@rubytech/create-maxy-code 0.1.285 → 0.1.287

package/payload/platform/plugins/admin/hooks/prompt-optimiser-directive.sh

@@ -39,6 +39,31 @@ HOOK_INPUT=$(cat 2>/dev/null || true)
 # Fail-open if the JSON encoder is unavailable.
 command -v python3 >/dev/null 2>&1 || exit 0
 
+# Task 753 — suppress the directive on a native channel turn. A channel inbound
+# arrives as a `<channel source="..." ...>` event; the channel service already
+# reframes that event text into a select-and-dispatch instruction, so injecting
+# the standing routing ladder on top is redundant. The marker is matched on the
+# parsed `.prompt` field (not raw stdin) and only at the start of the prompt, so
+# a normal admin prompt that merely mentions "channel" is never suppressed.
+# Fail-open: if the prompt cannot be parsed, do NOT suppress (inject as usual).
+IS_CHANNEL_TURN=$(printf '%s' "$HOOK_INPUT" | python3 -c '
+import json, sys
+try:
+    p = json.load(sys.stdin).get("prompt", "")
+except Exception:
+    print("no"); sys.exit(0)
+print("yes" if isinstance(p, str) and p.lstrip().startswith("<channel source=") else "no")
+' 2>/dev/null || echo "no")
+if [ "$IS_CHANNEL_TURN" = "yes" ]; then
+  SID_C=$(printf '%s' "$HOOK_INPUT" | python3 -c 'import json,sys
+try:
+    print(json.load(sys.stdin).get("session_id","") or "?")
+except Exception:
+    print("?")' 2>/dev/null)
+  echo "[prompt-optimiser-directive] skipped reason=channel-turn session=${SID_C:-?}" >&2
+  exit 0
+fi
+
 # Read a generated list from the account dir (cwd). On a missing file, emit a
 # visible breadcrumb to stderr and echo a one-line placeholder so the ladder
 # still names the tier.
@@ -97,21 +122,45 @@ print(json.dumps({
 [ -n "$OUT" ] || exit 0
 printf '%s\n' "$OUT"
 
-# Durable breadcrumb: capture the per-turn injection in $LOG_DIR so "directive
-# fired on this turn" is greppable for compliance review, not only on stderr
-# (Task 719). Fail-open: no LOG_DIR, missing dir, or unwritable -> skip the file;
-# the stderr line below still emits. session_id is parsed from the captured
-# stdin; absent -> "?".
-if [ -n "${LOG_DIR:-}" ] && [ -d "$LOG_DIR" ]; then
-  SID=$(printf '%s' "$HOOK_INPUT" | python3 -c 'import json,sys
+# Session id, content hash, timestamp — computed unconditionally (cheap) so the
+# stored file path and the breadcrumb can reference them even when LOG_DIR is
+# absent (file=-). session_id is parsed from the captured stdin; absent -> "?".
+SID=$(printf '%s' "$HOOK_INPUT" | python3 -c 'import json,sys
 try:
     print(json.load(sys.stdin).get("session_id","") or "")
 except Exception:
     print("")' 2>/dev/null)
-  TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-  printf '%s [prompt-optimiser-directive] injected len=%s session=%s\n' \
-    "$TS" "${#DIRECTIVE}" "${SID:-?}" >> "$LOG_DIR/prompt-optimiser-directive.log" 2>/dev/null || true
+SID=${SID:-?}
+SHA=$(printf '%s' "$DIRECTIVE" | python3 -c 'import hashlib,sys
+sys.stdout.write(hashlib.sha256(sys.stdin.buffer.read()).hexdigest())' 2>/dev/null || echo "?")
+TS=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Task 746: persist the EXACT emitted additionalContext bytes per turn, so the
+# full directive is recoverable from an operator surface (the JSONL attachment
+# row Claude Code keeps is truncated to <=2.6 KB; this file is not). Keyed by
+# session + epoch seconds + pid -> one file per injection. Fail-open: a missing
+# LOG_DIR, an unknown session, an un-creatable dir, or an unwritable file all
+# skip the write and leave DIR_FILE=- ; the turn is never blocked.
+DIR_FILE="-"
+if [ -n "${LOG_DIR:-}" ] && [ -d "$LOG_DIR" ] && [ "$SID" != "?" ]; then
+  STORE="$LOG_DIR/prompt-optimiser-directives/$SID"
+  if mkdir -p "$STORE" 2>/dev/null; then
+    CAND="$STORE/$(date +%s)-$$.txt"
+    if printf '%s' "$DIRECTIVE" > "$CAND" 2>/dev/null; then
+      DIR_FILE="$CAND"
+    fi
+  fi
+fi
+
+# Durable breadcrumb (Task 719 + 746): length + content hash + stored path +
+# session, so "directive fired on this turn" carries enough to recover and
+# verify the exact bytes. The `injected len=` and `session=` substrings are
+# preserved for the existing greps/tests.
+if [ -n "${LOG_DIR:-}" ] && [ -d "$LOG_DIR" ]; then
+  printf '%s [prompt-optimiser-directive] injected len=%s sha256=%s file=%s session=%s\n' \
+    "$TS" "${#DIRECTIVE}" "$SHA" "$DIR_FILE" "$SID" \
+    >> "$LOG_DIR/prompt-optimiser-directive.log" 2>/dev/null || true
 fi
 
-echo "[prompt-optimiser-directive] injected len=${#DIRECTIVE}" >&2
+echo "[prompt-optimiser-directive] injected len=${#DIRECTIVE} sha256=$SHA file=$DIR_FILE session=$SID" >&2
 exit 0

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:cc48ff74e2c0782fd1d36ad2f280495df8124e1bb5e3fff9a3d777db7c48b3de
+content-hash: sha256:a058a1f676b20300c5b0cbba3a8eb4f1ccb4d3e127a19865286b1500a23b9cd0
 brand: maxy-code
 product-name: Maxy
 ---
@@ -344,7 +344,7 @@ These are part of Maxy's foundation and cannot be disabled:
 | `tasks` | Task lifecycle — create, update, list, relate, complete |
 | `workflows` | Persistent named workflows — reusable instruction sets |
 | `contacts` | CRM contact management — create, lookup, update, list |
-| `prompt-optimiser` | Prompt optimiser — two modes. Chat-app mode turns a rough draft or task description into a single finished, copy-pasteable prompt tuned for Opus 4.7 adaptive thinking (claude.ai, Mac, iOS). In-session mode is applied automatically: a standing `UserPromptSubmit` directive hook (`admin/hooks/prompt-optimiser-directive.sh`) injects context every turn telling the admin agent to restate each non-trivial prompt through this skill and act on the restatement, skipped for one-word confirmations, slash-commands, and direct continuations. Compliance is behavioural — the hook steers the agent, it cannot force the skill call. |
+| `prompt-optimiser` | Prompt optimiser — two modes. Chat-app mode turns a rough draft or task description into a single finished, copy-pasteable prompt tuned for Opus 4.7 adaptive thinking (claude.ai, Mac, iOS). In-session mode is applied automatically: a standing `UserPromptSubmit` directive hook (`admin/hooks/prompt-optimiser-directive.sh`) injects context every turn telling the admin agent to restate each non-trivial prompt through this skill and act on the restatement, skipped for one-word confirmations, slash-commands, and direct continuations. Compliance is behavioural — the hook steers the agent, it cannot force the skill call. The hook also persists the exact injected `additionalContext` per turn to `$LOG_DIR/prompt-optimiser-directives/<session>/<epoch>-<pid>.txt` and records `len`, `sha256`, and the stored `file=` path in `$LOG_DIR/prompt-optimiser-directive.log`, so any past turn's full ~17 KB directive is recoverable and verifiable (the JSONL attachment row Claude Code keeps is truncated to ≤2.6 KB). `platform/scripts/prompt-optimiser-audit.sh` reconciles breadcrumbs against stored files per session (`injected=N stored=M`; `N!=M` is the leak signature, and any breadcrumb whose `file=` is missing is named). |
 | `url-get` | Faithful page retrieval — fetches a server-rendered page, writes a verbatim markdown copy to an account-scoped reference file (no model in the path, so no copyright refusal), and returns the cleaned page text (capped) plus the file path. No summary and no subprocess: a caller that wants a summary invokes url-get from a delegated subagent. Use instead of WebFetch when a faithful copy is needed (e.g. ingesting your own published writing). |
 
 ### Maxy Plugins (user-selectable)
@@ -2443,8 +2443,8 @@ authoritative. This section names the surfaces and what backs each.
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. | `/claude-sessions/events`, `/claude-sessions` |
-| Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session** (Task 738). Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows the **operator display name** (`Person givenName familyName`, resolved server-side from `senderId`; falls back to the raw `senderId` when unbound/unresolved), with the agent session title as the hover tooltip only. | `/whatsapp-reader/conversations` |
-| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. | `/whatsapp-reader/stream` |
+| Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session** (Task 738). Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title` (Task 747): the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
+| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom (Task 747). The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn (Task 746), sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |
 | Artefacts list | Lists every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'`, all file types, excluding the `uploads/<id>/` subtree — Task 684) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal (Task 518). | `sidebar-artefacts.ts`, `files.ts` |
 | System-stats widget | CPU / RAM widget at the foot of the sidebar. | `system-stats.ts` (see above) |
@@ -3421,7 +3421,7 @@ If you need to restart the service manually (rare), ask Maxy to do it for you.
 
 ## Browsing the brand filesystem on your LAN (SMB)
 
-Every install provisions a per-brand SMB share against the brand's install folder. See [Samba Share](./samba.md) for the share path, credentials, per-OS mount instructions, peer-brand lifecycle, and the LAN-only binding posture.
+Every install provisions a per-brand SMB share against the brand's install folder. See [Samba Share](./samba.md) for the share path, credentials, per-OS mount instructions, peer-brand lifecycle, and the interface-binding posture (LAN-only on a private-LAN host, loopback-only on a public-only cloud host).
 
 ## Remote Access via Cloudflare
 
@@ -3604,9 +3604,9 @@ The share lives next to the rest of the brand. On a device that runs more than o
 The installer runs the same Samba step on every supported footprint — Raspberry Pi, Hetzner Cloud server, and self-hosted Linux laptop. Four sub-steps emit `[install-invariant] samba-provision-<step>` markers in order:
 
 1. **apt** — installs the `samba` package (skipped if `dpkg -s samba` already reports installed, so re-runs don't fight `unattended-upgrades` for the dpkg lock).
-2. **conf** — writes `/etc/samba/smb.conf` with a LAN-only `[global]` section plus a `[<brand>]` stanza pointing at the brand's install directory. The stanza is owned by the install owner (see below) and is marked `read only = no`, `browseable = yes`.
+2. **conf** — writes `/etc/samba/smb.conf` with a `[global]` section plus a `[<brand>]` stanza pointing at the brand's install directory. The stanza is owned by the install owner (see below) and is marked `read only = no`, `browseable = yes`. The `[global]` bind posture depends on the host's interfaces (see "Interface binding" below); the marker records which posture fired — `bind=lan iface=<name>` or `bind=loopback-only`.
 3. **user** — deferred at install time on a fresh Pi or Hetzner box because there is no PIN to hand to `smbpasswd` yet. The user is created the moment the operator sets a PIN in the admin UI (see "PIN rotation" below).
-4. **units** — `systemctl enable --now smbd nmbd` so the share is reachable as soon as the install finishes.
+4. **units** — `systemctl enable --now smbd` so the share is reachable as soon as the install finishes. `nmbd` (NetBIOS name service) is never enabled: nothing mounts the share by NetBIOS name, and on a public-facing host it answers on `:137`/`:138` as a DDoS-reflection vector.
 
 macOS install is a no-op for this step — the installer logs `samba-provision skipped: platform=darwin` and returns. Mac operators do not get an SMB share against their laptop.
 
@@ -3641,18 +3641,31 @@ So:
 - Rotating the PIN re-syncs the SMB password to the new value on the next set-pin request. Mounts using the old PIN start failing immediately; remount with the new PIN.
 - If `set-pin` cannot read `~/.<brand>/.install-owner` (file missing or empty), it logs `[set-pin] smbpasswd sync failed owner=<unknown> rc=-1 reason=install-owner-file-missing` and skips the sync. The PIN still writes to the admin UI, but the SMB mount keeps refusing the new password until the install-owner file is restored.
 
-## LAN-only binding
+## Interface binding
 
-The `[global]` section binds smbd to loopback plus one LAN interface:
+`bind interfaces only = yes` is always set, which makes the `interfaces` line an allow-list rather than a hint. Smbd binds only to the interfaces named there. The installer classifies the host's interfaces and writes one of two postures:
 
-```
-interfaces = lo <lan>
-bind interfaces only = yes
-```
+- **Private LAN host (Raspberry Pi).** At least one non-loopback interface carries a private address — RFC1918 (`10/8`, `172.16/12`, `192.168/16`), CGNAT (`100.64/10`), or link-local (`169.254/16`). The installer binds loopback plus that interface (`wlan0` preferred, then `eth0`, then the first other private interface):
+
+  ```
+  interfaces = lo <lan>
+  bind interfaces only = yes
+  ```
+
+  The share is reachable on the LAN and nowhere else.
+
+- **Public-only host (Hetzner Cloud).** The only non-loopback interface carries a routable public address (typically `eth0` with a `/32`, no private LAN). Binding `lo eth0` here would put smbd directly on the public internet, so the installer binds **loopback only**:
+
+  ```
+  interfaces = lo
+  bind interfaces only = yes
+  ```
+
+  The share is reachable solely from the box itself. Operators reach it by forwarding loopback over SSH — `ssh -L 4445:localhost:445 admin@<tunnel-host>` and then mounting `smb://localhost:4445` — or by joining the box to a private network and re-installing, which makes the private interface the chosen LAN bind.
 
-`<lan>` is whichever non-loopback interface has an IPv4 address — `wlan0` preferred, then `eth0`, then the first other interface with an address. If the device has no LAN interface at all, the installer refuses to provision and exits — there is nothing safe to bind to.
+If the device has no non-loopback IPv4 interface at all, the installer refuses to provision and exits — there is nothing safe to bind to. This is distinct from the public-only case, which still provisions a working (host-local) share.
 
-This is the structural guarantee that SMB never leaves the LAN, even if upstream firewall rules are misconfigured. The Cloudflare tunnel that fronts the admin UI carries HTTPS only; it does not route SMB. **On a Hetzner box the share is therefore not reachable from the public internet** — operators reach it by `ssh -L 4445:localhost:445 admin@<tunnel-host>` and then mounting `smb://localhost:4445`, or by running the Hetzner box on a private network that the operator's machine also joins.
+This classification is the structural guarantee that SMB never leaves the box (loopback-only) or the LAN (LAN-only), even if upstream firewall rules are misconfigured. The Cloudflare tunnel that fronts the admin UI carries HTTPS only; it does not route SMB.
 
 ## Peer-brand lifecycle
 
@@ -3669,8 +3682,8 @@ The brand-stanza name is the only identifier the uninstaller matches on, so two
 
 - **"Logon failure" on mount.** The PIN you typed does not match the current `smbpasswd` entry. Set a new PIN in the admin UI and remount. If the PIN was just rotated and the mount still fails, check `~/.<brand>/.install-owner` exists and is non-empty.
 - **Share does not show up in Finder / network browser.** mDNS may not be routed on your network. Mount by LAN IP instead of `<hostname>.local`.
-- **`smbd` not running after install.** Check the install log for the four `[install-invariant] samba-provision-<step>` markers. The `units` step running `systemctl enable --now smbd nmbd` is the last to fire; if it failed the marker prints `fail: <reason>`.
-- **Hetzner share not reachable from outside the box.** This is by design — see "LAN-only binding" above. Use SSH port forwarding.
+- **`smbd` not running after install.** Check the install log for the four `[install-invariant] samba-provision-<step>` markers. The `units` step running `systemctl enable --now smbd` is the last to fire; if it failed the marker prints `fail: <reason>`.
+- **Hetzner share not reachable from outside the box.** This is by design — see "Interface binding" above. A public-only host binds loopback only; use SSH port forwarding (`ssh -L 4445:localhost:445 …`).
 
 Also see [Deployment Guide](./deployment.md) for the surrounding install flow, and [Access Control](./access-control.md) for how the brand isolation extends from the admin UI to the SMB share.
 

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -216,8 +216,8 @@ authoritative. This section names the surfaces and what backs each.
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. | `/claude-sessions/events`, `/claude-sessions` |
-| Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session** (Task 738). Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows the **operator display name** (`Person givenName familyName`, resolved server-side from `senderId`; falls back to the raw `senderId` when unbound/unresolved), with the agent session title as the hover tooltip only. | `/whatsapp-reader/conversations` |
-| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. | `/whatsapp-reader/stream` |
+| Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session** (Task 738). Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title` (Task 747): the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
+| Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom (Task 747). The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn (Task 746), sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |
 | Artefacts list | Lists every `:FileArtifact` under this account's tree (`relativePath STARTS WITH 'accounts/'`, all file types, excluding the `uploads/<id>/` subtree — Task 684) plus this account's IDENTITY / SOUL / KNOWLEDGE / specialist templates. Click downloads the row's backing file (`downloadPath` → `GET /api/admin/files/download`) so the operator opens it in their local app; rows whose file is outside `DATA_ROOT` (bundled-fallback templates) show a "can't be downloaded" pill. The in-app artefact pane is dead pending removal (Task 518). | `sidebar-artefacts.ts`, `files.ts` |
 | System-stats widget | CPU / RAM widget at the foot of the sidebar. | `system-stats.ts` (see above) |

package/payload/platform/plugins/docs/references/deployment.md

@@ -134,7 +134,7 @@ If you need to restart the service manually (rare), ask {{productName}} to do it
 
 ## Browsing the brand filesystem on your LAN (SMB)
 
-Every install provisions a per-brand SMB share against the brand's install folder. See [Samba Share](./samba.md) for the share path, credentials, per-OS mount instructions, peer-brand lifecycle, and the LAN-only binding posture.
+Every install provisions a per-brand SMB share against the brand's install folder. See [Samba Share](./samba.md) for the share path, credentials, per-OS mount instructions, peer-brand lifecycle, and the interface-binding posture (LAN-only on a private-LAN host, loopback-only on a public-only cloud host).
 
 ## Remote Access via Cloudflare
 

package/payload/platform/plugins/docs/references/plugins-guide.md

@@ -26,7 +26,7 @@ These are part of {{productName}}'s foundation and cannot be disabled:
 | `tasks` | Task lifecycle — create, update, list, relate, complete |
 | `workflows` | Persistent named workflows — reusable instruction sets |
 | `contacts` | CRM contact management — create, lookup, update, list |
-| `prompt-optimiser` | Prompt optimiser — two modes. Chat-app mode turns a rough draft or task description into a single finished, copy-pasteable prompt tuned for Opus 4.7 adaptive thinking (claude.ai, Mac, iOS). In-session mode is applied automatically: a standing `UserPromptSubmit` directive hook (`admin/hooks/prompt-optimiser-directive.sh`) injects context every turn telling the admin agent to restate each non-trivial prompt through this skill and act on the restatement, skipped for one-word confirmations, slash-commands, and direct continuations. Compliance is behavioural — the hook steers the agent, it cannot force the skill call. |
+| `prompt-optimiser` | Prompt optimiser — two modes. Chat-app mode turns a rough draft or task description into a single finished, copy-pasteable prompt tuned for Opus 4.7 adaptive thinking (claude.ai, Mac, iOS). In-session mode is applied automatically: a standing `UserPromptSubmit` directive hook (`admin/hooks/prompt-optimiser-directive.sh`) injects context every turn telling the admin agent to restate each non-trivial prompt through this skill and act on the restatement, skipped for one-word confirmations, slash-commands, and direct continuations. Compliance is behavioural — the hook steers the agent, it cannot force the skill call. The hook also persists the exact injected `additionalContext` per turn to `$LOG_DIR/prompt-optimiser-directives/<session>/<epoch>-<pid>.txt` and records `len`, `sha256`, and the stored `file=` path in `$LOG_DIR/prompt-optimiser-directive.log`, so any past turn's full ~17 KB directive is recoverable and verifiable (the JSONL attachment row Claude Code keeps is truncated to ≤2.6 KB). `platform/scripts/prompt-optimiser-audit.sh` reconciles breadcrumbs against stored files per session (`injected=N stored=M`; `N!=M` is the leak signature, and any breadcrumb whose `file=` is missing is named). |
 | `url-get` | Faithful page retrieval — fetches a server-rendered page, writes a verbatim markdown copy to an account-scoped reference file (no model in the path, so no copyright refusal), and returns the cleaned page text (capped) plus the file path. No summary and no subprocess: a caller that wants a summary invokes url-get from a delegated subagent. Use instead of WebFetch when a faithful copy is needed (e.g. ingesting your own published writing). |
 
 ### {{productName}} Plugins (user-selectable)

package/payload/platform/plugins/docs/references/samba.md

@@ -9,9 +9,9 @@ The share lives next to the rest of the brand. On a device that runs more than o
 The installer runs the same Samba step on every supported footprint — Raspberry Pi, Hetzner Cloud server, and self-hosted Linux laptop. Four sub-steps emit `[install-invariant] samba-provision-<step>` markers in order:
 
 1. **apt** — installs the `samba` package (skipped if `dpkg -s samba` already reports installed, so re-runs don't fight `unattended-upgrades` for the dpkg lock).
-2. **conf** — writes `/etc/samba/smb.conf` with a LAN-only `[global]` section plus a `[<brand>]` stanza pointing at the brand's install directory. The stanza is owned by the install owner (see below) and is marked `read only = no`, `browseable = yes`.
+2. **conf** — writes `/etc/samba/smb.conf` with a `[global]` section plus a `[<brand>]` stanza pointing at the brand's install directory. The stanza is owned by the install owner (see below) and is marked `read only = no`, `browseable = yes`. The `[global]` bind posture depends on the host's interfaces (see "Interface binding" below); the marker records which posture fired — `bind=lan iface=<name>` or `bind=loopback-only`.
 3. **user** — deferred at install time on a fresh Pi or Hetzner box because there is no PIN to hand to `smbpasswd` yet. The user is created the moment the operator sets a PIN in the admin UI (see "PIN rotation" below).
-4. **units** — `systemctl enable --now smbd nmbd` so the share is reachable as soon as the install finishes.
+4. **units** — `systemctl enable --now smbd` so the share is reachable as soon as the install finishes. `nmbd` (NetBIOS name service) is never enabled: nothing mounts the share by NetBIOS name, and on a public-facing host it answers on `:137`/`:138` as a DDoS-reflection vector.
 
 macOS install is a no-op for this step — the installer logs `samba-provision skipped: platform=darwin` and returns. Mac operators do not get an SMB share against their laptop.
 
@@ -46,18 +46,31 @@ So:
 - Rotating the PIN re-syncs the SMB password to the new value on the next set-pin request. Mounts using the old PIN start failing immediately; remount with the new PIN.
 - If `set-pin` cannot read `~/.<brand>/.install-owner` (file missing or empty), it logs `[set-pin] smbpasswd sync failed owner=<unknown> rc=-1 reason=install-owner-file-missing` and skips the sync. The PIN still writes to the admin UI, but the SMB mount keeps refusing the new password until the install-owner file is restored.
 
-## LAN-only binding
+## Interface binding
 
-The `[global]` section binds smbd to loopback plus one LAN interface:
+`bind interfaces only = yes` is always set, which makes the `interfaces` line an allow-list rather than a hint. Smbd binds only to the interfaces named there. The installer classifies the host's interfaces and writes one of two postures:
 
-```
-interfaces = lo <lan>
-bind interfaces only = yes
-```
+- **Private LAN host (Raspberry Pi).** At least one non-loopback interface carries a private address — RFC1918 (`10/8`, `172.16/12`, `192.168/16`), CGNAT (`100.64/10`), or link-local (`169.254/16`). The installer binds loopback plus that interface (`wlan0` preferred, then `eth0`, then the first other private interface):
 
-`<lan>` is whichever non-loopback interface has an IPv4 address — `wlan0` preferred, then `eth0`, then the first other interface with an address. If the device has no LAN interface at all, the installer refuses to provision and exits — there is nothing safe to bind to.
+  ```
+  interfaces = lo <lan>
+  bind interfaces only = yes
+  ```
 
-This is the structural guarantee that SMB never leaves the LAN, even if upstream firewall rules are misconfigured. The Cloudflare tunnel that fronts the admin UI carries HTTPS only; it does not route SMB. **On a Hetzner box the share is therefore not reachable from the public internet** — operators reach it by `ssh -L 4445:localhost:445 admin@<tunnel-host>` and then mounting `smb://localhost:4445`, or by running the Hetzner box on a private network that the operator's machine also joins.
+  The share is reachable on the LAN and nowhere else.
+
+- **Public-only host (Hetzner Cloud).** The only non-loopback interface carries a routable public address (typically `eth0` with a `/32`, no private LAN). Binding `lo eth0` here would put smbd directly on the public internet, so the installer binds **loopback only**:
+
+  ```
+  interfaces = lo
+  bind interfaces only = yes
+  ```
+
+  The share is reachable solely from the box itself. Operators reach it by forwarding loopback over SSH — `ssh -L 4445:localhost:445 admin@<tunnel-host>` and then mounting `smb://localhost:4445` — or by joining the box to a private network and re-installing, which makes the private interface the chosen LAN bind.
+
+If the device has no non-loopback IPv4 interface at all, the installer refuses to provision and exits — there is nothing safe to bind to. This is distinct from the public-only case, which still provisions a working (host-local) share.
+
+This classification is the structural guarantee that SMB never leaves the box (loopback-only) or the LAN (LAN-only), even if upstream firewall rules are misconfigured. The Cloudflare tunnel that fronts the admin UI carries HTTPS only; it does not route SMB.
 
 ## Peer-brand lifecycle
 
@@ -74,7 +87,7 @@ The brand-stanza name is the only identifier the uninstaller matches on, so two
 
 - **"Logon failure" on mount.** The PIN you typed does not match the current `smbpasswd` entry. Set a new PIN in the admin UI and remount. If the PIN was just rotated and the mount still fails, check `~/.<brand>/.install-owner` exists and is non-empty.
 - **Share does not show up in Finder / network browser.** mDNS may not be routed on your network. Mount by LAN IP instead of `<hostname>.local`.
-- **`smbd` not running after install.** Check the install log for the four `[install-invariant] samba-provision-<step>` markers. The `units` step running `systemctl enable --now smbd nmbd` is the last to fire; if it failed the marker prints `fail: <reason>`.
-- **Hetzner share not reachable from outside the box.** This is by design — see "LAN-only binding" above. Use SSH port forwarding.
+- **`smbd` not running after install.** Check the install log for the four `[install-invariant] samba-provision-<step>` markers. The `units` step running `systemctl enable --now smbd` is the last to fire; if it failed the marker prints `fail: <reason>`.
+- **Hetzner share not reachable from outside the box.** This is by design — see "Interface binding" above. A public-only host binds loopback only; use SSH port forwarding (`ssh -L 4445:localhost:445 …`).
 
 Also see [Deployment Guide](./deployment.md) for the surrounding install flow, and [Access Control](./access-control.md) for how the brand isolation extends from the admin UI to the SMB share.

package/payload/platform/plugins/whatsapp/PLUGIN.md

@@ -82,6 +82,10 @@ The agent never responds in a group. `checkGroupAccess` ([`inbound/access-contro
 
 Observation is fully preserved: group messages are stored in the ring buffer, recorded as activity, and persisted to the graph at the access-independent capture site, and remain visible via `whatsapp-conversations`, `whatsapp-group-info`, `list-groups`, and the `/whatsapp` reader. This is a Meta-policy constraint (automated messaging from an unofficial linked device is penalised, the same class as the reply-only DM posture); for agent-driven group messaging, Telegram is the recommended channel.
 
+## Native channel reply surface (Task 751)
+
+A native admin channel session runs a per-sender `whatsapp-channel` MCP server (`platform/services/whatsapp-channel/`) exposing two reply-only tools: `reply` (text) and `reply-document` (one or more files delivered as WhatsApp documents). `reply-document` POSTs to the gateway's `POST /wa-channel/reply-document`, which funnels through `sendWhatsAppDocument` — the single send core that owns account-dir path validation, the 100 MB ceiling, the canonical `[whatsapp:outbound] sent document …` log, and per-file reconciliation (`op=reply-document-reconciled` on delivery, `file-delivery-unreconciled` on a miss — no silent failure). A bare `SendUserFile` is also caught and delivered through the same core by a read-only JSONL follower on the session, so an attachment reaches the sender even when the agent skips the explicit tool. Both surfaces are reply-only: a file reply to a sender with no live conversation is refused. See [channels-whatsapp.md](references/channels-whatsapp.md) and `.docs/whatsapp-inbound-lifeline.md`.
+
 ## Live persistence
 
 Every `messages.upsert` event (both `notify` and `append`, both `fromMe` directions) writes a `:Message:WhatsAppMessage` row to Neo4j attached to the sessionKey-keyed `:Conversation`. A single capture site at `platform/ui/app/lib/whatsapp/manager.ts` covers inbound, outbound (Baileys echoes agent-sent messages back through `messages.upsert` with `fromMe=true`), and owner-mirror — without touching `outbound/send.ts`. `messageId` namespace is `whatsapp-live:<waName>:<remoteJid>:<msg.key.id>` where `<waName>` is the Baileys credential dirname (e.g. `default`); distinct from the `:ConversationArchive` `:Section` chunks written by the source-agnostic `conversation-archive` skill (parent `:ConversationArchive` keyed on `conversationIdentity`, plus `:Section` children) — live and archive live in disjoint shapes. Persist failures are loud (`[whatsapp-persist] FAIL …`) and never block dispatch — silent loss is the worse failure mode.

package/payload/platform/plugins/whatsapp/references/channels-whatsapp.md

@@ -10,7 +10,7 @@ WhatsApp connects via Baileys multi-account:
 
 The agent has **no tool to initiate a WhatsApp message to an arbitrary number.** The `whatsapp-send` and `whatsapp-send-document` MCP tools were removed after an agent-initiated cold first-contact send (to a number with no prior conversation) tripped WhatsApp's anti-automation guard and restricted the operator's account. Initiating is intentionally unavailable, not merely gated — a soft approval gate already existed and did not prevent the incident.
 
-What the agent **can** still do: reply within an existing chat. The whatsapp-channel `reply` tool (per-sender stdio channel, `platform/services/whatsapp-channel/`) and reply-path document delivery (`SendUserFile` → `file-delivery-bridge.ts` → `POST /api/whatsapp/send-document`) respond to a sender who messaged first. Replying within your chats is what WhatsApp permits; starting new chats from a linked device is what it penalises.
+What the agent **can** still do: reply within an existing chat. On a native admin channel session the whatsapp-channel server (`platform/services/whatsapp-channel/`) exposes two reply tools, both reply-only: `reply` (text) and `reply-document` (one or more files delivered as WhatsApp documents). `reply-document` POSTs to `POST /wa-channel/reply-document` → `sendWhatsAppDocument`, the one send core that owns path validation, the 100 MB ceiling, the canonical log, and per-file reconciliation (Task 751). A bare `SendUserFile` is also caught and delivered through the same core by a read-only JSONL follower on the session, so an attachment reaches the sender even if the agent skips the explicit tool. File delivery is refused for a sender with no live conversation — same reply-only posture as text. (The removed `whatsapp-send-document` route tool and the bridge path `SendUserFile` → `file-delivery-bridge.ts` → `POST /api/whatsapp/send-document` are the legacy webchat/email bridge surface, not the native WhatsApp channel.) Replying within your chats is what WhatsApp permits; starting new chats from a linked device is what it penalises.
 
 ## Observation-only in groups (Task 726)
 

package/payload/platform/scripts/__tests__/prompt-optimiser-audit.test.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Reconciliation audit for the per-turn directive store (Task 746). For each
+# session it emits `[prompt-optimiser-audit] session=<id> injected=<N> stored=<M>`
+# (N = breadcrumb lines, M = content files) and names any breadcrumb whose
+# file= path is missing on disk (the precise silent loss).
+set -u
+SCRIPT="$(cd "$(dirname "$0")/.." && pwd)/prompt-optimiser-audit.sh"
+[[ -x "$SCRIPT" ]] || { echo "FAIL: $SCRIPT not executable" >&2; exit 1; }
+PASS=0; FAIL=0
+
+LD=$(mktemp -d)
+mkdir -p "$LD/prompt-optimiser-directives/sessA"
+f1="$LD/prompt-optimiser-directives/sessA/100-11.txt"; printf 'one' > "$f1"
+f2="$LD/prompt-optimiser-directives/sessA/101-12.txt"; printf 'two' > "$f2"
+crumb="$LD/prompt-optimiser-directive.log"
+printf 'T [prompt-optimiser-directive] injected len=3 sha256=x file=%s session=sessA\n' "$f1" >> "$crumb"
+printf 'T [prompt-optimiser-directive] injected len=3 sha256=y file=%s session=sessA\n' "$f2" >> "$crumb"
+
+# Healthy: 2 breadcrumbs, 2 files.
+out=$(bash "$SCRIPT" --log-dir "$LD" sessA 2>/dev/null)
+if printf '%s' "$out" | grep -q "\[prompt-optimiser-audit\] session=sessA injected=2 stored=2"; then
+  echo "PASS: healthy session reconciles injected==stored"; PASS=$((PASS+1))
+else
+  echo "FAIL: healthy reconcile wrong: $out" >&2; FAIL=$((FAIL+1))
+fi
+
+# Leak: delete one content file -> injected=2 stored=1 + a missing-file line.
+rm -f "$f2"
+out=$(bash "$SCRIPT" --log-dir "$LD" sessA 2>/dev/null)
+if printf '%s' "$out" | grep -q "session=sessA injected=2 stored=1" \
+   && printf '%s' "$out" | grep -q "missing-file=$f2"; then
+  echo "PASS: deleted file flagged as leak (injected>stored + missing-file)"; PASS=$((PASS+1))
+else
+  echo "FAIL: leak not flagged: $out" >&2; FAIL=$((FAIL+1))
+fi
+
+# No argument -> walks every session in the breadcrumb log.
+printf 'T [prompt-optimiser-directive] injected len=1 sha256=z file=- session=sessB\n' >> "$crumb"
+out=$(bash "$SCRIPT" --log-dir "$LD" 2>/dev/null)
+if printf '%s' "$out" | grep -q "session=sessA " && printf '%s' "$out" | grep -q "session=sessB "; then
+  echo "PASS: no-arg mode walks all sessions"; PASS=$((PASS+1))
+else
+  echo "FAIL: no-arg mode missed a session: $out" >&2; FAIL=$((FAIL+1))
+fi
+# An explicitly-named session with no breadcrumbs reconciles cleanly to 0==0 on
+# a single line (regression: grep -c's exit-1 must not double-emit "0\n0").
+out=$(bash "$SCRIPT" --log-dir "$LD" sessZ 2>/dev/null); rc=$?
+nlines=$(printf '%s\n' "$out" | grep -c 'session=sessZ injected=')
+if [[ "$rc" -eq 0 ]] \
+   && printf '%s' "$out" | grep -Fqx "[prompt-optimiser-audit] session=sessZ injected=0 stored=0" \
+   && [[ "$nlines" -eq 1 ]]; then
+  echo "PASS: empty named session -> single clean injected=0 stored=0, rc=0"; PASS=$((PASS+1))
+else
+  echo "FAIL: empty named session mis-reported (rc=$rc lines=$nlines out=$out)" >&2; FAIL=$((FAIL+1))
+fi
+rm -rf "$LD"
+
+echo "----"; echo "PASS=$PASS FAIL=$FAIL"
+[[ "$FAIL" -eq 0 ]]

package/payload/platform/scripts/installer-device-verify.sh

@@ -229,11 +229,82 @@ REMOTE
   CHECK_RC=$?
   set -e
 
-  if [[ $CHECK_RC -eq 0 ]]; then
-    echo "OK    $NAME — CDP banner present" | tee -a "$SUMMARY_LOG"
-  else
+  if [[ $CHECK_RC -ne 0 ]]; then
     echo "FAIL  $NAME — CDP banner missing (rc=$CHECK_RC, see $SUMMARY_LOG)" | tee -a "$SUMMARY_LOG"
     FAILED=1
+    continue
+  fi
+
+  # Step 3 — standing Samba socket audit (Task 755). Reconcile the *actual*
+  # listening sockets against the bind invariant, independent of any install
+  # log, so this catches a drifted or re-opened box as well as a fresh
+  # mis-provision. Two assertions:
+  #   • smbd (TCP :445/:139) listens only on loopback or a private LAN address.
+  #     A public or wildcard (0.0.0.0 / [::] / public IP) listener is internet
+  #     exposure — the BSI-reported defect. Private LAN listeners are expected
+  #     on a Pi (LAN+loopback); loopback-only is expected on a cloud box. The
+  #     private-vs-public test mirrors isPrivateIPv4() in samba-provision.ts.
+  #   • nmbd is not active (the NetBIOS DDoS-reflection service is never run).
+  # Matched by port, so no root is needed to read process names.
+  #
+  # Loaded via `read -d ''` rather than `$(cat <<…)`: the audit body contains a
+  # `case` and process substitution, whose parens break bash 3.2's command-
+  # substitution scanner (operators may run this script from a macOS bash 3.2).
+  # The body itself runs on the device's modern bash over ssh.
+  IFS= read -r -d '' SOCKET_AUDIT <<'REMOTE' || true
+set -uo pipefail
+
+is_private_v4() {
+  local ip="$1" a b _rest
+  IFS=. read -r a b _rest <<<"$ip"
+  [[ "$a" =~ ^[0-9]+$ && "$b" =~ ^[0-9]+$ ]] || return 1
+  (( a == 10 )) && return 0
+  (( a == 172 && b >= 16 && b <= 31 )) && return 0
+  (( a == 192 && b == 168 )) && return 0
+  (( a == 100 && b >= 64 && b <= 127 )) && return 0
+  (( a == 169 && b == 254 )) && return 0
+  return 1
+}
+
+BAD=""
+while read -r localaddr; do
+  [[ -z "$localaddr" ]] && continue
+  host="${localaddr%:*}"                  # strip :port
+  host="${host#'['}"; host="${host%']'}"  # strip IPv6 brackets (quoted: '[' is a glob class)
+  case "$host" in
+    127.*|::1) continue ;;             # loopback — allowed
+  esac
+  if [[ "$host" == *.*.*.* ]] && is_private_v4 "$host"; then
+    continue                           # private IPv4 LAN (Pi) — allowed
+  fi
+  BAD+="$localaddr"$'\n'
+done < <(ss -tuln 2>/dev/null | awk '{print $5}' | grep -E ':(445|139)$' || true)
+
+NMBD=$(systemctl is-active nmbd 2>/dev/null || true)
+FAIL=0
+if [[ -n "${BAD//$'\n'/}" ]]; then
+  echo "smbd-exposed-listener:"
+  printf '%s' "$BAD"
+  FAIL=1
+fi
+if [[ "$NMBD" == "active" ]]; then
+  echo "nmbd-active"
+  FAIL=1
+fi
+[[ $FAIL -eq 0 ]] && echo "socket-audit-ok smbd=loopback-or-private nmbd=$NMBD"
+exit $FAIL
+REMOTE
+
+  set +e
+  run_ssh "$TARGET" "$PASS" "$SOCKET_AUDIT" >>"$SUMMARY_LOG" 2>&1
+  AUDIT_RC=$?
+  set -e
+
+  if [[ $AUDIT_RC -eq 0 ]]; then
+    echo "OK    $NAME — CDP banner present; smbd loopback/LAN-only, nmbd inactive" | tee -a "$SUMMARY_LOG"
+  else
+    echo "FAIL  $NAME — Samba socket audit failed (rc=$AUDIT_RC, see $SUMMARY_LOG)" | tee -a "$SUMMARY_LOG"
+    FAILED=1
   fi
 done
 

package/payload/platform/scripts/prompt-optimiser-audit.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# prompt-optimiser-audit.sh — reconcile per-turn directive-injection breadcrumbs
+# against the stored content files (Task 746). A missing content write emits no
+# error on its own, so this standing check is the leak detector: for each
+# session it prints
+#   [prompt-optimiser-audit] session=<id> injected=<N> stored=<M>
+# where N is the count of breadcrumb injection lines and M is the count of
+# content files. N != M is the leak signature. Every breadcrumb whose file=
+# path is absent on disk is named on its own `missing-file=` line.
+#
+# Usage:
+#   prompt-optimiser-audit.sh [--log-dir <dir>] [<session_id>]
+# With no <session_id> it walks every session that appears in the breadcrumb
+# log. --log-dir overrides the resolved account logs dir (used by tests); the
+# default resolves the single account's logs dir, the same dir the hook writes.
+#
+# Exit codes:
+#   0  every reported session reconciles (injected == stored)
+#   1  at least one session leaks (injected != stored)
+#   2  no log dir could be resolved
+set -uo pipefail
+
+LOG_DIR=""
+SESSION=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --log-dir) LOG_DIR="$2"; shift 2 ;;
+    *) SESSION="$1"; shift ;;
+  esac
+done
+
+# Resolve the account logs dir when not overridden: {installDir}/data/accounts/*/logs.
+if [ -z "$LOG_DIR" ]; then
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  PLATFORM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+  INSTALL_DIR="$(dirname "$PLATFORM_ROOT")"
+  for d in "$INSTALL_DIR"/data/accounts/*/logs; do
+    [ -d "$d" ] && LOG_DIR="$d" && break
+  done
+fi
+if [ -z "$LOG_DIR" ] || [ ! -d "$LOG_DIR" ]; then
+  echo "[prompt-optimiser-audit] no-log-dir resolved=${LOG_DIR:-<none>}" >&2
+  exit 2
+fi
+
+CRUMB="$LOG_DIR/prompt-optimiser-directive.log"
+STORE_ROOT="$LOG_DIR/prompt-optimiser-directives"
+
+# Sessions to report: the explicit arg, else every distinct non-"?" session in
+# the breadcrumb log (the breadcrumb's session= is always the last field).
+sessions() {
+  if [ -n "$SESSION" ]; then
+    echo "$SESSION"; return
+  fi
+  [ -f "$CRUMB" ] || return
+  grep -o 'session=[^ ]*$' "$CRUMB" 2>/dev/null | cut -d= -f2 | grep -v '^?$' | sort -u
+}
+
+rc=0
+while IFS= read -r sid; do
+  [ -n "$sid" ] || continue
+  injected=0
+  # grep -c prints a count AND exits 1 on zero matches, so a `|| echo 0` would
+  # double-emit "0\n0"; capture the count and default an empty/unreadable file.
+  if [ -f "$CRUMB" ]; then
+    injected=$(grep -c "session=$sid\$" "$CRUMB" 2>/dev/null)
+    injected=${injected:-0}
+  fi
+  stored=0
+  [ -d "$STORE_ROOT/$sid" ] && stored=$(find "$STORE_ROOT/$sid" -maxdepth 1 -name '*.txt' 2>/dev/null | wc -l | tr -d ' ')
+  echo "[prompt-optimiser-audit] session=$sid injected=$injected stored=$stored"
+  [ "$injected" != "$stored" ] && rc=1
+  # Name every breadcrumb whose stored file is absent.
+  if [ -f "$CRUMB" ]; then
+    grep "session=$sid\$" "$CRUMB" 2>/dev/null | grep -o 'file=[^ ]*' | cut -d= -f2- | while IFS= read -r f; do
+      [ "$f" = "-" ] && continue
+      [ -e "$f" ] || echo "[prompt-optimiser-audit] session=$sid missing-file=$f"
+    done
+  fi
+done < <(sessions)
+
+exit "$rc"