@rubytech/create-maxy-code 0.1.0

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@rubytech/create-maxy-code",
+  "version": "0.1.0",
+  "description": "Install Maxy — AI for Productive People",
+  "bin": {
+    "create-maxy-code": "./dist/index.js"
+  },
+  "type": "module",
+  "scripts": {
+    "build": "tsc",
+    "bundle": "node scripts/bundle.js",
+    "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+  },
+  "files": [
+    "dist",
+    "payload"
+  ],
+  "keywords": [
+    "maxy",
+    "ai",
+    "assistant",
+    "raspberry-pi",
+    "claude"
+  ],
+  "author": "Rubytech LLC",
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.3"
+  }
+}

package/payload/platform/config/brand-registry.json

@@ -0,0 +1,20 @@
+{
+  "brands": [
+    {
+      "hostname": "maxy",
+      "configDir": ".maxy",
+      "vncDisplay": 99,
+      "rfbPort": 5900,
+      "websockifyPort": 6080,
+      "cdpPort": 9222
+    },
+    {
+      "hostname": "realagent",
+      "configDir": ".realagent",
+      "vncDisplay": 100,
+      "rfbPort": 5901,
+      "websockifyPort": 6081,
+      "cdpPort": 9223
+    }
+  ]
+}

package/payload/platform/config/brand.json

@@ -0,0 +1,54 @@
+{
+  "productName": "Maxy",
+  "hostname": "maxy",
+  "serviceName": "maxy.service",
+  "installDir": "maxy",
+  "configDir": ".maxy",
+  "tagline": "AI for Productive People",
+  "strapline": "Convenience as standard.",
+  "domain": "getmaxy.com",
+  "neo4jPort": 7687,
+  "ttydPort": 7681,
+  "vncDisplay": 99,
+  "rfbPort": 5900,
+  "websockifyPort": 6080,
+  "cdpPort": 9222,
+  "claudeSessionManagerPort": 19400,
+  "commercialMode": false,
+
+  "defaultColors": {
+    "primary": "#7C8C72",
+    "primaryHover": "#6A7A62",
+    "primarySubtle": "rgba(124, 140, 114, 0.08)",
+    "primaryGlow": "rgba(124, 140, 114, 0.15)",
+    "accent": "#E8ECF0",
+    "background": "#FAFAF8",
+    "agentBubble": "#F5F2ED"
+  },
+
+  "defaultFonts": {
+    "display": "'Cormorant', Georgia, serif",
+    "body": "'DM Sans', -apple-system, BlinkMacSystemFont, sans-serif"
+  },
+
+  "logoContainsName": true,
+
+  "assets": {
+    "logo": "maxy-square.png",
+    "icon": "maxy-monochrome.png",
+    "favicon": "favicon.ico"
+  },
+
+  "npm": {
+    "packageName": "@rubytech/create-maxy-code",
+    "binName": "create-maxy-code",
+    "author": "Rubytech LLC"
+  },
+
+  "plugins": {
+    "core": ["admin", "memory", "docs", "cloudflare", "anthropic", "workflows", "tasks", "scheduling", "email", "contacts", "projects"],
+    "defaultEnabled": ["business-assistant", "sales"],
+    "available": ["telegram", "waitlist", "deep-research", "whatsapp", "replicate", "linkedin-import"],
+    "excluded": []
+  }
+}

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=enumerate.test.d.ts.map

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/enumerate.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.js

@@ -0,0 +1,88 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const index_js_1 = require("../index.js");
+function makeFixture() {
+    const root = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), "acct-enum-"));
+    // (a) non-UUID dir → excluded.
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "not-a-uuid"));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "not-a-uuid", "account.json"), "{}");
+    // (b) UUID dir, no account.json → excluded.
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "11111111-2222-3333-4444-555555555555"));
+    // (c) UUID dir, unparseable account.json → excluded (over-prune doctrine).
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "account.json"), "{ broken json");
+    // (d) UUID dir, parseable account.json → included.
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, "12345678-9abc-def0-1234-56789abcdef0"));
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, "12345678-9abc-def0-1234-56789abcdef0", "account.json"), JSON.stringify({ id: "12345678-9abc-def0-1234-56789abcdef0" }));
+    return root;
+}
+(0, node_test_1.default)("enumerateValidAccountIds returns only UUID dirs with parseable account.json", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        const result = (0, index_js_1.enumerateValidAccountIds)(root);
+        strict_1.default.deepEqual(result, ["12345678-9abc-def0-1234-56789abcdef0"]);
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("enumerateValidAccountIds returns [] when accountsDir does not exist", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const ghost = (0, node_path_1.join)((0, node_os_1.tmpdir)(), "acct-enum-does-not-exist-" + Date.now());
+    strict_1.default.deepEqual((0, index_js_1.enumerateValidAccountIds)(ghost), []);
+});
+(0, node_test_1.default)("enumerateValidAccountIds caches per accountsDir; reset re-reads", () => {
+    (0, index_js_1._resetEnumerationCache)();
+    const root = makeFixture();
+    try {
+        const first = (0, index_js_1.enumerateValidAccountIds)(root);
+        // Add a second valid dir AFTER first call; cached call must NOT see it.
+        const newId = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+        (0, node_fs_1.mkdirSync)((0, node_path_1.join)(root, newId));
+        (0, node_fs_1.writeFileSync)((0, node_path_1.join)(root, newId, "account.json"), "{}");
+        const cached = (0, index_js_1.enumerateValidAccountIds)(root);
+        strict_1.default.deepEqual(cached, first, "cache should hide the newly-added dir");
+        (0, index_js_1._resetEnumerationCache)();
+        const fresh = (0, index_js_1.enumerateValidAccountIds)(root);
+        strict_1.default.equal(fresh.length, 2);
+        strict_1.default.ok(fresh.includes(newId));
+    }
+    finally {
+        (0, node_fs_1.rmSync)(root, { recursive: true });
+    }
+});
+(0, node_test_1.default)("getAccountsDirFromEnv throws when MAXY_PLATFORM_ROOT is unset", () => {
+    const saved = process.env.MAXY_PLATFORM_ROOT;
+    delete process.env.MAXY_PLATFORM_ROOT;
+    try {
+        strict_1.default.throws(() => (0, index_js_1.getAccountsDirFromEnv)(), /MAXY_PLATFORM_ROOT not set/);
+    }
+    finally {
+        if (saved !== undefined)
+            process.env.MAXY_PLATFORM_ROOT = saved;
+    }
+});
+(0, node_test_1.default)("getAccountsDirFromEnv resolves to ${root}/../data/accounts when set", () => {
+    const saved = process.env.MAXY_PLATFORM_ROOT;
+    process.env.MAXY_PLATFORM_ROOT = "/tmp/fake-root/platform";
+    try {
+        const result = (0, index_js_1.getAccountsDirFromEnv)();
+        strict_1.default.equal(result, (0, node_path_1.resolve)("/tmp/fake-root/platform", "..", "data/accounts"));
+    }
+    finally {
+        if (saved !== undefined)
+            process.env.MAXY_PLATFORM_ROOT = saved;
+        else
+            delete process.env.MAXY_PLATFORM_ROOT;
+    }
+});
+//# sourceMappingURL=enumerate.test.js.map

package/payload/platform/lib/account-enumeration/dist/__tests__/enumerate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate.test.js","sourceRoot":"","sources":["../../src/__tests__/enumerate.test.ts"],"names":[],"mappings":";;;;;AAAA,0DAA6B;AAC7B,gEAAwC;AACxC,qCAAwE;AACxE,qCAAiC;AACjC,yCAA0C;AAC1C,0CAIqB;AAErB,SAAS,WAAW;IAClB,MAAM,IAAI,GAAG,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IACvD,+BAA+B;IAC/B,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACpC,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC9D,4CAA4C;IAC5C,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;IAC9D,IAAA,uBAAa,EACX,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,EAAE,cAAc,CAAC,EAClE,eAAe,CAChB,CAAC;IACF,mDAAmD;IACnD,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,CAAC,CAAC,CAAC;IAC9D,IAAA,uBAAa,EACX,IAAA,gBAAI,EAAC,IAAI,EAAE,sCAAsC,EAAE,cAAc,CAAC,EAClE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,sCAAsC,EAAE,CAAC,CAC/D,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAA,mBAAI,EAAC,6EAA6E,EAAE,GAAG,EAAE;IACvF,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC9C,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,sCAAsC,CAAC,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,KAAK,GAAG,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,2BAA2B,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACvE,gBAAM,CAAC,SAAS,CAAC,IAAA,mCAAwB,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,IAAA,iCAAsB,GAAE,CAAC;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC7C,wEAAwE;QACxE,MAAM,KAAK,GAAG,sCAAsC,CAAC;QACrD,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC9C,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,uCAAuC,CAAC,CAAC;QACzE,IAAA,iCAAsB,GAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAA,mCAAwB,EAAC,IAAI,CAAC,CAAC;QAC7C,gBAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9B,gBAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,IAAA,gBAAM,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IACtC,IAAI,CAAC;QACH,gBAAM,CAAC,MAAM,CACX,GAAG,EAAE,CAAC,IAAA,gCAAqB,GAAE,EAC7B,4BAA4B,CAC7B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC;IAClE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,qEAAqE,EAAE,GAAG,EAAE;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,yBAAyB,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,gCAAqB,GAAE,CAAC;QACvC,gBAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAA,mBAAO,EAAC,yBAAyB,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAClF,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,KAAK,CAAC;;YAC3D,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC7C,CAAC;AACH,CAAC,CAAC,CAAC"}

package/payload/platform/lib/account-enumeration/dist/__tests__/validate-env.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validate-env.test.d.ts.map

package/payload/platform/lib/account-enumeration/dist/__tests__/validate-env.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-env.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/validate-env.test.ts"],"names":[],"mappings":""}

package/payload/platform/lib/account-enumeration/dist/__tests__/validate-env.test.js

@@ -0,0 +1,55 @@
+"use strict";
+// Task 955 — acceptance gate for the env-vs-disk validator. Pure-function
+// shape (no I/O, no env read, no exit) keeps the test fast and lets the
+// caller (platform/ui/server/index.ts) own the side-effects (console.error +
+// process.exit). The four cases cover every observable boot state — missing,
+// no-on-disk-account, mismatch, ok — with no fallback path.
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = __importDefault(require("node:test"));
+const strict_1 = __importDefault(require("node:assert/strict"));
+const index_js_1 = require("../index.js");
+const UUID_A = "11111111-2222-3333-4444-555555555555";
+const UUID_B = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+(0, node_test_1.default)("validateAccountIdEnv ok when env matches a disk account", () => {
+    const result = (0, index_js_1.validateAccountIdEnv)(UUID_A, [UUID_A]);
+    strict_1.default.deepEqual(result, { ok: true, envId: UUID_A, diskIds: [UUID_A] });
+});
+(0, node_test_1.default)("validateAccountIdEnv FATAL reason=missing when env is undefined", () => {
+    const result = (0, index_js_1.validateAccountIdEnv)(undefined, [UUID_A]);
+    strict_1.default.equal(result.ok, false);
+    strict_1.default.equal(result.ok ? null : result.reason, "missing");
+    strict_1.default.equal(result.envId, null);
+});
+(0, node_test_1.default)("validateAccountIdEnv FATAL reason=missing when env is the empty string", () => {
+    // Empty string is the systemd shape when `Environment=ACCOUNT_ID=` lands
+    // without a value (e.g. an installer regression that interpolates an empty
+    // template variable). Same FATAL classification as undefined — we never
+    // accept a falsy env value and silently degrade.
+    const result = (0, index_js_1.validateAccountIdEnv)("", [UUID_A]);
+    strict_1.default.equal(result.ok, false);
+    strict_1.default.equal(result.ok ? null : result.reason, "missing");
+});
+(0, node_test_1.default)("validateAccountIdEnv FATAL reason=no-on-disk-account when disk is empty", () => {
+    const result = (0, index_js_1.validateAccountIdEnv)(UUID_A, []);
+    strict_1.default.equal(result.ok, false);
+    strict_1.default.equal(result.ok ? null : result.reason, "no-on-disk-account");
+    strict_1.default.equal(result.envId, UUID_A);
+    strict_1.default.deepEqual(result.diskIds, []);
+});
+(0, node_test_1.default)("validateAccountIdEnv FATAL reason=mismatch when env not in disk list", () => {
+    const result = (0, index_js_1.validateAccountIdEnv)(UUID_A, [UUID_B]);
+    strict_1.default.equal(result.ok, false);
+    strict_1.default.equal(result.ok ? null : result.reason, "mismatch");
+    strict_1.default.equal(result.envId, UUID_A);
+    strict_1.default.deepEqual(result.diskIds, [UUID_B]);
+});
+(0, node_test_1.default)("validateAccountIdEnv ok when env matches one of multiple disk accounts", () => {
+    // Phase 0 invariant is single-account, but the validator is shape-agnostic;
+    // future multi-account expansion should not require a code change here.
+    const result = (0, index_js_1.validateAccountIdEnv)(UUID_B, [UUID_A, UUID_B]);
+    strict_1.default.equal(result.ok, true);
+});
+//# sourceMappingURL=validate-env.test.js.map

package/payload/platform/lib/account-enumeration/dist/__tests__/validate-env.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-env.test.js","sourceRoot":"","sources":["../../src/__tests__/validate-env.test.ts"],"names":[],"mappings":";AAAA,0EAA0E;AAC1E,wEAAwE;AACxE,6EAA6E;AAC7E,6EAA6E;AAC7E,4DAA4D;;;;;AAE5D,0DAA6B;AAC7B,gEAAwC;AACxC,0CAAmD;AAEnD,MAAM,MAAM,GAAG,sCAAsC,CAAC;AACtD,MAAM,MAAM,GAAG,sCAAsC,CAAC;AAEtD,IAAA,mBAAI,EAAC,yDAAyD,EAAE,GAAG,EAAE;IACnE,MAAM,MAAM,GAAG,IAAA,+BAAoB,EAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,gBAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,MAAM,GAAG,IAAA,+BAAoB,EAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC1D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,MAAM,GAAG,IAAA,+BAAoB,EAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,yEAAyE,EAAE,GAAG,EAAE;IACnF,MAAM,MAAM,GAAG,IAAA,+BAAoB,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACrE,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,sEAAsE,EAAE,GAAG,EAAE;IAChF,MAAM,MAAM,GAAG,IAAA,+BAAoB,EAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC/B,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACnC,gBAAM,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,IAAA,mBAAI,EAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,MAAM,GAAG,IAAA,+BAAoB,EAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,gBAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC"}

package/payload/platform/lib/account-enumeration/dist/index.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Returns the list of valid account UUIDs found under `accountsDir`. A dir is
+ * "valid" iff its name is a UUID AND it contains a parseable `account.json`.
+ * Corruption-discipline: a present-but-unparseable account.json EXCLUDES the
+ * dir (over-prune one suspect account beats under-prune the leak it might
+ * be hiding).
+ */
+export declare function enumerateValidAccountIds(accountsDir: string): string[];
+/**
+ * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
+ * pattern at platform/ui/app/lib/claude-agent/account.ts:9
+ * (`ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts")`).
+ *
+ * Loud-throws when the env var is unset — graph-write's gate must not fall
+ * open silently.
+ */
+export declare function getAccountsDirFromEnv(): string;
+/**
+ * Test-only cache reset. Production callers must not invoke this — the cache
+ * is a deliberate boot-time invariant (see module doc).
+ */
+export declare function _resetEnumerationCache(): void;
+/**
+ * Task 955 — boot-time env-vs-disk validator. Compares `process.env.ACCOUNT_ID`
+ * (stamped by the brand systemd unit's `Environment=ACCOUNT_ID=` line) against
+ * the on-disk account set returned by `enumerateValidAccountIds`. The Hono
+ * server calls this once at boot before binding the listener; on FATAL it
+ * emits a structured `[graph-health] account-id-env FATAL` line and exits 1
+ * so systemd's restart loop surfaces the misconfiguration in journalctl.
+ *
+ * Pure function — no I/O, no env reads, no exits — caller passes both inputs.
+ * Reasons enumerate the four observable boot states (success + three failures)
+ * with no fallback path; the writeNodeWithEdges gate cannot trust an env that
+ * does not match disk, and silently degrading would re-create the silent-leak
+ * class the gate exists to close (`.docs/neo4j.md` "Account isolation invariant").
+ */
+export type AccountIdEnvValidationFailureReason = "missing" | "no-on-disk-account" | "mismatch";
+export type AccountIdEnvValidation = {
+    ok: true;
+    envId: string;
+    diskIds: string[];
+} | {
+    ok: false;
+    reason: AccountIdEnvValidationFailureReason;
+    envId: string | null;
+    diskIds: string[];
+};
+export declare function validateAccountIdEnv(envValue: string | undefined, diskIds: string[]): AccountIdEnvValidation;
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/account-enumeration/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}

package/payload/platform/lib/account-enumeration/dist/index.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enumerateValidAccountIds = enumerateValidAccountIds;
+exports.getAccountsDirFromEnv = getAccountsDirFromEnv;
+exports._resetEnumerationCache = _resetEnumerationCache;
+exports.validateAccountIdEnv = validateAccountIdEnv;
+/**
+ * account-enumeration — single source of truth for "which accountIds are
+ * provisioned on disk for this install?".
+ *
+ * Doctrine — `.docs/neo4j.md` "Account isolation invariant": every writer
+ * that stamps `n.accountId` must verify the value against
+ * `${DATA_ROOT}/accounts/<id>/account.json` before write. Read-side scoping
+ * (`WHERE n.accountId = $accountId`) silently hides leaks from every UI;
+ * an unenforced writer can leak indefinitely with zero downstream symptom.
+ *
+ * Two consumers:
+ *   1. `writeNodeWithEdges` (platform/lib/graph-write/) — central write-time
+ *      floor; rejects any write whose `props.accountId` is not in the set
+ *      returned here, unless `createdBy.agent === 'system'` (bootstrap).
+ *   2. `resolvePlatformAccountId` (platform/ui/app/lib/whatsapp/platform-account-id.ts)
+ *      — WhatsApp writer-side helper; loud-throws on zero or multi accounts.
+ *
+ * Per-process cache keyed on `accountsDir` — Phase 0 invariant has accounts
+ * created at install time, so adding/removing accounts requires a service
+ * restart anyway.
+ */
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const cache = new Map();
+/**
+ * Returns the list of valid account UUIDs found under `accountsDir`. A dir is
+ * "valid" iff its name is a UUID AND it contains a parseable `account.json`.
+ * Corruption-discipline: a present-but-unparseable account.json EXCLUDES the
+ * dir (over-prune one suspect account beats under-prune the leak it might
+ * be hiding).
+ */
+function enumerateValidAccountIds(accountsDir) {
+    const cached = cache.get(accountsDir);
+    if (cached !== undefined)
+        return cached;
+    let names;
+    try {
+        names = (0, node_fs_1.readdirSync)(accountsDir);
+    }
+    catch (err) {
+        if (err.code === "ENOENT") {
+            cache.set(accountsDir, []);
+            return [];
+        }
+        throw err;
+    }
+    const valid = [];
+    for (const name of names) {
+        if (!UUID_RE.test(name))
+            continue;
+        const configPath = (0, node_path_1.resolve)(accountsDir, name, "account.json");
+        try {
+            JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+            valid.push(name);
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === "ENOENT")
+                continue;
+            // SyntaxError (parse failure) and other read errors fall through:
+            // exclude this dir, try the next.
+        }
+    }
+    cache.set(accountsDir, valid);
+    return valid;
+}
+/**
+ * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
+ * pattern at platform/ui/app/lib/claude-agent/account.ts:9
+ * (`ACCOUNTS_DIR = resolve(PLATFORM_ROOT, "..", "data/accounts")`).
+ *
+ * Loud-throws when the env var is unset — graph-write's gate must not fall
+ * open silently.
+ */
+function getAccountsDirFromEnv() {
+    const root = process.env.MAXY_PLATFORM_ROOT;
+    if (!root) {
+        throw new Error("[graph-write] MAXY_PLATFORM_ROOT not set — cannot enforce accountId gate. " +
+            "Set MAXY_PLATFORM_ROOT in the spawning process or pass `accountsDir` explicitly.");
+    }
+    return (0, node_path_1.resolve)(root, "..", "data/accounts");
+}
+/**
+ * Test-only cache reset. Production callers must not invoke this — the cache
+ * is a deliberate boot-time invariant (see module doc).
+ */
+function _resetEnumerationCache() {
+    cache.clear();
+}
+function validateAccountIdEnv(envValue, diskIds) {
+    if (!envValue) {
+        return { ok: false, reason: "missing", envId: null, diskIds };
+    }
+    if (diskIds.length === 0) {
+        return { ok: false, reason: "no-on-disk-account", envId: envValue, diskIds };
+    }
+    if (!diskIds.includes(envValue)) {
+        return { ok: false, reason: "mismatch", envId: envValue, diskIds };
+    }
+    return { ok: true, envId: envValue, diskIds };
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/account-enumeration/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AA3ID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}

package/payload/platform/lib/account-enumeration/src/__tests__/enumerate.test.ts

@@ -0,0 +1,94 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import {
+  enumerateValidAccountIds,
+  getAccountsDirFromEnv,
+  _resetEnumerationCache,
+} from "../index.js";
+
+function makeFixture(): string {
+  const root = mkdtempSync(join(tmpdir(), "acct-enum-"));
+  // (a) non-UUID dir → excluded.
+  mkdirSync(join(root, "not-a-uuid"));
+  writeFileSync(join(root, "not-a-uuid", "account.json"), "{}");
+  // (b) UUID dir, no account.json → excluded.
+  mkdirSync(join(root, "11111111-2222-3333-4444-555555555555"));
+  // (c) UUID dir, unparseable account.json → excluded (over-prune doctrine).
+  mkdirSync(join(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"));
+  writeFileSync(
+    join(root, "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee", "account.json"),
+    "{ broken json",
+  );
+  // (d) UUID dir, parseable account.json → included.
+  mkdirSync(join(root, "12345678-9abc-def0-1234-56789abcdef0"));
+  writeFileSync(
+    join(root, "12345678-9abc-def0-1234-56789abcdef0", "account.json"),
+    JSON.stringify({ id: "12345678-9abc-def0-1234-56789abcdef0" }),
+  );
+  return root;
+}
+
+test("enumerateValidAccountIds returns only UUID dirs with parseable account.json", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    const result = enumerateValidAccountIds(root);
+    assert.deepEqual(result, ["12345678-9abc-def0-1234-56789abcdef0"]);
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("enumerateValidAccountIds returns [] when accountsDir does not exist", () => {
+  _resetEnumerationCache();
+  const ghost = join(tmpdir(), "acct-enum-does-not-exist-" + Date.now());
+  assert.deepEqual(enumerateValidAccountIds(ghost), []);
+});
+
+test("enumerateValidAccountIds caches per accountsDir; reset re-reads", () => {
+  _resetEnumerationCache();
+  const root = makeFixture();
+  try {
+    const first = enumerateValidAccountIds(root);
+    // Add a second valid dir AFTER first call; cached call must NOT see it.
+    const newId = "99999999-aaaa-bbbb-cccc-dddddddddddd";
+    mkdirSync(join(root, newId));
+    writeFileSync(join(root, newId, "account.json"), "{}");
+    const cached = enumerateValidAccountIds(root);
+    assert.deepEqual(cached, first, "cache should hide the newly-added dir");
+    _resetEnumerationCache();
+    const fresh = enumerateValidAccountIds(root);
+    assert.equal(fresh.length, 2);
+    assert.ok(fresh.includes(newId));
+  } finally {
+    rmSync(root, { recursive: true });
+  }
+});
+
+test("getAccountsDirFromEnv throws when MAXY_PLATFORM_ROOT is unset", () => {
+  const saved = process.env.MAXY_PLATFORM_ROOT;
+  delete process.env.MAXY_PLATFORM_ROOT;
+  try {
+    assert.throws(
+      () => getAccountsDirFromEnv(),
+      /MAXY_PLATFORM_ROOT not set/,
+    );
+  } finally {
+    if (saved !== undefined) process.env.MAXY_PLATFORM_ROOT = saved;
+  }
+});
+
+test("getAccountsDirFromEnv resolves to ${root}/../data/accounts when set", () => {
+  const saved = process.env.MAXY_PLATFORM_ROOT;
+  process.env.MAXY_PLATFORM_ROOT = "/tmp/fake-root/platform";
+  try {
+    const result = getAccountsDirFromEnv();
+    assert.equal(result, resolve("/tmp/fake-root/platform", "..", "data/accounts"));
+  } finally {
+    if (saved !== undefined) process.env.MAXY_PLATFORM_ROOT = saved;
+    else delete process.env.MAXY_PLATFORM_ROOT;
+  }
+});

package/payload/platform/lib/account-enumeration/src/__tests__/validate-env.test.ts

@@ -0,0 +1,57 @@
+// Task 955 — acceptance gate for the env-vs-disk validator. Pure-function
+// shape (no I/O, no env read, no exit) keeps the test fast and lets the
+// caller (platform/ui/server/index.ts) own the side-effects (console.error +
+// process.exit). The four cases cover every observable boot state — missing,
+// no-on-disk-account, mismatch, ok — with no fallback path.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { validateAccountIdEnv } from "../index.js";
+
+const UUID_A = "11111111-2222-3333-4444-555555555555";
+const UUID_B = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+
+test("validateAccountIdEnv ok when env matches a disk account", () => {
+  const result = validateAccountIdEnv(UUID_A, [UUID_A]);
+  assert.deepEqual(result, { ok: true, envId: UUID_A, diskIds: [UUID_A] });
+});
+
+test("validateAccountIdEnv FATAL reason=missing when env is undefined", () => {
+  const result = validateAccountIdEnv(undefined, [UUID_A]);
+  assert.equal(result.ok, false);
+  assert.equal(result.ok ? null : result.reason, "missing");
+  assert.equal(result.envId, null);
+});
+
+test("validateAccountIdEnv FATAL reason=missing when env is the empty string", () => {
+  // Empty string is the systemd shape when `Environment=ACCOUNT_ID=` lands
+  // without a value (e.g. an installer regression that interpolates an empty
+  // template variable). Same FATAL classification as undefined — we never
+  // accept a falsy env value and silently degrade.
+  const result = validateAccountIdEnv("", [UUID_A]);
+  assert.equal(result.ok, false);
+  assert.equal(result.ok ? null : result.reason, "missing");
+});
+
+test("validateAccountIdEnv FATAL reason=no-on-disk-account when disk is empty", () => {
+  const result = validateAccountIdEnv(UUID_A, []);
+  assert.equal(result.ok, false);
+  assert.equal(result.ok ? null : result.reason, "no-on-disk-account");
+  assert.equal(result.envId, UUID_A);
+  assert.deepEqual(result.diskIds, []);
+});
+
+test("validateAccountIdEnv FATAL reason=mismatch when env not in disk list", () => {
+  const result = validateAccountIdEnv(UUID_A, [UUID_B]);
+  assert.equal(result.ok, false);
+  assert.equal(result.ok ? null : result.reason, "mismatch");
+  assert.equal(result.envId, UUID_A);
+  assert.deepEqual(result.diskIds, [UUID_B]);
+});
+
+test("validateAccountIdEnv ok when env matches one of multiple disk accounts", () => {
+  // Phase 0 invariant is single-account, but the validator is shape-agnostic;
+  // future multi-account expansion should not require a code change here.
+  const result = validateAccountIdEnv(UUID_B, [UUID_A, UUID_B]);
+  assert.equal(result.ok, true);
+});