@rubytech/create-maxy-code 0.1.246 → 0.1.247

package/payload/platform/plugins/admin/mcp/dist/tools/admin-identity-authenticate.js

@@ -0,0 +1,32 @@
+// Task 619 — admin-identity-authenticate tool.
+//
+// The agent-callable PIN-submit surface for native-CC admin sessions. The
+// PreToolUse identity gate validates the PIN, writes per-session auth state, and
+// only then allows this tool to run; the tool itself re-asks the same loopback
+// endpoint solely to fetch and return the authenticated operator's profile to
+// the agent. It never touches users.json or Neo4j directly — the endpoint is the
+// single resolution surface, so `loadUserProfile` is not duplicated here.
+export async function runAuthenticate(pin, deps = {}) {
+    const f = deps.fetchImpl ?? fetch;
+    const port = deps.uiPort ?? process.env.MAXY_UI_INTERNAL_PORT ?? "";
+    const url = `http://127.0.0.1:${port}/api/admin/identity/validate`;
+    let data;
+    try {
+        const r = await f(url, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ pin }),
+        });
+        data = (await r.json());
+    }
+    catch {
+        return "Identity service unavailable; could not load your profile.";
+    }
+    if (data.kind !== "match")
+        return "Invalid PIN.";
+    const name = data.userName ?? "operator";
+    const profile = data.aboutOwner?.ok ? (data.aboutOwner.body ?? "") : "";
+    console.error(`[admin-identity] op=about-owner-loaded userId=${(data.userId ?? "").slice(0, 8)}`);
+    return `Authenticated as ${name}.\n\n${profile}`.trim();
+}
+//# sourceMappingURL=admin-identity-authenticate.js.map

package/payload/platform/plugins/admin/mcp/dist/tools/admin-identity-authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-identity-authenticate.js","sourceRoot":"","sources":["../../src/tools/admin-identity-authenticate.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,0EAA0E;AAC1E,iFAAiF;AACjF,+EAA+E;AAC/E,8EAA8E;AAC9E,iFAAiF;AACjF,0EAA0E;AAc1E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,OAAyB,EAAE;IAC5E,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAA;IACnE,MAAM,GAAG,GAAG,oBAAoB,IAAI,8BAA8B,CAAA;IAElE,IAAI,IAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;SAC9B,CAAC,CAAA;QACF,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAqB,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,4DAA4D,CAAC;IACtE,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC;IAEjD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,OAAO,oBAAoB,IAAI,QAAQ,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC"}

package/payload/platform/plugins/admin/skills/investigate/SKILL.md

@@ -41,6 +41,40 @@ deliverable is a task entry, written through the resolved task surface.
 
 ---
 
+## Step 0: Evidence First — prerequisites before any reasoning
+
+**Do this before resolving the task surface, searching prior work,
+reading code, or forming any hypothesis.** The failure mode this guards
+against is forming a hypothesis from the conversation context — the
+error text the user pasted, what you assume the code does — and then
+treating evidence retrieval as redundant. By the time you have read the
+rest of this skill you have already started doing it. Stop.
+
+First action in this skill: create a TodoWrite list of the
+prerequisites below. Work through them in order. Do not read code, do
+not search prior tasks, do not propose a cause while any prerequisite
+is still open.
+
+1. **Retrieve the requested evidence.** When the user provides a
+   specific artifact — a session key, log reference, error excerpt, or
+   pointer to a particular event — that artifact is the primary
+   evidence. Retrieve it with the canonical log-retrieval tool for the
+   surface (e.g. `logs-read` for Pi sessions on deployed maxy). If a
+   retrieval hook injects an exact command, execute it as given; do not
+   improvise.
+
+   This todo may not be marked complete until the **actual retrieved
+   output appears in the transcript** — the real log lines, not a
+   summary, not a paraphrase, not "the logs confirm X." If you cannot
+   produce the output, the todo stays open and that itself is the
+   finding: an observability or retrieval gap (see Phase 1 step 6).
+
+2. **If no specific artifact was provided**, mark item 1 N/A and
+   proceed to Phase 1 — but state explicitly that no evidence artifact
+   was supplied, so the investigation starts from code-path tracing.
+
+---
+
 ## Task surface (where tasks live in this environment)
 
 Before searching prior work or writing the deliverable, resolve where
@@ -64,23 +98,6 @@ Throughout this skill, "search prior tasks", "cite prior work", and
 "write a task" mean: use the resolved surface. Do not invent a new
 location.
 
----
-
-## Evidence First
-
-When the user provides a specific artifact — a session key, log
-reference, error excerpt, or pointer to a particular event — that
-artifact is the primary evidence. Retrieve it before prior-task
-searches, code reading, or hypothesis formation.
-
-Use the canonical log-retrieval tool for the surface in question (e.g.
-`logs-read` for Pi sessions on deployed maxy). If a retrieval hook
-injects an exact command, execute it as given; do not improvise.
-
-If no specific artifact was provided, proceed directly to Phase 1.
-
----
-
 ## Phase 1: Root Cause Investigation
 
 1. **Check prior work.** Search the task surface (graph or `.tasks/`)

package/payload/platform/plugins/admin/skills/public-agent-manager/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: public-agent-manager
+description: "Create, edit, clone, list, preview, and delete public agents, each a self-contained directory with its own identity, personality, knowledge, and model. Use when asked to manage, configure, or set up public agents."
+---
+
 # Public Agent Manager
 
 Create, edit, clone, list, preview, and delete public agents. Each public agent is a self-contained directory under `agents/` with its own identity, personality, knowledge, and model.
@@ -10,7 +15,7 @@ Each agent lives at `{accountDir}/agents/{slug}/`:
 |------|---------|----------|
 | `config.json` | Model, display name, status, image identity, knowledge keywords | Yes |
 | `IDENTITY.md` | Boundaries, behavioural rules — copied verbatim from the Rubytech template | Yes |
-| `SOUL.md` | Personality and role — tone, voice, warmth, greeting; plus the agent's job: give basic public info and capture the visitor's contact details for human follow-up (the chat equivalent of the landing-page contact form) | Yes |
+| `SOUL.md` | Personality and the operator-defined role — tone, voice, warmth, greeting, and the role the operator gives the agent at creation | Yes |
 | `KNOWLEDGE.md` | The business's public-facing facts at landing-page detail — pricing, FAQs, services | Yes |
 | `KNOWLEDGE-SUMMARY.md` | Auto-generated summary when KNOWLEDGE.md exceeds context budget | No |
 | `assets/` | Per-agent images (logo, avatar, icon) | No |
@@ -82,10 +87,10 @@ Present as a `select` field within the agent configuration `form` during creatio
 SOUL.md is personality and role. When the user provides content for SOUL.md, route content that belongs elsewhere to the correct file:
 
 - **Facts, pricing, services, FAQs** → KNOWLEDGE.md
-- **Engagement and qualification — how the agent draws out what the visitor needs and captures their contact details for human follow-up** → SOUL.md (this is the agent's role; the public agent is toolless, so there are no plugins to embed)
+- **Personality and the operator-defined role — how the agent sounds and what the operator has tasked it to do** → SOUL.md (the role is whatever the operator specifies at creation; the public agent is toolless, so there are no plugins to embed)
 - **Boundaries and procedural rules** → IDENTITY.md (Rubytech-controlled and copied verbatim — the agent's hard limits live there, not in SOUL)
 
-SOUL.md answers "what does this agent feel like to talk to, and what is it here to do?" — tone, warmth, formality, greeting, and the role of giving basic public info and capturing contact details. SOUL.md must not restate constraints from IDENTITY.md. When user-provided content could belong to either file, apply this test: "does this restrict what the agent does?" → IDENTITY.md. "Does this describe how the agent sounds?" → SOUL.md. If content does both (e.g. "always respond politely"), route to SOUL — the constraint is a consequence of tone, not an operational boundary. Present SOUL.md via `document-editor` for the user to review and approve. Follow the document-editor encoding constraint in IDENTITY.md when generating content.
+SOUL.md answers "what does this agent feel like to talk to, and what is it here to do?" — tone, warmth, formality, greeting, and the operator-defined role the agent was created to fill. SOUL.md must not restate constraints from IDENTITY.md. When user-provided content could belong to either file, apply this test: "does this restrict what the agent does?" → IDENTITY.md. "Does this describe how the agent sounds?" → SOUL.md. If content does both (e.g. "always respond politely"), route to SOUL — the constraint is a consequence of tone, not an operational boundary. Present SOUL.md via `document-editor` for the user to review and approve. Follow the document-editor encoding constraint in IDENTITY.md when generating content.
 
 ## KNOWLEDGE.md Population
 
@@ -148,7 +153,7 @@ After creation, no template metadata persists in the agent's files. The resultin
 2. Ask for the agent's name (becomes the slug) and role description
 3. **Knowledge discovery** — search the graph with admin permissions (no `agentSlug` — the agent doesn't exist yet) to find available knowledge. Present available content grouped by category for the user to select.
 4. **Install `IDENTITY.md`** — copy the Rubytech-controlled template verbatim to `agents/{slug}/IDENTITY.md`. It is fixed (the toolless public directive — Task 615) and is never drafted, edited, or presented for review.
-5. Present `SOUL.md` via document-editor with `filePath: "agents/{slug}/SOUL.md"` (draft personality and role from user conversation — tone plus the job of giving basic public info and capturing the visitor's contact details). Write on approval. Must be non-empty; an empty SOUL is refused at spawn.
+5. Present `SOUL.md` via document-editor with `filePath: "agents/{slug}/SOUL.md"` (draft personality and the operator-defined role from user conversation — tone plus the role the operator describes for the agent). Write on approval. Must be non-empty; an empty SOUL is refused at spawn.
 6. Present agent configuration via a single `form` component with these fields:
    - `knowledgeKeywords` (`text`): label "Knowledge keywords (max 5, comma-separated)", placeholder with examples relevant to the agent's role
    - `model` (`select`): label "Model", options with descriptions:

package/payload/platform/plugins/admin/skills/publish-site/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: publish-site
+description: "Move an already-extracted static-site tree into the per-account static-publish surface and emit one canonical path slug. Use when asked to publish, host, or put a site online."
+---
+
 # Publish Site
 
 Call `mcp__plugin_admin_admin__publish-site` to move an already-extracted static-site tree into the per-account static-publish surface (`<accountDir>/sites/<slug>/`) and emit one canonical path slug. Pair the slug with `mcp__plugin_admin_admin__public-hostname` to surface the full URL in the same turn.

package/payload/platform/plugins/admin/skills/unzip-attachment/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: unzip-attachment
+description: "Safely extract a zip archive the admin has uploaded, inventory its contents, and route each entry to the right downstream specialist, refusing path traversal, symlink escape, and decompression bombs. Use when an admin uploads a zip to unzip or extract."
+---
+
 # Unzip Attachment
 
 Safely extract a zip archive the admin has uploaded, inventory its contents, and propose one concrete follow-up per entry class — refusing archives that attempt path traversal, symlink escape, or decompression-bomb pathologies.

package/payload/platform/plugins/admin/skills/update-knowledge/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: update-knowledge
+description: "Refresh a public agent's KNOWLEDGE.md from the current graph, scoped to that agent's knowledge configuration. Use when asked to update, refresh, or regenerate a public agent's knowledge."
+---
+
 # Update Knowledge
 
 Refresh a public agent's KNOWLEDGE.md from the current graph, scoped to that agent's knowledge configuration.

package/payload/platform/plugins/docs/references/admin-identity-gate.md

@@ -0,0 +1,81 @@
+# Native-CC admin PIN identity gate
+
+Every native-CC admin session — the operator chatting through claude.ai/code (web,
+desktop, mobile) over the per-account `claude rc` daemon — must bind a
+PIN-authenticated `userId` before any tool runs. This closes the gap where the
+daemon stamped one boot-time `USER_ID` (from `users.json`) onto every session,
+which is correct for at most one human on a multi-admin install. (Task 619.)
+
+The legacy cookie/PIN browser login (`POST /api/admin/session`) is a separate
+surface documented in [`admin-session.md`](admin-session.md); this gate covers the
+native path, which that login never touched.
+
+## How it works
+
+Three pieces, plus a standing audit. No cross-process `session_id` plumbing: the
+hook keys state by the `session_id` it reads from stdin; validation and profile
+resolution live behind one loopback endpoint.
+
+1. **Shared validator** — `ui/app/lib/admin-identity/pin-validator.ts`. The single
+   PIN primitive (`validatePin` → `match` / `miss` / `unavailable` / `corrupt`),
+   shared by the legacy browser login and the gate so the two cannot drift.
+
+2. **Loopback validate endpoint** — `POST /api/admin/identity/validate`
+   (`ui/server/routes/admin/identity.ts`). Loopback-only (rejects any request
+   carrying `x-forwarded-for`, which only edge-proxied browser requests have).
+   Body `{ pin, sessionId? }`. On a match it resolves the operator's `userName`
+   and `aboutOwner` via the same helpers the browser path uses
+   (`resolveUserIdentity`, `resolveOwnerProfileBlock`) — `loadUserProfile` is never
+   duplicated. On a miss with a `sessionId` it fires a best-effort manager
+   `POST /<sessionId>/stop` (only the UI process reliably holds the manager port).
+
+3. **PreToolUse gate hook** — `plugins/admin/hooks/pin-identity-gate.sh`, wired in
+   `setup-account.sh` as the first universal PreToolUse entry. Runs only for native
+   operator sessions (`MAXY_SESSION_ROLE=admin` and empty `MAXY_SPECIALIST` — the
+   latter excludes pty-spawned specialist/recorder sessions). Per tool call: if an
+   auth-state file exists for the `session_id`, allow; if the tool is
+   `admin-identity-authenticate`, post the PIN to the validate endpoint and on a
+   match write the state file and allow (on a miss/unavailable, deny + terminate);
+   any other tool while unauthenticated is denied with an instruction to
+   authenticate first. Enforcement is in the hook, not the agent's choice — a model
+   that skips the prompt reaches no other tool.
+
+The agent-callable surface is the eager-loaded `admin-identity-authenticate` MCP
+tool (admin plugin); the gate validates and binds before allowing it, and the tool
+returns the authenticated operator's profile to the agent.
+
+Auth state: `<accountDir>/state/admin-identity/<session_id>.json` (`{userId, ts}`).
+One file per authenticated conversation; bound for the session lifetime, not
+re-prompted per message. Task-tool specialist subagents share the operator's
+`session_id`, so they pass once the operator is authenticated.
+
+## Cases
+
+- **Zero admins / absent / empty `users.json`** → `pin-unavailable`, the gate
+  refuses; never a bound empty `userId`. A real install always has `users.json`
+  (the installer/seed writes it), so this is a misconfiguration guard.
+- **One admin** → still prompts; the single matching PIN binds that `userId`.
+- **Many admins** → each PIN binds its own `userId`. The account is fixed (the
+  install's own scope); there is no multi-account picker on this path.
+- **Mismatch** → the session is terminated on the first miss (no retry budget).
+
+## Observability
+
+One structured `[admin-identity]` line per step, correlated by `sessionId`:
+
+```
+op=loopback-spawn-received → op=pin-prompted → (op=pin-bound source=pin |
+op=pin-miss → op=session-terminated) ; the MCP tool emits op=about-owner-loaded.
+```
+
+**Standing audit** (`services/claude-session-manager/src/admin-identity-audit.ts`,
+every 60s) reconciles, independently of the hook, live native-operator sessions
+(watcher rows with `role === null` — daemon-spawned, no sidecar) that reached real
+tool use against the auth-state files. Any such session with no state file emits
+`[admin-identity] op=audit-orphan sessionId=…
+reason=loopback-session-without-authenticated-userId`. This is the no-event
+detector: a silent gate bypass leaves no per-session log line, but the audit still
+surfaces it.
+
+Diagnostic path: `journalctl --user -u <brand>-admin | grep -E '\[admin-identity\]'`,
+then filter by `sessionId` for one session's full lifeline.

package/payload/platform/plugins/memory/skills/conversation-archive-enrich/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: conversation-archive-enrich
+description: "Walk an existing ConversationArchive's chunks and derive high-confidence claims and insights into the graph, one operator-gated proposal per row. Use when asked to enrich, derive insights from, or mine an existing conversation archive."
 ---
 
 # Conversation Archive — chunk-anchored insight derivation

package/payload/platform/plugins/memory/skills/conversational-memory/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: conversational-memory
+description: "Notice, store, and recall who the owner is and how they work, accumulated from natural conversation rather than forms. Use when recording or retrieving user profile, preferences, and remembered context across sessions."
+---
+
 # Conversational Memory
 
 Memory accumulates from conversation — never from questionnaires, quizzes, or onboarding forms. The owner reveals who they are and how they work through natural interaction. Your role is to notice, store, and recall that knowledge so every session feels continuous rather than starting from scratch.

package/payload/platform/plugins/workflows/skills/workflow-manager/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: workflow-manager
+description: "Create, test, and diagnose persistent workflows that automate recurring multi-step processes spanning different plugin tools. Use when the user describes a recurring multi-step process to automate."
+---
+
 # Workflow Manager
 
 Create, test, and diagnose persistent workflows that automate recurring multi-step processes.

package/payload/platform/scripts/check-skill-frontmatter.mjs

@@ -0,0 +1,139 @@
+#!/usr/bin/env node
+// Task 621 — bundle-time frontmatter check for every SKILL.md across the
+// plugins trees.
+//
+// Why: Claude Code surfaces a skill in the session's available-skills reminder,
+// and makes it matchable by the description-driven search tools (ToolSearch,
+// skill-find), ONLY if its SKILL.md opens with YAML frontmatter carrying a
+// `name:` and a `description:`. A SKILL.md that opens straight into an `#` H1
+// has no description for the reminder to list and nothing for fuzzy search to
+// match — it stays invisible until an operator finds the directory by hand,
+// while the agent burns turns on blind find/grep. The skill remains invokable
+// by exact name, so the defect is silent: no error, no log line. This module
+// is the standing guard that fails the bundle before such a payload ships, so
+// the next frontmatter-less skill cannot regress discovery the same way.
+//
+// A file passes iff it opens with a `---\n...\n---` frontmatter block whose
+// keys include both `name:` and `description:`. Three failure shapes are
+// reported distinctly: no frontmatter block at all, missing `name:`, missing
+// `description:`.
+
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { resolve, relative, join, dirname } from "node:path";
+import { pathToFileURL } from "node:url";
+
+// Walk `dir` recursively, collecting every file whose basename matches `predicate`.
+function walk(dir, predicate, out = []) {
+  if (!existsSync(dir)) return out;
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return out;
+  }
+  for (const entry of entries) {
+    const full = join(dir, entry);
+    let st;
+    try {
+      st = statSync(full);
+    } catch {
+      continue;
+    }
+    if (st.isDirectory()) {
+      walk(full, predicate, out);
+    } else if (predicate(entry, full)) {
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+// Extract the leading frontmatter block. A block exists only when the very
+// first line is `---` and a closing `---` follows on its own line. The closing
+// fence is anchored to end-of-line (`\r?\n|$`) so a body line that merely
+// starts with `---` (a `---trailing` divider) cannot be mistaken for the
+// close, and a frontmatter-only file ending exactly at `---` still matches.
+// Returns the block body (between the fences) or null when there is no block.
+function frontmatterBody(raw) {
+  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
+  return m ? m[1] : null;
+}
+
+// True if the block contains a `<key>:` line at the start of any line. The key
+// may be followed by a value, a block scalar (`|`/`>`), or nothing.
+function hasKey(block, key) {
+  const re = new RegExp(`^${key}:`, "m");
+  return re.test(block);
+}
+
+function scanFile(filePath, repoRoot) {
+  let raw;
+  try {
+    raw = readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+  const source = relative(repoRoot, filePath);
+  const block = frontmatterBody(raw);
+  if (block === null) {
+    return { source, reason: "no YAML frontmatter block (file opens without a leading `---`)" };
+  }
+  const missing = [];
+  if (!hasKey(block, "name")) missing.push("name");
+  if (!hasKey(block, "description")) missing.push("description");
+  if (missing.length > 0) {
+    return { source, reason: `frontmatter missing required key(s): ${missing.join(", ")}` };
+  }
+  return null;
+}
+
+export function runSkillFrontmatterCheck({ platformRoot, premiumRoot }) {
+  const repoRoot = resolve(platformRoot, "..");
+  const sources = [];
+
+  // platform: every SKILL.md under plugins/
+  walk(resolve(platformRoot, "plugins"), (name) => name === "SKILL.md", sources);
+
+  // premium: every SKILL.md under any bundle (standalone or sub)
+  if (premiumRoot && existsSync(premiumRoot)) {
+    walk(premiumRoot, (name) => name === "SKILL.md", sources);
+  }
+
+  const violations = [];
+  for (const src of sources) {
+    const v = scanFile(src, repoRoot);
+    if (v) violations.push(v);
+  }
+
+  return {
+    ok: violations.length === 0,
+    violations,
+    scanned: sources.length,
+  };
+}
+
+// CLI entry — `node check-skill-frontmatter.mjs [platformRoot] [premiumRoot]`.
+// pathToFileURL keeps the self-detect correct across paths with spaces or
+// non-ASCII characters. When loaded via `import` from bundle.js the URLs
+// differ and this block is skipped.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const defaultPlatform = resolve(import.meta.dirname, "..");
+  const defaultPremium = resolve(import.meta.dirname, "..", "..", "premium-plugins");
+  const platformRoot = process.argv[2] ? resolve(process.argv[2]) : defaultPlatform;
+  const premiumRoot = process.argv[3] ? resolve(process.argv[3]) : defaultPremium;
+  const r = runSkillFrontmatterCheck({ platformRoot, premiumRoot });
+  if (!r.ok) {
+    for (const v of r.violations) {
+      console.error(`[bundle-validator] skill frontmatter missing`);
+      console.error(`  source: ${v.source}`);
+      console.error(`  reason: ${v.reason}`);
+    }
+    console.error(
+      `FATAL: ${r.violations.length} SKILL.md file(s) without name/description frontmatter across ${r.scanned} scanned file(s).`,
+    );
+    process.exit(1);
+  }
+  console.log(
+    `[bundle-validator] skill frontmatter ok scanned=${r.scanned}`,
+  );
+}

package/payload/platform/scripts/setup-account.sh

@@ -75,6 +75,11 @@ cat > "$ACCOUNT_SETTINGS" << SETTINGS_EOF
   },
   "hooks": {
     "PreToolUse": [
+      {
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/pin-identity-gate.sh" }
+        ]
+      },
       {
         "matcher": "Write",
         "hooks": [

package/payload/platform/services/claude-session-manager/dist/admin-identity-audit.d.ts

@@ -0,0 +1,39 @@
+import type { FsWatcher } from './fs-watcher.js';
+export type Logger = (line: string) => void;
+export interface AuditSession {
+    sessionId: string;
+    /** Sidecar role, or null for native rc-daemon operator sessions. */
+    role: string | null;
+    state: string;
+    /** True when the JSONL contains an assistant tool_use whose name is not the
+     *  auth tool. */
+    usedRealTool: boolean;
+}
+export interface AuditOnceDeps {
+    sessions: AuditSession[];
+    hasState: (sessionId: string) => boolean;
+    logger: Logger;
+}
+/** Pure reconciliation: emit one audit-orphan line per live native-operator
+ *  session that used a real tool but has no auth-state file. */
+export declare function auditOnce(deps: AuditOnceDeps): number;
+export interface IdentityAuditDeps {
+    watcher: FsWatcher;
+    /** Account dir (the manager's spawnCwd); used to derive JSONL + state paths. */
+    spawnCwd: string;
+    /** Directory holding per-session auth-state files written by the gate hook. */
+    stateDir: string;
+    intervalMs: number;
+    logger: Logger;
+}
+export interface IdentityAudit {
+    start(): void;
+    stop(): void;
+    /** Run one audit pass synchronously. Exposed for tests. */
+    tickOnce(): {
+        scanned: number;
+        orphans: number;
+    };
+}
+export declare function createIdentityAudit(deps: IdentityAuditDeps): IdentityAudit;
+//# sourceMappingURL=admin-identity-audit.d.ts.map

package/payload/platform/services/claude-session-manager/dist/admin-identity-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-identity-audit.d.ts","sourceRoot":"","sources":["../src/admin-identity-audit.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAU5D,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;AAE3C,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb;qBACiB;IACjB,YAAY,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,YAAY,EAAE,CAAA;IACxB,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAA;IACxC,MAAM,EAAE,MAAM,CAAA;CACf;AAED;gEACgE;AAChE,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAarD;AAiCD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,SAAS,CAAA;IAClB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAA;IAChB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;IACZ,2DAA2D;IAC3D,QAAQ,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACjD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,aAAa,CA0C1E"}

package/payload/platform/services/claude-session-manager/dist/admin-identity-audit.js

@@ -0,0 +1,133 @@
+// Standing audit for the native-CC admin PIN identity gate (Task 619).
+//
+// The no-event-failure detector. The gate hook, the validate endpoint, and the
+// auth tool each emit a log line WHEN they run — but a silent bypass (the gate
+// hook not wired into a session's settings, or a regression that strips it)
+// produces no log line at all. This audit reconciles, independently of the hook,
+// the set of live native-operator sessions that reached real tool use against the
+// set that completed PIN auth (one auth-state file per authenticated session_id).
+// Any live native-operator session that used a real tool with no auth-state file
+// is an orphan: the gate did not bind an identity, yet the session acted.
+//
+// Native-operator classification: a live watcher row whose `role` is null. Native
+// `claude rc` operator sessions are spawned by the rc-daemon, not via the
+// manager's /spawn path, so they carry no sidecar and `role` resolves to null.
+// pty-spawned sessions (recorder, specialists, public, WhatsApp/Telegram)
+// normally carry a sidecar with a non-null role and are excluded. The narrow
+// exception is a pty spawn whose sidecar is briefly absent or unreadable
+// (`applySidecarToRow` defaults role to null) AND has already produced a real
+// tool_use — that would be flagged spuriously. This only ever ADDS an orphan
+// signal (false positive), never hides a real bypass, so the audit errs safe.
+//
+// "Real tool" excludes admin-identity-authenticate itself: a session that only
+// ever called the auth tool either matched (state file written) or missed
+// (terminated), so it never reaches this branch.
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { jsonlPathForSessionId } from './jsonl-path.js';
+const TAG = '[admin-identity]';
+const AUTH_TOOL = 'admin-identity-authenticate';
+/** Skip JSONLs larger than this in the tool-use scan — a bounded read keeps the
+ *  per-tick cost predictable. A session this large has unquestionably used real
+ *  tools, so treat an oversized file as "used a real tool" (conservative: it can
+ *  only ever ADD an orphan signal, never hide one). */
+const MAX_SCAN_BYTES = 8 * 1024 * 1024;
+/** Pure reconciliation: emit one audit-orphan line per live native-operator
+ *  session that used a real tool but has no auth-state file. */
+export function auditOnce(deps) {
+    let orphans = 0;
+    for (const s of deps.sessions) {
+        if (s.state !== 'live')
+            continue;
+        if (s.role !== null)
+            continue; // pty-spawned (sidecar present) — not a native operator
+        if (!s.usedRealTool)
+            continue; // pre-tool-use session — gate has not been exercised yet
+        if (deps.hasState(s.sessionId))
+            continue; // authenticated — the gate bound an identity
+        deps.logger(`${TAG} op=audit-orphan sessionId=${s.sessionId.slice(0, 8)} reason=loopback-session-without-authenticated-userId`);
+        orphans++;
+    }
+    return orphans;
+}
+/** True when the session JSONL contains an assistant tool_use whose name is not
+ *  the auth tool. Best-effort: unreadable / unparseable lines are skipped. */
+function jsonlUsedRealTool(jsonlPath) {
+    if (!existsSync(jsonlPath))
+        return false;
+    let raw;
+    try {
+        if (statSync(jsonlPath).size > MAX_SCAN_BYTES)
+            return true;
+        raw = readFileSync(jsonlPath, 'utf8');
+    }
+    catch {
+        return false;
+    }
+    for (const line of raw.split('\n')) {
+        if (!line.includes('"tool_use"'))
+            continue;
+        let obj;
+        try {
+            obj = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        const content = obj?.message?.content;
+        if (!Array.isArray(content))
+            continue;
+        for (const block of content) {
+            const b = block;
+            if (b?.type === 'tool_use' && typeof b.name === 'string' && !b.name.endsWith(AUTH_TOOL)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+export function createIdentityAudit(deps) {
+    let timer = null;
+    function tickOnce() {
+        const rows = deps.watcher.all();
+        const candidates = rows.filter((r) => r.state === 'live' && r.role === null);
+        const sessions = candidates.map((r) => ({
+            sessionId: r.sessionId,
+            role: r.role,
+            state: r.state,
+            usedRealTool: jsonlUsedRealTool(jsonlPathForSessionId(deps.spawnCwd, r.sessionId)),
+        }));
+        const orphans = auditOnce({
+            sessions,
+            hasState: (sid) => existsSync(join(deps.stateDir, `${sid}.json`)),
+            logger: deps.logger,
+        });
+        return { scanned: candidates.length, orphans };
+    }
+    return {
+        tickOnce,
+        start() {
+            if (timer)
+                return;
+            timer = setInterval(() => {
+                try {
+                    tickOnce();
+                }
+                catch (err) {
+                    deps.logger(`${TAG} op=audit-tick-failed message=${err instanceof Error ? err.message : String(err)}`);
+                }
+            }, deps.intervalMs);
+            // Don't keep the event loop alive for the audit alone.
+            if (typeof timer.unref === 'function')
+                timer.unref();
+            deps.logger(`${TAG} op=audit-started intervalMs=${deps.intervalMs} stateDir=${deps.stateDir}`);
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=admin-identity-audit.js.map

package/payload/platform/services/claude-session-manager/dist/admin-identity-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-identity-audit.js","sourceRoot":"","sources":["../src/admin-identity-audit.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,0EAA0E;AAC1E,EAAE;AACF,kFAAkF;AAClF,0EAA0E;AAC1E,+EAA+E;AAC/E,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,iDAAiD;AAEjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAGvD,MAAM,GAAG,GAAG,kBAAkB,CAAA;AAC9B,MAAM,SAAS,GAAG,6BAA6B,CAAA;AAC/C;;;uDAGuD;AACvD,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAoBtC;gEACgE;AAChE,MAAM,UAAU,SAAS,CAAC,IAAmB;IAC3C,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAQ;QAChC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,SAAQ,CAAC,wDAAwD;QACtF,IAAI,CAAC,CAAC,CAAC,YAAY;YAAE,SAAQ,CAAC,yDAAyD;QACvF,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,SAAQ,CAAC,6CAA6C;QACtF,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,8BAA8B,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,uDAAuD,CACnH,CAAA;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;8EAC8E;AAC9E,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO,IAAI,CAAA;QAC1D,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,SAAQ;QAC1C,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAI,GAA2C,EAAE,OAAO,EAAE,OAAO,CAAA;QAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAQ;QACrC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,KAA2C,CAAA;YACrD,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxF,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAmBD,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,IAAI,KAAK,GAA0B,IAAI,CAAA;IAEvC,SAAS,QAAQ;QACf,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAA;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;QAC5E,MAAM,QAAQ,GAAmB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtD,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,YAAY,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;SACnF,CAAC,CAAC,CAAA;QACH,MAAM,OAAO,GAAG,SAAS,CAAC;YACxB,QAAQ;YACR,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;YACjE,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,EAAE,CAAA;IAChD,CAAC;IAED,OAAO;QACL,QAAQ;QACR,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,IAAI,CAAC;oBACH,QAAQ,EAAE,CAAA;gBACZ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACxG,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnB,uDAAuD;YACvD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;YACpD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,gCAAgC,IAAI,CAAC,UAAU,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;QAChG,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAiB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAiLtD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAiB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAkLtD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js

@@ -33,6 +33,7 @@ export const CANONICAL_MAXY_TOOL_NAMES = [
     "mcp__plugin_admin_admin__action-pending",
     "mcp__plugin_admin_admin__action-reject",
     "mcp__plugin_admin_admin__admin-add",
+    "mcp__plugin_admin_admin__admin-identity-authenticate",
     "mcp__plugin_admin_admin__admin-list",
     "mcp__plugin_admin_admin__admin-remove",
     "mcp__plugin_admin_admin__admin-update-pin",