@rubytech/create-maxy-code 0.1.276 → 0.1.277

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.276",
+  "version": "0.1.277",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:0e8368ce205506dec22d5ed93f886c0cfc0f12b5306a6b953b4ddad19e8d3175
+content-hash: sha256:0536d599c193b028cf47a9172677b87814e3e7af2e244051ede138fba340a40b
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2290,7 +2290,7 @@ Task 500 — **admin session management moved entirely to claude's own interface
 
 | Mount | Purpose |
 |---|---|
-| `/sidebar-artefacts` | Lists every editable artefact for the sidebar Artefacts view (KnowledgeDocuments + this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates). |
+| `/sidebar-artefacts` | Lists the sidebar Artefacts rows: every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'` — all file types, excluding the separate `uploads/<id>/` subtree) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates (Task 684). |
 | `/sidebar-artefact-content` | Reads a single artefact's bytes for the artefact pane. |
 | `/sidebar-artefact-save` | Persists an artefact edit. |
 | `/attachment` | Per-attachment binary fetch (images, PDFs, etc.). |
@@ -2437,7 +2437,7 @@ authoritative. This section names the surfaces and what backs each.
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. | `/claude-sessions/events`, `/claude-sessions` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |
-| Artefacts list | Lists every KnowledgeDocument plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal (Task 518). | `sidebar-artefacts.ts`, `files.ts` |
+| Artefacts list | Lists every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'`, all file types, excluding the `uploads/<id>/` subtree — Task 684) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal (Task 518). | `sidebar-artefacts.ts`, `files.ts` |
 | System-stats widget | CPU / RAM widget at the foot of the sidebar. | `system-stats.ts` (see above) |
 | Footer | Operator avatar, name, role, and the actions popover. | `session.ts` |
 

package/payload/platform/plugins/docs/references/admin-identity-gate.md

@@ -31,10 +31,47 @@ sessions skip it.
 
 ## Accepted boundary
 
-On loopback, multiple admins resolve to the right *profile* conversationally but
-share the owner's `userId` at the env/MCP layer. Deterministic per-admin `userId`
-on the loopback surface is deliberately out of scope: making it deterministic again
-means a per-session identity step, which is exactly the deadlock Task 681 removed.
-A per-admin binding table that stamps the correct `userId` for channel sessions
-would generalise the channel model further; it was considered and left out of
-Task 681 (Option B in the design), not adopted.
+On a channel (WhatsApp today), the inbound sender phone is bound to a person's
+`userId` via `users.json` (`UserEntry.phone`), confirmed against the account's
+`admins[]`. The channel admin session carries that `userId` — graph writes and
+the `${USER_ID}` MCP env attribute to the actual sender (Task 682). An unbound
+sender (the owner's self-phone, or an `adminPhones` entry with no `users.json`
+phone) falls back to the boot-time owner `userId`.
+
+A WhatsApp admin whose inbound arrives as an unresolved LID (a cold mapping
+cache) resolves to their own `userId` via a runtime LID cache
+(`whatsapp-lid-map.json`), populated the first time their LID resolves to their
+phone (Task 686). A LID that has never resolved has no cache entry and still
+falls back to the owner `userId` — visible as the `op=admin-identity …
+userId=owner-fallback` log line.
+
+On loopback (claude.ai/code), multiple admins resolve to the right *profile*
+conversationally but share the owner's `userId` at the env/MCP layer.
+Deterministic per-admin `userId` on loopback is deliberately out of scope:
+making it deterministic again means a per-session identity step, which is exactly
+the deadlock Task 681 removed.
+
+## Boot-time binding drift gate (Task 687)
+
+The channel-admin binding is reassembled at read time from three independently
+operator-maintained sources: `adminPhones` (role allowlist), `admins[]`
+(membership), and `users.json` `UserEntry.phone` (the phone→userId binding). If
+they disagree, `resolveAdminUserId` returns null and the session silently runs
+under the owner `userId` — the fallback named in the boundary above, but here as
+a *misconfiguration*, not an intentional unbound sender.
+
+On every server start the platform replays the resolution chain for each
+account's `adminPhones` entry and logs one line per entry that would silently
+fall to the owner `userId`:
+
+    [admin-identity] binding-drift accountId=<id> phone=<p> reason=no-users-binding
+    [admin-identity] binding-drift accountId=<id> phone=<p> reason=userid-not-admin userId=<u>
+
+- `no-users-binding` — no `users.json` entry's `phone` matches this admin phone,
+  so it can never resolve to a userId. Add the phone to the person's `users.json`
+  entry.
+- `userid-not-admin` — the phone is bound to `userId`, but that userId is not in
+  this account's `admins[]`. Add the userId to `admins[]`.
+
+The gate is informational: it never blocks boot, and steady-state boots with
+consistent bindings emit nothing.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -70,7 +70,7 @@ Task 500 — **admin session management moved entirely to claude's own interface
 
 | Mount | Purpose |
 |---|---|
-| `/sidebar-artefacts` | Lists every editable artefact for the sidebar Artefacts view (KnowledgeDocuments + this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates). |
+| `/sidebar-artefacts` | Lists the sidebar Artefacts rows: every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'` — all file types, excluding the separate `uploads/<id>/` subtree) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates (Task 684). |
 | `/sidebar-artefact-content` | Reads a single artefact's bytes for the artefact pane. |
 | `/sidebar-artefact-save` | Persists an artefact edit. |
 | `/attachment` | Per-attachment binary fetch (images, PDFs, etc.). |
@@ -217,7 +217,7 @@ authoritative. This section names the surfaces and what backs each.
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. | `/claude-sessions/events`, `/claude-sessions` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |
-| Artefacts list | Lists every KnowledgeDocument plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal (Task 518). | `sidebar-artefacts.ts`, `files.ts` |
+| Artefacts list | Lists every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'`, all file types, excluding the `uploads/<id>/` subtree — Task 684) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal (Task 518). | `sidebar-artefacts.ts`, `files.ts` |
 | System-stats widget | CPU / RAM widget at the foot of the sidebar. | `system-stats.ts` (see above) |
 | Footer | Operator avatar, name, role, and the actions popover. | `session.ts` |
 

package/payload/platform/scripts/check-no-esm-require.mjs

@@ -41,6 +41,9 @@ const ALLOWLIST = new Set([
   // Same vi.hoisted pattern: Task 549's sidebar-sessions test pre-builds a
   // tmpdir before the module-under-test's ACCOUNTS_DIR mock is wired.
   'platform/ui/server/routes/admin/__tests__/sidebar-sessions.test.ts',
+  // Same vi.hoisted pattern: Task 684's sidebar-artefacts test pre-builds an
+  // empty tmpdir for ACCOUNTS_DIR/PLATFORM_ROOT before the module's mocks fire.
+  'platform/ui/server/routes/admin/__tests__/sidebar-artefacts.test.ts',
   // Same vi.hoisted pattern: Task 576's claude-auth refresh-lock test
   // builds a tmpdir + creds path before the module's `../paths` mock fires.
   'platform/ui/app/lib/__tests__/claude-auth-refresh-lock.test.ts',

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts

@@ -4,6 +4,7 @@ import type { FsWatcher } from './fs-watcher.js';
 import type { RateLimiter } from './spawn-rate-limiter.js';
 import type { AuditRegistry } from './public-tool-audit.js';
 import { type UserTitleStore } from './user-title-store.js';
+import { WaChannelStore } from './wa-channel-store.js';
 export declare const SESSION_ID_PATTERN: RegExp;
 export declare const RC_SPAWN_URL_WAIT_DEFAULT_MS = 60000;
 export interface HttpDeps extends Omit<SpawnDeps, 'onSessionReady' | 'watcher'> {
@@ -19,6 +20,10 @@ export interface HttpDeps extends Omit<SpawnDeps, 'onSessionReady' | 'watcher'>
     /** Task 253 — operator-stamped title override store. Reads merge into
      *  every displayName resolution site; the /:sessionId/rename route writes. */
     userTitleStore: UserTitleStore;
+    /** Task 683 — per-session WhatsApp channel binding. Gateway `/rc-spawn`
+     *  write-throughs it; every resume path reads it back to re-apply the
+     *  channel argv so `reply` is present on every live PTY for the session. */
+    waChannelStore: WaChannelStore;
     /** Task 648 — override the `/rc-spawn` pid/bind poll bound. Production
      *  omits this and gets RC_SPAWN_URL_WAIT_DEFAULT_MS (60s); tests inject a
      *  short value to exercise the bind-timeout response without a 60s wait. */

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAS3B,OAAO,EAeL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAkBzB,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAgF9E,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AA+MD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAyrDpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAS3B,OAAO,EAeL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAkBzB,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAgFtD,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AA+MD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAsuDpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -23,7 +23,7 @@ import { Hono } from 'hono';
 import { stream } from 'hono/streaming';
 import { existsSync, statSync, createReadStream, watchFile, unwatchFile, rmSync, mkdirSync, renameSync, readFileSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { buildWaChannelMcpServers, waChannelDevChannelsArgv, isDevChannelPrompt } from './wa-channel-mcp.js';
+import { buildWaChannelMcpServers, buildWaChannelArgv, waChannelMcpConfigPath, isDevChannelPrompt } from './wa-channel-mcp.js';
 import { randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { buildRcChildEnv } from './rc-daemon.js';
@@ -1295,6 +1295,10 @@ export function buildHttpApp(deps) {
         // logs its own failure and reads still serve from the in-memory map
         // until next boot.
         deps.userTitleStore.remove(sessionId);
+        // Task 683 — drop the channel binding too so wa-channel-bindings.json
+        // doesn't accrete orphans and a recreated session can't inherit a stale
+        // binding. Best-effort; the store logs its own failure.
+        deps.waChannelStore.remove(sessionId);
         deps.logger(`purge sessionId=${sessionId.slice(0, 8)} bytes=${bytes}`);
         timed(deps.logger, 'DELETE', `/${id}`, 204, Date.now() - start);
         return c.body(null, 204);
@@ -1549,6 +1553,13 @@ export function buildHttpApp(deps) {
         const personId = typeof body.personId === 'string' && body.personId.length > 0 && body.personId.length <= 128
             ? body.personId
             : undefined;
+        // Task 682 — per-session userId override. Server-resolved by the UI from the
+        // authoritative users.json/account.json (never message content) and shape-
+        // validated here the same way as personId. Absent for owner self-phone and
+        // any unbound sender, where the boot-time deps.userId (owner) is used.
+        const overrideUserId = typeof body.userId === 'string' && body.userId.length > 0 && body.userId.length <= 128
+            ? body.userId
+            : undefined;
         // Task 626 — one-shot admin jobs (LinkedIn ingest, public session-end
         // review) carry their prompt as the session's first turn, the same
         // trailing-positional mechanism /public-spawn uses, and close after that
@@ -1595,20 +1606,41 @@ export function buildHttpApp(deps) {
         // development channel. Inbound WhatsApp then arrives as a `<channel
         // source="whatsapp">` event and the agent replies via the channel `reply`
         // tool — no keystroke injection. Pushed before the trailing positional.
-        if (waChannel && sessionId) {
+        // Task 683 — resolve the effective binding. The gateway `/rc-spawn` supplies
+        // waChannel and we write it through to the store; any later resume (operator
+        // / PIN / manager) omits it, so we read the binding back. Either way the same
+        // per-session --mcp-config + development-channels argv is injected, so
+        // `mcp__whatsapp-channel__reply` is present on every live PTY for the session.
+        let effectiveWaChannel;
+        if (sessionId) {
+            if (waChannel) {
+                effectiveWaChannel = waChannel;
+                deps.waChannelStore.set(sessionId, waChannel);
+            }
+            else {
+                const stored = deps.waChannelStore.get(sessionId);
+                if (stored) {
+                    effectiveWaChannel = { senderId: stored.senderId, gatewayUrl: stored.gatewayUrl, serverPath: stored.serverPath };
+                    deps.logger(`[rc-spawn] op=wa-channel-rebind sessionId=${sessionId.slice(0, 8)} senderId=${stored.senderId} source=store`);
+                }
+            }
+        }
+        let waPath = null;
+        if (effectiveWaChannel && sessionId) {
             const waServers = buildWaChannelMcpServers({
                 sessionId,
-                senderId: waChannel.senderId,
-                gatewayUrl: waChannel.gatewayUrl,
-                serverPath: waChannel.serverPath,
+                senderId: effectiveWaChannel.senderId,
+                gatewayUrl: effectiveWaChannel.gatewayUrl,
+                serverPath: effectiveWaChannel.serverPath,
             });
-            const waPath = join(tmpdir(), `maxy-wa-channel-${sessionId.replace(/[^A-Za-z0-9_-]/g, '_')}.json`);
+            waPath = waChannelMcpConfigPath(sessionId, tmpdir());
             try {
                 writeFileSync(waPath, JSON.stringify({ mcpServers: waServers }, null, 2), 'utf8');
-                argv.push('--mcp-config', waPath, ...waChannelDevChannelsArgv());
-                deps.logger(`[rc-spawn] op=wa-channel senderId=${waChannel.senderId} gateway=${waChannel.gatewayUrl} path=${waPath}`);
+                argv.push(...buildWaChannelArgv(waPath));
+                deps.logger(`[rc-spawn] op=wa-channel senderId=${effectiveWaChannel.senderId} gateway=${effectiveWaChannel.gatewayUrl} path=${waPath}`);
             }
             catch (err) {
+                waPath = null;
                 deps.logger(`[rc-spawn] op=wa-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
             }
         }
@@ -1622,7 +1654,7 @@ export function buildHttpApp(deps) {
         // so the child's MCP stderr-tee writes its readable per-server log.
         const env = buildRcChildEnv({
             accountId: deps.accountId,
-            userId: deps.userId,
+            userId: overrideUserId ?? deps.userId,
             sessionId: sessionId ?? undefined,
             uiPort: process.env.MAXY_UI_INTERNAL_PORT ?? '',
             platformRoot: deps.platformRoot,
@@ -1690,6 +1722,16 @@ export function buildHttpApp(deps) {
             pid: pty.pid,
             managerOpenFds: openFdCount(),
         });
+        // Task 683 — standing invariant. A bound session whose live PTY was spawned
+        // without the channel mcp-config is the silent-revert state (the reply tool
+        // is absent, the agent falls back to whatsapp-send). The resume read-back
+        // makes the resume-without-binding case impossible, so this now fires only
+        // when the mcp-config write itself failed (waPath reset to null) — it
+        // verifies the post-condition (PTY actually carries the channel) rather than
+        // the intent to spawn it.
+        if (sessionId && deps.waChannelStore.get(sessionId) && waPath === null) {
+            deps.logger(`[rc-spawn] op=channel-binding-lost sessionId=${sessionId} pid=${pty.pid} reason=resume-without-mcp-config`);
+        }
         // Tracker registration — closes the leak gap the Task 552 path opened.
         // For fresh spawns without a caller-supplied sessionId we register the
         // tracker under the unitToken so the entry has a stable key; the
@@ -1751,7 +1793,7 @@ export function buildHttpApp(deps) {
         const BIND_BUF_TAIL = 8 * 1024;
         pty.onData((data) => {
             stdoutBytes += data.length;
-            if (waChannel && !devChannelConfirmed) {
+            if (effectiveWaChannel && !devChannelConfirmed) {
                 devChannelScan += data;
                 if (devChannelScan.length > 4096)
                     devChannelScan = devChannelScan.slice(devChannelScan.length - 4096);