@rubytech/create-maxy-code 0.1.0

package/payload/platform/plugins/admin/skills/unzip-attachment/__tests__/preflight.sh

@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# Regression suite for the single-pass pre-flight prescribed by SKILL.md step 2.
+# Each test builds a fixture zip, runs the exact awk one-liners from SKILL.md
+# against `unzip -Z` output, and asserts the expected gate fires.
+#
+# Run from anywhere: `bash platform/plugins/admin/skills/unzip-attachment/__tests__/preflight.sh`
+# Exits 0 if all assertions pass, non-zero on the first failure.
+
+set -uo pipefail
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+PASS=0
+FAIL=0
+fail() { echo "FAIL: $1"; FAIL=$((FAIL+1)); }
+pass() { echo "PASS: $1"; PASS=$((PASS+1)); }
+
+# --- The four awk gates from SKILL.md step 2 -----------------------------------
+# Each takes `unzip -Z $zip` on stdin and exits 0 if the gate FIRES (attack
+# detected), non-zero if the zip is clean for that gate.
+
+detect_symlink()   { awk 'NR>2 && $1 ~ /^l/ { found=1; print $0 } END { exit !found }'; }
+detect_encrypted() { awk 'NR>2 && $5 ~ /^[TB]/ { found=1; print $0 } END { exit !found }'; }
+detect_slip()      { awk 'NR>2 && $1 ~ /^[-lrwxd?]/ { for (i=9; i<=NF; i++) if ($i ~ /^\.\.\//) { found=1; print $i } } END { exit !found }'; }
+sum_uncompressed() { awk 'NR>2 && $1 ~ /^[-lrwxd?]/ { s += $4 } END { print s+0 }'; }
+extract_names()    { awk 'NR>2 && $1 ~ /^[-lrwxd?]/ { for (i=9; i<=NF; i++) printf "%s%s", $i, (i<NF?" ":"\n") }'; }
+
+LIMIT=$((100 * 1024 * 1024))
+
+# --- (a) Password-protected archive refused ----------------------------------
+cd "$WORK"
+echo "secret" > a-secret.txt
+zip -e -P testpass a-pw.zip a-secret.txt >/dev/null 2>&1
+if unzip -Z a-pw.zip 2>/dev/null | detect_encrypted >/dev/null; then
+  pass "(a) password — col-5 uppercase first letter detected"
+else
+  fail "(a) password — col-5 uppercase first letter NOT detected"
+fi
+
+# --- (b) Symlink entry refused -----------------------------------------------
+cd "$WORK"
+ln -s /etc/passwd b-link
+echo "ok" > b-ok.txt
+zip -y b-sym.zip b-link b-ok.txt >/dev/null 2>&1
+if unzip -Z b-sym.zip 2>/dev/null | detect_symlink >/dev/null; then
+  pass "(b) symlink — col-1 leading 'l' detected"
+else
+  fail "(b) symlink — col-1 leading 'l' NOT detected"
+fi
+
+# --- (c) Zip-slip entry refused by pre-scan ---------------------------------
+# The PRE-scan must detect `../`-prefixed entry names in `unzip -Z` column 9+
+# BEFORE extraction runs. macOS unzip silently sanitises these paths during
+# extraction (the file lands inside dest with `../` stripped), so the
+# post-extraction realpath check is a defense-in-depth backstop for unzip
+# versions that don't sanitise — not the primary gate.
+# zip(1) refuses `..` paths, so python forges the central-directory entry.
+cd "$WORK"
+python3 - <<'PY' >/dev/null 2>&1
+import zipfile
+with zipfile.ZipFile("c-slip.zip", "w") as z:
+    z.writestr("../../escapee.txt", "evil payload")
+    z.writestr("good.txt", "ok")
+PY
+if unzip -Z c-slip.zip 2>/dev/null | detect_slip >/dev/null; then
+  pass "(c) zip-slip — pre-scan caught '../' in entry name"
+else
+  fail "(c) zip-slip — pre-scan missed '../' in entry name"
+fi
+
+# --- (d) Oversize archive refused (declared > 100 MiB) -----------------------
+# Building a 100 MiB+ fixture is expensive on disk and CI. Instead, simulate
+# the awk gate against a synthetic `unzip -Z`-shaped fixture whose column-4
+# sum exceeds the limit. This tests the *gate logic*, not unzip itself.
+cd "$WORK"
+cat > d-zfake.txt <<'FAKE'
+Archive:  d-big.zip
+Zip file size: 999 bytes, number of entries: 2
+-rw-r--r--  3.0 unx 60000000 tx stor 26-May-10 21:08 big1.bin
+-rw-r--r--  3.0 unx 60000000 tx stor 26-May-10 21:08 big2.bin
+2 files, 120000000 bytes uncompressed, 999 bytes compressed:  0.0%
+FAKE
+SUM=$(sum_uncompressed < d-zfake.txt)
+if [ "$SUM" -gt "$LIMIT" ]; then
+  pass "(d) oversize — sum=$SUM > limit=$LIMIT detected"
+else
+  fail "(d) oversize — sum=$SUM did not exceed limit=$LIMIT (gate broken)"
+fi
+
+# --- (e) Clean zip = exactly 1 pre-flight + 1 extraction ---------------------
+cd "$WORK"
+mkdir e-stage && cd e-stage
+echo "alpha" > a.txt
+mkdir sub && echo "beta" > sub/b.txt
+zip -r ../e-clean.zip a.txt sub >/dev/null 2>&1
+cd "$WORK"
+
+# Wrap unzip in a tracer that increments a counter file per invocation, scoped
+# by the flag combination so we can count pre-flight vs extraction calls.
+TRACE_DIR=$(mktemp -d)
+mkdir -p "$TRACE_DIR/bin"
+cat > "$TRACE_DIR/bin/unzip" <<TRACE
+#!/usr/bin/env bash
+# Classify the call: -Z* = pre-flight (zipinfo mode), -o* = extraction.
+case "\$1" in
+  -Z*) echo "Z" >> "$TRACE_DIR/calls" ;;
+  -o*) echo "O" >> "$TRACE_DIR/calls" ;;
+  -t*) echo "T" >> "$TRACE_DIR/calls" ;;
+  *)   echo "?" >> "$TRACE_DIR/calls" ;;
+esac
+exec /usr/bin/unzip "\$@"
+TRACE
+chmod +x "$TRACE_DIR/bin/unzip"
+: > "$TRACE_DIR/calls"
+
+# Run the prescribed clean-path: 1 `unzip -Z` + 1 `unzip -oq`.
+mkdir e-dest
+PATH="$TRACE_DIR/bin:/usr/bin:/bin" unzip -Z e-clean.zip >/dev/null 2>&1
+PATH="$TRACE_DIR/bin:/usr/bin:/bin" unzip -oq e-clean.zip -d e-dest >/dev/null 2>&1
+
+Z_COUNT=$(grep -c '^Z$' "$TRACE_DIR/calls" || true)
+O_COUNT=$(grep -c '^O$' "$TRACE_DIR/calls" || true)
+T_COUNT=$(grep -c '^T$' "$TRACE_DIR/calls" || true)
+
+if [ "$Z_COUNT" = "1" ] && [ "$O_COUNT" = "1" ] && [ "$T_COUNT" = "0" ]; then
+  pass "(e) clean — exactly 1 pre-flight + 1 extraction (Z=$Z_COUNT O=$O_COUNT T=$T_COUNT)"
+else
+  fail "(e) clean — wrong invocation count Z=$Z_COUNT O=$O_COUNT T=$T_COUNT"
+fi
+
+# --- (f) Filenames with spaces survive name extraction -----------------------
+cd "$WORK"
+mkdir f-stage && cd f-stage
+echo "hello" > "hello world.txt"
+zip ../f-space.zip "hello world.txt" >/dev/null 2>&1
+cd "$WORK"
+NAMES=$(unzip -Z f-space.zip 2>/dev/null | extract_names)
+if [ "$NAMES" = "hello world.txt" ]; then
+  pass "(f) whitespace name — extracted intact: '$NAMES'"
+else
+  fail "(f) whitespace name — corrupted: got '$NAMES' want 'hello world.txt'"
+fi
+
+# --- Summary -----------------------------------------------------------------
+echo
+echo "RESULT: $PASS passed, $FAIL failed"
+exit "$FAIL"

package/payload/platform/plugins/admin/skills/unzip-attachment/references/safety.md

@@ -0,0 +1,116 @@
+# Zip extraction safety reference
+
+This file is the authoritative source for the exact shell commands, attack examples, and refusal messages referenced by [SKILL.md](../SKILL.md). Changes here propagate to every extraction — the skill file inlines the pre-flight bash block; this reference explains *why* each gate is shaped the way it is.
+
+## The single-pass pre-flight
+
+One `unzip -Z "$zip"` call produces the zipinfo column listing. Every attack-class gate reads the same output:
+
+```
+Archive:  example.zip
+Zip file size: 317 bytes, number of entries: 2
+-rw-r--r--  3.0 unx        6 tx stor 26-May-10 21:08 foo.txt
+lrwxr-xr-x  3.0 unx       11 bx stor 26-May-10 21:08 link
+2 files, 17 bytes uncompressed, 17 bytes compressed:  0.0%
+```
+
+Columns: `$1=permissions $2=zip-version $3=os $4=size-bytes $5=text/binary+crypto-flag $6=method $7=date $8=time $9+=name`. Each gate keys off one column; no second `unzip` invocation is needed.
+
+## Attack classes
+
+### 1. Zip slip (path traversal via entry name)
+
+A malicious archive contains an entry whose name starts with `../` (or uses Windows `..\` on some unzip builds). A naive extractor writing relative paths without validation lands the file *outside* the intended destination.
+
+Example listing (`unzip -Z`):
+```
+?rw-------  2.0 unx        4 b- stor 26-May-11 06:31 ../../escapee.txt
+?rw-------  2.0 unx        2 b- stor 26-May-11 06:31 good.txt
+```
+
+Pre-scan detection (one awk pass over column 9+):
+```awk
+NR>2 && $1 ~ /^[-lrwxd?]/ { for (i=9; i<=NF; i++) if ($i ~ /^\.\.\//) { print "blocked: " $i; exit } }
+```
+
+Ground-truth backstop: after extraction, for every path under `$dest`, compute `realpath --relative-to "$dest" "<entry>"`. If the relative path begins with `../`, the entry escaped. On macOS InfoZIP 6.00 the extractor silently sanitises `../` prefixes (the file lands inside `$dest` with the prefix stripped), so the realpath check is a no-op in that case — but it still catches the attack on `unzip` builds that don't sanitise. Defense in depth: pre-scan refuses the obvious case, realpath catches the version-specific escape.
+
+Refusal line: `[skill:unzip] zip-slip-blocked attachmentId=<uuid> entry=<path>`.
+
+Refusal message to the operator:
+
+> I rejected this archive because one of its entries tried to write outside the extraction directory (zip-slip attack). Entry: `<path>`. No files were kept.
+
+### 2. Symlink escape
+
+A malicious archive contains a symlink entry — for example, a zero-byte file with permission `lrwxrwxrwx` pointing at `/etc/passwd`. If the extractor materialises it, subsequent operations that follow the symlink read or overwrite the target.
+
+Pre-scan detection (same `unzip -Z` output, column 1):
+```awk
+NR>2 && $1 ~ /^l/ { print "blocked: " $9; exit }
+```
+First field beginning with `l` is the POSIX symlink flag in the permission column.
+
+Ground-truth backstop:
+```sh
+find "$dest" -mindepth 1 -type l
+```
+Any hit here → refuse even if the pre-scan missed it (defense in depth against `unzip` versions that normalise symlink entries into regular files with `..` payloads, flipping the attack class).
+
+Refusal line: `[skill:unzip] symlink-blocked attachmentId=<uuid> entry=<path>`.
+
+### 3. Decompression bomb
+
+A 42 KB archive expands to 4.5 GB — the classic `42.zip`. Not filesystem-escape but resource exhaustion: fills the account disk, causes OOM on downstream processing.
+
+Pre-scan gate (sum column 4 over the same `unzip -Z` output):
+```awk
+NR>2 && $1 ~ /^[-lrwxd?]/ { s += $4 } END { if (s > 100*1024*1024) print "oversize: " s }
+```
+Column 4 is the uncompressed size in bytes per entry. If the running sum exceeds `MAX_ZIP_UNCOMPRESSED_BYTES` (100 MiB, defined in `attachments.ts`), refuse *before* calling `unzip -oq`.
+
+Refusal line: `[skill:unzip] oversize attachmentId=<uuid> uncompressed=<bytes> limit=104857600`.
+
+Note: a hostile archive can lie in its declared sizes. The post-extraction realpath loop runs regardless; if the extraction step itself exhausts disk, `unzip -oq` exits non-zero and the skill refuses with the underlying stderr.
+
+### 4. Password-protected archive
+
+Refused without prompting. The signal is **not** the exit code — `unzip -Z` exits 0 on password-protected archives because the central directory itself is unencrypted; only entry payloads are. The signal is column 5: a leading uppercase `T` (encrypted text) or `B` (encrypted binary). Lowercase `t`/`b` = unencrypted.
+
+Pre-scan detection:
+```awk
+NR>2 && $5 ~ /^[TB]/ { print "password"; exit }
+```
+
+Refusal line: `[skill:unzip] unreadable attachmentId=<uuid> reason=password`.
+
+Refusal message:
+
+> This archive is password-protected. Please extract it locally and upload the individual files you want me to look at.
+
+A genuinely corrupt zip (no central directory) makes `unzip -Z` exit non-zero (typically 9). That is the only exit-code-driven branch: non-zero → `[skill:unzip] unreadable attachmentId=<uuid> reason=corrupt`.
+
+## Canonical commands
+
+| Purpose | Command |
+|---------|---------|
+| Single-pass pre-flight (listing + permissions + sizes + crypto flag) | `unzip -Z "$zip"` |
+| Extract | `unzip -oq "$zip" -d "$dest"` |
+| Post-extraction symlink backstop | `find "$dest" -mindepth 1 -type l` |
+| Per-entry zip-slip backstop | `realpath --relative-to "$dest" "<entry>"` → must not start with `../` |
+
+All of these are from `unzip` (InfoZIP) + `coreutils` — installed on every Pi image by the installer. No additional dependency.
+
+## Why one pass
+
+Each `Bash` tool_use is one agent turn. `effortToMaxTurns("low") = 5` ([platform/ui/app/lib/claude-agent/budget.ts:175](../../../../ui/app/lib/claude-agent/budget.ts#L175)). The previous flow used three separate `unzip -Z` invocations (entry list, verbose-for-symlink, totals) plus the extraction — four bash calls inside the skill alone, before counting the surrounding specialist dispatch and `plugin-read` calls. At `effort=low` the floor was six turns; one upload exhausted the budget and tripped `error_max_turns`. The fix is structural: every signal the four gates need is already in `unzip -Z`'s column output, so the three pre-flight calls collapse to one.
+
+The observability anchor is `preflightPasses=1` on the `[skill:unzip] start` log line. Absence after a clean upload means either the skill did not activate or the flow regressed back to multiple passes — both regressions are caught by `grep '[skill:unzip] start' server.log | grep -v preflightPasses=1`.
+
+## Why this is a skill, not a tool
+
+Doctrine: the admin agent has `Bash`; the security-critical code path is a sequence of shell commands whose determinism is enforced by the shell primitives themselves, not by LLM reasoning. Wrapping this in an MCP tool would add a translation layer without adding enforcement — a tool wrapper is still LLM-mediated at the decision boundary. The shell script is the deterministic primitive; the skill tells the agent which primitive to invoke, in which order, against which argument.
+
+## Regression suite
+
+[`__tests__/preflight.sh`](../__tests__/preflight.sh) is the executable specification of the four pre-flight gates. Run it after any change to this file or `SKILL.md`. It builds fixtures for each attack class, pipes `unzip -Z` output through the same awk gates inlined in `SKILL.md` step 2, and asserts each gate fires (or stays silent) on the right input. The clean-zip case also traces `unzip` invocations to assert exactly 1 pre-flight + 1 extraction — the structural invariant `preflightPasses=1` is built on.

package/payload/platform/plugins/admin/skills/update-knowledge/SKILL.md

@@ -0,0 +1,47 @@
+# Update Knowledge
+
+Refresh a public agent's KNOWLEDGE.md from the current graph, scoped to that agent's knowledge configuration.
+
+## When to Use
+
+The admin asks to update, refresh, or regenerate a public agent's knowledge. Examples: "update the knowledge for the sales agent", "refresh the advisor's KNOWLEDGE.md", "rebuild knowledge for all public agents".
+
+## Knowledge Scope
+
+Each public agent's knowledge comes from two complementary sources, both configured in the agent's `config.json`:
+
+**Direct tags** — graph nodes with the agent's slug in their `agents` array.
+
+**Keyword subscriptions** — the agent's `knowledgeKeywords` array. Nodes matching these keywords are included regardless of whether they are directly tagged.
+
+The union of both result sets (deduplicated) forms the agent's knowledge scope.
+
+## Admin vs Runtime Search
+
+This skill runs at admin time, not at runtime. All `memory-search` queries must use admin permissions — do NOT pass `agentSlug` as a parameter. The `agentSlug` parameter applies runtime enforcement logic (restricts graph traversal to tagged nodes only), which is appropriate for the public agent's MCP server but not for admin-time knowledge discovery.
+
+To find directly-tagged nodes: search with the agent's role or topic as the query term (no `agentSlug`), then identify results where the `agents` property contains the target slug.
+
+To find keyword matches: search with each keyword as the query term (no `agentSlug`). Keyword subscriptions exist to capture content beyond the directly-tagged set.
+
+## Constraints
+
+- If the agent has neither direct tags nor keyword subscriptions configured, there is nothing to refresh. Inform the admin: "This agent has no knowledge scope configured. Tag nodes for the agent or add keyword subscriptions in config.json first."
+- If all queries return empty results, do NOT write an empty KNOWLEDGE.md. Warn the admin: "No matching content found for this agent's knowledge scope. KNOWLEDGE.md was not modified." Preserve any existing KNOWLEDGE.md.
+- After writing KNOWLEDGE.md, check the context budget. If the total system prompt (IDENTITY.md + SOUL.md + plugins + KNOWLEDGE.md) exceeds 50% of the model's context window, auto-generate KNOWLEDGE-SUMMARY.md and present it via `document-editor` with `filePath: "agents/{slug}/KNOWLEDGE-SUMMARY.md"` for review.
+- Present the generated KNOWLEDGE.md via `document-editor` with `filePath: "agents/{slug}/KNOWLEDGE.md"` for admin review before finalising.
+- Log the refresh: write a note at the top of KNOWLEDGE.md with the refresh timestamp.
+
+## Querying
+
+Run `memory-search` multiple times with targeted queries to build comprehensive coverage. Do not pass `agentSlug` on any query — all searches use admin permissions.
+
+1. Search with the agent's role or topic as the query term. In the results, identify nodes whose `agents` property contains the target agent's slug — these are the directly-tagged nodes.
+2. For each keyword in the agent's `knowledgeKeywords`, search with that keyword as the query term. These capture content by topic regardless of tagging.
+3. Merge all results, deduplicate by node content, and organise under clear markdown headings by topic.
+
+Categories to cover (where relevant to the agent's role): services, pricing, FAQs, team, policies, products, location/hours, contact info. Skip categories where no matching content exists.
+
+## Bulk Refresh
+
+When asked to refresh all agents, iterate over each public agent directory under `agents/`, read its `config.json`, and run the refresh for each. Present a summary of results.

package/payload/platform/plugins/anthropic/PLUGIN.md

@@ -0,0 +1,40 @@
+---
+name: anthropic
+description: Guide users through obtaining an Anthropic API key to power the public agent.
+---
+
+# Anthropic / Claude Setup
+
+The public agent runs on the Anthropic API. This plugin handles obtaining, storing, and verifying an API key from the Anthropic Console (platform.claude.com).
+
+## When to activate
+
+- Prerequisites check detects missing Anthropic API key (via `api-key-verify` tool)
+- User asks how to connect Claude, get an Anthropic key, or set up their AI
+- BOOTSTRAP detects no working Anthropic API connection
+- User sees an API authentication error
+- User wants to rotate or replace their API key
+
+## What it unlocks
+
+- Claude as the AI model powering the public agent — conversations, reasoning, and tool use
+- Pay-per-use via Anthropic API key
+
+## Shared module
+
+API key management is centralised in `platform/lib/anthropic-key/` — all consumers (claude-agent.ts, admin MCP, email scripts, health route) import `readKey()`, `writeKey()`, `hasKey()`, and `validateKey()` from this module instead of inlining the env-var-then-file lookup pattern.
+
+## Skills
+
+| Task | When to use | Skill |
+|------|-------------|-------|
+| Obtain API key | `api-key-verify` returns `missing` or user wants to rotate key | `skills/get-api-key/SKILL.md` |
+
+## References
+
+| Topic | When to use | Reference |
+|-------|-------------|-----------|
+| Troubleshooting & FAQ | API key rejected, billing questions, manual key entry | `references/setup-guide.md` |
+| Console API surface | Understanding the endpoints used by the get-api-key skill | `references/console-api.md` |
+
+For API key acquisition (including during onboarding), use the `skills/get-api-key/SKILL.md` skill. For troubleshooting and common questions, load the reference.

package/payload/platform/plugins/anthropic/references/console-api.md

@@ -0,0 +1,186 @@
+# Anthropic Console — Internal API Reference
+
+Captured 2026-04-07 from `platform.claude.com` (formerly `console.anthropic.com`).
+
+These are undocumented internal endpoints used by the Console's React frontend. They are not part of Anthropic's public API and may change without notice.
+
+## Authentication
+
+Cookie-based via `sessionKey` cookie:
+- Domain: `.platform.claude.com`
+- Flags: `httpOnly`, `secure`, `SameSite=Lax`
+- Expiry: 7 days from sign-in
+
+The cookie is set during the OAuth sign-in flow (Google or email verification). Because it is `httpOnly`, it cannot be read by JavaScript — but `fetch()` with `credentials: 'include'` sends it automatically.
+
+Common request headers (set by the Console frontend, not required for API auth):
+- `content-type: application/json`
+- `anthropic-client-platform: web_console`
+
+## Org Discovery
+
+The Console is org-scoped. All billing and key management endpoints require an org UUID. A user may have multiple orgs (e.g., a consumer chat org and an API org).
+
+### GET /api/organizations
+
+Returns all orgs the user belongs to.
+
+```json
+[
+  {
+    "id": 55730262,
+    "uuid": "1882f41b-...",
+    "name": "Neo's Individual Org",
+    "billing_type": "prepaid",
+    "capabilities": ["api", "api_individual"],
+    "created_at": "2025-06-28T06:40:26.071676Z"
+  }
+]
+```
+
+**Selecting the API org:** Filter for the org whose `capabilities` array contains `"api"`. Consumer orgs have `capabilities: ["claude_max", "chat"]` and no API key management.
+
+### GET /api/bootstrap
+
+Returns current user account info and org memberships. Useful for getting the user's name and email.
+
+```json
+{
+  "account": {
+    "tagged_id": "user_01YW5...",
+    "uuid": "ff1a722d-...",
+    "email_address": "user@example.com",
+    "full_name": "Neo Aeon",
+    "memberships": [
+      { "organization": { "uuid": "...", "name": "..." }, "role": "admin" }
+    ]
+  }
+}
+```
+
+## Billing Endpoints
+
+All GET, org-scoped. Replace `{orgId}` with the org UUID.
+
+### GET /api/organizations/{orgId}/prepaid/credits
+
+Credit balance.
+
+```json
+{
+  "amount": 504,
+  "currency": "USD",
+  "auto_reload_settings": {
+    "enabled": true,
+    "threshold_in_minor_units": 500,
+    "reload_to_in_minor_units": 1500
+  },
+  "pending_invoice_amount_cents": null
+}
+```
+
+`amount` is in **cents** (minor currency units). 504 = $5.04.
+
+### GET /api/organizations/{orgId}/current_spend
+
+Current billing period spend.
+
+```json
+{
+  "amount": 39,
+  "resets_at": "2026-05-01T00:00:00Z"
+}
+```
+
+`amount` is in **cents**. 39 = $0.39.
+
+### GET /api/organizations/{orgId}/prepaid/auto_recharge
+
+Auto-recharge configuration.
+
+```json
+{
+  "status": "active",
+  "stripe_error_code": null,
+  "target_amount": 1500,
+  "threshold_amount": 500
+}
+```
+
+Amounts in **cents**.
+
+### GET /api/organizations/{orgId}/payment_method
+
+Payment method on file.
+
+```json
+{
+  "brand": null,
+  "country": null,
+  "last4": null,
+  "type": "link"
+}
+```
+
+## API Key Endpoints
+
+### GET /api/console/organizations/{orgId}/api_keys
+
+List all API keys for the org.
+
+```json
+[
+  {
+    "id": "apikey_01XY5wjo397BKKLjHNgvHATx",
+    "type": "api_key",
+    "name": "maxy",
+    "workspace_id": null,
+    "created_at": "2026-03-22T19:08:25.868735Z",
+    "created_by": { "id": "user_01YW5...", "type": "user" },
+    "partial_key_hint": "sk-ant-api03-kNh...HAAA",
+    "status": "active",
+    "expires_at": null
+  }
+]
+```
+
+`status` values: `"active"`, `"inactive"` (disabled), `"archived"` (deleted).
+
+### POST /api/console/organizations/{orgId}/workspaces/default/api_keys
+
+Create a new API key. The `raw_key` is only returned once at creation time.
+
+**Request:**
+```json
+{ "name": "Maxy" }
+```
+
+**Response (200):**
+```json
+{
+  "id": "apikey_01Hkz...",
+  "type": "api_key",
+  "name": "Maxy",
+  "workspace_id": null,
+  "created_at": "2026-04-07T11:05:39.949811Z",
+  "created_by": { "id": "user_01YW5...", "type": "user" },
+  "partial_key_hint": "sk-ant-api03-cPs...1AAA",
+  "status": "active",
+  "expires_at": null,
+  "raw_key": "sk-ant-api03-cPsiih...ewev1AAA"
+}
+```
+
+### POST /api/console/organizations/{orgId}/workspaces/default/api_keys/{keyId}
+
+Update key status.
+
+**Disable:**
+```json
+{ "status": "inactive" }
+```
+
+**Archive (delete):**
+```json
+{ "status": "archived" }
+```

package/payload/platform/plugins/anthropic/references/setup-guide.md

@@ -0,0 +1,36 @@
+# Anthropic / Claude — Setup Guide
+
+Reference for API key troubleshooting, manual key entry, and common questions. For the automated browser-guided flow, use the `skills/get-api-key/SKILL.md` skill instead of this reference.
+
+---
+
+## Manual key entry
+
+If the automated browser flow is unavailable or the user already has a key:
+
+1. Verify format: starts with `sk-ant-`, at least 90 characters
+2. Store via `api-key-store` tool: `api-key-store({ apiKey: "<the key>" })`
+3. Confirm: "API key stored. Takes effect immediately."
+
+---
+
+## Troubleshooting
+
+| Problem | Solution |
+|---------|----------|
+| API key rejected | Verify it starts with `sk-ant-`. Check that billing is set up on platform.claude.com — keys don't work without an active billing method. |
+| Key created on zero-balance account | Keys created before credits are loaded are permanently rejected. Create a new key after adding credits. |
+| "Which provider should I pick?" | Anthropic / Claude is the right choice. It powers all of the public agent's conversations and reasoning. |
+| Browser automation failed | Tell the user to get a key from platform.claude.com/settings/keys in their own browser, then paste it in the chat. |
+
+---
+
+## Common questions
+
+| Question | Answer |
+|----------|--------|
+| "Why do I need to sign in again?" | Anthropic runs two separate services: Claude (claude.ai) for the product, and the Console (platform.claude.com) for the API. They share the same credentials — same email, password, or Google account — but they have independent sessions and independent billing. The sign-in you did earlier authenticated you with Claude; this step authenticates you with the Console so we can create an API key. You can have one without the other, but there is no issue using the same account for both. |
+| "How much does the API cost?" | Anthropic charges per API call. For small business use, typical costs are a few dollars per month. See anthropic.com/pricing for current rates. |
+| "Do I need to restart after adding a key?" | No — the API key is applied immediately. |
+| "Can I rotate my key?" | Yes — run the `get-api-key` skill again or paste a new key. The old key is overwritten. |
+| "What if my key stops working?" | Check that billing is still active on platform.claude.com. If the account ran out of credits, add more and the existing key should resume working (unless it was created on a zero-balance account). |