_number)
+    @phone_numbers ||= twilio_client.incoming_phone_numbers.list(phone_number: twilio_phone_number)
  end

  def channel
@@ -46,6 +50,14 @@ class Twilio::WebhookSetupService
  end

  def twilio_client
-    @twilio_client ||= ::Twilio::REST::Client.new(channel.account_sid, channel.auth_token)
+    @twilio_client ||= if channel.api_key_sid.present?
+                         ::Twilio::REST::Client.new(
+                           channel.api_key_sid,
+                           channel.auth_token,
+                           channel.account_sid
+                         )
+                       else
+                         ::Twilio::REST::Client.new(channel.account_sid, channel.auth_token)
+                       end
  end
 end
@@ -37,12 +37,18 @@ class WebsiteBrandingService
  private

  def fetch_page
-    response = HTTParty.get(@url, follow_redirects: true, timeout: 15)
-    @http_status = response.code
-    return nil unless response.success?
+    body = nil
+    SafeFetch.fetch(@url, validate_content_type: false) do |result|
+      body = result.tempfile.read
+    end
+    @http_status = 200
+    return nil if body.blank?

-    Nokogiri::HTML(response.body)
-  rescue StandardError => e
+    Nokogiri::HTML(body)
+  rescue SafeFetch::HttpError => e
+    @http_status = e.message.to_i
+    nil
+  rescue SafeFetch::Error => e
    Rails.logger.error "[WebsiteBranding] Failed to fetch #{@url}: #{e.message}"
    nil
  end
@@ -13,7 +13,6 @@ class Whatsapp::EmbeddedSignupService

    access_token = exchange_code_for_token
    phone_info = fetch_phone_info(access_token)
-    validate_token_access(access_token)

    channel = create_or_reauthorize_channel(access_token, phone_info)
    # NOTE: We call setup_webhooks explicitly here instead of relying on after_commit callback because:
@@ -42,10 +41,6 @@ class Whatsapp::EmbeddedSignupService
    Whatsapp::PhoneInfoService.new(@waba_id, @phone_number_id, access_token).perform
  end

-  def validate_token_access(access_token)
-    Whatsapp::TokenValidationService.new(access_token, @waba_id).perform
-  end
-
  def create_or_reauthorize_channel(access_token, phone_info)
    if @inbox_id.present?
      Whatsapp::ReauthorizationService.new(
@@ -13,8 +13,17 @@ class Whatsapp::IncomingMessageWhatsappCloudService < Whatsapp::IncomingMessageB
      inbox.channel.media_url(attachment_payload[:id]),
      headers: inbox.channel.api_headers
    )
+
    # This url response will be failure if the access token has expired.
    inbox.channel.authorization_error! if url_response.unauthorized?
-    Down.download(url_response.parsed_response['url'], headers: inbox.channel.api_headers) if url_response.success?
+
+    return unless url_response.success?
+
+    downloaded_file = Down.download(url_response.parsed_response['url'], headers: inbox.channel.api_headers)
+    # WhatsApp Cloud sends the original filename in the payload; preserve it so accented
+    # names keep their correct extension instead of relying on the mangled remote metadata.
+    filename = attachment_payload[:filename]
+    downloaded_file.define_singleton_method(:original_filename) { filename } if filename.present?
+    downloaded_file
  end
 end
@@ -1,42 +0,0 @@
-class Whatsapp::TokenValidationService
-  def initialize(access_token, waba_id)
-    @access_token = access_token
-    @waba_id = waba_id
-    @api_client = Whatsapp::FacebookApiClient.new(access_token)
-  end
-
-  def perform
-    validate_parameters!
-    validate_token_waba_access
-  end
-
-  private
-
-  def validate_parameters!
-    raise ArgumentError, 'Access token is required' if @access_token.blank?
-    raise ArgumentError, 'WABA ID is required' if @waba_id.blank?
-  end
-
-  def validate_token_waba_access
-    token_debug_data = @api_client.debug_token(@access_token)
-    waba_scope = extract_waba_scope(token_debug_data)
-    verify_waba_authorization(waba_scope)
-  end
-
-  def extract_waba_scope(token_data)
-    granular_scopes = token_data.dig('data', 'granular_scopes')
-    waba_scope = granular_scopes&.find { |scope| scope['scope'] == 'whatsapp_business_management' }
-
-    raise 'No WABA scope found in token' unless waba_scope
-
-    waba_scope
-  end
-
-  def verify_waba_authorization(waba_scope)
-    authorized_waba_ids = waba_scope['target_ids'] || []
-
-    return if authorized_waba_ids.include?(@waba_id)
-
-    raise "Token does not have access to WABA #{@waba_id}. Authorized WABAs: #{authorized_waba_ids}"
-  end
-end
@@ -14,6 +14,9 @@ if resource.custom_attributes.present?
    json.referral_source resource.custom_attributes['referral_source'] if resource.custom_attributes['referral_source'].present?
    json.brand_info resource.custom_attributes['brand_info'] if resource.custom_attributes['brand_info'].present?
    json.onboarding_step resource.onboarding_step if resource.onboarding_step.present?
+    if resource.custom_attributes['help_center_generation_id'].present?
+      json.help_center_generation_id resource.custom_attributes['help_center_generation_id']
+    end
    json.marked_for_deletion_at resource.custom_attributes['marked_for_deletion_at'] if resource.custom_attributes['marked_for_deletion_at'].present?
    if resource.custom_attributes['marked_for_deletion_reason'].present?
      json.marked_for_deletion_reason resource.custom_attributes['marked_for_deletion_reason']
@@ -140,6 +140,7 @@ end
 ## Voice attributes for TwilioSms
 if resource.twilio? && resource.channel.respond_to?(:voice_enabled?)
  json.voice_enabled resource.channel.voice_enabled?
+  json.inbound_calls_enabled resource.channel.inbound_calls_enabled?
  json.voice_configured resource.channel.try(:twiml_app_sid).present?
  json.has_api_key_secret resource.channel.try(:api_key_secret).present?
  if resource.channel.try(:twiml_app_sid).present?
@@ -149,4 +150,7 @@ if resource.twilio? && resource.channel.respond_to?(:voice_enabled?)
 end

 ## Voice attribute for WhatsApp Cloud (only embedded-signup channels surface true)
-json.voice_enabled resource.channel.voice_enabled? if resource.channel_type == 'Channel::Whatsapp' && resource.channel.respond_to?(:voice_enabled?)
+if resource.channel_type == 'Channel::Whatsapp' && resource.channel.respond_to?(:voice_enabled?)
+  json.voice_enabled resource.channel.voice_enabled?
+  json.inbound_calls_enabled resource.channel.inbound_calls_enabled?
+end
@@ -1,5 +1,5 @@
 shared: &shared
-  version: '4.14.1'
+  version: '4.14.2'

 development:
  <<: *shared
@@ -19,7 +19,7 @@ class Rack::Attack
  Rack::Attack.cache.store = ActiveSupport::Cache::RedisCacheStore.new(redis: $velma, pool: false)

  class Request < ::Rack::Request
-    # You many need to specify a method to fetch the correct remote IP address
+    # You may need to specify a method to fetch the correct remote IP address
    # if the web server is behind a load balancer.
    def remote_ip
      @remote_ip ||= (env['action_dispatch.remote_ip'] || ip).to_s
@@ -31,9 +31,9 @@ class Rack::Attack
      (default_allowed_ips + env_allowed_ips).include?(remote_ip)
    end

-    # Rails would allow requests to paths with extentions, so lets compare against the path with extention stripped
+    # Rails would allow requests to paths with extensions, so lets compare against the path with extension stripped
    # example /auth & /auth.json would both work
-    def path_without_extentions
+    def path_without_extensions
      path[/^[^.]+/]
    end
  end
@@ -75,11 +75,11 @@ class Rack::Attack

  ### Prevent Brute-Force Super Admin Login Attacks ###
  throttle('super_admin_login/ip', limit: 5, period: 5.minutes) do |req|
-    req.ip if req.path_without_extentions == '/super_admin/sign_in' && req.post?
+    req.ip if req.path_without_extensions == '/super_admin/sign_in' && req.post?
  end

  throttle('super_admin_login/email', limit: 5, period: 15.minutes) do |req|
-    if req.path_without_extentions == '/super_admin/sign_in' && req.post?
+    if req.path_without_extensions == '/super_admin/sign_in' && req.post?
      # NOTE: This line used to throw ArgumentError /rails/action_mailbox/sendgrid/inbound_emails : invalid byte sequence in UTF-8
      # Hence placed in the if block
      # ref: https://github.com/rack/rack-attack/issues/399
@@ -91,7 +91,7 @@ class Rack::Attack
  # ### Prevent Brute-Force Login Attacks ###
  # Exclude MFA verification attempts from regular login throttling
  throttle('login/ip', limit: 5, period: 5.minutes) do |req|
-    if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
+    if req.path_without_extensions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
      # Skip if this is an MFA verification request
      req.ip
    end
@@ -99,7 +99,7 @@ class Rack::Attack

  throttle('login/email', limit: 10, period: 15.minutes) do |req|
    # Skip if this is an MFA verification request
-    if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
+    if req.path_without_extensions == '/auth/sign_in' && req.post? && req.params['mfa_token'].blank?
      # ref: https://github.com/rack/rack-attack/issues/399
      # NOTE: This line used to throw ArgumentError /rails/action_mailbox/sendgrid/inbound_emails : invalid byte sequence in UTF-8
      # Hence placed in the if block
@@ -110,11 +110,11 @@ class Rack::Attack

  ## Reset password throttling
  throttle('reset_password/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/auth/password' && req.post?
+    req.ip if req.path_without_extensions == '/auth/password' && req.post?
  end

  throttle('reset_password/email', limit: 5, period: 1.hour) do |req|
-    if req.path_without_extentions == '/auth/password' && req.post?
+    if req.path_without_extensions == '/auth/password' && req.post?
      email = req.params['email'].presence || ActionDispatch::Request.new(req.env).params['email'].presence
      email.to_s.downcase.gsub(/\s+/, '')
    end
@@ -122,11 +122,11 @@ class Rack::Attack

  ## Resend confirmation throttling (unauthenticated)
  throttle('resend_confirmation/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/resend_confirmation' && req.post?
+    req.ip if req.path_without_extensions == '/resend_confirmation' && req.post?
  end

  throttle('resend_confirmation/email', limit: 5, period: 1.hour) do |req|
-    if req.path_without_extentions == '/resend_confirmation' && req.post?
+    if req.path_without_extensions == '/resend_confirmation' && req.post?
      email = req.params['email'].presence || ActionDispatch::Request.new(req.env).params['email'].presence
      email.to_s.downcase.gsub(/\s+/, '')
    end
@@ -134,25 +134,25 @@ class Rack::Attack

  ## Resend confirmation throttling (authenticated)
  throttle('resend_confirmation_auth/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/api/v1/profile/resend_confirmation' && req.post?
+    req.ip if req.path_without_extensions == '/api/v1/profile/resend_confirmation' && req.post?
  end

  ## MFA throttling - prevent brute force attacks
  throttle('mfa_verification/ip', limit: 5, period: 1.minute) do |req|
-    if req.path_without_extentions == '/api/v1/profile/mfa'
+    if req.path_without_extensions == '/api/v1/profile/mfa'
      req.ip if req.delete? # Throttle disable attempts
-    elsif req.path_without_extentions.match?(%r{/api/v1/profile/mfa/(verify|backup_codes)})
+    elsif req.path_without_extensions.match?(%r{/api/v1/profile/mfa/(verify|backup_codes)})
      req.ip if req.post? # Throttle verify and backup_codes attempts
    end
  end

  # Separate rate limiting for MFA verification attempts
  throttle('mfa_login/ip', limit: 10, period: 1.minute) do |req|
-    req.ip if req.path_without_extentions == '/auth/sign_in' && req.post? && req.params['mfa_token'].present?
+    req.ip if req.path_without_extensions == '/auth/sign_in' && req.post? && req.params['mfa_token'].present?
  end

  throttle('mfa_login/token', limit: 10, period: 1.minute) do |req|
-    if req.path_without_extentions == '/auth/sign_in' && req.post?
+    if req.path_without_extensions == '/auth/sign_in' && req.post?
      # Track by MFA token to prevent brute force on a specific token
      mfa_token = req.params['mfa_token'].presence
      (mfa_token.presence)
@@ -161,7 +161,7 @@ class Rack::Attack

  ## Prevent Brute-Force Signup Attacks ###
  throttle('accounts/ip', limit: 5, period: 30.minutes) do |req|
-    req.ip if req.path_without_extentions == '/api/v1/accounts' && req.post?
+    req.ip if req.path_without_extensions == '/api/v1/accounts' && req.post?
  end

  ##-----------------------------------------------##
@@ -176,17 +176,17 @@ class Rack::Attack
  if ActiveModel::Type::Boolean.new.cast(ENV.fetch('ENABLE_RACK_ATTACK_WIDGET_API', true))
    ## Prevent Conversation Bombing on Widget APIs ###
    throttle('api/v1/widget/conversations', limit: 6, period: 12.hours) do |req|
-      req.ip if req.path_without_extentions == '/api/v1/widget/conversations' && req.post?
+      req.ip if req.path_without_extensions == '/api/v1/widget/conversations' && req.post?
    end

    ## Prevent Contact update Bombing in Widget API ###
    throttle('api/v1/widget/contacts', limit: 60, period: 1.hour) do |req|
-      req.ip if req.path_without_extentions == '/api/v1/widget/contacts' && (req.patch? || req.put?)
+      req.ip if req.path_without_extensions == '/api/v1/widget/contacts' && (req.patch? || req.put?)
    end

    ## Prevent Conversation Bombing through multiple sessions
    throttle('widget?website_token={website_token}&cw_conversation={x-auth-token}', limit: 5, period: 1.hour) do |req|
-      req.ip if req.path_without_extentions == '/widget' && ActionDispatch::Request.new(req.env).params['cw_conversation'].blank?
+      req.ip if req.path_without_extensions == '/widget' && ActionDispatch::Request.new(req.env).params['cw_conversation'].blank?
    end
  end

@@ -1,3 +1,10 @@
 # Be sure to restart your server when you modify this file.
+# Sessions are used only for the super_admin dashboard (flash/CSRF), not for API auth.

-Rails.application.config.session_store :cookie_store, key: '_chatwoot_session', same_site: :lax
+secure_cookies = ActiveModel::Type::Boolean.new.cast(ENV.fetch('FORCE_SSL', false))
+
+Rails.application.config.session_store :cookie_store,
+                                       key: '_chatwoot_session',
+                                       same_site: :lax,
+                                       secure: secure_cookies,
+                                       httponly: true
@@ -55,7 +55,9 @@ Rails.application.routes.draw do
            resource :contact_merge, only: [:create]
          end
          resource :bulk_actions, only: [:create]
-          resource :onboarding, only: [:update]
+          resource :onboarding, only: [:update] do
+            get :help_center_generation
+          end
          resources :agents, only: [:index, :create, :update, :destroy] do
            post :bulk_create, on: :collection
          end
@@ -265,6 +267,7 @@ Rails.application.routes.draw do
              end
              post :enable_whatsapp_calling, on: :member
              post :disable_whatsapp_calling, on: :member
+              post :set_inbound_calls, on: :member
            end

            resource :csat_template, only: [:show, :create], controller: 'inbox_csat_templates' do
@@ -0,0 +1,5 @@
+class AddProviderConfigToChannelTwilioSms < ActiveRecord::Migration[7.1]
+  def change
+    add_column :channel_twilio_sms, :provider_config, :jsonb, default: {}
+  end
+end
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema[7.1].define(version: 2026_05_25_093000) do
+ActiveRecord::Schema[7.1].define(version: 2026_06_04_000000) do
  # These extensions should be enabled to support this database
  enable_extension "pg_stat_statements"
  enable_extension "pg_trgm"
@@ -557,6 +557,7 @@ ActiveRecord::Schema[7.1].define(version: 2026_05_25_093000) do
    t.boolean "voice_enabled", default: false, null: false
    t.string "twiml_app_sid"
    t.string "api_key_secret"
+    t.jsonb "provider_config", default: {}
    t.index ["account_sid", "phone_number"], name: "index_channel_twilio_sms_on_account_sid_and_phone_number", unique: true
    t.index ["messaging_service_sid"], name: "index_channel_twilio_sms_on_messaging_service_sid", unique: true
    t.index ["phone_number"], name: "index_channel_twilio_sms_on_phone_number", unique: true
@@ -27,8 +27,8 @@ class Api::V1::Accounts::Captain::CustomToolsController < Api::V1::Accounts::Bas

  def test
    tool = account_custom_tools.new(custom_tool_params)
-    result = execute_test_request(tool)
-    render json: { status: result.code.to_i, body: result.body.to_s.truncate(500) }
+    body = execute_test_request(tool)
+    render json: { status: 200, body: body.to_s.truncate(500) }
  rescue StandardError => e
    render json: { error: e.message }, status: :unprocessable_content
  end
@@ -1,4 +1,6 @@
 module Enterprise::Api::V1::Accounts::InboxesController
+  extend ActiveSupport::Concern
+
  def inbox_attributes
    super + ee_inbox_attributes
  end
@@ -21,6 +23,24 @@ module Enterprise::Api::V1::Accounts::InboxesController
    render_could_not_create_error(e.message)
  end

+  # Toggles only the inbound-calls flag in provider_config. Saved with validate: false
+  # so WhatsApp's remote credential re-check (validate_provider_config) can't reject a
+  # simple toggle, mirroring enable_voice_calling!. Voice support (WhatsApp calling or
+  # Twilio voice) is guarded inline by ensure_inbound_calls_supported.
+  def set_inbound_calls
+    return unless ensure_inbound_calls_supported
+
+    channel = @inbox.channel
+    channel.provider_config = (channel.provider_config || {}).merge(
+      'inbound_calls_enabled' => ActiveModel::Type::Boolean.new.cast(params[:inbound_calls_enabled])
+    )
+    channel.save!(validate: false)
+    @inbox.update_account_cache # bump inbox cache key so the cached inbox list refetches the new flag
+    head :ok
+  rescue StandardError => e
+    render_could_not_create_error(e.message)
+  end
+
  def ee_inbox_attributes
    [auto_assignment_config: [:max_assignment_limit]]
  end
@@ -35,6 +55,14 @@ module Enterprise::Api::V1::Accounts::InboxesController
    false
  end

+  # Inbound calls can be toggled on any voice-enabled inbox (WhatsApp calling or Twilio voice).
+  def ensure_inbound_calls_supported
+    return true if @inbox.channel.try(:voice_enabled?)
+
+    render_could_not_create_error('Inbox does not support calling')
+    false
+  end
+
  def allowed_channel_types
    super + ['voice']
  end
@@ -0,0 +1,38 @@
+module Enterprise::Api::V1::Accounts::OnboardingsController
+  def help_center_generation
+    @account = Current.account
+    render json: help_center_generation_status
+  end
+
+  private
+
+  def help_center_generation_status
+    generation_id = help_center_generation_id
+    return super if generation_id.blank?
+
+    state = Onboarding::HelpCenterGenerationState.current(generation_id)
+
+    {
+      generation_id: generation_id,
+      state: state,
+      articles_count: articles_count,
+      categories_count: categories_count
+    }
+  end
+
+  def help_center_generation_id
+    @account.custom_attributes['help_center_generation_id']
+  end
+
+  def articles_count
+    onboarding_portal&.articles&.count || 0
+  end
+
+  def categories_count
+    onboarding_portal&.categories&.count || 0
+  end
+
+  def onboarding_portal
+    @onboarding_portal ||= @account.portals.first
+  end
+end
@@ -24,6 +24,8 @@ class Twilio::VoiceController < ApplicationController
      "TWILIO_VOICE_TWIML account=#{current_account.id} call_sid=#{twilio_call_sid} from=#{twilio_from} direction=#{twilio_direction}"
    )

+    return render xml: reject_twiml if reject_inbound?
+
    call = resolve_call
    render xml: conference_twiml(call)
  end
@@ -88,6 +90,16 @@ class Twilio::VoiceController < ApplicationController
    from_number.start_with?('client:')
  end

+  # A fresh contact-initiated leg on an inbox with inbound calls turned off.
+  # Reject it so no conference, conversation, or Call row is created.
+  def reject_inbound?
+    twilio_direction == 'inbound' && !agent_leg?(twilio_from) && !inbox.channel.inbound_calls_enabled?
+  end
+
+  def reject_twiml
+    Twilio::TwiML::VoiceResponse.new(&:reject).to_s
+  end
+
  def resolve_call
    return find_call_for_agent if agent_leg?(twilio_from)

@@ -2,10 +2,10 @@ class Onboarding::HelpCenterArticleGenerationJob < ApplicationJob
  queue_as :low

  retry_on Firecrawl::FirecrawlError, wait: :polynomially_longer, attempts: 3 do |job, error|
-    _account_id, _portal_id, user_id, generation_id = job.arguments
+    _account_id, _portal_id, _user_id, generation_id = job.arguments
    reason = "firecrawl exhausted: #{error.message}"
    Rails.logger.warn "[HelpCenterGenerationJob] gen=#{generation_id} #{reason}"
-    job.send(:skip_and_broadcast, user: User.find_by(id: user_id), generation_id: generation_id, reason: reason)
+    job.send(:skip_generation, generation_id: generation_id, reason: reason)
  end

  def perform(account_id, portal_id, user_id, generation_id)
@@ -19,7 +19,7 @@ class Onboarding::HelpCenterArticleGenerationJob < ApplicationJob
    )
  rescue Onboarding::HelpCenterErrors::CurationSkipped => e
    Rails.logger.info "[HelpCenterGenerationJob] gen=#{generation_id} skipped: #{e.message}"
-    skip_and_broadcast(user: User.find_by(id: user_id), generation_id: generation_id, reason: e.message)
+    skip_generation(generation_id: generation_id, reason: e.message)
  end

  private
@@ -89,15 +89,12 @@ class Onboarding::HelpCenterArticleGenerationJob < ApplicationJob
  def enqueue_writer_jobs(account_id:, portal_id:, user_id:, generation_id:, articles:)
    articles.each do |article|
      Onboarding::HelpCenterArticleWriterJob.perform_later(
-        account_id, portal_id, user_id, generation_id, { article: article }
+        account_id, portal_id, user_id, generation_id, article
      )
    end
  end

-  def skip_and_broadcast(user:, generation_id:, reason:)
+  def skip_generation(generation_id:, reason:)
    Onboarding::HelpCenterGenerationState.skip(generation_id, reason: reason)
-    Onboarding::HelpCenterBroadcaster.completed(
-      user: user, generation_id: generation_id, status: 'skipped', skip_reason: reason
-    )
  end
 end
@@ -9,43 +9,27 @@ class Onboarding::HelpCenterArticleWriterJob < ApplicationJob
    job.send(:on_writer_failure, error)
  end

-  def perform(account_id, portal_id, user_id, generation_id, article_payload)
-    user = User.find(user_id)
-    payload = article_payload.with_indifferent_access
-    article = Onboarding::HelpCenterArticleBuilder.new(
+  def perform(account_id, portal_id, user_id, generation_id, article)
+    Onboarding::HelpCenterArticleBuilder.new(
      account: Account.find(account_id),
      portal: Portal.find(portal_id),
-      user: user,
-      article: payload[:article]
+      user: User.find(user_id),
+      article: article
    ).perform

-    finalize(user: user, generation_id: generation_id, article: article)
+    finalize(generation_id: generation_id)
  end

  private

  def on_writer_failure(error)
-    user, generation_id = failure_context
+    generation_id = arguments[3]
    Rails.logger.warn "[HelpCenterWriterJob] gen=#{generation_id} failed: #{error.class} #{error.message}"
-    finalize(user: user, generation_id: generation_id, article: nil)
+    finalize(generation_id: generation_id)
  end

-  def failure_context
-    _account_id, _portal_id, user_id, generation_id = arguments
-    [User.find_by(id: user_id), generation_id]
-  end
-
-  def finalize(user:, generation_id:, article:)
-    result = Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
-
-    if article
-      Onboarding::HelpCenterBroadcaster.article_generated(
-        user: user, generation_id: generation_id, article: article, articles_finished: result[:finished]
-      )
-    end
-    return unless result[:completed]
-
-    Onboarding::HelpCenterBroadcaster.completed(user: user, generation_id: generation_id, status: 'completed')
+  def finalize(generation_id:)
+    Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
  rescue Onboarding::HelpCenterGenerationState::Missing => e
    Rails.logger.warn "[HelpCenterWriterJob] gen=#{generation_id} #{e.message}"
  end
@@ -1,29 +0,0 @@
-module Onboarding::HelpCenterBroadcaster
-  ARTICLE_GENERATED = 'help_center.article_generated'.freeze
-  GENERATION_COMPLETED = 'help_center.generation_completed'.freeze
-
-  module_function
-
-  def article_generated(user:, generation_id:, article:, articles_finished:)
-    broadcast(user, ARTICLE_GENERATED, {
-                generation_id: generation_id,
-                article_id: article.id,
-                articles_finished: articles_finished
-              })
-  end
-
-  def completed(user:, generation_id:, status:, skip_reason: nil)
-    broadcast(user, GENERATION_COMPLETED, {
-                generation_id: generation_id,
-                status: status,
-                skip_reason: skip_reason
-              })
-  end
-
-  def broadcast(user, event, payload)
-    token = user&.pubsub_token
-    return if token.blank?
-
-    ActionCableBroadcastJob.perform_later([token], event, payload)
-  end
-end
@@ -77,6 +77,7 @@ class Onboarding::HelpCenterCreationService

    generation_id = SecureRandom.uuid
    Onboarding::HelpCenterArticleGenerationJob.perform_later(@account.id, portal.id, @user.id, generation_id)
+    @account.update!(custom_attributes: @account.custom_attributes.merge('help_center_generation_id' => generation_id))
  rescue StandardError => e
    Rails.logger.error "[HelpCenterCreation] Failed to enqueue article generation for account #{@account.id}: #{e.class} - #{e.message}"
  end
@@ -9,7 +9,7 @@ class Whatsapp::CallService
    call.with_lock do
      transition_to_in_progress!
      update_message_status('in_progress')
-      update_conversation_call_status(call.display_status)
+      claim_conversation_and_set_call_status
      broadcast(:accepted, accepted_by_agent_id: agent.id)
    end
    call
@@ -56,7 +56,6 @@ class Whatsapp::CallService
    forward_answer_to_meta!
    call.update!(status: 'in_progress', accepted_by_agent_id: agent.id, started_at: Time.current,
                 meta: (call.meta || {}).merge('sdp_answer' => sdp_answer))
-    claim_conversation_for_agent
  end

  def forward_answer_to_meta!
@@ -64,9 +63,13 @@ class Whatsapp::CallService
    invoke_provider!(:accept_call, sdp_answer)
  end

-  # Take ownership of the conversation if no one holds it; leave assignee alone otherwise (transfer via UI).
-  def claim_conversation_for_agent
-    call.conversation.update!(assignee: agent) if call.conversation.assignee_id.blank?
+  # Claim an unheld conversation and set call_status in one save so previous_changes carries both the
+  # assignee change (activity message + ASSIGNEE_CHANGED) and the call_status change (conversation.updated webhook).
+  def claim_conversation_and_set_call_status
+    conversation = call.conversation
+    attrs = { additional_attributes: (conversation.additional_attributes || {}).merge('call_status' => call.display_status) }
+    attrs[:assignee] = agent if conversation.assignee_id.blank?
+    conversation.update!(attrs)
  end

  # Raise on Meta failure (bool false or transport error) so callers bail before
@@ -72,6 +72,12 @@ class Whatsapp::IncomingCallService
  end

  def create_inbound_call(payload)
+    unless inbox.channel.inbound_calls_enabled?
+      Rails.logger.info "[WHATSAPP CALL] Inbound calls disabled for inbox #{inbox.id}; rejecting call #{payload[:id]}"
+      inbox.channel.provider_service.reject_call(payload[:id])
+      return
+    end
+
    sdp_offer = payload.dig(:session, :sdp)
    extra_meta = { 'sdp_offer' => sdp_offer, 'ice_servers' => Call.default_ice_servers }
    name = caller_profile_name(payload)
@@ -15,8 +15,8 @@ class Captain::Tools::HttpTool < Agents::Tool
    url = @custom_tool.build_request_url(params)
    body = @custom_tool.build_request_body(params)

-    response = execute_http_request(url, body, tool_context)
-    @custom_tool.format_response(response.body)
+    response_body = execute_http_request(url, body, tool_context)
+    @custom_tool.format_response(response_body)
  rescue StandardError => e
    Rails.logger.error("HttpTool execution error for #{@custom_tool.slug}: #{e.class} - #{e.message}")
    'An error occurred while executing the request'
@@ -24,89 +24,32 @@ class Captain::Tools::HttpTool < Agents::Tool

  private

-  PRIVATE_IP_RANGES = [
-    IPAddr.new('127.0.0.0/8'),    # IPv4 Loopback
-    IPAddr.new('10.0.0.0/8'),     # IPv4 Private network
-    IPAddr.new('172.16.0.0/12'),  # IPv4 Private network
-    IPAddr.new('192.168.0.0/16'), # IPv4 Private network
-    IPAddr.new('169.254.0.0/16'), # IPv4 Link-local
-    IPAddr.new('::1'),            # IPv6 Loopback
-    IPAddr.new('fc00::/7'),       # IPv6 Unique local addresses
-    IPAddr.new('fe80::/10')       # IPv6 Link-local
-  ].freeze
-
  # Limit response size to prevent memory exhaustion and match LLM token limits
  # 1MB of text ≈ 250K tokens, which exceeds most LLM context windows
  MAX_RESPONSE_SIZE = 1.megabyte

+  # Route through SafeFetch so custom tool requests share the app's centralized HTTP
+  # fetching (resolution, timeouts, response size limits, and redirect handling).
  def execute_http_request(url, body, tool_context)
-    uri = URI.parse(url)
+    json_body = body if @custom_tool.http_method == 'POST'

-    # Check if resolved IP is private
-    check_private_ip!(uri.host)
-
-    http = Net::HTTP.new(uri.host, uri.port)
-    http.use_ssl = uri.scheme == 'https'
-    http.read_timeout = 30
-    http.open_timeout = 10
-    http.max_retries = 0 # Disable redirects
-
-    request = build_http_request(uri, body)
-    apply_authentication(request)
-    apply_metadata_headers(request, tool_context)
-
-    response = http.request(request)
-
-    raise "HTTP request failed with status #{response.code}" unless response.is_a?(Net::HTTPSuccess)
-
-    validate_response!(response)
-
-    response
+    response_body = +''
+    SafeFetch.fetch(
+      url,
+      method: @custom_tool.http_method == 'POST' ? :post : :get,
+      body: json_body,
+      headers: request_headers(tool_context, json_body),
+      http_basic_authentication: @custom_tool.build_basic_auth_credentials,
+      max_bytes: MAX_RESPONSE_SIZE,
+      validate_content_type: false
+    ) { |result| response_body = result.tempfile.read }
+    response_body
  end

-  def check_private_ip!(hostname)
-    ip_address = IPAddr.new(Resolv.getaddress(hostname))
-
-    raise 'Request blocked: hostname resolves to private IP address' if PRIVATE_IP_RANGES.any? { |range| range.include?(ip_address) }
-  rescue Resolv::ResolvError, SocketError => e
-    raise "DNS resolution failed: #{e.message}"
-  end
-
-  def validate_response!(response)
-    content_length = response['content-length']&.to_i
-    if content_length && content_length > MAX_RESPONSE_SIZE
-      raise "Response size #{content_length} bytes exceeds maximum allowed #{MAX_RESPONSE_SIZE} bytes"
-    end
-
-    return unless response.body && response.body.bytesize > MAX_RESPONSE_SIZE
-
-    raise "Response body size #{response.body.bytesize} bytes exceeds maximum allowed #{MAX_RESPONSE_SIZE} bytes"
-  end
-
-  def build_http_request(uri, body)
-    if @custom_tool.http_method == 'POST'
-      request = Net::HTTP::Post.new(uri.request_uri)
-      if body
-        request.body = body
-        request['Content-Type'] = 'application/json'
-      end
-    else
-      request = Net::HTTP::Get.new(uri.request_uri)
-    end
-    request
-  end
-
-  def apply_authentication(request)
+  def request_headers(tool_context, json_body)
    headers = @custom_tool.build_auth_headers
-    headers.each { |key, value| request[key] = value }
-
-    credentials = @custom_tool.build_basic_auth_credentials
-    request.basic_auth(*credentials) if credentials
-  end
-
-  def apply_metadata_headers(request, tool_context)
-    state = tool_context&.state || {}
-    metadata_headers = @custom_tool.build_metadata_headers(state)
-    metadata_headers.each { |key, value| request[key] = value }
+    headers.merge!(@custom_tool.build_metadata_headers(tool_context&.state || {}))
+    headers['Content-Type'] = 'application/json' if json_body.present?
+    headers
  end
 end
@@ -1,6 +1,6 @@
 {
  "name": "@chatwoot/chatwoot",
-  "version": "4.14.1",
+  "version": "4.14.2",
  "license": "MIT",
  "scripts": {
    "eslint": "eslint app/**/*.{js,vue}",
@@ -34,7 +34,7 @@
    "@amplitude/analytics-browser": "^2.11.10",
    "@breezystack/lamejs": "^1.2.7",
    "@chatwoot/ninja-keys": "1.2.3",
-    "@chatwoot/prosemirror-schema": "1.3.19",
+    "@chatwoot/prosemirror-schema": "1.3.22",
    "@chatwoot/utils": "^0.0.55",
    "@formkit/core": "^1.7.2",
    "@formkit/vue": "^1.7.2",
@@ -25,8 +25,8 @@ importers:
        specifier: 1.2.3
        version: 1.2.3
      '@chatwoot/prosemirror-schema':
-        specifier: 1.3.19
-        version: 1.3.19
+        specifier: 1.3.22
+        version: 1.3.22
      '@chatwoot/utils':
        specifier: ^0.0.55
        version: 0.0.55
@@ -458,8 +458,8 @@ packages:
  '@chatwoot/ninja-keys@1.2.3':
    resolution: {integrity: sha512-xM8d9P5ikDMZm2WbaCTk/TW5HFauylrU3cJ75fq5je6ixKwyhl/0kZbVN/vbbZN4+AUX/OaSIn6IJbtCgIF67g==}

-  '@chatwoot/prosemirror-schema@1.3.19':
-    resolution: {integrity: sha512-LbATIAeTzclvbIK6WjtrGUO37AtMWkzCJi+s/KpUIp81TORhc0fHnclGT3353AbxeH6dF51/4hFTTsmF+ziqGA==}
+  '@chatwoot/prosemirror-schema@1.3.22':
+    resolution: {integrity: sha512-0r+PT8xhQLCKCpoV9k9XVTTRECs/0Nr37wbcLsRS7yvc7WkF9FY05z2hGCRJReWmTOcmmshHtb042LVP+MyB/w==}

  '@chatwoot/utils@0.0.55':
    resolution: {integrity: sha512-8G6HYQe1ZEYfJEsSYfDVvE+uhf98JDRjtGlpB+bzMko+yltbrk4yACSo/ImC3jSaJ6K8yPTSjJToSRmsQbL2iQ==}
@@ -5128,7 +5128,7 @@ snapshots:
      hotkeys-js: 3.8.7
      lit: 2.2.6

-  '@chatwoot/prosemirror-schema@1.3.19':
+  '@chatwoot/prosemirror-schema@1.3.22':
    dependencies:
      markdown-it-sup: 2.0.0
      prosemirror-commands: 1.7.1
@@ -39,6 +39,21 @@ describe ContactInboxWithContactBuilder do
      expect(contact_inbox.inbox_id).to eq(inbox.id)
    end

+    it 'truncates long contact names before creating the contact' do
+      long_name = 'a' * 300
+
+      contact_inbox = described_class.new(
+        source_id: '123456',
+        inbox: inbox,
+        contact_attributes: {
+          name: long_name,
+          email: 'testemail@example.com'
+        }
+      ).perform
+
+      expect(contact_inbox.contact.name).to eq(long_name.first(ApplicationRecord::MAX_STRING_COLUMN_LENGTH))
+    end
+
    it 'doesnot create contact if it already exist with identifier' do
      contact_inbox = described_class.new(
        source_id: '123456',
@@ -0,0 +1,29 @@
+require 'rails_helper'
+
+# rubocop:disable RSpec/DescribeClass
+describe 'Session Store Configuration' do
+  # rubocop:enable RSpec/DescribeClass
+
+  let(:session_options) { Rails.application.config.session_options }
+
+  it 'uses cookie_store as the session store' do
+    expect(Rails.application.config.session_store).to eq(ActionDispatch::Session::CookieStore)
+  end
+
+  it 'sets the session key' do
+    expect(session_options[:key]).to eq('_chatwoot_session')
+  end
+
+  it 'sets same_site to lax' do
+    expect(session_options[:same_site]).to eq(:lax)
+  end
+
+  it 'sets httponly to true' do
+    expect(session_options[:httponly]).to be(true)
+  end
+
+  it 'sets secure flag based on FORCE_SSL' do
+    expected_secure = ActiveModel::Type::Boolean.new.cast(ENV.fetch('FORCE_SSL', false))
+    expect(session_options[:secure]).to eq(expected_secure)
+  end
+end
@@ -38,6 +38,8 @@ RSpec.describe '/api/v1/accounts/{account.id}/channels/twilio_channel', type: :r
    context 'when user is logged in' do
      context 'with user as administrator' do
        it 'creates inbox and returns inbox object' do
+          expect(Twilio::WebhookSetupService).to receive(:new).and_return(twilio_webhook_setup_service)
+          expect(twilio_webhook_setup_service).to receive(:perform)
          allow(twilio_client).to receive(:messages).and_return(message_double)
          allow(message_double).to receive(:list).and_return([])

@@ -53,6 +55,8 @@ RSpec.describe '/api/v1/accounts/{account.id}/channels/twilio_channel', type: :r
        end

        it 'creates inbox with blank phone number and returns inbox object' do
+          expect(Twilio::WebhookSetupService).to receive(:new).and_return(twilio_webhook_setup_service)
+          expect(twilio_webhook_setup_service).to receive(:perform)
          params = {
            twilio_channel: {
              account_sid: 'sid-1',
@@ -131,6 +135,8 @@ RSpec.describe '/api/v1/accounts/{account.id}/channels/twilio_channel', type: :r
        end

        it 'return error if Twilio tokens are incorrect' do
+          expect(twilio_webhook_setup_service).not_to receive(:perform)
+          expect(Twilio::WebhookSetupService).not_to receive(:new)
          allow(twilio_client).to receive(:messages).and_return(message_double)
          allow(message_double).to receive(:list).and_raise(Twilio::REST::TwilioError)

@@ -141,6 +141,7 @@ RSpec.describe 'Conversations API', type: :request do

          expect(response).to have_http_status(:success)
          expect(response.parsed_body['payload']).to eq(
+            'all_count' => 1,
            'inboxes' => { visible_inbox.id.to_s => 1 },
            'labels' => { label.id.to_s => 1 },
            'teams' => {}
@@ -111,4 +111,40 @@ RSpec.describe 'Onboarding API', type: :request do
      end
    end
  end
+
+  describe 'GET /api/v1/accounts/{account.id}/onboarding/help_center_generation' do
+    context 'when unauthenticated' do
+      it 'returns unauthorized' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation", as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when authenticated as an agent (non-admin)' do
+      let(:agent) { create(:user, account: account, role: :agent) }
+
+      it 'returns unauthorized' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation",
+            headers: agent.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
+    context 'when no help center generation has started' do
+      it 'returns not_started with zero counts' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation",
+            headers: admin.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(response.parsed_body).to include(
+          'generation_id' => nil,
+          'state' => nil,
+          'articles_count' => 0,
+          'categories_count' => 0
+        )
+      end
+    end
+  end
 end
@@ -122,8 +122,8 @@ RSpec.describe SamlUserBuilder do
        it 'does not add the user to the target account' do
          expect do
            builder.perform
-          rescue SamlUserBuilder::AuthenticationFailed
-            nil
+          rescue StandardError => e
+            raise unless e.class.name == 'SamlUserBuilder::AuthenticationFailed' # rubocop:disable Style/ClassEqualityComparison
          end.not_to change(AccountUser, :count)
          expect(existing_user.reload.accounts).not_to include(account)
        end
@@ -131,8 +131,8 @@ RSpec.describe SamlUserBuilder do
        it 'does not convert the user provider to saml' do
          expect do
            builder.perform
-          rescue SamlUserBuilder::AuthenticationFailed
-            nil
+          rescue StandardError => e
+            raise unless e.class.name == 'SamlUserBuilder::AuthenticationFailed' # rubocop:disable Style/ClassEqualityComparison
          end.not_to(change { existing_user.reload.provider })
        end
      end
@@ -0,0 +1,42 @@
+require 'rails_helper'
+
+RSpec.describe 'Enterprise Onboarding API', type: :request do
+  let(:account) { create(:account, domain: 'example.com') }
+  let(:admin) { create(:user, account: account, role: :administrator) }
+
+  describe 'GET /api/v1/accounts/{account.id}/onboarding/help_center_generation' do
+    context 'when help center generation is in progress' do
+      let(:generation_id) { 'generation-123' }
+      let!(:portal) { create(:portal, account_id: account.id) }
+      let!(:category) { create(:category, portal: portal, account_id: account.id) }
+
+      before do
+        account.update!(custom_attributes: { 'help_center_generation_id' => generation_id })
+        create(:article, portal: portal, category: category, account_id: account.id, author_id: admin.id)
+        Onboarding::HelpCenterGenerationState.start(generation_id, total: 3)
+        Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
+      end
+
+      after do
+        Redis::Alfred.delete(Onboarding::HelpCenterGenerationState.key(generation_id))
+      end
+
+      it 'returns Redis state and help center counts' do
+        get "/api/v1/accounts/#{account.id}/onboarding/help_center_generation",
+            headers: admin.create_new_auth_token, as: :json
+
+        expect(response).to have_http_status(:success)
+        expect(response.parsed_body).to include(
+          'generation_id' => generation_id,
+          'articles_count' => 1,
+          'categories_count' => 1
+        )
+        expect(response.parsed_body['state']).to include(
+          'status' => 'generating',
+          'finished' => '1',
+          'total' => '3'
+        )
+      end
+    end
+  end
+end
@@ -49,6 +49,59 @@ RSpec.describe 'Enterprise Inboxes API', type: :request do
    end
  end

+  describe 'POST /api/v1/accounts/{account.id}/inboxes/:id/set_inbound_calls' do
+    before do
+      allow(Twilio::VoiceWebhookSetupService).to receive(:new)
+        .and_return(instance_double(Twilio::VoiceWebhookSetupService, perform: "AP#{SecureRandom.hex(16)}"))
+    end
+
+    context 'when administrator' do
+      it 'disables inbound calls on a Twilio voice inbox' do
+        channel = create(:channel_twilio_sms, :with_voice, account: account)
+
+        post "/api/v1/accounts/#{account.id}/inboxes/#{channel.inbox.id}/set_inbound_calls",
+             headers: admin.create_new_auth_token,
+             params: { inbound_calls_enabled: false },
+             as: :json
+
+        expect(response).to have_http_status(:ok)
+        expect(channel.reload.inbound_calls_enabled?).to be false
+      end
+
+      it 'enables inbound calls on a WhatsApp inbox without re-validating provider config' do
+        account.enable_features('channel_voice')
+        account.save!
+        channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud',
+                                            validate_provider_config: false, sync_templates: false)
+        channel.update!(provider_config: channel.provider_config.merge('calling_enabled' => true, 'inbound_calls_enabled' => false))
+
+        post "/api/v1/accounts/#{account.id}/inboxes/#{channel.inbox.id}/set_inbound_calls",
+             headers: admin.create_new_auth_token,
+             params: { inbound_calls_enabled: true },
+             as: :json
+
+        expect(response).to have_http_status(:ok)
+        expect(channel.reload.inbound_calls_enabled?).to be true
+      end
+    end
+
+    context 'when agent' do
+      let(:agent) { create(:user, account: account, role: :agent) }
+
+      it 'is forbidden' do
+        channel = create(:channel_twilio_sms, :with_voice, account: account)
+
+        post "/api/v1/accounts/#{account.id}/inboxes/#{channel.inbox.id}/set_inbound_calls",
+             headers: agent.create_new_auth_token,
+             params: { inbound_calls_enabled: false },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(channel.reload.inbound_calls_enabled?).to be true
+      end
+    end
+  end
+
  describe 'PATCH /api/v1/accounts/{account.id}/inboxes/:id' do
    let(:inbox) { create(:inbox, account: account, auto_assignment_config: { max_assignment_limit: 5 }) }

@@ -112,6 +112,23 @@ RSpec.describe 'Twilio::VoiceController', type: :request do
      }
      expect(response).to have_http_status(:not_found)
    end
+
+    it 'rejects the inbound contact leg without building a call when inbound calls are disabled' do
+      channel.update!(provider_config: { 'inbound_calls_enabled' => false })
+      expect(Voice::InboundCallBuilder).not_to receive(:perform!)
+
+      expect do
+        post "/twilio/voice/call/#{digits}", params: {
+          'CallSid' => call_sid,
+          'From' => from_number,
+          'To' => to_number,
+          'Direction' => 'inbound'
+        }
+      end.not_to change(Call, :count)
+
+      expect(response).to have_http_status(:ok)
+      expect(response.body).to include('<Reject')
+    end
  end

  describe 'POST /twilio/voice/status/:phone' do
@@ -53,11 +53,9 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
            admin.id,
            generation_id,
            hash_including(
-              'article' => hash_including(
-                'title' => 'Hello',
-                'urls' => ['https://x.test/a'],
-                'category_id' => portal.categories.first.id
-              )
+              'title' => 'Hello',
+              'urls' => ['https://x.test/a'],
+              'category_id' => portal.categories.first.id
            )
          )
        )
@@ -83,7 +81,7 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
      writer_jobs = enqueued_jobs.select { |job| job['job_class'] == Onboarding::HelpCenterArticleWriterJob.name }
      expect(writer_jobs.size).to eq(1)
      expect(writer_jobs.first['arguments']).to include(
-        hash_including('article' => hash_including('title' => 'Valid'))
+        hash_including('title' => 'Valid')
      )
    end
  end
@@ -106,7 +104,7 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
      writer_jobs = enqueued_jobs.select { |job| job['job_class'] == Onboarding::HelpCenterArticleWriterJob.name }
      expect(writer_jobs.size).to eq(1)
      expect(writer_jobs.first['arguments']).to include(
-        hash_including('article' => hash_including('title' => 'Approved', 'urls' => ['https://x.test/a']))
+        hash_including('title' => 'Approved', 'urls' => ['https://x.test/a'])
      )
      expect(Onboarding::HelpCenterGenerationState.current(generation_id)).to include('total' => '1')
    end
@@ -170,19 +168,4 @@ RSpec.describe Onboarding::HelpCenterArticleGenerationJob do
      expect(state['skip_reason']).to include('firecrawl exhausted')
    end
  end
-
-  describe 'broadcasts' do
-    it 'broadcasts generation_completed with status: skipped on CurationSkipped' do
-      curator = instance_double(Onboarding::HelpCenterCurator)
-      allow(curator).to receive(:perform).and_raise(
-        Onboarding::HelpCenterErrors::CurationSkipped, 'no website url'
-      )
-      allow(Onboarding::HelpCenterCurator).to receive(:new).and_return(curator)
-
-      payload = hash_including(generation_id: generation_id, status: 'skipped', skip_reason: 'no website url')
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', payload)
-    end
-  end
 end
@@ -6,8 +6,7 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
  let!(:admin) { create(:user, account: account, role: :administrator) }
  let(:generation_id) { 'generation-123' }
  let(:article_spec) { { 'urls' => ['https://x.test/a'], 'title' => 'A', 'category_id' => nil } }
-  let(:article_payload) { { 'article' => article_spec } }
-  let(:job_args) { [account.id, portal.id, admin.id, generation_id, article_payload] }
+  let(:job_args) { [account.id, portal.id, admin.id, generation_id, article_spec] }
  let(:state_key) { Onboarding::HelpCenterGenerationState.key(generation_id) }

  before do
@@ -68,16 +67,14 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
      expect(Onboarding::HelpCenterGenerationState.current(generation_id)).to include('finished' => '1')
    end

-    it 'broadcasts completion when the final writer fails with ArticleBuildFailed' do
+    it 'marks generation completed when the final writer fails with ArticleBuildFailed' do
      allow(Onboarding::HelpCenterArticleBuilder).to receive(:new).and_raise(
        Onboarding::HelpCenterErrors::ArticleBuildFailed, 'no source urls'
      )
      Onboarding::HelpCenterGenerationState.record_article_finished(generation_id)
-      payload = hash_including(generation_id: generation_id, status: 'completed')

-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', payload)
+      described_class.perform_now(*job_args)
+
      expect(Onboarding::HelpCenterGenerationState.current(generation_id)).to include(
        'status' => 'completed', 'finished' => '2'
      )
@@ -105,7 +102,7 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
    end
  end

-  describe 'broadcasts' do
+  describe 'missing state' do
    let(:built_article) { instance_double(Article, id: 9876) }

    before do
@@ -113,47 +110,10 @@ RSpec.describe Onboarding::HelpCenterArticleWriterJob do
      allow(Onboarding::HelpCenterArticleBuilder).to receive(:new).and_return(builder)
    end

-    it 'broadcasts help_center.article_generated on success' do
-      payload = hash_including(generation_id: generation_id, article_id: 9876, articles_finished: 1)
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.article_generated', payload)
-    end
-
-    it 'broadcasts help_center.generation_completed when the last writer finishes' do
-      described_class.perform_now(*job_args)
-      payload = hash_including(generation_id: generation_id, status: 'completed')
-
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', payload)
-    end
-
-    it 'does not broadcast article_generated on builder failure' do
-      allow(Onboarding::HelpCenterArticleBuilder).to receive(:new).and_raise(
-        Onboarding::HelpCenterErrors::ArticleBuildFailed, 'no source urls'
-      )
-
-      expect { described_class.perform_now(*job_args) }
-        .not_to have_enqueued_job(ActionCableBroadcastJob)
-        .with(anything, 'help_center.article_generated', anything)
-    end
-
-    it 'broadcasts generation_completed on late retries past total' do
-      described_class.perform_now(*job_args)
-      described_class.perform_now(*job_args)
-      clear_enqueued_jobs
-
-      expect { described_class.perform_now(*job_args) }
-        .to have_enqueued_job(ActionCableBroadcastJob)
-        .with([admin.pubsub_token], 'help_center.generation_completed', hash_including(generation_id: generation_id))
-    end
-
-    it 'skips progress broadcasts when state is missing' do
+    it 'does not raise when state is missing' do
      Redis::Alfred.delete(state_key)

-      expect { described_class.perform_now(*job_args) }
-        .not_to have_enqueued_job(ActionCableBroadcastJob)
+      expect { described_class.perform_now(*job_args) }.not_to raise_error
    end
  end
 end
@@ -38,6 +38,19 @@ RSpec.describe Channel::TwilioSms do
    end
  end

+  describe '#inbound_calls_enabled?' do
+    it 'returns true by default when nothing has been toggled' do
+      channel = create(:channel_twilio_sms, :with_voice, account: account)
+      expect(channel.inbound_calls_enabled?).to be true
+    end
+
+    it 'returns false only when explicitly disabled in provider_config' do
+      channel = create(:channel_twilio_sms, :with_voice, account: account,
+                                                         provider_config: { 'inbound_calls_enabled' => false })
+      expect(channel.inbound_calls_enabled?).to be false
+    end
+  end
+
  describe '#voice_call_webhook_url' do
    it 'returns the webhook URL based on phone number' do
      channel = create(:channel_twilio_sms, :with_voice)
@@ -26,6 +26,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do

    result = described_class.new(account: account, user: agent).perform

+    expect(result[:all_count]).to eq(2)
    expect(result[:inboxes]).to eq(inbox.id.to_s => 2)
    expect(result[:labels]).to eq(label.id.to_s => 2)
    expect(result[:teams]).to eq(team.id.to_s => 2)
@@ -40,6 +41,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do

    result = described_class.new(account: account, user: agent).perform

+    expect(result[:all_count]).to eq(2)
    expect(result[:inboxes]).to eq(inbox.id.to_s => 2)
    expect(result[:labels]).to eq(label.id.to_s => 2)
    expect(result[:teams]).to eq(team.id.to_s => 2)
@@ -53,6 +55,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do

    result = described_class.new(account: account, user: agent).perform

+    expect(result[:all_count]).to eq(1)
    expect(result[:inboxes]).to eq(inbox.id.to_s => 1)
    expect(result[:labels]).to eq(label.id.to_s => 1)
    expect(result[:teams]).to eq(team.id.to_s => 1)
@@ -65,7 +68,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do

    result = described_class.new(account: account, user: agent).perform

-    expect(result).to eq(inboxes: {}, labels: {}, teams: {})
+    expect(result).to eq(all_count: 0, inboxes: {}, labels: {}, teams: {})
    expect(store.base_ready?(account.id)).to be(false)
    expect(store.assignment_ready?(account.id)).to be(false)
  end
@@ -30,6 +30,20 @@ describe Whatsapp::IncomingCallService do
    end
  end

+  context 'when inbound calls are disabled on the channel' do
+    it 'rejects the call with Meta without creating a Call or Conversation' do
+      channel.provider_config = channel.provider_config.merge('inbound_calls_enabled' => false)
+      channel.save!
+      provider_service = instance_double(Whatsapp::Providers::WhatsappCloudService, reject_call: true)
+      allow(inbox.channel).to receive(:provider_service).and_return(provider_service)
+
+      params = call_payload(event: 'connect', session: { sdp: "v=0\r\n...sdp...", sdp_type: 'offer' })
+      expect { described_class.new(inbox: inbox, params: params).perform }
+        .to not_change(Call, :count).and not_change(Conversation, :count)
+      expect(provider_service).to have_received(:reject_call).with(provider_call_id)
+    end
+  end
+
  describe 'inbound connect' do
    let(:sdp_offer) { "v=0\r\n...sdp..." }
    let!(:agent) { create(:user, account: account) }
@@ -58,7 +58,7 @@ RSpec.describe MutexApplicationJob do

  describe '.retry_on_lock_conflict' do
    let(:job_class) do
-      Class.new(described_class) do
+      Class.new(MutexApplicationJob) do
        retry_on_lock_conflict wait: 1.second, attempts: 1, on_exhaustion: :process_without_lock

        attr_reader :fallback_args
@@ -90,7 +90,7 @@ RSpec.describe MutexApplicationJob do

    context 'without an exhaustion handler' do
      let(:job_class) do
-        Class.new(described_class) do
+        Class.new(MutexApplicationJob) do
          retry_on_lock_conflict wait: 1.second, attempts: 1

          def perform(lock_key)
@@ -248,4 +248,22 @@ RSpec.describe Channel::Whatsapp do
      expect(channel.voice_enabled?).to be false
    end
  end
+
+  describe '#inbound_calls_enabled?' do
+    let(:account) { create(:account) }
+
+    it 'returns true by default when nothing has been toggled' do
+      channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud',
+                                          validate_provider_config: false, sync_templates: false)
+      expect(channel.inbound_calls_enabled?).to be true
+    end
+
+    it 'returns false only when explicitly disabled in provider_config' do
+      channel = create(:channel_whatsapp, account: account, provider: 'whatsapp_cloud',
+                                          validate_provider_config: false, sync_templates: false)
+      channel.update!(provider_config: channel.provider_config.merge('inbound_calls_enabled' => false))
+
+      expect(channel.inbound_calls_enabled?).to be false
+    end
+  end
 end
@@ -62,6 +62,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
    result = described_class.new(account: account, user: agent).perform

    expect(result).to eq(
+      all_count: 1,
      inboxes: { visible_inbox.id.to_s => 1 },
      labels: { label.id.to_s => 1 },
      teams: { visible_team.id.to_s => 1 }
@@ -75,6 +76,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
    result = described_class.new(account: account, user: admin).perform

    expect(result).to eq(
+      all_count: 2,
      inboxes: { visible_inbox.id.to_s => 1, hidden_inbox.id.to_s => 1 },
      labels: { label.id.to_s => 2 },
      teams: { visible_team.id.to_s => 2 }
@@ -87,6 +89,7 @@ RSpec.describe Conversations::UnreadCounts::Counter do
    result = described_class.new(account: account, user: agent).perform

    expect(result).to eq(
+      all_count: 1,
      inboxes: { visible_inbox.id.to_s => 1 },
      labels: {},
      teams: { visible_team.id.to_s => 1 }
@@ -10,8 +10,40 @@ describe Twilio::WebhookSetupService do
  end

  describe '#perform' do
+    context 'with api key authentication' do
+      let(:channel_twilio_sms) do
+        create(
+          :channel_twilio_sms,
+          api_key_sid: 'SK1234567890abcdef',
+          account_sid: 'AC1234567890abcdef',
+          auth_token: 'api-key-token',
+          messaging_service_sid: 'MG1234567890abcdef'
+        )
+      end
+
+      let(:messaging) { instance_double(Twilio::REST::Messaging) }
+      let(:services) { instance_double(Twilio::REST::Messaging::V1::ServiceContext) }
+
+      before do
+        allow(Twilio::REST::Client).to receive(:new).with(
+          'SK1234567890abcdef',
+          'api-key-token',
+          'AC1234567890abcdef'
+        ).and_return(twilio_client)
+        allow(twilio_client).to receive(:messaging).and_return(messaging)
+        allow(messaging).to receive(:services).with(channel_twilio_sms.messaging_service_sid).and_return(services)
+        allow(services).to receive(:update)
+      end
+
+      it 'uses API key credentials to initialize twilio client' do
+        described_class.new(inbox: channel_twilio_sms.inbox).perform
+
+        expect(services).to have_received(:update)
+      end
+    end
+
    context 'with a messaging service sid' do
-      let(:channel_twilio_sms) { create(:channel_twilio_sms) }
+      let(:channel_twilio_sms) { create(:channel_twilio_sms, :whatsapp) }

      let(:messaging) { instance_double(Twilio::REST::Messaging) }
      let(:services) { instance_double(Twilio::REST::Messaging::V1::ServiceContext) }
@@ -20,12 +52,14 @@ describe Twilio::WebhookSetupService do
        allow(twilio_client).to receive(:messaging).and_return(messaging)
        allow(messaging).to receive(:services).with(channel_twilio_sms.messaging_service_sid).and_return(services)
        allow(services).to receive(:update)
+        allow(twilio_client).to receive(:incoming_phone_numbers)
      end

-      it 'updates the messaging service' do
+      it 'updates the messaging service webhook and skips phone number lookup' do
        described_class.new(inbox: channel_twilio_sms.inbox).perform

        expect(services).to have_received(:update)
+        expect(twilio_client).not_to have_received(:incoming_phone_numbers)
      end
    end

@@ -60,6 +94,26 @@ describe Twilio::WebhookSetupService do
          sms_url: twilio_callback_index_url
        )
      end
+
+      it 'strips whatsapp prefix before looking up phone number' do
+        phone_channel = create(
+          :channel_twilio_sms,
+          :with_phone_number,
+          :whatsapp,
+          phone_number: 'whatsapp:+1234567890',
+          messaging_service_sid: nil
+        )
+
+        allow(twilio_client).to receive(:incoming_phone_numbers).and_return(phone_double)
+        allow(phone_double).to receive(:list).and_return([phone_record_double])
+        allow(phone_record_double).to receive(:sid).and_return('1234')
+
+        described_class.new(inbox: phone_channel.inbox).perform
+
+        expect(phone_double).to have_received(:list).with(
+          phone_number: '+1234567890'
+        )
+      end
    end
  end
 end
@@ -36,11 +36,6 @@ describe Whatsapp::EmbeddedSignupService do
        .with(params[:waba_id], params[:phone_number_id], access_token).and_return(phone_service)
      allow(phone_service).to receive(:perform).and_return(phone_info)

-      validation_service = instance_double(Whatsapp::TokenValidationService)
-      allow(Whatsapp::TokenValidationService).to receive(:new)
-        .with(access_token, params[:waba_id]).and_return(validation_service)
-      allow(validation_service).to receive(:perform)
-
      channel_creation = instance_double(Whatsapp::ChannelCreationService)
      allow(Whatsapp::ChannelCreationService).to receive(:new)
        .with(account, { waba_id: params[:waba_id], business_name: 'Test Business' }, phone_info, access_token)
@@ -59,6 +59,41 @@ describe Whatsapp::IncomingMessageWhatsappCloudService do
      end
    end

+    context 'when document attachment includes an accented filename' do
+      let(:document_params) do
+        {
+          phone_number: whatsapp_channel.phone_number,
+          object: 'whatsapp_business_account',
+          entry: [{
+            changes: [{
+              value: {
+                contacts: [{ profile: { name: 'Sojan Jose' }, wa_id: '2423423243' }],
+                messages: [{
+                  from: '2423423243',
+                  document: {
+                    id: 'b1c68f38-8734-4ad3-b4a1-ef0c10d683',
+                    mime_type: 'application/pdf',
+                    filename: 'Currículum café.pdf',
+                    caption: 'My résumé'
+                  },
+                  timestamp: '1664799904', type: 'document'
+                }]
+              }
+            }]
+          }]
+        }.with_indifferent_access
+      end
+
+      it 'preserves the original filename from the payload' do
+        stub_media_url_request
+        stub_sample_png_request
+        described_class.new(inbox: whatsapp_channel.inbox, params: document_params).perform
+
+        attachment = whatsapp_channel.inbox.messages.first.attachments.first
+        expect(attachment.file.filename.to_s).to eq('Currículum café.pdf')
+      end
+    end
+
    context 'when invalid attachment message params' do
      let(:error_params) do
        {
@@ -1,99 +0,0 @@
-require 'rails_helper'
-
-describe Whatsapp::TokenValidationService do
-  let(:access_token) { 'test_access_token' }
-  let(:waba_id) { 'test_waba_id' }
-  let(:service) { described_class.new(access_token, waba_id) }
-  let(:api_client) { instance_double(Whatsapp::FacebookApiClient) }
-
-  before do
-    allow(Whatsapp::FacebookApiClient).to receive(:new).with(access_token).and_return(api_client)
-  end
-
-  describe '#perform' do
-    context 'when token has access to WABA' do
-      let(:debug_response) do
-        {
-          'data' => {
-            'granular_scopes' => [
-              {
-                'scope' => 'whatsapp_business_management',
-                'target_ids' => [waba_id, 'another_waba_id']
-              }
-            ]
-          }
-        }
-      end
-
-      before do
-        allow(api_client).to receive(:debug_token).with(access_token).and_return(debug_response)
-      end
-
-      it 'validates successfully' do
-        expect { service.perform }.not_to raise_error
-      end
-    end
-
-    context 'when token does not have access to WABA' do
-      let(:debug_response) do
-        {
-          'data' => {
-            'granular_scopes' => [
-              {
-                'scope' => 'whatsapp_business_management',
-                'target_ids' => ['different_waba_id']
-              }
-            ]
-          }
-        }
-      end
-
-      before do
-        allow(api_client).to receive(:debug_token).with(access_token).and_return(debug_response)
-      end
-
-      it 'raises an error' do
-        expect { service.perform }.to raise_error(/Token does not have access to WABA/)
-      end
-    end
-
-    context 'when no WABA scope is found' do
-      let(:debug_response) do
-        {
-          'data' => {
-            'granular_scopes' => [
-              {
-                'scope' => 'some_other_scope',
-                'target_ids' => ['some_id']
-              }
-            ]
-          }
-        }
-      end
-
-      before do
-        allow(api_client).to receive(:debug_token).with(access_token).and_return(debug_response)
-      end
-
-      it 'raises an error' do
-        expect { service.perform }.to raise_error('No WABA scope found in token')
-      end
-    end
-
-    context 'when access_token is blank' do
-      let(:access_token) { '' }
-
-      it 'raises ArgumentError' do
-        expect { service.perform }.to raise_error(ArgumentError, 'Access token is required')
-      end
-    end
-
-    context 'when waba_id is blank' do
-      let(:waba_id) { '' }
-
-      it 'raises ArgumentError' do
-        expect { service.perform }.to raise_error(ArgumentError, 'WABA ID is required')
-      end
-    end
-  end
-end
@@ -1 +1 @@
 .14.1
 .14.2