@rubytech/create-maxy-code 0.1.219 → 0.1.222

package/payload/platform/plugins/admin/references/publish-site-routing.md

@@ -0,0 +1,44 @@
+# Publish-site routing
+
+How a published static site goes from disk to a public URL, so the admin agent can find a site or share a link without guessing.
+
+## On-disk layout
+
+Every published site lives under the active account:
+
+```
+<accountDir>/sites/<slug>/
+  index.html
+  …assets
+```
+
+Where `<accountDir>` resolves to `<installDir>/data/accounts/<accountId>/` and `<slug>` is one or more `/`-separated segments accepted by the `publish-site` tool. To enumerate every published site on the account, list `<accountDir>/sites/` — `LS`, `Glob`, or `Bash ls` all work, pick whichever is in the surface.
+
+## URL composition
+
+The full published URL is exactly:
+
+```
+https://<public-hostname>/<slug>
+```
+
+`<public-hostname>` is whatever the `public-hostname` tool returns for this account. That tool reads cloudflared's own ingress config and `alias-domains.json` — the same files the platform server trusts to route — so its answer is deterministic. **Do not guess the hostname**: the public landing host for the product family (for example, `realagent.chat`) is not the publish-site host. Each account's sites are served from the account's own admin tunnel, and the canonical name comes from `public-hostname`.
+
+## Recipe — find a site
+
+1. `LS <accountDir>/sites/` (or `Glob '<accountDir>/sites/*'`).
+2. Pick the slug whose name matches the request.
+3. Call `public-hostname` once.
+4. The URL is `https://<hostname>/<slug>`.
+
+## Recipe — share a published site
+
+1. Confirm the slug exists with `LS <accountDir>/sites/<slug>/` (must contain at least an `index.html`).
+2. Call `public-hostname`.
+3. Paste `https://<hostname>/<slug>` to the operator.
+
+## Failure modes the agent should not chain
+
+- **`browser-render https://<product-host>/<slug>` returning the generic shell.** That host is the marketing landing, not the publish-site host. Resolve the hostname with `public-hostname` instead of typing a guess.
+- **Treating `url-get` `textLength: 0` as "page does not exist".** On a JS-rendered shell the verbatim HTML is fetched but contains no extracted text. The tool returns `ok: true` with `textLength: 0`; use `browser-render` to get the rendered DOM.
+- **Reading `<accountDir>/sites/<slug>/` directly with `Read`.** `Read` is for files, not directories. Use `LS` or `Glob` for directory contents.

package/payload/platform/plugins/admin/skills/admin-user-management/SKILL.md

@@ -28,7 +28,7 @@ Admin identity lives in three places that must stay in lockstep:
 
 ## Never write `account.json` directly
 
-All account-level mutations (`tier`, `outputStyle`, `thinkingView`, `effort`, `enabledPlugins`, `admins[]`, agent settings) go through the dedicated MCP tools: `account-update`, `plugin-toggle-enabled`, `admin-add`, `admin-remove`. The pre-tool-use hook denies direct `Edit` or `Write` on `account.json` server-side; this rule is the explanation for the denial. `tier` and `purchasedPlugins` derive from a Rubytech-signed entitlement payload on commercial installs, so a hand-edit is silently void.
+All account-level mutations (`tier`, `outputStyle`, `thinkingView`, `effort`, `enabledPlugins`, `admins[]`, agent settings) go through the dedicated MCP tools: `account-update`, `plugin-toggle-enabled`, `admin-add`, `admin-remove`. Direct `Edit` or `Write` on `account.json` is forbidden by IDENTITY.md doctrine — there is no server-side gate, so the doctrine line is the only thing standing between an agent slip and a silently corrupted account file. `tier` and `purchasedPlugins` derive from a Rubytech-signed entitlement payload on commercial installs, so a hand-edit is silently void.
 
 `tier` is the one account-level field with no admin-agent surface — `account-update` excludes it deliberately, because tier is privilege-bearing and the agent must not self-elevate. When refusing a tier-cap violation (`admin-add` against a full slot, etc.), point the owner at the founder-side path: `npx @rubytech/create-<brand>-code@latest --tier <solo|family|pro>` run on the device by the founder. On commercial installs the founder delivers a signed payload instead: `--entitlement-base64 <base64>`.
 

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:d8c18dc6630fbbddd4408fa971e7786cddfe36288714ac1e3840530d18903e91
+content-hash: sha256:cabadf29cd1f98c47b4f93c23339ee577ce7bb41092d085d01268b947165a1d5
 brand: maxy-code
 product-name: Maxy
 ---
@@ -220,7 +220,7 @@ Each session row also carries a small muted timestamp crumb under the name showi
 
 **Two spawn surfaces, one primitive (Task 573).** The manager runs two on-device spawn surfaces, both backed by the same primitive: **node-pty wrapped in `systemd-run --user --scope`** (via `index.ts::spawnPtyAdapter`).
 
-- **`claude rc` daemon** — spawned at platform boot by `rc-daemon.ts`. One supervised daemon per account; owns the long-lived composer session that backs claude.ai/code Remote Control. Master fd held for the daemon's lifetime, released on natural exit / restart.
+- **`claude rc` daemon** — spawned at platform boot by `rc-daemon.ts`. One supervised daemon per account; owns the long-lived composer session that backs claude.ai/code Remote Control. Master fd held for the daemon's lifetime, released on natural exit / restart. **Headless consent pre-seed (Task 578).** Before the first spawn, `ensureRemoteControlConsent` writes `{"remoteControlAtStartup": true}` into `$CLAUDE_CONFIG_DIR/.claude.json` (read-merge-write, atomic tmp+rename, idempotent). Without this, headless `claude rc` hangs at `Enable Remote Control? (y/n)` — nothing answers, the supervisor restarts the child, eventually marks the daemon permanently-failed. The key is the same one `claude` itself writes when the user answers `y` at the prompt; siblings (`teammateMode`, `hasUsedRemoteControl`, claude's auth blocks) are preserved.
 - **`claude --remote-control` on-device sidebar spawn** — spawned per-click by `/rc-spawn` in `http-server.ts`. One PTY per click; the manager holds the master fd **for the session's entire lifetime**. The pty master IS the live session — claude operates on the slave, and closing the master hangs up the slave. Valid master-release points: (1) explicit operator teardown — `/stop` → `stopSession` → `op=archive-release` — and (2) the natural-exit path inside `pty.onExit → handlePtyNaturalExit`.
 
 Inside the scope, `sh -c 'trap "" HUP; exec "$@"' sh <claudeBin> <args...>` keeps claude resident across PTY master-close (SIGHUP trap) and preserves the pid through the exec chain. The earlier `script(1)` wrap and the non-PTY scope primitive (Tasks 552/556/562) are gone; node-pty allocates the TTY directly.
@@ -244,7 +244,7 @@ Inside the scope, `sh -c 'trap "" HUP; exec "$@"' sh <claudeBin> <args...>` keep
 
 `verified=true` requires `master-fd=closed` AND `fdDelta>=1` AND `trackerRemoved=true`. `master-fd=close-failed` is logged at error level (`[rc-spawn-error]` prefix) — never swallowed; the next post-archive sweep is the catch-net.
 
-**Cross-arm `[rc-life]` schema.** rc-spawn and rc-daemon emit a shared log shape so the populations can be compared from `server.log` alone. One spawn's full lifeline is `grep <unitToken>`; one surface's signature is `grep 'source=rc-spawn'` or `'source=rc-daemon'`. Success on both surfaces is `op=pidfile-present`; failure is `op=spawn-failed` / `op=early-exit` / `op=wait-pid-failed`. Full schema and operator runbook in [`.docs/rc-life-observability.md`](../../../.docs/rc-life-observability.md).
+**Cross-arm `[rc-life]` schema.** rc-spawn and rc-daemon emit a shared log shape so the populations can be compared from `server.log` alone. One spawn's full lifeline is `grep <unitToken>`; one surface's signature is `grep 'source=rc-spawn'` or `'source=rc-daemon'`. Success on both surfaces is `op=pidfile-present`; failure is `op=spawn-failed` / `op=early-exit` / `op=wait-pid-failed`. Full schema and operator runbook in [`.docs/rc-life-observability.md`](../../../.docs/rc-life-observability.md). **Measured `remoteBound` (Task 578).** The rc-daemon liveness emit reports `remoteBound` as a measured value flipped by `detectRcHandshake` once the daemon's own post-bind output (`Capacity:` header or an `N of M` capacity line) is seen on the PTY. A daemon that is alive but not registered to Remote Control therefore prints `pidAlive=true remoteBound=false` — previously masked by a hardcoded literal. A class-guard test (`rc-life-literals.test.ts`) scans every `emitRcLife` call across the manager and fails if any status-shaped field is set to a boolean/string literal. The captured PTY output is now dumped on **every** exit (not only fast exits), prefix `exit-output` or `fast-exit-output`, so a late-life prompt-hang is no longer invisible.
 
 **Post-archive fd sweep (Task 558).** Independent of spawn/archive request traffic, the manager runs a 60 s sweep that walks both directions of the master-fd invariant:
 
@@ -3134,7 +3134,7 @@ Each log entry includes the tool name and a truncated conversation ID for correl
 
 Every durable action — cloudflare tunnel-login, brand publish, future deterministic flows — emits a `:Task {kind:"<flow>"}` node carrying the action's lifecycle and a `:PRODUCED` edge to every entity the action created. This makes the graph traversable from the originating Conversation to every entity created during it via `(c)<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e)` — answering "what did this turn produce" in one Cypher hop.
 
-The doctrine is enforced at the storage primitive: writes to `:Person`, `:UserProfile`, `:AdminUser`, `:Organization`, `:LocalBusiness`, `:CloudflareTunnel`, or `:CloudflareHostname` MUST include at least one inbound `:PRODUCED` edge whose source is one of `:Task`, `:Conversation`, or `:Message`. Subtype labels like `:AdminConversation`, `:UserMessage`, `:AssistantMessage`, `:AdminMessage` qualify because the gate checks the full `labels()` array. Bootstrap writes (PIN-setup, schema migrations, lazy first-session UserProfile creation) are exempt via `createdBy.agent === 'system'`.
+The doctrine is observed at the storage primitive: writes to `:Person`, `:UserProfile`, `:AdminUser`, `:Organization`, `:LocalBusiness`, `:CloudflareTunnel`, or `:CloudflareHostname` should carry an inbound `:PRODUCED` edge whose source is one of `:Task`, `:Conversation`, or `:Message`. Subtype labels like `:AdminConversation`, `:UserMessage`, `:AssistantMessage`, `:AdminMessage` qualify because the gate checks the full `labels()` array. Bootstrap writes (PIN-setup, schema migrations, lazy first-session UserProfile creation) are exempt via `createdBy.agent === 'system'`. When no qualifying edge resolves, the primitive emits a `[graph-write] warn reason=missing-provenance labels=<csv> agent=<agentLabel>` line and the write proceeds (Task 580 relaxed this from a hard reject — the composer-spawned admin path inherits a bare per-account env that never receives the `SESSION_NODE_ID` stamp, so the throw was failing every direct admin contact-create / memory-write for a gated label).
 
 Two surfaces emit the lifecycle: agent-driven actions call `work-create`/`work-update`/`work-complete` over MCP (`work-create` accepts `kind`, the canonical `inputsProvided` call-shape record, `inputs` + `inputSchema` for the operator-meaningful form payload, and `raisedDuringConversationKey` to resolve the `RAISED_DURING` edge). Shell-driven actions wrap their script invocation in [platform/ui/app/lib/cloudflare-task-tracker.ts](../../../ui/app/lib/cloudflare-task-tracker.ts) (cloudflare is the first; installer / brand-publish / OAuth-login deferred). Both surfaces emit the same `[task] action-start|step|done` log lines so operators can grep one channel uniformly. Both also call the central `redactSecrets` primitive ([platform/lib/task-secrets/](../../../lib/task-secrets/)) to strip schema-tagged secret keys before persisting `inputs.<field>` props on the Task — see `.docs/neo4j.md § Audit Task input contract` for the contract that replaces per-kind allow-lists.
 
@@ -3630,6 +3630,13 @@ tail -200 ~/.maxy/logs/maxy-ui.log | rg '\[remote-auth\].*resolvedKind='
 2. `diff <(jq .claudeAiOauth.accessToken ~/.maxy/.claude/.credentials.json) <(jq .claudeAiOauth.accessToken ~/.realagent/.claude/.credentials.json)` — must be non-empty after each brand's operator has run `claude /login` against distinct Anthropic accounts; if it's empty, both brands are still logged in to the same account (operator action, not a code bug).
 3. `grep "\[install\] claude-creds pickup" ~/.${brand}/logs/install-*.log` — fires once on the first post-Task-923 install of any brand and moves the legacy `~/.claude/.credentials.json` into that brand's path. Subsequent brands install with no credentials and require a fresh `claude /login` inside that brand's chat (which writes to the brand-scoped path because the systemd unit env is in scope).
 
+**All sessions on the brand stopped responding after a token expiry.** Symptom on the operator side: every spawn dies at `pid-file-timeout` and the dashboard health probe reports auth dead. Diagnose the OAuth refresh path before anything else:
+
+1. `tail -n 300 ~/.${brand}/logs/server.log | grep -E 'auth-refresh|auth-health|invalid_grant'` — `op=lock-acquired` proves the cross-process lock is in play (Task 576). `op=skipped-fresh` means a sibling process (the admin server or a `claude` binary) already rotated the tokens during the lock wait — expected, healthy. `op=renewed expiresAt=…` is the only line that means a network refresh actually ran.
+2. `outcome=fail-token` or `invalid_grant` lines mean Anthropic rejected the refresh token itself (revoked or expired beyond the rotation window). The brand needs a fresh `claude /login`. Pre-576 the most common cause was the admin server and a spawned `claude` racing to rotate the same single-use refresh token; that race is now serialised by the file lock at `~/.${brand}/.claude/.credentials.json.lock` and a re-read after the lock skips redundant refreshes.
+3. `grep '\[auth-health\]' ~/.${brand}/logs/server.log | tail -n 5` — the heartbeat fires every five minutes. `status=dead expiresIn=...` means the refresh token is gone; only a re-login fixes it. `status=ok` heartbeats with no spawns in between mean the credentials file is healthy and the failure lives elsewhere.
+4. The spawn-failure surface now carries `reason=auth-refresh-failed` (with `authStatus` in the JSON body) instead of generic `pid-file-timeout` whenever the credentials file is in `dead` or `expired` state at the moment of failure — visible in `grep '\[spawn-failed\]'` on server.log.
+
 ---
 
 ## Memory Not Working

package/payload/platform/plugins/admin/skills/plugin-management/SKILL.md

@@ -34,7 +34,7 @@ Built-in plugins under `$PLATFORM_ROOT/plugins/`:
 
 - Enable: call `plugin-toggle-enabled` with `pluginName` and `action: "enable"`. Activates the plugin's behaviour embed and MCP server from the next session. Plugins with scheduled behaviour (declared via `lifecycle` in PLUGIN.md frontmatter) are activated automatically by the platform heartbeat within one minute — no separate setup command needed.
 - Disable: call `plugin-toggle-enabled` with `pluginName` and `action: "disable"`. Deactivates from the next session. Any scheduled Events owned by the plugin (`sourcePlugin` field) are cancelled automatically by the platform heartbeat.
-- The tool refuses core plugins (admin, memory, docs, cloudflare) and refuses plugins not installed under `$PLATFORM_ROOT/plugins/`. Direct `Edit` of `account.json` is denied by the pre-tool-use hook — `plugin-toggle-enabled` is the only legitimate path.
+- The tool refuses core plugins (admin, memory, docs, cloudflare) and refuses plugins not installed under `$PLATFORM_ROOT/plugins/`. Direct `Edit` of `account.json` is forbidden by IDENTITY.md doctrine — `plugin-toggle-enabled` is the only legitimate path.
 
 ## Premium Plugins
 
@@ -50,7 +50,7 @@ When the user asks about a specific premium plugin (e.g., "tell me about the tea
 
 ### Recording a purchase
 
-`purchasedPlugins` is an entitlement-bearing field: the effective list derives from the Rubytech-signed entitlement payload, not from raw `account.json`. The pre-tool-use hook denies any agent write to `account.json`. Direct purchase recording is therefore unavailable to the agent.
+`purchasedPlugins` is an entitlement-bearing field: the effective list derives from the Rubytech-signed entitlement payload, not from raw `account.json`. IDENTITY.md doctrine forbids any agent write to `account.json`. Direct purchase recording is therefore unavailable to the agent.
 
 - **Production path:** the Rubytech-side issuance endpoint signs an updated entitlement payload after a Stripe purchase event and delivers it to `~/<configDir>/entitlement.json`. The verifier picks up the new payload at the next session start.
 - **Pre-launch / dev path:** the founder runs `node platform/scripts/generate-entitlement-fixture.mjs sign --account-id <id> --email <e> --tier <t> --plugins a,b,c --out ~/<configDir>/entitlement.json` to produce a signed test payload. The agent does not invoke this script.

package/payload/platform/plugins/contacts/PLUGIN.md

@@ -55,8 +55,8 @@ Tools are available via the `contacts` MCP server.
 
 ## Provenance anchoring
 
-`contact-create` writes a `:Person` node, which is one of the action-provenance-gated labels in `writeNodeWithEdges`. The write must carry an inbound `:PRODUCED` edge from `:Task`, `:Conversation`, or `:Message`. There is no agent-visible field for this — the admin server stamps `SESSION_NODE_ID` (the `sessionId` UUID of the active `:AdminConversation`) at MCP spawn time, and the wrapper auto-injects the `:PRODUCED` edge via `injectConversationProvenance`. The helper MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is enforced inside the natural key, not as a separate gate, so a cross-account env-stamp returns zero rows and never injects.
+`contact-create` writes a `:Person` node, which is one of the action-provenance-gated labels in `writeNodeWithEdges`. The write should carry an inbound `:PRODUCED` edge from `:Task`, `:Conversation`, or `:Message`. There is no agent-visible field for this — the admin server stamps `SESSION_NODE_ID` (the `sessionId` UUID of the active `:AdminConversation`) at MCP spawn time, and the wrapper auto-injects the `:PRODUCED` edge via `injectConversationProvenance`. The helper MATCHes `(c:Conversation {sessionId, accountId})` — account isolation is enforced inside the natural key, not as a separate gate, so a cross-account env-stamp returns zero rows and never injects.
 
-The agent passes whichever organic relationships are appropriate (`PARTICIPATES_IN` to a Conversation, `WORKS_FOR` to an Organization, `KNOWN_VIA` to a referral source) — the provenance edge is composed automatically and is not an agent concern. When the env-stamp resolution fails (loud `[mcp:contacts] [provenance-missing] reason=<...>`), the downstream gate emits `missing-provenance` and the write fails closed.
+The agent passes whichever organic relationships are appropriate (`PARTICIPATES_IN` to a Conversation, `WORKS_FOR` to an Organization, `KNOWN_VIA` to a referral source) — the provenance edge is composed automatically and is not an agent concern. When the env-stamp resolution fails (loud `[mcp:contacts] [provenance-missing] reason=<...>`), the downstream gate emits a `[graph-write] warn reason=missing-provenance labels=<csv> agent=<agentLabel>` line and the write proceeds (Task 580 relaxed this from a hard reject). The warn carries the labels and agent so operators can quantify how often the gap fires; the upstream `[provenance-missing]` line names the resolution failure that caused it.
 
 See [.docs/neo4j.md § Process provenance doctrine](../../../.docs/neo4j.md) for the doctrine and observability surface.

package/payload/platform/plugins/docs/references/internals.md

@@ -502,7 +502,7 @@ Each log entry includes the tool name and a truncated conversation ID for correl
 
 Every durable action — cloudflare tunnel-login, brand publish, future deterministic flows — emits a `:Task {kind:"<flow>"}` node carrying the action's lifecycle and a `:PRODUCED` edge to every entity the action created. This makes the graph traversable from the originating Conversation to every entity created during it via `(c)<-[:RAISED_DURING]-(t:Task)-[:PRODUCED]->(e)` — answering "what did this turn produce" in one Cypher hop.
 
-The doctrine is enforced at the storage primitive: writes to `:Person`, `:UserProfile`, `:AdminUser`, `:Organization`, `:LocalBusiness`, `:CloudflareTunnel`, or `:CloudflareHostname` MUST include at least one inbound `:PRODUCED` edge whose source is one of `:Task`, `:Conversation`, or `:Message`. Subtype labels like `:AdminConversation`, `:UserMessage`, `:AssistantMessage`, `:AdminMessage` qualify because the gate checks the full `labels()` array. Bootstrap writes (PIN-setup, schema migrations, lazy first-session UserProfile creation) are exempt via `createdBy.agent === 'system'`.
+The doctrine is observed at the storage primitive: writes to `:Person`, `:UserProfile`, `:AdminUser`, `:Organization`, `:LocalBusiness`, `:CloudflareTunnel`, or `:CloudflareHostname` should carry an inbound `:PRODUCED` edge whose source is one of `:Task`, `:Conversation`, or `:Message`. Subtype labels like `:AdminConversation`, `:UserMessage`, `:AssistantMessage`, `:AdminMessage` qualify because the gate checks the full `labels()` array. Bootstrap writes (PIN-setup, schema migrations, lazy first-session UserProfile creation) are exempt via `createdBy.agent === 'system'`. When no qualifying edge resolves, the primitive emits a `[graph-write] warn reason=missing-provenance labels=<csv> agent=<agentLabel>` line and the write proceeds (Task 580 relaxed this from a hard reject — the composer-spawned admin path inherits a bare per-account env that never receives the `SESSION_NODE_ID` stamp, so the throw was failing every direct admin contact-create / memory-write for a gated label).
 
 Two surfaces emit the lifecycle: agent-driven actions call `work-create`/`work-update`/`work-complete` over MCP (`work-create` accepts `kind`, the canonical `inputsProvided` call-shape record, `inputs` + `inputSchema` for the operator-meaningful form payload, and `raisedDuringConversationKey` to resolve the `RAISED_DURING` edge). Shell-driven actions wrap their script invocation in [platform/ui/app/lib/cloudflare-task-tracker.ts](../../../ui/app/lib/cloudflare-task-tracker.ts) (cloudflare is the first; installer / brand-publish / OAuth-login deferred). Both surfaces emit the same `[task] action-start|step|done` log lines so operators can grep one channel uniformly. Both also call the central `redactSecrets` primitive ([platform/lib/task-secrets/](../../../lib/task-secrets/)) to strip schema-tagged secret keys before persisting `inputs.<field>` props on the Task — see `.docs/neo4j.md § Audit Task input contract` for the contract that replaces per-kind allow-lists.
 

package/payload/platform/plugins/docs/references/platform.md

@@ -108,7 +108,7 @@ Each session row also carries a small muted timestamp crumb under the name showi
 
 **Two spawn surfaces, one primitive (Task 573).** The manager runs two on-device spawn surfaces, both backed by the same primitive: **node-pty wrapped in `systemd-run --user --scope`** (via `index.ts::spawnPtyAdapter`).
 
-- **`claude rc` daemon** — spawned at platform boot by `rc-daemon.ts`. One supervised daemon per account; owns the long-lived composer session that backs claude.ai/code Remote Control. Master fd held for the daemon's lifetime, released on natural exit / restart.
+- **`claude rc` daemon** — spawned at platform boot by `rc-daemon.ts`. One supervised daemon per account; owns the long-lived composer session that backs claude.ai/code Remote Control. Master fd held for the daemon's lifetime, released on natural exit / restart. **Headless consent pre-seed (Task 578).** Before the first spawn, `ensureRemoteControlConsent` writes `{"remoteControlAtStartup": true}` into `$CLAUDE_CONFIG_DIR/.claude.json` (read-merge-write, atomic tmp+rename, idempotent). Without this, headless `claude rc` hangs at `Enable Remote Control? (y/n)` — nothing answers, the supervisor restarts the child, eventually marks the daemon permanently-failed. The key is the same one `claude` itself writes when the user answers `y` at the prompt; siblings (`teammateMode`, `hasUsedRemoteControl`, claude's auth blocks) are preserved.
 - **`claude --remote-control` on-device sidebar spawn** — spawned per-click by `/rc-spawn` in `http-server.ts`. One PTY per click; the manager holds the master fd **for the session's entire lifetime**. The pty master IS the live session — claude operates on the slave, and closing the master hangs up the slave. Valid master-release points: (1) explicit operator teardown — `/stop` → `stopSession` → `op=archive-release` — and (2) the natural-exit path inside `pty.onExit → handlePtyNaturalExit`.
 
 Inside the scope, `sh -c 'trap "" HUP; exec "$@"' sh <claudeBin> <args...>` keeps claude resident across PTY master-close (SIGHUP trap) and preserves the pid through the exec chain. The earlier `script(1)` wrap and the non-PTY scope primitive (Tasks 552/556/562) are gone; node-pty allocates the TTY directly.
@@ -132,7 +132,7 @@ Inside the scope, `sh -c 'trap "" HUP; exec "$@"' sh <claudeBin> <args...>` keep
 
 `verified=true` requires `master-fd=closed` AND `fdDelta>=1` AND `trackerRemoved=true`. `master-fd=close-failed` is logged at error level (`[rc-spawn-error]` prefix) — never swallowed; the next post-archive sweep is the catch-net.
 
-**Cross-arm `[rc-life]` schema.** rc-spawn and rc-daemon emit a shared log shape so the populations can be compared from `server.log` alone. One spawn's full lifeline is `grep <unitToken>`; one surface's signature is `grep 'source=rc-spawn'` or `'source=rc-daemon'`. Success on both surfaces is `op=pidfile-present`; failure is `op=spawn-failed` / `op=early-exit` / `op=wait-pid-failed`. Full schema and operator runbook in [`.docs/rc-life-observability.md`](../../../.docs/rc-life-observability.md).
+**Cross-arm `[rc-life]` schema.** rc-spawn and rc-daemon emit a shared log shape so the populations can be compared from `server.log` alone. One spawn's full lifeline is `grep <unitToken>`; one surface's signature is `grep 'source=rc-spawn'` or `'source=rc-daemon'`. Success on both surfaces is `op=pidfile-present`; failure is `op=spawn-failed` / `op=early-exit` / `op=wait-pid-failed`. Full schema and operator runbook in [`.docs/rc-life-observability.md`](../../../.docs/rc-life-observability.md). **Measured `remoteBound` (Task 578).** The rc-daemon liveness emit reports `remoteBound` as a measured value flipped by `detectRcHandshake` once the daemon's own post-bind output (`Capacity:` header or an `N of M` capacity line) is seen on the PTY. A daemon that is alive but not registered to Remote Control therefore prints `pidAlive=true remoteBound=false` — previously masked by a hardcoded literal. A class-guard test (`rc-life-literals.test.ts`) scans every `emitRcLife` call across the manager and fails if any status-shaped field is set to a boolean/string literal. The captured PTY output is now dumped on **every** exit (not only fast exits), prefix `exit-output` or `fast-exit-output`, so a late-life prompt-hang is no longer invisible.
 
 **Post-archive fd sweep (Task 558).** Independent of spawn/archive request traffic, the manager runs a 60 s sweep that walks both directions of the master-fd invariant:
 

package/payload/platform/plugins/docs/references/troubleshooting.md

@@ -89,6 +89,13 @@ tail -200 ~/.maxy/logs/maxy-ui.log | rg '\[remote-auth\].*resolvedKind='
 2. `diff <(jq .claudeAiOauth.accessToken ~/.maxy/.claude/.credentials.json) <(jq .claudeAiOauth.accessToken ~/.realagent/.claude/.credentials.json)` — must be non-empty after each brand's operator has run `claude /login` against distinct Anthropic accounts; if it's empty, both brands are still logged in to the same account (operator action, not a code bug).
 3. `grep "\[install\] claude-creds pickup" ~/.${brand}/logs/install-*.log` — fires once on the first post-Task-923 install of any brand and moves the legacy `~/.claude/.credentials.json` into that brand's path. Subsequent brands install with no credentials and require a fresh `claude /login` inside that brand's chat (which writes to the brand-scoped path because the systemd unit env is in scope).
 
+**All sessions on the brand stopped responding after a token expiry.** Symptom on the operator side: every spawn dies at `pid-file-timeout` and the dashboard health probe reports auth dead. Diagnose the OAuth refresh path before anything else:
+
+1. `tail -n 300 ~/.${brand}/logs/server.log | grep -E 'auth-refresh|auth-health|invalid_grant'` — `op=lock-acquired` proves the cross-process lock is in play (Task 576). `op=skipped-fresh` means a sibling process (the admin server or a `claude` binary) already rotated the tokens during the lock wait — expected, healthy. `op=renewed expiresAt=…` is the only line that means a network refresh actually ran.
+2. `outcome=fail-token` or `invalid_grant` lines mean Anthropic rejected the refresh token itself (revoked or expired beyond the rotation window). The brand needs a fresh `claude /login`. Pre-576 the most common cause was the admin server and a spawned `claude` racing to rotate the same single-use refresh token; that race is now serialised by the file lock at `~/.${brand}/.claude/.credentials.json.lock` and a re-read after the lock skips redundant refreshes.
+3. `grep '\[auth-health\]' ~/.${brand}/logs/server.log | tail -n 5` — the heartbeat fires every five minutes. `status=dead expiresIn=...` means the refresh token is gone; only a re-login fixes it. `status=ok` heartbeats with no spawns in between mean the credentials file is healthy and the failure lives elsewhere.
+4. The spawn-failure surface now carries `reason=auth-refresh-failed` (with `authStatus` in the JSON body) instead of generic `pid-file-timeout` whenever the credentials file is in `dead` or `expired` state at the moment of failure — visible in `grep '\[spawn-failed\]'` on server.log.
+
 ---
 
 ## Memory Not Working

package/payload/platform/plugins/memory/PLUGIN.md

@@ -175,7 +175,7 @@ Every node in the graph sits under a parent in the canonical chain `LocalBusines
 
 ## Anchoring writes to provenance — `producedByTaskId` and the conversation env-stamp
 
-Writes targeting `:Person`, `:UserProfile`, `:AdminUser`, `:Organization`, `:LocalBusiness`, `:CloudflareTunnel`, or `:CloudflareHostname` require an inbound `:PRODUCED` edge whose source is one of `:Task`, `:Conversation`, or `:Message` (deterministic bootstrap paths run as `createdBy.agent === 'system'` and are exempt). Two surfaces feed the gate:
+Writes targeting `:Person`, `:UserProfile`, `:AdminUser`, `:Organization`, `:LocalBusiness`, `:CloudflareTunnel`, or `:CloudflareHostname` expect an inbound `:PRODUCED` edge whose source is one of `:Task`, `:Conversation`, or `:Message` (deterministic bootstrap paths run as `createdBy.agent === 'system'` and are exempt). The expectation is enforced as a soft warning, not a reject: when no qualifying edge resolves the storage primitive emits a single `[graph-write] warn reason=missing-provenance labels=<csv> agent=<agentLabel>` line on stderr and the write proceeds. Task 580 relaxed this from a hard throw — the composer-spawned admin path inherits a bare per-account env that never receives the `SESSION_NODE_ID` stamp, so the throw was failing every direct admin contact-create / memory-write for a gated label. The two stamping surfaces below remain the right thing to use; the warn line is the operator-visible signal for how often the gap fires. Two surfaces feed the stamp:
 
 - **Workflow path — `producedByTaskId`.** `memory-write` accepts an optional `producedByTaskId` parameter. When set, the platform composes an inbound `:PRODUCED` edge from that `:Task` node into the write's `relationships` array before the write runs. The Task and the new node must share the same `accountId`; mismatch is rejected loud. The typical pattern: call `work-create` at the start of an autonomous flow (onboarding skill, cloudflare tunnel-login) with `kind` and `raisedDuringConversationKey`; capture the returned `taskId`; pass it as `producedByTaskId` on every subsequent `memory-write` for one of the gated labels.
 

package/payload/platform/plugins/memory/references/graph-primitives.md

@@ -99,8 +99,8 @@ graph as a single action.
 **Never run `cypher-shell` via `Bash` to work around the read-only tool.**
 The admin session's `Bash` surface has no path to the per-brand Neo4j
 password (it lives in `${PLATFORM_ROOT}/config/.neo4j-password`,
-unreachable from the admin account's `Bash` cwd, and pre-tool-use hooks
-block `Bash` against the code tree anyway — `.docs/neo4j.md`'s migration
+unreachable from the admin account's `Bash` cwd, and IDENTITY.md doctrine
+forbids `Bash` against the code tree anyway — `.docs/neo4j.md`'s migration
 section is an operator-run runbook, not a path you should replicate in
 chat). Every write intent has a schema-aware tool above. If none of them
 fits, tell the user plainly: *"This operation is not in the admin tool

package/payload/platform/plugins/url-get/mcp/dist/tools/url-get.d.ts

@@ -1,12 +1,13 @@
 export interface UrlGetParams {
     url: string;
 }
-export type UrlGetError = "fetch" | "http" | "non-html" | "challenge" | "empty" | "no-account-dir";
+export type UrlGetError = "fetch" | "http" | "non-html" | "challenge" | "no-account-dir";
 export type UrlGetResult = {
     ok: true;
     url: string;
     httpStatus: number;
     bytes: number;
+    textLength: number;
     referencePath: string;
     summary: string;
     summarized: boolean;

package/payload/platform/plugins/url-get/mcp/dist/tools/url-get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"url-get.d.ts","sourceRoot":"","sources":["../../src/tools/url-get.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,OAAO,GAAG,gBAAgB,CAAC;AAEnG,MAAM,MAAM,YAAY,GACpB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAyCN,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAqGxE"}
+{"version":3,"file":"url-get.d.ts","sourceRoot":"","sources":["../../src/tools/url-get.ts"],"names":[],"mappings":"AAsBA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAEzF,MAAM,MAAM,YAAY,GACpB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;CACrB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAyCN,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA2GxE"}

package/payload/platform/plugins/url-get/mcp/dist/tools/url-get.js

@@ -98,16 +98,11 @@ export async function urlGet(params) {
         };
     }
     const markdown = NodeHtmlMarkdown.translate(html).trim();
-    if (markdown.length === 0) {
-        console.error(`[url-get] url=${url} error=empty`);
-        return {
-            ok: false,
-            url,
-            error: "empty",
-            httpStatus,
-            message: "page has no readable text content",
-        };
-    }
+    const textLength = markdown.length;
+    // HTTP 200 is success. Empty extractable text is a property of the response,
+    // not an error: a JS-rendered SPA shell legitimately has zero markdown bytes
+    // until the bundle runs. Surface `textLength` so the caller can decide
+    // whether to fall back to browser-render; never invert the success signal.
     const accountDir = resolveAccountDir();
     if (!accountDir) {
         console.error(`[url-get] url=${url} error=no-account-dir`);
@@ -128,20 +123,31 @@ export async function urlGet(params) {
     await writeFile(referencePath, fileBody, "utf-8");
     // Summary is derived and best-effort. The verbatim file is the contract and
     // is already on disk; a summary failure degrades gracefully rather than
-    // discarding the artefact.
+    // discarding the artefact. On empty extractable text we short-circuit with a
+    // synthesised summary — calling the LLM on zero input either fails or
+    // hallucinates, neither of which serves the agent.
     let summary;
     let summarized;
-    try {
-        summary = await summarise(url, markdown.slice(0, SUMMARY_INPUT_CAP));
-        summarized = true;
-    }
-    catch (err) {
-        const detail = err instanceof Error ? err.message : String(err);
-        summary = `<summary unavailable: ${detail}> — read the reference file at ${referencePath} for the full text.`;
+    if (textLength === 0) {
+        summary =
+            `Page returned HTTP ${httpStatus} but had no extractable text content ` +
+                `(textLength=0; bytes=${bytes}). The response is likely a JavaScript-` +
+                `rendered shell; use browser-render to retrieve the rendered DOM.`;
         summarized = false;
     }
-    console.error(`[url-get] url=${url} httpStatus=${httpStatus} bytes=${bytes} refPath=${referencePath} ` +
-        `summarized=${summarized} (${Date.now() - t0}ms)`);
-    return { ok: true, url, httpStatus, bytes, referencePath, summary, summarized };
+    else {
+        try {
+            summary = await summarise(url, markdown.slice(0, SUMMARY_INPUT_CAP));
+            summarized = true;
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            summary = `<summary unavailable: ${detail}> — read the reference file at ${referencePath} for the full text.`;
+            summarized = false;
+        }
+    }
+    console.error(`[url-get] url=${url} httpStatus=${httpStatus} bytes=${bytes} textLength=${textLength} ` +
+        `refPath=${referencePath} summarized=${summarized} (${Date.now() - t0}ms)`);
+    return { ok: true, url, httpStatus, bytes, textLength, referencePath, summary, summarized };
 }
 //# sourceMappingURL=url-get.js.map

package/payload/platform/plugins/url-get/mcp/dist/tools/url-get.js.map

@@ -1 +1 @@
-{"version":3,"file":"url-get.js","sourceRoot":"","sources":["../../src/tools/url-get.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,iGAAiG;AACjG,2FAA2F;AAC3F,2FAA2F;AAC3F,+FAA+F;AAC/F,mGAAmG;AACnG,kGAAkG;AAClG,qGAAqG;AACrG,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,+EAA+E;AAC/E,yEAAyE;AACzE,+DAA+D;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA0BhD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GACd,qEAAqE;IACrE,gDAAgD,CAAC;AAEnD,4EAA4E;AAC5E,4EAA4E;AAC5E,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG;IAC3B,8BAA8B;IAC9B,yBAAyB;IACzB,2CAA2C;IAC3C,wCAAwC;IACxC,kCAAkC;IAClC,sBAAsB;CACvB,CAAC;AAEF;;;;mDAImD;AACnD,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,IAAI,YAAY,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAoB;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtB,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC7C,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,iCAAiC,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,eAAe,UAAU,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,+BAA+B,WAAW,EAAE,CAAC,CAAC;QAChF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,KAAK,EAAE,UAAU;YACjB,UAAU;YACV,OAAO,EAAE,6BAA6B,WAAW,8CAA8C;SAChG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE/C,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,kBAAkB,CAAC,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,OAAO,EAAE,yDAAyD;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,cAAc,CAAC,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,KAAK,EAAE,OAAO;YACd,UAAU;YACV,OAAO,EAAE,mCAAmC;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,KAAK,EAAE,gBAAgB;YACvB,UAAU;YACV,OAAO,EAAE,mFAAmF;SAC7F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,GAAG,cAAc,SAAS,eAAe,UAAU,WAAW,QAAQ,IAAI,CAAC;IACnH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElD,4EAA4E;IAC5E,wEAAwE;IACxE,2BAA2B;IAC3B,IAAI,OAAe,CAAC;IACpB,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACrE,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,GAAG,yBAAyB,MAAM,kCAAkC,aAAa,qBAAqB,CAAC;QAC9G,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,KAAK,CACX,iBAAiB,GAAG,eAAe,UAAU,UAAU,KAAK,YAAY,aAAa,GAAG;QACtF,cAAc,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CACpD,CAAC;IAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"url-get.js","sourceRoot":"","sources":["../../src/tools/url-get.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,iGAAiG;AACjG,2FAA2F;AAC3F,2FAA2F;AAC3F,+FAA+F;AAC/F,mGAAmG;AACnG,kGAAkG;AAClG,qGAAqG;AACrG,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,+EAA+E;AAC/E,yEAAyE;AACzE,+DAA+D;AAE/D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AA2BhD,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GACd,qEAAqE;IACrE,gDAAgD,CAAC;AAEnD,4EAA4E;AAC5E,4EAA4E;AAC5E,2DAA2D;AAC3D,MAAM,oBAAoB,GAAG;IAC3B,8BAA8B;IAC9B,yBAAyB;IACzB,2CAA2C;IAC3C,wCAAwC;IACxC,kCAAkC;IAClC,sBAAsB;CACvB,CAAC;AAEF;;;;mDAImD;AACnD,SAAS,iBAAiB;IACxB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACvC,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzC,IAAI,YAAY,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAoB;IAC/C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEtB,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;YAC7C,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,iCAAiC,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,eAAe,UAAU,EAAE,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,UAAU,EAAE,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1E,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,+BAA+B,WAAW,EAAE,CAAC,CAAC;QAChF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,KAAK,EAAE,UAAU;YACjB,UAAU;YACV,OAAO,EAAE,6BAA6B,WAAW,8CAA8C;SAChG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAE/C,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,kBAAkB,CAAC,CAAC;QACtD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,KAAK,EAAE,WAAW;YAClB,UAAU;YACV,OAAO,EAAE,yDAAyD;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IAEnC,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,2EAA2E;IAE3E,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,iBAAiB,GAAG,uBAAuB,CAAC,CAAC;QAC3D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,GAAG;YACH,KAAK,EAAE,gBAAgB;YACvB,UAAU;YACV,OAAO,EAAE,mFAAmF;SAC7F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,KAAK,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,GAAG,cAAc,SAAS,eAAe,UAAU,WAAW,QAAQ,IAAI,CAAC;IACnH,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAElD,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,OAAe,CAAC;IACpB,IAAI,UAAmB,CAAC;IACxB,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,sBAAsB,UAAU,uCAAuC;gBACvE,wBAAwB,KAAK,yCAAyC;gBACtE,kEAAkE,CAAC;QACrE,UAAU,GAAG,KAAK,CAAC;IACrB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;YACrE,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO,GAAG,yBAAyB,MAAM,kCAAkC,aAAa,qBAAqB,CAAC;YAC9G,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,KAAK,CACX,iBAAiB,GAAG,eAAe,UAAU,UAAU,KAAK,eAAe,UAAU,GAAG;QACtF,WAAW,aAAa,eAAe,UAAU,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAC7E,CAAC;IAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AAC9F,CAAC"}

package/payload/platform/scripts/check-no-esm-require.mjs

@@ -41,6 +41,9 @@ const ALLOWLIST = new Set([
   // Same vi.hoisted pattern: Task 549's sidebar-sessions test pre-builds a
   // tmpdir before the module-under-test's ACCOUNTS_DIR mock is wired.
   'platform/ui/server/routes/admin/__tests__/sidebar-sessions.test.ts',
+  // Same vi.hoisted pattern: Task 576's claude-auth refresh-lock test
+  // builds a tmpdir + creds path before the module's `../paths` mock fires.
+  'platform/ui/app/lib/__tests__/claude-auth-refresh-lock.test.ts',
 ])
 
 const REQUIRE_CALL_RE = /\brequire\s*\(/

package/payload/platform/scripts/setup-account.sh

@@ -66,14 +66,12 @@ cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
       {
         "matcher": "Write",
         "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
         ]
       },
       {
         "matcher": "Edit",
         "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
         ]
       },
@@ -86,22 +84,9 @@ cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
       {
         "matcher": "Bash",
         "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" },
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }
         ]
       },
-      {
-        "matcher": "mcp__plugin_memory_memory__memory-write",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" }
-        ]
-      },
-      {
-        "matcher": "mcp__plugin_memory_memory__memory-update",
-        "hooks": [
-          { "type": "command", "command": "bash $HOOKS_PATH/pre-tool-use.sh admin" }
-        ]
-      },
       {
         "hooks": [
           { "type": "command", "command": "bash $HOOKS_PATH/archive-ingest-surface-gate.sh" }

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.d.ts

@@ -0,0 +1,4 @@
+export type AuthSnapshot = 'dead' | 'expired' | 'unknown';
+export declare function credentialsPathForConfigDir(claudeConfigDir: string): string;
+export declare function snapshotAuthForFailureReason(credentialsPath: string | undefined): AuthSnapshot;
+//# sourceMappingURL=auth-snapshot.d.ts.map

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-snapshot.d.ts","sourceRoot":"","sources":["../src/auth-snapshot.ts"],"names":[],"mappings":"AAmBA,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,SAAS,CAAA;AAEzD,wBAAgB,2BAA2B,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,4BAA4B,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAqB9F"}

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.js

@@ -0,0 +1,50 @@
+/**
+ * Task 576 — auth-snapshot.
+ *
+ * Read-only, no-dependency snapshot of the OAuth credentials file used
+ * by the http-server spawn-failure path to surface `reason=auth-refresh-failed`
+ * to the operator instead of the generic `pid-file-timeout`. Lives in
+ * claude-session-manager so the failure path stays in one tree; the
+ * authoritative refresh + lock logic continues to live in
+ * `platform/ui/app/lib/claude-auth.ts`.
+ *
+ * Returns one of:
+ *  - `dead`    — token expired AND no refresh token available
+ *  - `expired` — token expired but a refresh token is on disk
+ *  - `unknown` — token still valid, or the file is missing / unreadable
+ *                (not auth's fault — let the original failure reason stand)
+ */
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+export function credentialsPathForConfigDir(claudeConfigDir) {
+    return resolve(claudeConfigDir, '.credentials.json');
+}
+export function snapshotAuthForFailureReason(credentialsPath) {
+    if (!credentialsPath)
+        return 'unknown';
+    let raw;
+    try {
+        raw = readFileSync(credentialsPath, 'utf-8');
+    }
+    catch {
+        return 'unknown';
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return 'unknown';
+    }
+    const oauth = parsed.claudeAiOauth;
+    if (!oauth || typeof oauth !== 'object')
+        return 'unknown';
+    const expiresAt = oauth.expiresAt;
+    if (typeof expiresAt !== 'number' || !Number.isFinite(expiresAt))
+        return 'unknown';
+    if (expiresAt > Date.now())
+        return 'unknown'; // not the auth path's fault
+    const refreshToken = oauth.refreshToken;
+    return typeof refreshToken === 'string' && refreshToken.length > 0 ? 'expired' : 'dead';
+}
+//# sourceMappingURL=auth-snapshot.js.map

package/payload/platform/services/claude-session-manager/dist/auth-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-snapshot.js","sourceRoot":"","sources":["../src/auth-snapshot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAInC,MAAM,UAAU,2BAA2B,CAAC,eAAuB;IACjE,OAAO,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,eAAmC;IAC9E,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAA;IACtC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAA+B,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAoD,CAAA;IACzE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IACzD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAA;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IAClF,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,SAAS,CAAA,CAAC,4BAA4B;IACzE,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;IACvC,OAAO,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;AACzF,CAAC"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAM3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAezB,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AA+E9E,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAI1D,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;CAC/B;AA4LD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAi4CpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAM3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAezB,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAgF9E,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAI1D,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;CAC/B;AA4LD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAs5CpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -31,6 +31,7 @@ import { readJsonlSession } from './jsonl-enumerator.js';
 import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, } from './jsonl-path.js';
 import { basename, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
+import { credentialsPathForConfigDir, snapshotAuthForFailureReason } from './auth-snapshot.js';
 const ROLES = ['admin', 'public'];
 const CHANNELS = ['browser', 'whatsapp', 'telegram', 'webchat', 'email'];
 // Task 382 — body.conversationNodeId shape gate. The value is the
@@ -672,7 +673,16 @@ export function buildHttpApp(deps) {
                 return c.json({ error: 'operator-slots-reserved', total: result.rejected.total, reserve: result.rejected.reserve, totalCap: result.rejected.totalCap }, 503);
             }
             timed(deps.logger, 'POST', '/spawn', 500, Date.now() - start);
-            return c.json({ error: 'spawn-failed', reason: result.reason, stderrTail: result.stderrTail }, 500);
+            // Task 576 — surface the auth-refresh-failed reason when the
+            // creds file says `dead` or `expired`. Without this the operator
+            // sees a generic `pid-file-timeout` for what is actually an
+            // OAuth-token failure and cannot recover via "Reconnect Claude".
+            const authSnap = snapshotAuthForFailureReason(credentialsPathForConfigDir(deps.claudeConfigDir));
+            const reason = authSnap === 'dead' || authSnap === 'expired' ? 'auth-refresh-failed' : result.reason;
+            if (reason === 'auth-refresh-failed') {
+                deps.logger(`[spawn-failed] reason=auth-refresh-failed authStatus=${authSnap} originalReason=${result.reason}`);
+            }
+            return c.json({ error: 'spawn-failed', reason, stderrTail: result.stderrTail, authStatus: authSnap }, 500);
         }
         timed(deps.logger, 'POST', '/spawn', 200, Date.now() - start);
         const payload = buildSpawnReturnPayload(result.session.sessionId, result.session.pid, result.session.startedAt, result.session.url);
@@ -1487,7 +1497,14 @@ export function buildHttpApp(deps) {
             deps.logger(`[sessions-rc-resume] spawn-failed sessionId=${sessionId ?? 'new'} name=${name ?? 'none'} err=${msg}`);
             deps.logger(`[rc-spawn] op=spawn-failed unitToken=${unitToken} err=${JSON.stringify(msg)}`);
             timed(deps.logger, 'POST', '/rc-spawn', 500, Date.now() - start);
-            return c.json({ error: msg }, 500);
+            // Task 576 — same auth-aware reason as /spawn so the resume path
+            // surfaces auth death too, not only spawn-time failures.
+            const authSnap = snapshotAuthForFailureReason(credentialsPathForConfigDir(deps.claudeConfigDir));
+            const reason = authSnap === 'dead' || authSnap === 'expired' ? 'auth-refresh-failed' : msg;
+            if (reason === 'auth-refresh-failed') {
+                deps.logger(`[rc-spawn] op=auth-refresh-failed authStatus=${authSnap} unitToken=${unitToken}`);
+            }
+            return c.json({ error: msg, reason, authStatus: authSnap }, 500);
         }
         // Step 3 — PTY spawned. fd baseline at this instant; the fd-release
         // line later in the lifecycle is read relative to this value.