@rubytech/create-maxy-code 0.1.244 → 0.1.247

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.244",
+  "version": "0.1.247",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/docs/superpowers/plans/2026-06-04-public-agent-knowledge-delivery.md

@@ -0,0 +1,230 @@
+# Public Agent Knowledge Delivery — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make the public agent's `KNOWLEDGE.md` reach its spawn prompt, refuse a dud (empty/missing SOUL or KNOWLEDGE) public spawn with a distinct logged reason, and stop seeding/reading the dead public `SOUL`/`config` templates and `plugins` config field.
+
+**Architecture:** The only spawn-prompt path is `composeAppendSystemPrompt` in `claude-session-manager`. It reads `agents/<role>/{IDENTITY,SOUL}.md`; we add a public-only `KNOWLEDGE.md` read rendered as `<knowledge>` after `<soul>`, with strict empty/missing refusal. `pty-spawner` maps the new refusal reasons and emits the per-spawn byte-count line. The installer stops manufacturing a public agent on fresh install but re-syncs the Rubytech IDENTITY into existing agent dirs on upgrade. The UI config reader drops the unused `plugins` field. The admin skill doc is corrected to match.
+
+**Tech Stack:** TypeScript (Node, vitest), bash (`setup-account.sh`), markdown (SKILL.md).
+
+---
+
+### Task 1: `system-prompt.ts` — read KNOWLEDGE for public, distinct refusal reasons
+
+**Files:**
+- Modify: `services/claude-session-manager/src/system-prompt.ts`
+- Test: `services/claude-session-manager/src/__tests__/system-prompt.test.ts`
+
+**Behaviours:**
+- `AppendBlockResult` ok:true gains `knowledgeBytes: number`.
+- `AppendBlockResult` ok:false `reason` union gains `'soul-empty' | 'knowledge-missing' | 'knowledge-empty'`.
+- `renderAppendBlock` gains a `knowledgeContent: string | null` param; when non-null, render `<knowledge>\n{content}\n</knowledge>` immediately after `</soul>`, before `<about-owner>`; return `knowledgeBytes`. Null ⇒ no block, no bytes (admin + self-test + drift unchanged).
+- `composeAppendSystemPrompt`: IDENTITY failure → `identity-unresolved` (all roles, unchanged). SOUL failure → `identity-unresolved` for admin (unchanged); for `role==='public'` → `soul-empty`. When `role==='public'`, read `<roleDir>/KNOWLEDGE.md` via `readIdentityFile`: detail ending `:empty` → `knowledge-empty`; any other failure (ENOENT/unreadable) → `knowledge-missing`. Pass content to `renderAppendBlock`; admin passes `null`.
+
+- [ ] **Step 1: Write failing tests** — append to `system-prompt.test.ts`:
+
+```ts
+describe('composeAppendSystemPrompt — public KNOWLEDGE delivery', () => {
+  function makePublic(seed: { identity?: string | null; soul?: string | null; knowledge?: string | null }): string {
+    const dir = mkdtempSync(join(tmpdir(), 'task618-account-'))
+    const roleDir = join(dir, 'agents', 'public')
+    mkdirSync(roleDir, { recursive: true })
+    if (typeof seed.identity === 'string') writeFileSync(join(roleDir, 'IDENTITY.md'), seed.identity)
+    if (typeof seed.soul === 'string') writeFileSync(join(roleDir, 'SOUL.md'), seed.soul)
+    if (typeof seed.knowledge === 'string') writeFileSync(join(roleDir, 'KNOWLEDGE.md'), seed.knowledge)
+    return dir
+  }
+
+  it('public + non-empty KNOWLEDGE ⇒ <knowledge> verbatim, ordered after <soul>, knowledgeBytes>0', () => {
+    const knowledge = '# Knowledge\nWe open 9-5. Sale price £450k.\n'
+    const accountDir = makePublic({ identity: 'I', soul: 'S', knowledge })
+    try {
+      const result = composeAppendSystemPrompt(HOST, { accountDir, role: 'public' })
+      expect(result.ok).toBe(true)
+      if (!result.ok) return
+      expect(result.block).toContain(`<knowledge>\n${knowledge}\n</knowledge>`)
+      expect(result.block.indexOf('<knowledge>')).toBeGreaterThan(result.block.indexOf('</soul>'))
+      expect(result.knowledgeBytes).toBe(Buffer.byteLength(knowledge, 'utf8'))
+    } finally { rmSync(accountDir, { recursive: true, force: true }) }
+  })
+
+  it('public + missing KNOWLEDGE ⇒ ok:false reason=knowledge-missing', () => {
+    const accountDir = makePublic({ identity: 'I', soul: 'S' })
+    try {
+      const result = composeAppendSystemPrompt(HOST, { accountDir, role: 'public' })
+      expect(result.ok).toBe(false)
+      if (result.ok) return
+      expect(result.reason).toBe('knowledge-missing')
+      expect(result.detail).toContain('KNOWLEDGE.md')
+    } finally { rmSync(accountDir, { recursive: true, force: true }) }
+  })
+
+  it('public + empty KNOWLEDGE ⇒ ok:false reason=knowledge-empty', () => {
+    const accountDir = makePublic({ identity: 'I', soul: 'S', knowledge: '' })
+    try {
+      const result = composeAppendSystemPrompt(HOST, { accountDir, role: 'public' })
+      expect(result.ok).toBe(false)
+      if (result.ok) return
+      expect(result.reason).toBe('knowledge-empty')
+    } finally { rmSync(accountDir, { recursive: true, force: true }) }
+  })
+
+  it('public + empty SOUL ⇒ ok:false reason=soul-empty', () => {
+    const accountDir = makePublic({ identity: 'I', soul: '', knowledge: 'K' })
+    try {
+      const result = composeAppendSystemPrompt(HOST, { accountDir, role: 'public' })
+      expect(result.ok).toBe(false)
+      if (result.ok) return
+      expect(result.reason).toBe('soul-empty')
+    } finally { rmSync(accountDir, { recursive: true, force: true }) }
+  })
+
+  it('public + empty IDENTITY ⇒ identity-unresolved (unchanged)', () => {
+    const accountDir = makePublic({ identity: '', soul: 'S', knowledge: 'K' })
+    try {
+      const result = composeAppendSystemPrompt(HOST, { accountDir, role: 'public' })
+      expect(result.ok).toBe(false)
+      if (result.ok) return
+      expect(result.reason).toBe('identity-unresolved')
+    } finally { rmSync(accountDir, { recursive: true, force: true }) }
+  })
+
+  it('admin + KNOWLEDGE.md on disk ⇒ no <knowledge> block', () => {
+    const accountDir = makeAccountDir({ admin: { identity: 'I', soul: 'S' } })
+    writeFileSync(join(accountDir, 'agents', 'admin', 'KNOWLEDGE.md'), 'admin-knowledge')
+    try {
+      const result = composeAppendSystemPrompt(HOST, { accountDir, role: 'admin' })
+      expect(result.ok).toBe(true)
+      if (!result.ok) return
+      expect(result.block).not.toContain('<knowledge>')
+      expect(result.block).not.toContain('admin-knowledge')
+    } finally { rmSync(accountDir, { recursive: true, force: true }) }
+  })
+
+  it('snapshot: full composed public prompt with a sample KNOWLEDGE.md', () => {
+    const accountDir = makePublic({
+      identity: '# Identity\nYou speak for the business.',
+      soul: '# Soul\nWarm, brief.',
+      knowledge: '# Knowledge\nOpen 9-5. Contact 01234 567890.',
+    })
+    try {
+      const result = composeAppendSystemPrompt(HOST, { accountDir, role: 'public' })
+      expect(result.ok).toBe(true)
+      if (!result.ok) return
+      expect(result.block).toMatchSnapshot()
+    } finally { rmSync(accountDir, { recursive: true, force: true }) }
+  })
+})
+```
+
+- [ ] **Step 2: Run, verify fail** — `npx vitest run src/__tests__/system-prompt.test.ts` → FAIL (knowledge not read).
+
+- [ ] **Step 3: Implement** in `system-prompt.ts`:
+  - Add `knowledgeBytes: number` to ok:true; extend ok:false reason union.
+  - Add `knowledgeContent: string | null` param to `renderAppendBlock`; insert `<knowledge>` block after `</soul>` push, before `<about-owner>`; track + return `knowledgeBytes`.
+  - Update both internal `renderAppendBlock` callers (`runIdentityDriftAssertion`, `runSystemPromptSelfTest`) to pass `null`.
+  - In `composeAppendSystemPrompt`: on SOUL failure, `return { ok:false, reason: sources.role === 'public' ? 'soul-empty' : 'identity-unresolved', detail: soul.detail }`. When `role==='public'`, read `KNOWLEDGE.md`; on failure `return { ok:false, reason: knowledge.detail.endsWith(':empty') ? 'knowledge-empty' : 'knowledge-missing', detail: knowledge.detail }`. Pass `role==='public' ? knowledge.content : null` to `renderAppendBlock`; set `knowledgeBytes` accordingly (0 for admin).
+
+- [ ] **Step 4: Run, verify pass** — `npx vitest run src/__tests__/system-prompt.test.ts` → PASS. Review the new snapshot.
+
+- [ ] **Step 5: Commit** — `feat(public-agent): read KNOWLEDGE.md into public spawn prompt with strict refusal`
+
+---
+
+### Task 2: `pty-spawner.ts` — surface refusal reasons + per-spawn compose line
+
+**Files:**
+- Modify: `services/claude-session-manager/src/pty-spawner.ts` (`SpawnFailureReason` ~351; compose handling ~1292-1315)
+
+**Behaviours:**
+- `SpawnFailureReason` gains `'soul-empty' | 'knowledge-missing' | 'knowledge-empty'`.
+- In the `!composed.ok` branch, for the three new reasons emit `[pty-spawn] spawn-failed reason=<r> role=public slug=<agentSlug>` and return `{ ok:false, reason:<r>, stderrTail: composed.detail }`. The existing `identity-unresolved` path is unchanged.
+- Track `knowledge` in `composedBytes`. On public success emit `[pty-spawn] op=public-prompt-compose role=public slug=<agentSlug> identityBytes=N soulBytes=N knowledgeBytes=N` (in addition to the existing `compose-system-prompt-ok` line, which gains `knowledgeBytes`).
+
+- [ ] **Step 1: Implement** — extend the union; in the failure branch add a `case` for the three reasons before the identity fallthrough; add `knowledge: composed.knowledgeBytes` to `composedBytes`; append `knowledgeBytes=${composed.knowledgeBytes}` to the `compose-system-prompt-ok` log; after that log, `if (args.role === 'public') deps.logger(\`op=public-prompt-compose role=public slug=${agentSlug} identityBytes=${composed.identityBytes} soulBytes=${composed.soulBytes} knowledgeBytes=${composed.knowledgeBytes}\`)`.
+
+- [ ] **Step 2: Verify** — `npx vitest run` for csm (no test directly asserts these strings; the build + existing suite must stay green). Confirm tsc has no error on the union/result fields.
+
+- [ ] **Step 3: Commit** — `feat(public-agent): map knowledge/soul refusal reasons + emit public-prompt-compose line`
+
+---
+
+### Task 3: Templates — delete dead public SOUL + config
+
+**Files:**
+- Delete: `templates/agents/public/SOUL.md`, `templates/agents/public/config.json`
+- Keep: `templates/agents/public/IDENTITY.md`
+
+- [ ] **Step 1:** `git rm templates/agents/public/SOUL.md templates/agents/public/config.json`
+- [ ] **Step 2: Verify no live reader** — `grep -rIn 'agents/public/SOUL\|agents/public/config' --include=*.ts --include=*.sh .` returns only `setup-account.sh` lines removed in Task 4. (`smoke-boot-services.sh` and `verify-doc-impl.sh` copy/grep IDENTITY only.)
+- [ ] **Step 3: Commit** with Task 4 (template deletion is meaningless without the seed removal).
+
+---
+
+### Task 4: `setup-account.sh` — no fresh-install public agent; re-sync IDENTITY for existing
+
+**Files:**
+- Modify: `scripts/setup-account.sh` (mkdir ~38; IDENTITY block ~181-184; SOUL/config seed ~221-224)
+
+**Behaviours:**
+- Drop `"$ACCOUNT_DIR/agents/public"` from the line-38 `mkdir -p`.
+- Remove the public IDENTITY overwrite (lines 183-184) and the public SOUL/config seed (lines 221-224).
+- Add, in the agent-identities section, a loop: for each `"$ACCOUNT_DIR/agents"/*/` whose basename ≠ `admin` and which already contains `IDENTITY.md`, overwrite `IDENTITY.md` from `"$TEMPLATES_DIR/agents/public/IDENTITY.md"`; echo a re-sync line. Never create dirs; never write SOUL/KNOWLEDGE/config. Admin block untouched.
+
+- [ ] **Step 1: Implement** the three edits.
+- [ ] **Step 2: Verify fresh install** — run `setup-account.sh` against a scratch `ACCOUNT_DIR` with no `agents/public`; assert no `agents/public/` is created and `agents/admin/IDENTITY.md` exists.
+- [ ] **Step 3: Verify upgrade** — scratch `ACCOUNT_DIR` pre-seeded with `agents/sales/IDENTITY.md` (stale text) + `agents/sales/SOUL.md`; run; assert `agents/sales/IDENTITY.md` now equals the template and `agents/sales/SOUL.md` is untouched.
+- [ ] **Step 4: Commit** (with Task 3) — `refactor(installer): public agents author client-side; re-sync IDENTITY for existing dirs only`
+
+---
+
+### Task 5: `account.ts` — drop the dead `plugins` config field
+
+**Files:**
+- Modify: `ui/app/lib/claude-agent/account.ts` (`ResolvedAgentConfig` ~277; reader ~304,324; return ~395)
+- Test: `ui/app/lib/claude-agent/__tests__/spawn-context.test.ts` (trim `plugins` assertions only)
+
+**Behaviours:**
+- Remove `plugins: string[] | null` from `ResolvedAgentConfig`; remove `let plugins`, the `parsed.plugins` read, and `plugins` from the return object. Leave `knowledgeKeywords` and the budget-breakdown `plugins: 0` token field intact.
+
+- [ ] **Step 1: Find & update the test** — `grep -n 'plugins' ui/app/lib/claude-agent/__tests__/spawn-context.test.ts`; remove only the assertions reading `config.plugins`; add/confirm a case that a public `config.json` lacking `plugins` resolves and `knowledgeKeywords` is still read.
+- [ ] **Step 2: Run, verify fail/observe** — `npx vitest run ui/app/lib/claude-agent/__tests__/spawn-context.test.ts`.
+- [ ] **Step 3: Implement** the field removal in `account.ts`.
+- [ ] **Step 4: Run, verify pass** — same vitest command → PASS.
+- [ ] **Step 5: Commit** — `refactor(public-agent): drop unused plugins field from resolved agent config`
+
+---
+
+### Task 6: `public-agent-manager/SKILL.md` — correct the doc
+
+**Files:**
+- Modify: `plugins/admin/skills/public-agent-manager/SKILL.md`
+
+**Behaviours (scope item 6):**
+- (a) Table: `KNOWLEDGE.md` Required → Yes; `SOUL.md` purpose → personality + role (basic public info, capture the visitor's contact details for human follow-up — the chat equivalent of the landing-page contact form). Add a line: SOUL.md and KNOWLEDGE.md are authored entirely client-side and must be non-empty before the agent goes active; an empty one is refused at spawn. KNOWLEDGE = the business's public-facing facts at landing-page detail.
+- (b) Create step: IDENTITY.md is copied from the Rubytech template verbatim, not drafted/edited.
+- (c) Remove the `plugins` key from the `config.json` example; remove "selected plugins" from the table; delete the "Plugin Selection" section; remove the plugin-selection Create step and renumber the Create steps + every cross-reference (`Step 4/5/6/7`, `All other steps (4, 8-12)`). Update the template-create plugin pre-select bullet (plugins gone) and note IDENTITY is the fixed Rubytech template.
+- (d) Ensure no reference to a SOUL/config seed template remains.
+- Keep: `knowledgeKeywords` field, the create-form field, keyword-subscription and direct-tagging sections, projection steps.
+
+- [ ] **Step 1: Implement** the edits above.
+- [ ] **Step 2: Verify** — `grep -n 'plugins' SKILL.md` shows no `plugins` config key or Plugin Selection section (knowledgeKeywords/tagging prose may remain); Create steps are sequentially numbered with consistent cross-refs.
+- [ ] **Step 3: Commit** — `docs(public-agent): KNOWLEDGE required, IDENTITY templated, drop plugins from skill`
+
+---
+
+### Task 7: Verify — build, bundle, full suites
+
+- [ ] **Step 1:** `npm run build:claude-session-manager` → no tsc errors.
+- [ ] **Step 2:** Full csm suite `cd services/claude-session-manager && npx vitest run` → green (esp. `public-identity-template`, `pty-spawner-channels`).
+- [ ] **Step 3:** `npx vitest run ui/app/lib/claude-agent/__tests__/` → green.
+- [ ] **Step 4:** Bundle the installer payload (`maxy-code/packages/create-maxy-code` `npm run bundle`) → no runtime errors; confirm `templates/agents/public/` in the payload contains only `IDENTITY.md`.
+
+---
+
+## Self-Review
+
+- **Spec coverage:** scope 1→T1, 2→T2, 3→T3, 4→T4, 5→T5, 6→T6; verification + observability→T1/T2/T7. All covered.
+- **Out of scope (untouched):** `knowledgeKeywords` machinery, projection routes, the migrated Real Agent agent's KNOWLEDGE authoring, Pi hand-patched files.
+- **Type consistency:** `knowledgeBytes` and the three reasons named identically in T1 (composer) and T2 (spawner). `renderAppendBlock` `knowledgeContent` param threaded through all three callers.

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective), and admin-identity-authenticate (native-CC PIN identity gate — the operator submits their PIN as the first action of every session to bind their authenticated userId; the PreToolUse pin-identity-gate hook blocks all other tools until this succeeds) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), session-retrospective-mark-complete (the deterministic sentinel the session-end Stop hook reads via JSONL grep to release the retrospective gate; admin calls it once per session after running the three-pass retrospective), and admin-identity-authenticate (native-CC PIN identity gate — the operator submits their PIN as the first action of every session to bind their authenticated userId; the PreToolUse pin-identity-gate hook blocks all other tools until this succeeds) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -75,6 +75,9 @@ tools:
   - name: session-retrospective-mark-complete
     publicAllowlist: false
     adminAllowlist: true
+  - name: admin-identity-authenticate
+    publicAllowlist: false
+    adminAllowlist: true
 hidden:
   - remote-auth-status
   - remote-auth-set-password

package/payload/platform/plugins/admin/hooks/__tests__/pin-identity-gate.test.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+# Regression test for pin-identity-gate.sh (Task 619).
+#
+# Covers:
+#   1. Non-admin role                                  → ALLOW (no-op)
+#   2. admin, unauthenticated, ordinary tool           → BLOCK (op=pin-prompted)
+#   3. admin, already authenticated (state file)       → ALLOW
+#   4. admin, auth tool, endpoint match                → ALLOW + state written (op=pin-bound)
+#   5. admin, auth tool, endpoint miss                 → BLOCK (op=session-terminated)
+#   6. admin, auth tool, endpoint unavailable          → BLOCK (op=pin-unavailable)
+#   7. admin, auth tool, endpoint unreachable          → BLOCK (op=pin-error)
+#
+# The validate endpoint is stubbed via a `curl` shim on PATH whose response is
+# driven by $FAKE_VALIDATE_KIND.
+
+set -u
+HOOK="$(cd "$(dirname "$0")/.." && pwd)/pin-identity-gate.sh"
+[ -x "$HOOK" ] || { echo "FAIL: $HOOK not executable" >&2; exit 1; }
+
+TMP_DIR=$(mktemp -d)
+trap 'rm -rf "$TMP_DIR"' EXIT
+mkdir -p "$TMP_DIR/bin" "$TMP_DIR/state"
+
+# curl shim: emit a canned validate response based on $FAKE_VALIDATE_KIND.
+cat > "$TMP_DIR/bin/curl" <<'SHIM'
+#!/usr/bin/env bash
+case "${FAKE_VALIDATE_KIND:-}" in
+  match)       echo '{"kind":"match","userId":"user-0001"}' ;;
+  miss)        echo '{"kind":"miss"}' ;;
+  unavailable) echo '{"kind":"unavailable"}' ;;
+  corrupt)     echo '{"kind":"corrupt"}' ;;
+  unreachable) echo '' ;;
+  *)           echo '' ;;
+esac
+SHIM
+chmod +x "$TMP_DIR/bin/curl"
+
+AUTH_TOOL='mcp__plugin_admin_admin__admin-identity-authenticate'
+PASS=0; FAIL=0
+
+# run <role> <kind> <stdin-json> [specialist] ; sets EXIT and ERR
+run() {
+  ERR=$(printf '%s' "$3" | \
+    PATH="$TMP_DIR/bin:$PATH" \
+    MAXY_SESSION_ROLE="$1" \
+    MAXY_SPECIALIST="${4:-}" \
+    FAKE_VALIDATE_KIND="$2" \
+    MAXY_IDENTITY_GATE_STATE_DIR="$TMP_DIR/state" \
+    MAXY_IDENTITY_VALIDATE_URL="http://stub/validate" \
+    bash "$HOOK" 2>&1 >/dev/null)
+  EXIT=$?
+}
+
+check() { # <label> <want-exit> <grep-or-->
+  if [ "$EXIT" != "$2" ]; then echo "FAIL[$1]: exit=$EXIT want=$2 err=$ERR"; FAIL=$((FAIL+1)); return; fi
+  if [ "$3" != "-" ] && ! printf '%s' "$ERR" | grep -q "$3"; then echo "FAIL[$1]: missing '$3' in: $ERR"; FAIL=$((FAIL+1)); return; fi
+  echo "PASS[$1]"; PASS=$((PASS+1))
+}
+
+# 1. non-admin → allow
+run public '' '{"session_id":"s1","tool_name":"Bash","tool_input":{}}'
+check non-admin 0 -
+
+# 1b. admin but specialist subagent (MAXY_SPECIALIST set) → allow (no-op)
+run admin '' '{"session_id":"s1b","tool_name":"Bash","tool_input":{}}' database-operator
+check specialist-exempt 0 -
+
+# 2. admin unauth, ordinary tool → block
+run admin '' '{"session_id":"s2","tool_name":"Bash","tool_input":{}}'
+check unauth-block 2 "op=pin-prompted"
+
+# 3. admin, authenticated (state file present) → allow
+echo '{"userId":"user-0001"}' > "$TMP_DIR/state/s3.json"
+run admin '' '{"session_id":"s3","tool_name":"Bash","tool_input":{}}'
+check authed-allow 0 -
+
+# 4. admin, auth tool, match → allow + state written + pin-bound
+run admin match "{\"session_id\":\"s4\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"1234\"}}"
+check match-allow 0 "op=pin-bound"
+[ -f "$TMP_DIR/state/s4.json" ] && { echo "PASS[match-state-written]"; PASS=$((PASS+1)); } || { echo "FAIL[match-state-written]"; FAIL=$((FAIL+1)); }
+
+# 5. admin, auth tool, miss → block + terminate
+run admin miss "{\"session_id\":\"s5\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"9999\"}}"
+check miss-block 2 "op=session-terminated"
+
+# 6. admin, auth tool, unavailable → block
+run admin unavailable "{\"session_id\":\"s6\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"1\"}}"
+check unavailable-block 2 "op=pin-unavailable"
+
+# 7. admin, auth tool, unreachable endpoint → block (fail-closed)
+run admin unreachable "{\"session_id\":\"s7\",\"tool_name\":\"$AUTH_TOOL\",\"tool_input\":{\"pin\":\"1\"}}"
+check unreachable-block 2 "op=pin-error"
+
+echo "---"
+echo "PASS=$PASS FAIL=$FAIL"
+[ "$FAIL" = 0 ] || exit 1

package/payload/platform/plugins/admin/hooks/pin-identity-gate.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+# Native-CC admin PIN identity gate (Task 619).
+#
+# PreToolUse hook, registered under the universal (no-matcher) entry so it fires
+# for EVERY tool call on a native-CC admin session. It denies all tools until the
+# operator authenticates: the agent must call `admin-identity-authenticate` with a
+# PIN that the loopback validate endpoint matches against users.json. On match the
+# hook records per-session auth state (keyed by the conversation `session_id` it
+# reads from stdin) and lets every subsequent tool through. Enforcement is here —
+# a model that skips the prompt cannot reach any other tool.
+#
+# Scope: only native loopback admin sessions (MAXY_SESSION_ROLE=admin). Specialist
+# subagents dispatched via the Task tool share the parent conversation's
+# session_id, so they pass once the operator session is authenticated.
+#
+# Protocol: exit 0 = allow, exit 2 = block (stderr message shown to the agent),
+# matching the sibling gate hooks. Fail-closed on terminal stdin.
+#
+# Lifecycle (one [admin-identity] line per step, correlated by sessionId):
+#   op=loopback-spawn-received → op=pin-prompted → (op=pin-bound source=pin |
+#   op=pin-miss → op=session-terminated) ; the MCP tool emits op=about-owner-loaded.
+
+set -uo pipefail
+
+if [ -t 0 ]; then
+  echo "Blocked: pin-identity-gate received no stdin (cannot inspect tool call). Failing closed." >&2
+  exit 2
+fi
+INPUT=$(cat)
+
+# Only native loopback admin OPERATOR sessions are in scope:
+#  - MAXY_SESSION_ROLE=admin excludes public/access sessions.
+#  - MAXY_SPECIALIST empty excludes pty-spawned specialist/recorder sessions,
+#    which carry role=admin but are not human operators and never enter a PIN
+#    (mirrors the recursion guard the other admin hooks use). Task-tool
+#    specialist subagents share the operator's session_id + empty MAXY_SPECIALIST,
+#    so they pass via the operator's auth-state file once it is bound.
+[ "${MAXY_SESSION_ROLE:-}" = "admin" ] || exit 0
+[ -z "${MAXY_SPECIALIST:-}" ] || exit 0
+
+# ----- Parse fields from stdin (python3, robust on nested tool_input) -------
+SESSION_ID=$(printf '%s' "$INPUT" | python3 -c 'import json,sys
+try: d=json.load(sys.stdin)
+except Exception: d={}
+print(d.get("session_id","") or "")' 2>/dev/null)
+TOOL_NAME=$(printf '%s' "$INPUT" | python3 -c 'import json,sys
+try: d=json.load(sys.stdin)
+except Exception: d={}
+print(d.get("tool_name","") or "")' 2>/dev/null)
+
+SID8="${SESSION_ID:0:8}"; [ -z "$SID8" ] && SID8='-'
+log() { echo "[admin-identity] $1" >&2; }
+
+# ----- Resolve account/state dir -------------------------------------------
+# The account dir basename IS the ACCOUNT_ID (resolve-account-dir.sh), and the
+# rc child env carries ACCOUNT_ID, so resolve deterministically rather than
+# `find | head -1` — which does not skip dotfiles and could pick the sibling
+# `data/accounts/.trash/`, diverging from the manager's `spawnCwd` (= the
+# account dir) and stranding state the standing audit can never reconcile.
+HOOK_DIR="$(cd "$(dirname "$0")" 2>/dev/null && pwd)"
+PLATFORM_ROOT_RESOLVED="${HOOK_DIR}/../../.."
+ACCOUNTS_DIR="${PLATFORM_ROOT_RESOLVED}/../data/accounts"
+ACCOUNT_DIR=""
+if [ -n "${ACCOUNT_ID:-}" ]; then
+  ACCOUNT_DIR="${ACCOUNTS_DIR}/${ACCOUNT_ID}"
+elif [ -d "$ACCOUNTS_DIR" ]; then
+  # Defensive fallback only when ACCOUNT_ID is unset — exclude dot-entries.
+  ACCOUNT_DIR=$(find "$ACCOUNTS_DIR" -mindepth 1 -maxdepth 1 -type d ! -name '.*' 2>/dev/null | head -1)
+fi
+STATE_DIR="${MAXY_IDENTITY_GATE_STATE_DIR:-${ACCOUNT_DIR}/state/admin-identity}"
+STATE_FILE="${STATE_DIR}/${SESSION_ID}.json"
+
+AUTH_TOOL='mcp__plugin_admin_admin__admin-identity-authenticate'
+VALIDATE_URL="${MAXY_IDENTITY_VALIDATE_URL:-http://127.0.0.1:${MAXY_UI_INTERNAL_PORT:-0}/api/admin/identity/validate}"
+
+# Already authenticated for this conversation → pass everything through.
+if [ -n "$SESSION_ID" ] && [ -f "$STATE_FILE" ]; then
+  exit 0
+fi
+
+log "op=loopback-spawn-received sessionId=${SID8}"
+
+# ----- The authenticate tool: validate, bind on match, terminate on miss ----
+if [ "$TOOL_NAME" = "$AUTH_TOOL" ]; then
+  PIN=$(printf '%s' "$INPUT" | python3 -c 'import json,sys
+try: d=json.load(sys.stdin)
+except Exception: d={}
+ti=d.get("tool_input") or {}
+print(ti.get("pin","") or "")' 2>/dev/null)
+
+  REQ=$(python3 -c 'import json,sys
+print(json.dumps({"pin": sys.argv[1], "sessionId": sys.argv[2]}))' "$PIN" "$SESSION_ID" 2>/dev/null)
+  RESP=$(printf '%s' "$REQ" | curl -s --max-time 5 -X POST -H 'content-type: application/json' -d @- "$VALIDATE_URL" 2>/dev/null)
+  KIND=$(printf '%s' "$RESP" | python3 -c 'import json,sys
+try: print((json.load(sys.stdin) or {}).get("kind","") or "")
+except Exception: print("")' 2>/dev/null)
+
+  case "$KIND" in
+    match)
+      USERID=$(printf '%s' "$RESP" | python3 -c 'import json,sys
+print(json.load(sys.stdin).get("userId","") or "")' 2>/dev/null)
+      mkdir -p "$STATE_DIR" 2>/dev/null
+      printf '{"userId":%s,"ts":"%s"}' \
+        "$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$USERID")" \
+        "$(date -u +%FT%TZ)" > "$STATE_FILE" 2>/dev/null
+      log "op=pin-bound sessionId=${SID8} userId=${USERID:0:8} source=pin authSurface=loopback"
+      exit 0
+      ;;
+    miss)
+      log "op=pin-miss sessionId=${SID8} reason=no-matching-user"
+      log "op=session-terminated sessionId=${SID8} reason=pin-auth-failed"
+      echo "PIN did not match. This session is being terminated. Start a new session and enter a valid PIN." >&2
+      exit 2
+      ;;
+    unavailable)
+      log "op=pin-unavailable sessionId=${SID8} reason=users-json-empty"
+      echo "No admin PIN is configured for this install. Complete onboarding before using the admin agent." >&2
+      exit 2
+      ;;
+    corrupt)
+      log "op=pin-error sessionId=${SID8} reason=users-json-corrupt"
+      echo "Admin user configuration is corrupt. Re-run the seed script before authenticating." >&2
+      exit 2
+      ;;
+    *)
+      log "op=pin-error sessionId=${SID8} reason=validate-unreachable"
+      echo "Identity validation is unavailable; cannot proceed without authentication." >&2
+      exit 2
+      ;;
+  esac
+fi
+
+# ----- Unauthenticated and not the auth tool → block -----------------------
+log "op=pin-prompted sessionId=${SID8}"
+echo "Authenticate first: call admin-identity-authenticate with the operator's PIN. No other tool is reachable until a matching PIN is bound for this session." >&2
+exit 2

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-identity-authenticate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=admin-identity-authenticate.test.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-identity-authenticate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-identity-authenticate.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/admin-identity-authenticate.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-identity-authenticate.test.js

@@ -0,0 +1,34 @@
+import { describe, it, expect, vi } from "vitest";
+import { runAuthenticate } from "../tools/admin-identity-authenticate.js";
+function fetchReturning(json) {
+    return vi.fn(async () => ({ json: async () => json }));
+}
+describe("runAuthenticate", () => {
+    it("returns the operator name and profile on match", async () => {
+        const f = fetchReturning({ kind: "match", userId: "u-1", userName: "Ada", aboutOwner: { ok: true, body: "PROFILE" } });
+        const res = await runAuthenticate("1234", { fetchImpl: f, uiPort: "1" });
+        expect(res).toContain("Ada");
+        expect(res).toContain("PROFILE");
+    });
+    it("returns Invalid PIN on miss", async () => {
+        const f = fetchReturning({ kind: "miss" });
+        const res = await runAuthenticate("9999", { fetchImpl: f, uiPort: "1" });
+        expect(res).toBe("Invalid PIN.");
+    });
+    it("omits the profile when aboutOwner is unresolved but still authenticates", async () => {
+        const f = fetchReturning({ kind: "match", userId: "u-1", userName: "Ada", aboutOwner: { ok: false, reason: "profile-not-found" } });
+        const res = await runAuthenticate("1234", { fetchImpl: f, uiPort: "1" });
+        expect(res).toBe("Authenticated as Ada.");
+    });
+    it("reports service-unavailable when the endpoint throws", async () => {
+        const f = vi.fn(async () => { throw new Error("ECONNREFUSED"); });
+        const res = await runAuthenticate("1234", { fetchImpl: f, uiPort: "1" });
+        expect(res).toContain("unavailable");
+    });
+    it("posts the pin to the loopback validate endpoint", async () => {
+        const f = vi.fn(async () => ({ json: async () => ({ kind: "miss" }) }));
+        await runAuthenticate("1234", { fetchImpl: f, uiPort: "19200" });
+        expect(f).toHaveBeenCalledWith("http://127.0.0.1:19200/api/admin/identity/validate", expect.objectContaining({ method: "POST", body: JSON.stringify({ pin: "1234" }) }));
+    });
+});
+//# sourceMappingURL=admin-identity-authenticate.test.js.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/admin-identity-authenticate.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-identity-authenticate.test.js","sourceRoot":"","sources":["../../src/__tests__/admin-identity-authenticate.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE1E,SAAS,cAAc,CAAC,IAAa;IACnC,OAAO,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAA4B,CAAC;AACpF,CAAC;AAED,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACvH,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;QAC3C,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,CAAC,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACpI,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAA4B,CAAC;QAC7F,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAA4B,CAAC;QACnG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAC5B,oDAAoD,EACpD,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CACnF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-no-prescribed-role.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-no-prescribed-role.test.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-no-prescribed-role.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-no-prescribed-role.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/skill-no-prescribed-role.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-no-prescribed-role.test.js

@@ -0,0 +1,50 @@
+// Standing guard for Task 622 — no prescribed lead-capture role in any admin skill.
+//
+// SOUL.md is personality plus the role the operator defines at creation. The
+// skill text must never re-prescribe a fixed Rubytech role (lead-capture /
+// contact-form / "give basic public info"). This is a no-event failure mode:
+// nothing logs when the prescribed role creeps back into the skill prose, so
+// the reconciliation between expected state (no prescribed role) and actual
+// file content lives here. A green run is the success signal; a match prints
+// the offending `file:line` and fails the build.
+import { describe, it, expect } from "vitest";
+import { readdirSync, readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+const SKILLS_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "skills");
+// Case-insensitive. The exact phrases the operator confirmed as prescriptive
+// and wrong (session ebff1750); see .tasks/archive/622-*.md.
+const FORBIDDEN = [
+    "capture the visitor's contact details",
+    "landing-page contact form",
+    "give basic public info",
+];
+function skillFiles(dir) {
+    const out = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const full = join(dir, entry.name);
+        if (entry.isDirectory())
+            out.push(...skillFiles(full));
+        else if (entry.name === "SKILL.md")
+            out.push(full);
+    }
+    return out;
+}
+describe("admin skills carry no prescribed lead-capture role (Task 622)", () => {
+    it("no SKILL.md contains a forbidden prescribed-role phrase", () => {
+        const hits = [];
+        for (const file of skillFiles(SKILLS_DIR)) {
+            const lines = readFileSync(file, "utf8").split("\n");
+            lines.forEach((line, i) => {
+                const lower = line.toLowerCase();
+                for (const phrase of FORBIDDEN) {
+                    if (lower.includes(phrase.toLowerCase())) {
+                        hits.push(`${file}:${i + 1} — ${phrase}`);
+                    }
+                }
+            });
+        }
+        expect(hits, `prescribed-role phrasing found:\n${hits.join("\n")}`).toEqual([]);
+    });
+});
+//# sourceMappingURL=skill-no-prescribed-role.test.js.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-no-prescribed-role.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-no-prescribed-role.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-no-prescribed-role.test.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,iDAAiD;AACjD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;AAE7F,6EAA6E;AAC7E,6DAA6D;AAC7D,MAAM,SAAS,GAAG;IAChB,uCAAuC;IACvC,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC;AAEF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;aAClD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,QAAQ,CAAC,+DAA+D,EAAE,GAAG,EAAE;IAC7E,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;gBACxB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjC,KAAK,MAAM,MAAM,IAAI,SAAS,EAAE,CAAC;oBAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;wBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,oCAAoC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}