@rubytech/create-maxy-code 0.1.186 → 0.1.188

package/payload/platform/plugins/memory/mcp/dist/tools/session-retrospective-skip-rate.js

@@ -15,6 +15,7 @@
  * most-recent completed retrospective) carry the deferred typed-edge work
  * that will land at the next /end.
  */
+import { int } from "neo4j-driver";
 export async function sessionRetrospectiveSkipRate(args, session, accountId) {
     const windowSize = Math.max(1, Math.min(args.windowSize ?? 10, 100));
     // Conversations carry `retrospectiveCompletedAt` when the sentinel tool
@@ -88,7 +89,7 @@ export async function sessionRetrospectiveSkipRate(args, session, accountId) {
     try {
         const result = await session.run(cypher, {
             accountId,
-            windowSize,
+            windowSize: int(windowSize),
             proseLabels,
         });
         records = result.records;
@@ -96,7 +97,7 @@ export async function sessionRetrospectiveSkipRate(args, session, accountId) {
     catch {
         const result = await session.run(fallbackCypher, {
             accountId,
-            windowSize,
+            windowSize: int(windowSize),
             proseLabels,
         });
         records = result.records;

package/payload/platform/plugins/memory/mcp/dist/tools/session-retrospective-skip-rate.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-retrospective-skip-rate.js","sourceRoot":"","sources":["../../src/tools/session-retrospective-skip-rate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgBH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAyB,EACzB,OAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAErE,wEAAwE;IACxE,kEAAkE;IAClE,sEAAsE;IACtE,6BAA6B;IAC7B,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;GAuBd,CAAC;IAEF,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;GAuBtB,CAAC;IAEF,MAAM,WAAW,GAAG;QAClB,SAAS;QACT,MAAM;QACN,SAAS;QACT,OAAO;QACP,MAAM;QACN,MAAM;QACN,MAAM;QACN,QAAQ;KACT,CAAC;IAEF,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvC,SAAS;YACT,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;YAC/C,SAAS;YACT,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,CAAC;YACjB,uBAAuB,EAAE,CAAC;YAC1B,QAAQ,EAAE,CAAC;YACX,qBAAqB,EAAE,IAAI;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,uBAAuB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,cAAc,GAAG,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,GAAG,uBAAuB,CAAC,GAAG,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9E,OAAO,CAAC,GAAG,CACT,+CAA+C,YAAY,YAAY,cAAc,cAAc,uBAAuB,cAAc,QAAQ,mBAAmB,gBAAgB,IAAI,MAAM,EAAE,CAChM,CAAC;IAEF,OAAO;QACL,cAAc;QACd,uBAAuB;QACvB,QAAQ;QACR,qBAAqB,EAAE,gBAAgB;KACxC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"session-retrospective-skip-rate.js","sourceRoot":"","sources":["../../src/tools/session-retrospective-skip-rate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,GAAG,EAAgB,MAAM,cAAc,CAAC;AAcjD,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAyB,EACzB,OAAgB,EAChB,SAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IAErE,wEAAwE;IACxE,kEAAkE;IAClE,sEAAsE;IACtE,6BAA6B;IAC7B,wEAAwE;IACxE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;GAuBd,CAAC;IAEF,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;GAuBtB,CAAC;IAEF,MAAM,WAAW,GAAG;QAClB,SAAS;QACT,MAAM;QACN,SAAS;QACT,OAAO;QACP,MAAM;QACN,MAAM;QACN,MAAM;QACN,QAAQ;KACT,CAAC;IAEF,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvC,SAAS;YACT,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;YAC3B,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;YAC/C,SAAS;YACT,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;YAC3B,WAAW;SACZ,CAAC,CAAC;QACH,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,cAAc,EAAE,CAAC;YACjB,uBAAuB,EAAE,CAAC;YAC1B,QAAQ,EAAE,CAAC;YACX,qBAAqB,EAAE,IAAI;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,uBAAuB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,cAAc,GAAG,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,GAAG,uBAAuB,CAAC,GAAG,cAAc,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3C,MAAM,gBAAgB,GAAG,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE9E,OAAO,CAAC,GAAG,CACT,+CAA+C,YAAY,YAAY,cAAc,cAAc,uBAAuB,cAAc,QAAQ,mBAAmB,gBAAgB,IAAI,MAAM,EAAE,CAChM,CAAC;IAEF,OAAO;QACL,cAAc;QACd,uBAAuB;QACvB,QAAQ;QACR,qBAAqB,EAAE,gBAAgB;KACxC,CAAC;AACJ,CAAC"}

package/payload/platform/plugins/memory/references/graph-primitives.md

@@ -40,31 +40,40 @@ token-limit discipline the upstream server enforces.
 
 ## When the memory tools are absent
 
-If `mcp__memory__memory-write`, `mcp__memory__memory-search`,
-`mcp__memory__memory-reindex`,
-`mcp__memory__session-compact`, `mcp__memory__session-compact-status`, or
-`mcp__memory__conversation-search` is missing from your tool list, the
-memory MCP server failed to start on this device. Reply once with
-exactly:
-
-> The memory MCP server failed to start on this device. Run the admin
+The maxy MCP tool names are bound to the live registry (Task 502): the
+canonical long name `mcp__plugin_memory_memory__<tool>` is generated from the
+memory plugin's manifest, a build gate fails when any instruction names a tool
+the registry does not serve, and a PostToolUse hook turns a missing-tool call
+into a fixed envelope. So a missing memory tool is one of two distinct states,
+not the single "failed to start" the old contract assumed:
+
+- **Server dead.** None of the `mcp__plugin_memory_memory__*` tools appear in
+  your tool list at all. The per-account memory server did not start; the
+  platform's `[mcp-init-error] server=memory` line in the per-conversation
+  stream log names it.
+- **Name not registered.** The server is up and other
+  `mcp__plugin_memory_memory__*` tools are present, but a specific call returns
+  `No such tool available`. The `mcp-tool-missing` hook has already logged
+  `[mcp-tool-missing] server=memory tool=<tool>` and returned the deterministic
+  envelope you are reading.
+
+In either state, reply once with exactly:
+
+> The memory MCP server is unavailable on this device. Run the admin
 > system-status check to diagnose — do not retry by other routes.
 
-Then stop. Do not search for a similarly-named tool via `ToolSearch`, do
-not improvise via `maxy-graph-read_neo4j_cypher` (it is read-only — every
-write goes through the schema-aware memory tools), do not paraphrase.
-A missing memory tool is a deterministic failure of the per-account
-memory server: the platform's `[mcp-init-error] server=memory` line in
-the per-conversation stream log already names it; the user-facing reply
-exists so the operator knows the session cannot proceed without an
-operator-side fix (the loud-fail contract applies equally
-to graph and memory tool initialisation).
+Then stop. Do not search for a similarly-named tool via `ToolSearch`, do not
+improvise via `mcp__plugin_graph_graph__maxy-graph-read_neo4j_cypher` (it is
+read-only — every write goes through the schema-aware memory tools), do not
+paraphrase, do not describe the server as "warming up". The reply exists so the
+operator knows the session cannot proceed without an operator-side fix (the
+loud-fail contract applies equally to graph and memory tool initialisation).
 
 ## Mutation intents
 
 The graph tools above are read-only. Every write intent has a schema-aware
 tool that already exists — match the user's prose to a tool in this table
-rather than improvising. `mcp__admin__admin-remove` is in your initial
+rather than improvising. `mcp__plugin_admin_admin__admin-remove` is in your initial
 tool list; the other tools below are deferred (they do not appear until
 you invoke `ToolSearch` by the exact name you pick from the table).
 Do not use `ToolSearch` to *discover* the tool by keyword — identify it
@@ -78,14 +87,14 @@ graph as a single action.
 
 | User intent | Tool | When to pick this, not the next row |
 |---|---|---|
-| "remove admin X", "take away their admin access", "revoke admin" | `mcp__admin__admin-remove` | Device-level admin offboarding — detaches the `(AdminUser)-[:ADMIN_OF]->(LocalBusiness)` edge and updates `platform/config/users.json`. Not for scrubbing personal data — use the GDPR contact-erase tools for that. |
-| "delete this specific node", "remove this entry by its id", "get rid of node X", "remove orphans", "prune", "clean up" | `mcp__memory__memory-delete` | Soft-deletes a single node by `elementId` (adds `:Trashed`, preserves relationships, snapshots unique keys, invisible to `memory-search` and any `notTrashed`-filtered read). For KnowledgeDocument, cascades to Sections and Chunks. Enumerate candidates first with a Cypher read, confirm with the user, then delete each by `elementId`. There is no bulk "delete everything without relationships" tool. Per the write doctrine (`.docs/neo4j.md` § Write doctrine), **new** orphans should be impossible — every writer now rejects zero-edge calls at the MCP tool-surface. Existing orphans from legacy data are legitimate backfill candidates but are not produced by any live writer; if you see a freshly-created orphan, it is a bug in a writer that bypassed `writeNodeWithEdges`, not expected state. |
-| "undo that delete", "I deleted X by mistake, bring it back", "restore the contact I just trashed" | `mcp__memory__memory-restore` | Removes `:Trashed`, restores snapshotted unique-key properties. Fails loudly when an active node already holds the unique slot (e.g. a fresh `LocalBusiness` was created while the old one was in trash) — the error names the conflicting `elementId` so you can ask the user how to resolve. |
-| "empty the trash", "purge old soft-deletes", "what's been sitting in trash and ready to clear" | `mcp__memory__memory-empty-trash` | Hard-deletes trashed nodes whose `trashedAt` is older than `graceDays` (default 30); `dryRun=true` lists candidates without mutating. Use `dryRun` first, show the list to the user, then run for real. For KnowledgeDocument candidates, the on-disk attachment directory is removed too. |
-| "scrub this conversation's memory", "remove this claim the bot picked up", "forget what we said in that thread" | `mcp__memory__conversation-memory-expunge` | Removes deny-listable content from `:Memory` nodes scoped to one conversation. Requires an explicit pattern and sessionId. Not for deleting individual nodes — use `memory-delete`. |
-| "update a property", "fix a typo in a node", "change the role field on X", "null this poisonous string" | `mcp__memory__memory-update` | Targeted property edit on an existing node, schema-validated. Use to null individual string properties matching a deny-list entry once you've identified the offender via a Cypher read. Not for creating new nodes — use `memory-write`. |
-| "update X by name, search didn't return it", "wire this Org but search came back empty", "I know it exists but I don't have the elementId" | `mcp__memory__memory-update-by-name` | Repair surface for the case where `memory-search` cannot return a row you know exists by name. Resolves the unique `(label, name, accountId)` tuple, then delegates to `memory-update`. Rejects loudly on zero or ambiguous matches (the rejection lists candidate elementIds so you can pick one). Trashed nodes excluded. Use this only after `memory-search` failed — for normal updates, get the elementId from search and call `memory-update` directly. |
-| "don't surface these substrings in future memory results", "watch for this string" | `mcp__memory__graph-prune-denylist-add` | Records a substring as operator-curated signal. Nothing auto-applies it — when a subsequent memory-search or cypher read surfaces a match, use `memory-update` or `memory-delete` with discretion to scrub it. |
+| "remove admin X", "take away their admin access", "revoke admin" | `mcp__plugin_admin_admin__admin-remove` | Device-level admin offboarding — detaches the `(AdminUser)-[:ADMIN_OF]->(LocalBusiness)` edge and updates `platform/config/users.json`. Not for scrubbing personal data — use the GDPR contact-erase tools for that. |
+| "delete this specific node", "remove this entry by its id", "get rid of node X", "remove orphans", "prune", "clean up" | `mcp__plugin_memory_memory__memory-delete` | Soft-deletes a single node by `elementId` (adds `:Trashed`, preserves relationships, snapshots unique keys, invisible to `memory-search` and any `notTrashed`-filtered read). For KnowledgeDocument, cascades to Sections and Chunks. Enumerate candidates first with a Cypher read, confirm with the user, then delete each by `elementId`. There is no bulk "delete everything without relationships" tool. Per the write doctrine (`.docs/neo4j.md` § Write doctrine), **new** orphans should be impossible — every writer now rejects zero-edge calls at the MCP tool-surface. Existing orphans from legacy data are legitimate backfill candidates but are not produced by any live writer; if you see a freshly-created orphan, it is a bug in a writer that bypassed `writeNodeWithEdges`, not expected state. |
+| "undo that delete", "I deleted X by mistake, bring it back", "restore the contact I just trashed" | `mcp__plugin_memory_memory__memory-restore` | Removes `:Trashed`, restores snapshotted unique-key properties. Fails loudly when an active node already holds the unique slot (e.g. a fresh `LocalBusiness` was created while the old one was in trash) — the error names the conflicting `elementId` so you can ask the user how to resolve. |
+| "empty the trash", "purge old soft-deletes", "what's been sitting in trash and ready to clear" | `mcp__plugin_memory_memory__memory-empty-trash` | Hard-deletes trashed nodes whose `trashedAt` is older than `graceDays` (default 30); `dryRun=true` lists candidates without mutating. Use `dryRun` first, show the list to the user, then run for real. For KnowledgeDocument candidates, the on-disk attachment directory is removed too. |
+| "scrub this conversation's memory", "remove this claim the bot picked up", "forget what we said in that thread" | `mcp__plugin_memory_memory__conversation-memory-expunge` | Removes deny-listable content from `:Memory` nodes scoped to one conversation. Requires an explicit pattern and sessionId. Not for deleting individual nodes — use `memory-delete`. |
+| "update a property", "fix a typo in a node", "change the role field on X", "null this poisonous string" | `mcp__plugin_memory_memory__memory-update` | Targeted property edit on an existing node, schema-validated. Use to null individual string properties matching a deny-list entry once you've identified the offender via a Cypher read. Not for creating new nodes — use `memory-write`. |
+| "update X by name, search didn't return it", "wire this Org but search came back empty", "I know it exists but I don't have the elementId" | `mcp__plugin_memory_memory__memory-update-by-name` | Repair surface for the case where `memory-search` cannot return a row you know exists by name. Resolves the unique `(label, name, accountId)` tuple, then delegates to `memory-update`. Rejects loudly on zero or ambiguous matches (the rejection lists candidate elementIds so you can pick one). Trashed nodes excluded. Use this only after `memory-search` failed — for normal updates, get the elementId from search and call `memory-update` directly. |
+| "don't surface these substrings in future memory results", "watch for this string" | `mcp__plugin_memory_memory__graph-prune-denylist-add` | Records a substring as operator-curated signal. Nothing auto-applies it — when a subsequent memory-search or cypher read surfaces a match, use `memory-update` or `memory-delete` with discretion to scrub it. |
 
 **Never run `cypher-shell` via `Bash` to work around the read-only tool.**
 The admin session's `Bash` surface has no path to the per-brand Neo4j
@@ -107,7 +116,7 @@ MATCH (a:AdminUser) WHERE NOT (a)--() RETURN elementId(a), a.userId, a.createdAt
 ```
 
 Show the list to the user. For each confirmed entry, call
-`mcp__memory__memory-delete` with the `elementId`. Do not batch-delete
+`mcp__plugin_memory_memory__memory-delete` with the `elementId`. Do not batch-delete
 by pattern — on 2026-04-20 an autonomous orphan-delete rule wiped 19
 nodes in one call, with no property recovery possible. Structural mass-
 deletion by shape is banned; discretion per node is the only sanctioned

package/payload/platform/plugins/obsidian-import/PLUGIN.md

@@ -18,7 +18,7 @@ The admin agent delegates to `specialists:database-operator` when the operator d
 
 ## How parsing happens
 
-The skill does not parse markdown. Vault traversal, frontmatter YAML, wikilink regex, tag scanning, daily-notes detection, and attachment resolution all happen server-side inside `mcp__memory__obsidian-vault-import` (memory plugin). The skill is the operator-facing conversation surface only: confirm owner → select filters → invoke the tool with `mode='dry-run'` → present ambiguities → invoke with `mode='commit'` and the operator's resolutions.
+The skill does not parse markdown. Vault traversal, frontmatter YAML, wikilink regex, tag scanning, daily-notes detection, and attachment resolution all happen server-side inside `mcp__plugin_memory_memory__obsidian-vault-import` (memory plugin). The skill is the operator-facing conversation surface only: confirm owner → select filters → invoke the tool with `mode='dry-run'` → present ambiguities → invoke with `mode='commit'` and the operator's resolutions.
 
 ## Intra-plugin growth
 

package/payload/platform/plugins/telegram/mcp/dist/tools/message-history.js

@@ -33,7 +33,7 @@ export async function messageHistory(params) {
     const session = getSession();
     try {
         const conditions = ["m.accountId = $accountId"];
-        const queryParams = { accountId, limit };
+        const queryParams = { accountId, limit: neo4j.int(limit) };
         if (channel) {
             conditions.push("m.channel = $channel");
             queryParams.channel = channel;

package/payload/platform/plugins/telegram/mcp/dist/tools/message-history.js.map

@@ -1 +1 @@
-{"version":3,"file":"message-history.js","sourceRoot":"","sources":["../../src/tools/message-history.ts"],"names":[],"mappings":"AAAA,OAAO,KAAoC,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAElE,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EACxE,wBAAwB,CACzB,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,YAAY,gCAAgC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6DAA6D;QAC7D,oEAAoE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;AAC1B,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE1D,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAChD,MAAM,WAAW,GAA4B,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAElE,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACxC,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACtC,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,GAAG;;cAEJ,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;;;KAIjC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAErD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAiB;gBAC5B,MAAM,EAAE,CAAC,CAAC,MAAgB;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAc;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAiB;gBAC5B,SAAS,EAAE,CAAC,CAAC,QAAkB;aAChC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}
+{"version":3,"file":"message-history.js","sourceRoot":"","sources":["../../src/tools/message-history.ts"],"names":[],"mappings":"AAAA,OAAO,KAAoC,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC,SAAS,YAAY;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAElE,MAAM,YAAY,GAAG,OAAO,CAC1B,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,EACxE,wBAAwB,CACzB,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,yCAAyC,YAAY,gCAAgC,CACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,6DAA6D;QAC7D,oEAAoE;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,2FAA2F,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,KAAK,CAAC,iDAAiD,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;AAC1B,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC;IAE1D,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAChD,MAAM,WAAW,GAA4B,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAEpF,IAAI,OAAO,EAAE,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACxC,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;QAChC,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACtC,WAAW,CAAC,MAAM,GAAG,MAAM,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,GAAG;;cAEJ,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;;;;KAIjC,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAErD,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;YACrC,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAiB;gBAC5B,MAAM,EAAE,CAAC,CAAC,MAAgB;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAc;gBACtB,OAAO,EAAE,CAAC,CAAC,OAAiB;gBAC5B,SAAS,EAAE,CAAC,CAAC,QAAkB;aAChC,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/payload/platform/scripts/check-canonical-tool-names.mjs

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+// Strong build gate for canonical maxy MCP tool names (Task 502).
+//
+// Two checks, both must pass:
+//   1. Regenerate-and-diff: the committed generated artifact
+//      (canonical-tool-names.generated.ts) must byte-match a fresh generation
+//      from platform/plugins/*/PLUGIN.md. A stale artifact fails the build —
+//      this is what stops a PLUGIN.md tool add/remove from drifting away from
+//      the names instructions are bound to.
+//   2. Instruction-name validation: every `mcp__...` tool name in an
+//      instruction file (specialist templates, agent prompts, plugin
+//      references/skills, PLUGIN.md prose) that targets a MAXY plugin must be
+//      the canonical long prefix AND must exist in the live set. A short-prefix
+//      maxy name (mcp__<plugin>__<tool>) fails — it must be long. An unknown
+//      long-prefix maxy name fails — typo or stale. Non-maxy bridge namespaces
+//      (playwright, etc.) are ignored: their tool names are upstream-owned.
+
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs'
+import { join } from 'node:path'
+import { computeCanonicalToolNames, MAXY_CODE_ROOT } from './lib/canonical-tool-names.mjs'
+import { renderArtifact, renderPluginsList } from './generate-canonical-tool-names.mjs'
+
+const GENERATED = join(
+  MAXY_CODE_ROOT, 'platform', 'services', 'claude-session-manager', 'src',
+  'canonical-tool-names.generated.ts',
+)
+const PLUGINS_TXT = join(
+  MAXY_CODE_ROOT, 'platform', 'plugins', 'admin', 'hooks', 'lib',
+  'maxy-mcp-plugins.txt',
+)
+
+const SCAN_DIRS = [
+  join(MAXY_CODE_ROOT, 'platform', 'templates', 'specialists', 'agents'),
+  join(MAXY_CODE_ROOT, 'platform', 'plugins'),
+]
+const SCAN_EXT = new Set(['.md'])
+const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'payload', '__tests__'])
+// mcp__<seg>__<tool>  — seg may itself contain `_` (long prefix plugin_a_b).
+const TOOL_RE = /mcp__([A-Za-z0-9-]+(?:_[A-Za-z0-9-]+)*)__([A-Za-z0-9_-]+)/g
+
+function* walk(dir) {
+  let entries
+  try { entries = readdirSync(dir) } catch { return }
+  for (const e of entries.sort()) {
+    if (e.startsWith('.') || SKIP_DIRS.has(e)) continue
+    const p = join(dir, e)
+    let st
+    try { st = statSync(p) } catch { continue }
+    if (st.isDirectory()) { yield* walk(p); continue }
+    const ext = e.includes('.') ? '.' + e.split('.').pop() : ''
+    if (SCAN_EXT.has(ext)) yield p
+  }
+}
+
+function main() {
+  const { plugins, names } = computeCanonicalToolNames()
+  const maxyPlugins = new Set(plugins)
+  const canonical = new Set(names)
+
+  // Check 1 — regenerate-and-diff both generated outputs.
+  let driftError = null
+  const staleOutputs = []
+  if ((existsSync(GENERATED) ? readFileSync(GENERATED, 'utf8') : '') !== renderArtifact()) staleOutputs.push(GENERATED)
+  if ((existsSync(PLUGINS_TXT) ? readFileSync(PLUGINS_TXT, 'utf8') : '') !== renderPluginsList()) staleOutputs.push(PLUGINS_TXT)
+  if (staleOutputs.length > 0) {
+    driftError =
+      `[gate] canonical-tool-names: GENERATED ARTIFACT STALE.\n` +
+      staleOutputs.map((p) => `  ${p}`).join('\n') + '\n' +
+      `  Regenerate: cd platform && npm run gen:canonical-tools`
+  }
+
+  // Check 2 — instruction-name validation.
+  const violations = []
+  for (const root of SCAN_DIRS) {
+    for (const file of walk(root)) {
+      const text = readFileSync(file, 'utf8')
+      for (const m of text.matchAll(TOOL_RE)) {
+        const seg = m[1]
+        const full = m[0]
+        // Skip glob patterns in prose (`mcp__plugin_x_x__*`): the `*` is not a
+        // tool char so the match captured a partial name, not a real reference.
+        if (text[m.index + full.length] === '*') continue
+        if (seg.startsWith('plugin_')) {
+          // Long prefix mcp__plugin_<plugin>_<server>__<tool>.
+          const inner = seg.slice('plugin_'.length)
+          // plugin === server for maxy; the long prefix is `<plugin>_<plugin>`.
+          const plugin = [...maxyPlugins].find((p) => inner === `${p}_${p}`)
+          if (!plugin) continue // non-maxy bridge (playwright) — upstream-owned.
+          if (!canonical.has(full)) {
+            violations.push({ file, name: full, why: 'unknown maxy tool (typo or stale)' })
+          }
+        } else if (maxyPlugins.has(seg)) {
+          // Short prefix mcp__<maxyplugin>__<tool> — must be long now.
+          violations.push({ file, name: full, why: `short prefix for maxy plugin '${seg}' — use canonical long name` })
+        }
+      }
+    }
+  }
+
+  const failed = driftError || violations.length > 0
+  if (driftError) console.error(driftError)
+  if (violations.length > 0) {
+    console.error('[gate] canonical-tool-names: instruction files name tools outside the live set:')
+    for (const v of violations) console.error(`  ${v.file.replace(MAXY_CODE_ROOT + '/', '')}: ${v.name} — ${v.why}`)
+  }
+  if (failed) process.exit(1)
+  console.log(`[gate] check-canonical-tool-names: PASS (${names.length} canonical names, scanned instruction files)`)
+}
+
+main()

package/payload/platform/scripts/check-cypher-int-params.mjs

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+// Build-time gate: rejects raw JS numbers bound into Cypher integer positions.
+//
+// The neo4j-driver serializes a plain JS `number` as a Cypher FLOAT (15 -> 15.0).
+// Cypher `LIMIT`/`SKIP` reject non-integers: "Invalid input. '15.0' is not a
+// valid value. Must be a non-negative integer." A `LIMIT $p` / `SKIP $p` bound a
+// raw number therefore THROWS on every call — and the throw is usually swallowed
+// by a tool's catch and returned as empty data, so it presents as "no results"
+// rather than an error. The fix at every call site is `neo4j.int(p)` (or the
+// package's `int(...)` alias). Live repro: writer-craft voice-retrieve returned an
+// empty voice profile in production because `LIMIT $k` was bound k=15.
+//
+// Posture: TARGETED, FAIL-OPEN. The gate fails the build only on a DEFINITE
+// unwrapped binding — a `LIMIT $p`/`SKIP $p` param bound as object shorthand
+// (`{ p }`) or as `p: <expr>` where <expr> contains no `int(`. When the params
+// object cannot be statically resolved (built across multiple statements, spread
+// from `...rest`, or passed through a helper), the site is skipped rather than
+// flagged — zero false positives is the priority for a gate that must stay
+// trusted. A novel unparseable offender would still surface at runtime via the
+// existing per-tool error logging.
+//
+// Detection model:
+//   1. Tokenize once into two newline-preserving masked views: comments blanked
+//      in both; string/template CONTENTS kept in `keepStr` (so `LIMIT $p` inside a
+//      query template is visible) and blanked in `noStr` (so braces/parens/commas
+//      inside queries and string values never confuse structural scanning).
+//   2. Collect integer-position param names from `keepStr`: `LIMIT $p` / `SKIP $p`.
+//   3. For each `.run(` call, resolve its params argument from `noStr` — an inline
+//      `{...}` object, or a bare identifier traced back to its `const/let/var X = {`
+//      object literal in the same file.
+//   4. Within that object, flag each integer-position param bound shorthand or
+//      without an `int(` wrap.
+
+import { readFileSync, readdirSync, statSync } from 'node:fs'
+import { dirname, join, relative, basename } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url))
+const REPO_ROOT = join(SCRIPT_DIR, '..', '..')
+
+const SCAN_ROOTS = [
+  join(REPO_ROOT, 'premium-plugins'),
+  join(REPO_ROOT, 'platform', 'plugins'),
+  join(REPO_ROOT, 'platform', 'ui', 'server'),
+  join(REPO_ROOT, 'platform', 'ui', 'app'),
+]
+
+const ALLOWED_EXTS = new Set(['.ts', '.tsx'])
+const SKIP_DIR_NAMES = new Set([
+  'node_modules', 'dist', 'build', '.next', 'payload', '__tests__',
+])
+
+function shouldScanFile(filePath) {
+  const name = basename(filePath)
+  if (name.endsWith('.test.ts') || name.endsWith('.test.tsx')) return false
+  const ext = name.includes('.') ? '.' + name.split('.').pop() : ''
+  return ALLOWED_EXTS.has(ext)
+}
+
+function* walk(root) {
+  let entries
+  try { entries = readdirSync(root) } catch { return }
+  for (const name of entries) {
+    if (SKIP_DIR_NAMES.has(name)) continue
+    const full = join(root, name)
+    let st
+    try { st = statSync(full) } catch { continue }
+    if (st.isDirectory()) yield* walk(full)
+    else if (st.isFile()) yield full
+  }
+}
+
+// Single tokenizer pass. Returns two strings of identical length to `src`, with
+// newlines preserved so character offsets map back to line numbers:
+//   keepStr — comment characters replaced by spaces; string/template contents kept.
+//   noStr   — comment characters AND string/template contents replaced by spaces.
+// Delimiters (quotes, backticks, comment markers) become spaces in both.
+function mask(src) {
+  const keep = new Array(src.length)
+  const no = new Array(src.length)
+  // states: code, line (//), block (/* */), sq ('), dq ("), tpl (`)
+  let state = 'code'
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i]
+    const n = src[i + 1]
+    const blank = c === '\n' ? '\n' : ' '
+    if (state === 'code') {
+      if (c === '/' && n === '/') { keep[i] = no[i] = blank; state = 'line'; continue }
+      if (c === '/' && n === '*') { keep[i] = no[i] = blank; state = 'block'; continue }
+      if (c === "'") { keep[i] = no[i] = blank; state = 'sq'; continue }
+      if (c === '"') { keep[i] = no[i] = blank; state = 'dq'; continue }
+      if (c === '`') { keep[i] = no[i] = blank; state = 'tpl'; continue }
+      keep[i] = no[i] = c
+      continue
+    }
+    if (state === 'line') {
+      keep[i] = no[i] = blank
+      if (c === '\n') state = 'code'
+      continue
+    }
+    if (state === 'block') {
+      keep[i] = no[i] = blank
+      if (c === '*' && n === '/') {
+        // blank the closing slash too on the next iteration
+        no[i + 1] = keep[i + 1] = ' '
+        i++
+        state = 'code'
+      }
+      continue
+    }
+    // inside a string/template: keep content in `keep`, blank it in `no`.
+    if (state === 'sq' || state === 'dq' || state === 'tpl') {
+      const closer = state === 'sq' ? "'" : state === 'dq' ? '"' : '`'
+      if (c === '\\') {
+        // escape: consume this and the next char as string content
+        keep[i] = c === '\n' ? '\n' : (c)
+        no[i] = blank
+        if (i + 1 < src.length) {
+          keep[i + 1] = src[i + 1] === '\n' ? '\n' : src[i + 1]
+          no[i + 1] = src[i + 1] === '\n' ? '\n' : ' '
+          i++
+        }
+        continue
+      }
+      if (c === closer) { keep[i] = no[i] = blank; state = 'code'; continue }
+      keep[i] = c
+      no[i] = blank
+      continue
+    }
+  }
+  return { keep: keep.join(''), no: no.join('') }
+}
+
+function lineAt(text, index) {
+  let line = 1
+  for (let i = 0; i < index && i < text.length; i++) if (text[i] === '\n') line++
+  return line
+}
+
+const IDENT_RE = /^[A-Za-z_$][\w$]*$/
+
+// Capture a balanced {...} starting at `noStr[start]` (which must be '{').
+// Returns [objTextInNoStr, endIndexExclusive] or null.
+function captureBraces(noStr, start) {
+  if (noStr[start] !== '{') return null
+  let depth = 0
+  for (let i = start; i < noStr.length; i++) {
+    if (noStr[i] === '{') depth++
+    else if (noStr[i] === '}') { depth--; if (depth === 0) return [noStr.slice(start, i + 1), i + 1] }
+  }
+  return null
+}
+
+// Capture a balanced (...) starting at `noStr[start]` (which must be '(').
+// Returns [argsTextInNoStr, endIndexExclusive] or null.
+function captureParens(noStr, start) {
+  if (noStr[start] !== '(') return null
+  let depth = 0
+  for (let i = start; i < noStr.length; i++) {
+    if (noStr[i] === '(') depth++
+    else if (noStr[i] === ')') { depth--; if (depth === 0) return [noStr.slice(start, i + 1), i + 1] }
+  }
+  return null
+}
+
+// Split args text (without the outer parens) on TOP-LEVEL commas only.
+function splitTopLevelArgs(argsInner) {
+  const parts = []
+  let depth = 0
+  let cur = ''
+  for (const ch of argsInner) {
+    if (ch === '(' || ch === '{' || ch === '[') depth++
+    else if (ch === ')' || ch === '}' || ch === ']') depth--
+    if (ch === ',' && depth === 0) { parts.push(cur); cur = ''; continue }
+    cur += ch
+  }
+  if (cur.trim() !== '') parts.push(cur)
+  return parts
+}
+
+// Given a params object's text (from noStr) and the set of integer-position
+// param names, return the names that are bound shorthand or without an int() wrap.
+function findUnwrapped(objText, intParams) {
+  const offenders = []
+  for (const name of intParams) {
+    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+    // Explicit binding `name : value`
+    const explicit = new RegExp(`\\b${esc}\\s*:\\s*([^,}]+)`)
+    const m = objText.match(explicit)
+    if (m) {
+      if (!/\bint\s*\(/.test(m[1])) offenders.push(name)
+      continue
+    }
+    // Shorthand `{ name }` / `, name ,` / `, name }` — bare identifier, never wrapped.
+    const shorthand = new RegExp(`[{,]\\s*${esc}\\s*[,}]`)
+    if (shorthand.test(objText)) offenders.push(name)
+  }
+  return offenders
+}
+
+const violations = []
+
+for (const root of SCAN_ROOTS) {
+  for (const file of walk(root)) {
+    if (!shouldScanFile(file)) continue
+    let src
+    try { src = readFileSync(file, 'utf-8') } catch { continue }
+    if (!/\.run\s*\(/.test(src)) continue
+
+    const { keep, no } = mask(src)
+
+    // 1. Integer-position param names from the query strings (kept in `keep`).
+    const intParams = new Set()
+    for (const mm of keep.matchAll(/\b(?:LIMIT|SKIP)\s+\$(\w+)/gi)) intParams.add(mm[1])
+    if (intParams.size === 0) continue
+
+    // 2. Walk each `.run(` call.
+    for (const rm of no.matchAll(/\.run\s*\(/g)) {
+      const parenStart = rm.index + rm[0].length - 1
+      const cap = captureParens(no, parenStart)
+      if (!cap) continue
+      const inner = cap[0].slice(1, -1)
+      const args = splitTopLevelArgs(inner)
+      if (args.length < 2) continue
+      const paramArg = args[1].trim()
+
+      let objText = null
+      if (paramArg.startsWith('{')) {
+        // Inline object literal: re-capture against `no` for balanced braces.
+        const objStart = no.indexOf('{', parenStart)
+        const objCap = objStart >= 0 ? captureBraces(no, objStart) : null
+        if (objCap) objText = objCap[0]
+      } else if (IDENT_RE.test(paramArg)) {
+        // Single-variable params object: trace back to its declaration.
+        const esc = paramArg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+        const declRe = new RegExp(`(?:const|let|var)\\s+${esc}\\b[^=]*=\\s*\\{`)
+        const dm = no.match(declRe)
+        if (dm) {
+          const braceIdx = no.indexOf('{', dm.index)
+          const objCap = braceIdx >= 0 ? captureBraces(no, braceIdx) : null
+          if (objCap) objText = objCap[0]
+        }
+      }
+      // Unresolved params shape -> fail open (skip).
+      if (!objText) continue
+
+      for (const name of findUnwrapped(objText, intParams)) {
+        violations.push({
+          file: relative(REPO_ROOT, file),
+          line: lineAt(no, parenStart),
+          name,
+        })
+      }
+    }
+  }
+}
+
+if (violations.length > 0) {
+  // De-duplicate identical (file, line, name) tuples.
+  const seen = new Set()
+  const unique = violations.filter((v) => {
+    const k = `${v.file}:${v.line}:${v.name}`
+    if (seen.has(k)) return false
+    seen.add(k)
+    return true
+  })
+  console.error(`check-cypher-int-params: ${unique.length} raw-number Cypher integer binding(s):`)
+  for (const v of unique) {
+    console.error(`  ${v.file}:${v.line}: LIMIT/SKIP $${v.name} is bound a raw JS number — wrap with int(${v.name})`)
+  }
+  console.error('')
+  console.error('neo4j-driver serializes a JS number as a Cypher float (15 -> 15.0); LIMIT/SKIP')
+  console.error('reject non-integers. Bind neo4j.int(p) (or the package int() alias) instead.')
+  process.exit(1)
+}
+
+console.log('check-cypher-int-params: ok (0 raw-number integer-position bindings)')

package/payload/platform/scripts/generate-canonical-tool-names.mjs

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+// Generator: writes the committed canonical maxy MCP tool-name artifact from
+// every platform/plugins/<dir>/PLUGIN.md. Run via `npm run gen:canonical-tools`
+// (platform). The strong build gate (check-canonical-tool-names.mjs) regenerates
+// in-memory and fails the build if the committed artifact has drifted.
+import { writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { computeCanonicalToolNames, MAXY_CODE_ROOT } from './lib/canonical-tool-names.mjs'
+
+const OUT = join(
+  MAXY_CODE_ROOT, 'platform', 'services', 'claude-session-manager', 'src',
+  'canonical-tool-names.generated.ts',
+)
+
+// Plain newline-delimited maxy plugin list the deterministic missing-tool hook
+// (bash) reads to tell a maxy server (mcp__plugin_<p>_<p>__) from a third-party
+// bridge that shares the same long-prefix shape (Playwright etc.).
+const PLUGINS_TXT = join(
+  MAXY_CODE_ROOT, 'platform', 'plugins', 'admin', 'hooks', 'lib',
+  'maxy-mcp-plugins.txt',
+)
+
+export function renderPluginsList() {
+  const { plugins } = computeCanonicalToolNames()
+  return plugins.join('\n') + '\n'
+}
+
+export function renderArtifact() {
+  const { plugins, names } = computeCanonicalToolNames()
+  const body = [
+    '// GENERATED — do not edit by hand.',
+    '// Source: platform/plugins/*/PLUGIN.md (tools: + hidden: blocks).',
+    '// Regenerate: cd platform && npm run gen:canonical-tools',
+    '// Gate: platform/scripts/check-canonical-tool-names.mjs fails the build on drift.',
+    '//',
+    '// Canonical long-prefix names every maxy MCP tool is served under by the',
+    '// installed-plugin channel: mcp__plugin_<dir>_<dir>__<tool>.',
+    '',
+    '/** Directory basenames of maxy platform plugins that expose a tool surface. */',
+    'export const MAXY_MCP_PLUGINS: readonly string[] = [',
+    ...plugins.map((p) => `  ${JSON.stringify(p)},`),
+    ']',
+    '',
+    '/** Every canonical maxy MCP tool name (long prefix), sorted. */',
+    'export const CANONICAL_MAXY_TOOL_NAMES: readonly string[] = [',
+    ...names.map((n) => `  ${JSON.stringify(n)},`),
+    ']',
+    '',
+  ].join('\n')
+  return body
+}
+
+function main() {
+  writeFileSync(OUT, renderArtifact(), 'utf8')
+  writeFileSync(PLUGINS_TXT, renderPluginsList(), 'utf8')
+  const { plugins, names } = computeCanonicalToolNames()
+  console.log(`[gen] canonical-tool-names: ${plugins.length} plugins, ${names.length} tools -> ${OUT}`)
+  console.log(`[gen] maxy-mcp-plugins.txt -> ${PLUGINS_TXT}`)
+}
+
+export { OUT, PLUGINS_TXT }
+
+if (import.meta.url === `file://${process.argv[1]}`) main()