@rubytech/create-maxy-code 0.1.264 → 0.1.266

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.264",
+  "version": "0.1.266",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/models/dist/index.d.ts

@@ -1,4 +1,4 @@
-export declare const OPUS_MODEL = "claude-opus-4-7";
+export declare const OPUS_MODEL = "claude-opus-4-8[1m]";
 export declare const SONNET_MODEL = "claude-sonnet-4-6";
 export declare const HAIKU_MODEL = "claude-haiku-4-5";
 export declare const MODEL_CONTEXT_WINDOW: Record<string, number>;

package/payload/platform/lib/models/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,UAAU,oBAAoB,CAAC;AAC5C,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD"}

package/payload/platform/lib/models/dist/index.js

@@ -5,11 +5,14 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = void 0;
 exports.contextWindow = contextWindow;
-exports.OPUS_MODEL = "claude-opus-4-7";
+// Opus defaults to the 1M-context variant ([1m] is Claude Code's
+// context-extension suffix, valid in settings.json "model" and agent
+// frontmatter); Sonnet/Haiku stay on the standard 200k window.
+exports.OPUS_MODEL = "claude-opus-4-8[1m]";
 exports.SONNET_MODEL = "claude-sonnet-4-6";
 exports.HAIKU_MODEL = "claude-haiku-4-5";
 exports.MODEL_CONTEXT_WINDOW = {
-    [exports.OPUS_MODEL]: 200_000,
+    [exports.OPUS_MODEL]: 1_000_000,
     [exports.SONNET_MODEL]: 200_000,
     [exports.HAIKU_MODEL]: 200_000,
 };

package/payload/platform/lib/models/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAa7C,sCAEC;AAbY,QAAA,UAAU,GAAG,iBAAiB,CAAC;AAC/B,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,OAAO;IACrB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAgB7C,sCAEC;AAhBD,iEAAiE;AACjE,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC"}

package/payload/platform/lib/models/src/index.ts

@@ -2,12 +2,15 @@
 // Templates, docs, and skills reference these values as strings;
 // all TypeScript consumers import from here.
 
-export const OPUS_MODEL = "claude-opus-4-7";
+// Opus defaults to the 1M-context variant ([1m] is Claude Code's
+// context-extension suffix, valid in settings.json "model" and agent
+// frontmatter); Sonnet/Haiku stay on the standard 200k window.
+export const OPUS_MODEL = "claude-opus-4-8[1m]";
 export const SONNET_MODEL = "claude-sonnet-4-6";
 export const HAIKU_MODEL = "claude-haiku-4-5";
 
 export const MODEL_CONTEXT_WINDOW: Record<string, number> = {
-  [OPUS_MODEL]: 200_000,
+  [OPUS_MODEL]: 1_000_000,
   [SONNET_MODEL]: 200_000,
   [HAIKU_MODEL]: 200_000,
 };

package/payload/platform/neo4j/schema.cypher

@@ -1462,6 +1462,19 @@ FOR (wg:WhatsAppGroup) ON (wg.accountId);
 // :VoiceProfile nodes. The per-label format index lets per-format corpus
 // walks and profile reads avoid full-label scans.
 
+// Task 676 — :VoiceProfile.scope ∈ {'personal','org'} discriminates the two
+// profile kinds. Personal: key (accountId, userId, format), scope='personal',
+// anchored on :AdminUser via HAS_VOICE_PROFILE. Org: key (accountId,
+// userId='__org__', format), scope='org', anchored on :LocalBusiness. The
+// reserved sentinel userId '__org__' keeps the (accountId, userId, format)
+// UNIQUE constraint below valid with NO migration — exactly one org profile
+// per (account, format). A real :AdminUser must never hold userId='__org__'
+// (voice-distil-profile surfaces, never swallows, the resulting constraint
+// error). Corpus nodes carry voiceAuthor (a userId): org walks are
+// account-wide, personal walks filter n.voiceAuthor = the operator. :VoiceEdit
+// also carries scope + the profile-key userId so feedback routes to the
+// matching profile; the real editor is preserved via :AUTHORED.
+
 // Task 462 — drop the old (accountId, adminUserId) constraint before
 // creating the new (accountId, userId, format) three-key constraint.
 // `IF EXISTS` makes the DROP idempotent on fresh installs.

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and admin-identity-authenticate (native-CC PIN identity gate — the operator submits their PIN as the first action of every session to bind their authenticated userId; the PreToolUse pin-identity-gate hook blocks all other tools until this succeeds) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and admin-identity-authenticate (native-CC PIN identity gate — the operator submits their PIN as the first action of every session to bind their authenticated userId; the PreToolUse pin-identity-gate hook blocks all other tools until this succeeds) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and admin-identity-authenticate (native-CC PIN identity gate — the operator submits their PIN as the first action of every session to bind their authenticated userId; the PreToolUse pin-identity-gate hook blocks all other tools until this succeeds) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, action-approval tools (action-pending, action-approve, action-reject, action-edit), and admin-identity-authenticate (native-CC PIN identity gate — the operator submits their PIN as the first action of every session to bind their authenticated userId; the PreToolUse pin-identity-gate hook blocks all other tools until this succeeds) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -51,6 +51,9 @@ tools:
   - name: skill-load
     publicAllowlist: false
     adminAllowlist: true
+  - name: skill-search
+    publicAllowlist: false
+    adminAllowlist: true
   - name: store-skill
     publicAllowlist: false
     adminAllowlist: true
@@ -104,6 +107,8 @@ Platform management tools for both the admin and public agents. The `plugin-read
 
 Tools are available via the `admin` MCP server.
 
+**Intent → skill resolution (Task 675).** `skill-search query="<free text>"` is the description-driven resolver: it walks every plugin's `skills/<slug>/SKILL.md`, reads frontmatter `name`+`description` only, and returns the top owners ranked by a frequency-aware match (distinctive terms dominate; common trigger words contribute little) with each owner's canonical `skills/<slug>/SKILL.md` path. It exists because the session's available-skills menu — the only other description-driven surface — is injected at session start and resume but **not** after a context compaction; once it leaves context, intent-phrased guesses miss `skill-find` (which is exact-slug only) and the agent falls back to blind `find`/`grep`. `skill-search` makes the mapping a single deterministic call regardless of whether the menu is present; feed the returned slug straight to `skill-load`. `skill-find` and `skill-load` stay exact-slug — they resolve a slug you already know — and are unchanged.
+
 **Admin-seat authoring-skill gate (Task 516).** `skill-load` and `plugin-read` refuse to return the body of a content-producer-owned authoring skill — `professional-document`, `a4-print-documents`, `publish-site` — when the caller is the admin seat (`MAXY_SESSION_ROLE=admin` with no `MAXY_SPECIALIST`). The refusal relays one line — "This deliverable is owned by content-producer. Dispatch it with the Agent tool and subagent_type content-producer." — so the admin's next action is the dispatch, not inline authoring. `plugin-read` extracts the skill slug from a `skills/<slug>/…` file path (or a slug buried in `pluginName`), so the raw-SKILL.md read path can't bypass the gate; `PLUGIN.md` and plain `references/*` reads are untouched. content-producer's own spawns carry `MAXY_SPECIALIST=content-producer` and resolve these skills normally (it reaches them via the native `Skill` tool regardless), and the public seat is out of scope. The gate is a pure name+env check before any filesystem read and fails open for any non-admin or unidentified seat — it never bricks a legitimate load. Each block emits `[admin-skill-gate] role=admin skill=<name> decision=block reason=content-producer-owned`. This is the enforcement layer; the IDENTITY.md delegation paragraph documents the intent but is not the gate ([[feedback_deterministic_means_remove_llm]], [[feedback_doctrine_paragraph_is_not_a_gate]]). Skills the admin invokes directly are deliberately excluded: `unzip-attachment` (its SKILL.md says "Invoked by the admin agent directly — admin owns all unzipping", then routes the extracted tree to a specialist) and `deck-pages` (admin-owned, a content-producer refusal target). The set is each skill's own SKILL.md "Invoked by" declaration, not the admin plugin's skill catalogue (which lists these admin-hosted skills for discovery — the catalogue is the inline path this gate closes).
 
 **Three-store admin auth invariant.** `admin-add` writes to all three identity stores (`users.json` PIN auth at the persistent `~/{configDir}/users.json` location , `account.json` `admins[]` role, Neo4j `:AdminUser`/`:Person` graph identity) with per-leg `[admin-auth-store]` log lines plus the `[admins-write]` chokepoint line, and returns `is_error: true` on any leg failure naming what's already written. `admin-update-pin` writes `users.json` only and emits the same `[admin-auth-store]` line. **Single chokepoint:** every `users.json` + `account.json admins[]` mutation routes through `platform/lib/admins-write` (`writeAdminEntry` for admin-add/set-pin, `removeAdminFromAccount` for admin-remove); the static check `grep -rnE 'admins\.push\|config\.admins\s*=' platform/ \| grep -v lib/admins-write` returns 0. Direct `Edit`/`Write` on `account.json` is forbidden by IDENTITY.md doctrine — mutations go through `account-update`, `plugin-toggle-enabled`, or the `admin-*` tools. **Install + boot invariants:** the installer and admin-server boot walk every account.json admins[] vs users.json; `[install-invariant]` / `[admin-invariant] direction=… userId=<id8> source=<file>` fires per divergence with a `check complete divergences=<n>` summary. Log-only — does not block. See `.docs/agents.md` § "Three-store admin auth invariant" for the full contract.

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-search.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-search.test.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-search.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-search.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/skill-search.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-search.test.js

@@ -0,0 +1,106 @@
+// `skill-search` keyword-resolution acceptance gate (Task 675).
+//
+// Locks in `searchSkills` / `parseSkillFrontmatter` — the description-driven
+// surface that maps intent -> skill slug when the available-skills menu has
+// left context. Tests build a temp PLATFORM_ROOT, seed SKILL.md frontmatter,
+// and assert ranking + parse shapes. Ephemeral: not part of a standing suite.
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { searchSkills, parseSkillFrontmatter } from "../skill-resolution.js";
+let root;
+beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "skill-search-"));
+});
+afterEach(() => {
+    rmSync(root, { recursive: true, force: false });
+});
+function seedSkill(plugin, skill, body) {
+    const dir = join(root, "plugins", plugin, "skills", skill);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "SKILL.md"), body);
+}
+const fm = (name, description) => `---\nname: ${name}\ndescription: ${description}\n---\n\n# ${name}\n`;
+describe("searchSkills", () => {
+    it("description-only match returns the owning plugin + canonical slug path top-ranked", () => {
+        seedSkill("quotation", "quotation", fm("quotation", "Use when an operator's own way of pricing jobs needs to become something the assistant can apply — set up my pricing, learn how I quote, re-learning their method from past quotes."));
+        seedSkill("admin", "qr-code", fm("qr-code", "Generate QR codes. Trigger phrases: create a QR, make a QR code."));
+        seedSkill("admin", "datetime", fm("datetime", "Timezone queries and relative-date arithmetic."));
+        const hits = searchSkills(root, "pricing algorithm");
+        expect(hits.length).toBeGreaterThan(0);
+        expect(hits[0].pluginName).toBe("quotation");
+        expect(hits[0].skillName).toBe("quotation");
+        expect(hits[0].file).toBe("skills/quotation/SKILL.md");
+    });
+    it("a common trigger word does not let a noise skill outrank the distinctive match", () => {
+        // "create" is a noise term (appears in many descriptions); "quote" is
+        // distinctive. quotation must still win for "create a quote".
+        seedSkill("quotation", "quotation", fm("quotation", "Onboarding a new business's pricing, re-learning their method from past quotes, checking the method reproduces past quotes."));
+        seedSkill("admin", "qr-code", fm("qr-code", "Create a QR code. Trigger: create a QR, create a code."));
+        seedSkill("admin", "publish-site", fm("publish-site", "Create and publish a static site online."));
+        seedSkill("admin", "deck-pages", fm("deck-pages", "Create a slide deck of pages."));
+        const hits = searchSkills(root, "create a quote");
+        expect(hits[0].skillName).toBe("quotation");
+    });
+    it("no-match query returns an empty array, not an error", () => {
+        seedSkill("admin", "qr-code", fm("qr-code", "Generate QR codes."));
+        const hits = searchSkills(root, "zxqw nonexistent");
+        expect(hits).toEqual([]);
+    });
+    it("ranks against block-scalar descriptions (> and |)", () => {
+        seedSkill("admin", "datetime", "---\nname: datetime\ndescription: >\n  Timezone queries (current time, conversion, UTC offset, DST) and\n  relative-date arithmetic across cities.\n---\n\n# datetime\n");
+        seedSkill("admin", "investigate", "---\nname: investigate\ndescription: |\n  Systematic debugging with root cause investigation. Use when asked to\n  debug this or find the root cause of an error.\n---\n\n# investigate\n");
+        const tz = searchSkills(root, "timezone conversion");
+        expect(tz[0].skillName).toBe("datetime");
+        const dbg = searchSkills(root, "root cause debugging");
+        expect(dbg[0].skillName).toBe("investigate");
+    });
+    it("respects the limit and orders deterministically by score", () => {
+        for (let i = 0; i < 8; i++) {
+            seedSkill("admin", `skill-${i}`, fm(`skill-${i}`, `Handles widget task number ${i}.`));
+        }
+        const hits = searchSkills(root, "widget", 3);
+        expect(hits.length).toBe(3);
+        for (let i = 1; i < hits.length; i++) {
+            expect(hits[i - 1].score).toBeGreaterThanOrEqual(hits[i].score);
+        }
+    });
+    it("returns [] when the plugins dir is absent (no throw)", () => {
+        expect(searchSkills(join(root, "does-not-exist"), "anything")).toEqual([]);
+    });
+    it("matches on word boundaries, not arbitrary substrings", () => {
+        // "id" must not match "video"/"guide"; "art" must not match "start".
+        seedSkill("admin", "video-guide", fm("video-guide", "A guide to start recording video."));
+        seedSkill("contacts", "id-card", fm("id-card", "Manage an id card for a person."));
+        const hits = searchSkills(root, "id");
+        expect(hits.map(h => h.skillName)).toEqual(["id-card"]);
+        const none = searchSkills(root, "art");
+        expect(none).toEqual([]);
+    });
+    it("parses a block scalar with a chomping modifier (>- / |-)", () => {
+        const r = parseSkillFrontmatter("---\nname: x\ndescription: >-\n  Fold this and strip the\n  trailing newline.\n---\n");
+        expect(r.description).toBe("Fold this and strip the trailing newline.");
+    });
+});
+describe("parseSkillFrontmatter", () => {
+    it("reads a single-line description", () => {
+        const r = parseSkillFrontmatter("---\nname: quotation\ndescription: Set up my pricing and learn how I quote.\n---\n\n# x\n");
+        expect(r.name).toBe("quotation");
+        expect(r.description).toContain("learn how I quote");
+    });
+    it("folds a block-scalar description into one line", () => {
+        const r = parseSkillFrontmatter("---\nname: qr-code\ndescription: >\n  Generate QR codes from URLs,\n  Wi-Fi credentials, contacts.\nallowed-tools: []\n---\n\n# x\n");
+        expect(r.name).toBe("qr-code");
+        expect(r.description).toBe("Generate QR codes from URLs, Wi-Fi credentials, contacts.");
+    });
+    it("returns empty strings when there is no frontmatter block", () => {
+        const r = parseSkillFrontmatter("# Just a heading\n\nbody\n");
+        expect(r).toEqual({ name: "", description: "" });
+    });
+    it("strips surrounding quotes from a quoted value", () => {
+        const r = parseSkillFrontmatter('---\nname: x\ndescription: "Quoted desc."\n---\n');
+        expect(r.description).toBe("Quoted desc.");
+    });
+});
+//# sourceMappingURL=skill-search.test.js.map

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-search.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-search.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-search.test.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE7E,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;AACtD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAE,EAAE,CAAC,cAAc,IAAI,kBAAkB,WAAW,cAAc,IAAI,IAAI,CAAC;AAExH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,SAAS,CACP,WAAW,EACX,WAAW,EACX,EAAE,CAAC,WAAW,EAAE,qLAAqL,CAAC,CACvM,CAAC;QACF,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,kEAAkE,CAAC,CAAC,CAAC;QACjH,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,gDAAgD,CAAC,CAAC,CAAC;QAEjG,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,sEAAsE;QACtE,8DAA8D;QAC9D,SAAS,CACP,WAAW,EACX,WAAW,EACX,EAAE,CAAC,WAAW,EAAE,6HAA6H,CAAC,CAC/I,CAAC;QACF,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,wDAAwD,CAAC,CAAC,CAAC;QACvG,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,CAAC,cAAc,EAAE,0CAA0C,CAAC,CAAC,CAAC;QACnG,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,+BAA+B,CAAC,CAAC,CAAC;QAEpF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAElD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAEpD,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,SAAS,CACP,OAAO,EACP,UAAU,EACV,yKAAyK,CAC1K,CAAC;QACF,SAAS,CACP,OAAO,EACP,aAAa,EACb,2LAA2L,CAC5L,CAAC;QAEF,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEzC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,8BAA8B,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,qEAAqE;QACrE,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,aAAa,EAAE,mCAAmC,CAAC,CAAC,CAAC;QAC1F,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,iCAAiC,CAAC,CAAC,CAAC;QAEnF,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,qBAAqB,CAAC,sFAAsF,CAAC,CAAC;QACxH,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,GAAG,qBAAqB,CAAC,2FAA2F,CAAC,CAAC;QAC7H,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,GAAG,qBAAqB,CAAC,qIAAqI,CAAC,CAAC;QACvK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,GAAG,qBAAqB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,GAAG,qBAAqB,CAAC,kDAAkD,CAAC,CAAC;QACpF,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -19,7 +19,7 @@ import { createConnection } from "node:net";
 import { homedir, hostname as osHostname } from "node:os";
 import QRCode from "qrcode";
 import { getSession, closeDriver } from "./lib/neo4j.js";
-import { findSkillOwners, computePluginReadHint, loadSkill, parseRequiredInputs, adminAuthoringSkillBlock, skillSlugFromReadArgs, AUTHORING_DISPATCH_HINT } from "./skill-resolution.js";
+import { findSkillOwners, searchSkills, computePluginReadHint, loadSkill, parseRequiredInputs, adminAuthoringSkillBlock, skillSlugFromReadArgs, AUTHORING_DISPATCH_HINT } from "./skill-resolution.js";
 import { resolvePublicHostname } from "./lib/public-hostname.js";
 import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
@@ -1896,6 +1896,41 @@ server.tool("skill-find", "Find which plugin owns a skill by name. Walks plugins
         isError: true,
     };
 });
+// `skill-search` maps intent -> skill slug when the agent does not yet know
+// the name. Task 675: the session's available-skills menu (each skill's
+// name+description) is injected at session start and resume, NOT after a
+// context compaction — so post-compaction the only description-driven surface
+// is gone and `skill-find` (exact-slug only) misses every intent-phrased
+// guess, leaving the agent on blind `find`/`grep`. This tool queries the same
+// frontmatter descriptions the menu carried, so resolution no longer depends
+// on the menu being in context. Eager-loaded (registered via eagerTool) so it
+// is present in the prompt at boot, reachable without a ToolSearch round-trip.
+eagerTool(server, "skill-search", "Find skills by free-text intent when you do not know the exact slug. Searches every plugin skill's SKILL.md name+description and returns the top owners ranked by relevance, each with its plugin and canonical skills/<slug>/SKILL.md path. Use this to map a request (e.g. \"pricing algorithm\", \"create a quote\") to a skill, then skill-load the slug it returns. For an exact slug you already know, use skill-load directly.", {
+    query: z.string().min(1, "query must be a non-empty free-text string"),
+}, async ({ query }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("skill-search");
+    const start = Date.now();
+    const hits = searchSkills(PLATFORM_ROOT, query);
+    const ms = Date.now() - start;
+    const top = hits.length > 0 ? `${hits[0].pluginName}:${hits[0].skillName}` : "none";
+    console.log(`[skill-search] query=${JSON.stringify(query)} hits=${hits.length} top=${top} ms=${ms}`);
+    if (hits.length === 0) {
+        return {
+            content: [{
+                    type: "text",
+                    text: `no_match — no skill description matched "${query}". Refine the query or browse with skill-find if you know a slug.`,
+                }],
+        };
+    }
+    const lines = hits.map(h => `pluginName="${h.pluginName}" skillName="${h.skillName}" file="${h.file}"\n  ${h.description}`).join("\n");
+    return {
+        content: [{
+                type: "text",
+                text: `${lines}\n\nLoad the right one in one call: skill-load skillName="${hits[0].skillName}"`,
+            }],
+    };
+});
 // `skill-load` collapses skill resolve+read into one call.
 //
 // Why: 21 prose call sites previously said *"Load `admin/skills/plainly/SKILL.md`