@rubytech/create-maxy-code 0.1.302 → 0.1.304

package/dist/__tests__/install-immutability.test.js

@@ -0,0 +1,55 @@
+// Task 848 — acceptance grid for install-immutability.ts.
+//
+// Pure command-emission module: protectCommands/unprotectCommands return the
+// privileged `chattr` argv that makes the deployed platform source immutable to
+// the agent's user. The caller injects the DetectedPlatform value so tests run
+// identically on Linux CI and Mac developer boxes — no process.platform reads
+// inside the module under test. Three roots are frozen (server, platform,
+// premium-plugins); platform/config is the sole runtime-writable exclusion.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { protectCommands, unprotectCommands, lsattrShowsImmutable, } from "../install-immutability.js";
+const INSTALL = "/home/admin/maxy-code";
+const SERVER = "/home/admin/maxy-code/server";
+const PLATFORM = "/home/admin/maxy-code/platform";
+const PREMIUM = "/home/admin/maxy-code/premium-plugins";
+const CONFIG = "/home/admin/maxy-code/platform/config";
+test("protect freezes the three roots then un-freezes config, in order, on linux", () => {
+    assert.deepEqual(protectCommands(INSTALL, "linux"), [
+        { command: "chattr", args: ["-R", "+i", SERVER] },
+        { command: "chattr", args: ["-R", "+i", PLATFORM] },
+        { command: "chattr", args: ["-R", "+i", PREMIUM] },
+        { command: "chattr", args: ["-R", "-i", CONFIG] },
+    ]);
+});
+test("unprotect emits chattr -R -i on the three roots for linux", () => {
+    assert.deepEqual(unprotectCommands(INSTALL, "linux"), [
+        { command: "chattr", args: ["-R", "-i", SERVER] },
+        { command: "chattr", args: ["-R", "-i", PLATFORM] },
+        { command: "chattr", args: ["-R", "-i", PREMIUM] },
+    ]);
+});
+test("config exclusion is un-frozen last, after its parent platform is frozen", () => {
+    const cmds = protectCommands(INSTALL, "linux");
+    const platformIdx = cmds.findIndex((c) => c.args[2] === PLATFORM && c.args[1] === "+i");
+    const configIdx = cmds.findIndex((c) => c.args[2] === CONFIG && c.args[1] === "-i");
+    assert.ok(platformIdx >= 0 && configIdx >= 0);
+    assert.ok(platformIdx < configIdx);
+});
+test("emits nothing on darwin", () => {
+    assert.deepEqual(protectCommands(INSTALL, "darwin"), []);
+    assert.deepEqual(unprotectCommands(INSTALL, "darwin"), []);
+});
+test("emits nothing on unsupported", () => {
+    assert.deepEqual(protectCommands(INSTALL, "unsupported"), []);
+    assert.deepEqual(unprotectCommands(INSTALL, "unsupported"), []);
+});
+test("lsattrShowsImmutable reads the immutable flag from an lsattr -d line", () => {
+    // `lsattr -d <path>` → "<flags> <path>"; the immutable 'i' sits in the flag field.
+    assert.equal(lsattrShowsImmutable("----i---------e---- /home/admin/maxy-code/platform"), true);
+    assert.equal(lsattrShowsImmutable("-------------e---- /home/admin/maxy-code/platform/config"), false);
+    // 'i' only ever occupies the immutable position; a capital 'I' (indexed dir) is distinct.
+    assert.equal(lsattrShowsImmutable("---------------I--- /home/admin/maxy-code/platform"), false);
+    // empty / malformed output is not immutable.
+    assert.equal(lsattrShowsImmutable(""), false);
+});

package/dist/index.js

@@ -10,7 +10,8 @@ import { validateTierFlag, validateEntitlementBase64, applyTierToAccountConfig,
 import { parseOsRelease, isUbuntuLike as isUbuntuLikePure, parseAptCacheCandidate, decideAptResolution, } from "./apt-resolve.js";
 import { findPeerBrandOnDefaultNeo4jPort } from "./peer-brand-detect.js";
 import { runInitLogging } from "./init-logging.js";
-import { requireSupportedPlatform } from "./platform-detect.js";
+import { requireSupportedPlatform, detectPlatform } from "./platform-detect.js";
+import { protectCommands, unprotectCommands, lsattrShowsImmutable } from "./install-immutability.js";
 import { renderPlist } from "./launchd-plist.js";
 import { installAllBrewPackages } from "./brew-install.js";
 import { parseSwVers, isSupportedMacosVersion } from "./macos-version.js";
@@ -1855,6 +1856,21 @@ function deployPayload() {
     // User data lives at {installDir}/data/ — outside the platform/ wipe zone.
     // Install path creates this fresh; runtime writers populate it on demand.
     mkdirSync(join(INSTALL_DIR, "data"), { recursive: true });
+    // Task 848 — on upgrade the prior server/, platform/, premium-plugins/ trees are
+    // immutable (chattr +i). Clear all three BEFORE the wipe loop, or the rmSync of
+    // those dirs below fails with EPERM. Gate on INSTALL_DIR existence (any prior
+    // install), not server/ alone — a partial state where server/ was removed but
+    // platform/ stayed frozen must still be unprotected. Fresh install: INSTALL_DIR
+    // not yet created (mkdirSync below), so skip. Linux-only (emits nothing
+    // elsewhere). bestEffort: a missing root chattr-errors harmlessly.
+    const guardPlatform = detectPlatform(process.platform);
+    if (existsSync(INSTALL_DIR)) {
+        for (const c of unprotectCommands(INSTALL_DIR, guardPlatform)) {
+            const target = c.args[c.args.length - 1];
+            console.log(`  [agent-guard] op=unprotect target=${target}`);
+            shell(c.command, c.args, { sudo: true, bestEffort: true });
+        }
+    }
     // Wipe deployment directories to prevent stale files.
     // data/ is NOT wiped — it contains user data (accounts, uploads) that must survive.
     for (const dir of ["platform", "server", "maxy", "premium-plugins", "docs", ".claude"]) {
@@ -1869,6 +1885,11 @@ function deployPayload() {
         recursive: true,
         force: true,
     });
+    // Task 848 — the platform source trees are frozen immutable as the final install
+    // action (see main()), not here: the installer keeps writing under platform/
+    // after this deploy (buildPlatform's npm install, service builds, plugin
+    // registration), so an early freeze would EPERM those writes. The pre-wipe
+    // unprotect above is the matching half on upgrade.
     // Link persistent config into install directory
     const configDir = join(INSTALL_DIR, "platform/config");
     mkdirSync(configDir, { recursive: true });
@@ -4068,6 +4089,30 @@ try {
     // step. The smbpasswd `user` step is deferred at install time and synced
     // by the platform's /set-pin route when the operator sets a PIN.
     provisionSamba();
+    // Task 848 — freeze the platform source trees as the final install action, after
+    // every install-time write under platform/ (buildPlatform's npm install →
+    // platform/node_modules, the service builds under platform/services/*/dist, and
+    // plugin registration). server/, platform/, premium-plugins/ become immutable to
+    // the agent's user; platform/config/ is excluded by protectCommands (it is
+    // runtime-writable). Load-bearing, so the outcome is verified positively: `chattr
+    // -R` exits nonzero on the benign symlinks/special files an npm tree always
+    // contains, so its aggregate exit code is not a reliable signal — instead
+    // re-read each target's own immutable bit with `lsattr -d`. A freeze command
+    // (+i) succeeded iff the target is now immutable; the config exclusion (-i)
+    // succeeded iff it is now mutable. A failed protect does not abort the install;
+    // the drift detector remains the backstop. Linux-only (emits nothing elsewhere).
+    const guardPlatformProtect = detectPlatform(process.platform);
+    for (const c of protectCommands(INSTALL_DIR, guardPlatformProtect)) {
+        const target = c.args[c.args.length - 1];
+        const freezing = c.args.includes("+i");
+        const op = freezing ? "protect" : "protect-exclude";
+        logFile(`> sudo ${c.command} ${c.args.join(" ")}`);
+        spawnSync("sudo", [c.command, ...c.args], { stdio: "pipe", timeout: 30_000 });
+        const probe = spawnSync("lsattr", ["-d", target], { stdio: "pipe", timeout: 10_000 });
+        const immutable = probe.status === 0 && lsattrShowsImmutable(probe.stdout?.toString() ?? "");
+        const ok = freezing ? immutable : !immutable;
+        console.log(`  [agent-guard] op=${ok ? op : `${op}-failed`} target=${target}`);
+    }
     console.log("");
     console.log("================================================================");
     console.log("");

package/dist/install-immutability.js

@@ -0,0 +1,59 @@
+// Task 848 — OS-level platform boundary. After the installer deploys the
+// platform, three trees are made immutable with `chattr +i` so a
+// confused-but-compliant agent (same user, running under `bypassPermissions`)
+// cannot hand-edit platform code — writes fail with EPERM and the agent reports
+// the platform defect instead of patching the box:
+//   - server/          the built server bundle (Task 843, the incident target)
+//   - platform/        plugin code, scripts, templates, channel-service dist
+//   - premium-plugins/ premium bundle source
+//
+// platform/config/ is the sole runtime-writable subpath under a frozen root
+// (the booting server writes .<hostname>-version there; it also holds brand.json,
+// the chromium path, and the neo4j password), so it is un-frozen last — after its
+// `+i` parent, since immutability is per-inode and a `-i` child dir stays
+// writable. Linux/ext4 only — `chattr` does not exist on darwin, so off-Linux
+// platforms emit nothing and the deploy step is a no-op. This module is pure: it
+// returns the privileged argv but never executes it; the caller runs unprotect
+// before the deploy wipe on upgrade and protect as the final install action.
+import { join } from "node:path";
+/** Install-relative roots frozen immutable, in apply order. */
+const PROTECTED_ROOTS = ["server", "platform", "premium-plugins"];
+/** Install-relative subpaths under a frozen root that the running platform
+ *  writes to, so they are un-frozen after the roots are frozen. */
+const WRITABLE_EXCLUSIONS = ["platform/config"];
+/** `chattr -R +i` each protected root, then `chattr -R -i` each writable
+ *  exclusion; [] on any non-Linux platform. */
+export function protectCommands(installDir, platform) {
+    if (platform !== "linux")
+        return [];
+    const cmds = PROTECTED_ROOTS.map((root) => ({
+        command: "chattr",
+        args: ["-R", "+i", join(installDir, root)],
+    }));
+    for (const sub of WRITABLE_EXCLUSIONS) {
+        cmds.push({ command: "chattr", args: ["-R", "-i", join(installDir, sub)] });
+    }
+    return cmds;
+}
+/** `chattr -R -i` each protected root; [] on any non-Linux platform.
+ *  A writable exclusion needs no separate entry: the recursive `-i` on its
+ *  parent root descends into it and clears the flag. */
+export function unprotectCommands(installDir, platform) {
+    if (platform !== "linux")
+        return [];
+    return PROTECTED_ROOTS.map((root) => ({
+        command: "chattr",
+        args: ["-R", "-i", join(installDir, root)],
+    }));
+}
+/** True iff an `lsattr -d <path>` output line shows the immutable ('i') flag.
+ *  `lsattr -d` prints "<flags> <path>"; the immutable attribute uniquely
+ *  occupies the lowercase-'i' position in the flag field, so a substring test on
+ *  the first whitespace-delimited token is exact. Used to verify a freeze took:
+ *  `chattr -R` exits nonzero on the benign symlinks/special files an npm tree
+ *  always contains, so its aggregate exit code is not a reliable success signal —
+ *  re-reading the target's own immutable bit is. */
+export function lsattrShowsImmutable(lsattrLine) {
+    const flags = lsattrLine.trim().split(/\s+/)[0] ?? "";
+    return flags.includes("i");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.302",
+  "version": "0.1.304",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/hooks/__tests__/prompt-optimiser-compliance.test.sh

@@ -56,6 +56,10 @@ CHANNEL_REFRAME='{"type":"user","isMeta":true,"message":{"role":"user","content"
 # payload, not the wrapper (the always-present instruction text would otherwise
 # make every reframed turn look non-trivial).
 CHANNEL_REFRAME_TRIVIAL='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"whatsapp-channel\">## Context\nyes\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.</channel>"}}'
+# Task 853 — multi-target (unified server) shape: the harness wraps with the
+# registration key `channel`, and the server embeds an inner source tag, so the
+# reframe arrives DOUBLE-wrapped. The strip must iterate to reach ## Context.
+CHANNEL_REFRAME_MULTI='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"channel\">\n<channel source=\"whatsapp\">\n## Context\nplease draft the works order PDF for order 926\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.\n</channel>\n</channel>"}}'
 
 assert_flagged() {
   local name="$1" t="$2" out
@@ -169,6 +173,14 @@ assert_not_flagged "reframe turn + Agent dispatch -> not flagged" \
 # even though the wrapper text is long.
 assert_not_flagged "reframe turn with one-word Context payload -> not flagged (trivial)" \
   "$(mk_transcript "$CHANNEL_REFRAME_TRIVIAL" "$ASSISTANT_TEXT")"
+# 18b. Task 853 — double-wrapped multi-target reframe + inline authoring, no
+# marker -> flagged. A single-strip would leave the inner tag and never see
+# ## Context (the Task 805 re-blinding class).
+assert_flagged "multi-target double-wrapped reframe + inline authoring -> flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME_MULTI" "$ASSISTANT_REPLY" "$ASSISTANT_BASH" "$ASSISTANT_WRITE")"
+# 18c. Same double-wrapped reframe with an Agent dispatch -> not flagged.
+assert_not_flagged "multi-target double-wrapped reframe + Agent dispatch -> not flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME_MULTI" "$ASSISTANT_REPLY" "$ASSISTANT_AGENT")"
 # 19. Channel-wrapped NON-reframe turn (no ## Instruction section — webchat
 # today, Task 776) with no marker -> not directive-equivalent, not flagged.
 assert_not_flagged "channel-wrapped non-reframe turn, no marker -> not flagged" \

package/payload/platform/plugins/admin/hooks/prompt-optimiser-compliance.sh

@@ -129,16 +129,20 @@ if boundary is None:
 
 slice_rows = rows[boundary:]
 
-# Strip a leading <channel ...>...</channel> wrapper to reach the inner prompt
-# (WhatsApp/native-channel prompts arrive wrapped).
+# Strip leading <channel ...>...</channel> wrapper(s) to reach the inner
+# prompt. WhatsApp/native-channel prompts arrive wrapped once; a multi-target
+# (unified-server, Task 853) prompt arrives DOUBLE-wrapped — the harness wraps
+# with the registration key `channel` and the server embeds an inner
+# <channel source="<door>"> tag — so iterate until the payload surfaces.
 inner = prompt_text
 is_channel = False
-if inner.startswith("<channel"):
+while inner.startswith("<channel"):
     end = inner.find(">")
     close = inner.rfind("</channel>")
-    if end != -1 and close != -1 and close > end:
-        inner = inner[end + 1:close].strip()
-        is_channel = True
+    if end == -1 or close == -1 or close <= end:
+        break
+    inner = inner[end + 1:close].strip()
+    is_channel = True
 
 # Task 805 — a channel-wrapped reframe turn (the ## Context / ## Instruction
 # sections of composeAdminContent) is directive-equivalent: the directive hook suppresses

package/payload/platform/plugins/admin/skills/access-manager/SKILL.md

@@ -16,6 +16,7 @@ Applies when the business owner wants to control who can access a gated public a
 - Admin asks to revoke or extend someone's access
 - Admin asks to set an agent's access mode (open or gated)
 - Admin asks to resend an invitation
+- Admin asks to enrol a worker with both a phone and an email (one person, two contact doors)
 
 ## Constraints
 

package/payload/platform/plugins/admin/skills/access-manager/references/operations.md

@@ -126,6 +126,28 @@ The endpoint is loopback-only; it accepts the element ID returned from the cyphe
 
 Present a `confirm` component before the revocation lands. Explain that the visitor is logged out immediately and must wait for a fresh invitation to re-access.
 
+## Enrol a Phone+Email Worker
+
+**Outcome:** One `Person` node carries both the worker's phone (E.164) and an email `AccessGrant` for the target agent, so the WhatsApp phone door and the email magic-link door resolve to the same person. Returns the `personId` and a grant summary.
+
+Do NOT write this via cypher — the UI server owns the enrolment write. After confirming, run:
+
+```bash
+curl -s -X POST http://localhost:19200/api/admin/enrol-person \
+  -H 'Content-Type: application/json' \
+  -d '{"phone": "+447700900123", "email": "worker@example.com", "agentSlug": "<slug>"}'
+```
+
+The endpoint is loopback-only. It normalises the phone to E.164 digits, lowercases the email, resolves the `accountId` server-side, and MERGEs — re-enrolling the same (account, phone) is idempotent. The response is `{"personId": "...", "grant": {"grantId": "...", "status": "...", "contactValue": "..."}}`; present both to the admin. A 400 names the malformed field (`invalid-phone` / `invalid-email`).
+
+The returned `status` is the grant's true state. Enrolling never un-revokes: if `status` is `"revoked"`, the worker stays locked out until the admin explicitly re-invites (the grant was deliberately revoked, and enrolment must not silently undo that). Tell the admin and offer the invite flow.
+
+No invite email is sent. If the worker needs web access, they request a magic link themselves from the agent's gate page (the request-magic-link flow), or the admin runs the normal invite/resend operation against the same email — it lands on the same person.
+
+This does not touch WhatsApp `dmPolicy` / `allowFrom` — whether the phone may message the agent stays operator config.
+
+Present a `confirm` component before enrolling, showing: the worker's phone, email, and the target agent.
+
 ## Extend Access
 
 **Outcome:** Grant's `expiresAt` is pushed forward by the requested duration.

package/payload/platform/plugins/docs/references/admin-session.md

@@ -26,6 +26,8 @@ The HMAC secret lives at `~/.${brand}/credentials/admin-session-secret` (mode `0
 
 **Observability.** `[session-rehydrate-from-token] sessionKey=… accountId=… userId=… ageMs=…` fires once per successful rehydrate in `server.log`. A tampered token fails HMAC and returns `invalid-token` silently (no log line — would otherwise be a noise/attack-amplifier surface); the request's downstream `[session] middleware-reject status=401 code=session-not-registered` is sufficient.
 
+**Adjacent 401 surface — remote-auth gate.** The PIN-session reject-code taxonomy (`session-missing`, `session-not-registered`, `session-expired-age`, `grant-expired` — the `AdminRejectCode` union in `platform/ui/app/lib/useAdminFetch.ts`) shares its 401 transport with one code from a different security domain: the remote-auth gate (`server/index.ts`, the `__remote_session` cookie's 24h TTL) answers an expired/missing/invalid remote-auth token on any `/api/*` path with `401 {"code":"remote-auth-required"}` — document navigations keep getting the login HTML with a redirect. Client handling is deliberately split: the PIN codes route to enter-pin recovery, while `remote-auth-required` triggers a full page reload (the gate then serves the login page for the current path), because a PIN screen behind an expired remote-auth token cannot reach its own API. The gate's log line is `[remote-auth] login required … respond=401|html`.
+
 ## SDK-resume contract on PIN-rebind
 
 The Anthropic SDK is stateless against its own JSONL: every cold-create with `resume: <agentSessionId>` reads `${CLAUDE_CONFIG_DIR}/projects/<encoded-cwd>/<agentSessionId>.jsonl` verbatim. The Maxy graph (`Conversation.agentSessionId`) is just the pointer into the JSONL, not a parallel transcript. The PIN-rebind contract preserves this:

package/payload/platform/plugins/whatsapp/skills/connect-whatsapp/SKILL.md

@@ -47,7 +47,7 @@ The self phone from Phase 1 is automatically registered as an admin phone. If th
 
 ### Phase 3: Public Agent Selection
 
-WhatsApp inbound from non-admin phones routes to a public agent configured in the WhatsApp config — not the account-level `defaultAgent`. The user must explicitly choose which agent handles WhatsApp. There is no automatic fallback; if no public agent is set, WhatsApp silently rejects non-admin messages.
+WhatsApp inbound from non-admin phones routes only for **authenticated-public** senders: the sender must be allowed by the DM policy **and** resolve to an enrolled `:Person` (their phone is on a Person record for this account). An allowed-but-unenrolled sender is dropped with `[whatsapp:route] op=dropped reason=public-unresolved`. Each routed sender gets their own per-person, reply-only session. The public-agent setting below is the WhatsApp config's designated public agent; it does not change how an authenticated-public sender is routed.
 
 1. **Check current state** — Call `whatsapp-config` with `action: "get-public-agent"` to see if one is already set. Also call `account-manage` to list the available public agents.
 
@@ -55,11 +55,11 @@ WhatsApp inbound from non-admin phones routes to a public agent configured in th
 
 3. **Set the public agent** — Call `whatsapp-config` with `action: "set-public-agent"` and `slug: "{chosen-slug}"`.
 
-4. **Open the DM policy** — Call `whatsapp-config` with `action: "update-config"`, `dmPolicy: "open"`, and `allowFrom: ["*"]`. Without this, all non-admin messages are silently dropped regardless of which public agent is configured.
+4. **Set the DM policy** — Call `whatsapp-config` with `action: "update-config"`, `dmPolicy: "allowlist"`, and the enrolled customers' phones in `allowFrom`. Without a policy that allows the sender, all non-admin messages are silently dropped regardless of which public agent is configured. Even an allowed sender only routes once enrolled as a `:Person` carrying that phone.
 
-5. **Confirm** — "WhatsApp messages from customers will be handled by {agent name}."
+5. **Confirm** — "Enrolled customers on the allowlist will get their own WhatsApp conversation with the agent."
 
-If only one public agent exists, confirm it as the choice rather than asking. If no public agents exist, tell the user: "You don't have a public agent yet. WhatsApp will be connected but won't respond to customer messages until you create one and set it with `whatsapp-config action: set-public-agent`."
+If only one public agent exists, confirm it as the choice rather than asking. If no public agents exist, the public-agent setting can be skipped — it does not gate authenticated-public routing.
 
 ## Relinking
 

package/payload/platform/scripts/__tests__/check-no-task-id-leaks.test.sh

@@ -13,6 +13,7 @@ ROOT=$(mktemp -d)
 trap 'rm -rf "$ROOT"' EXIT
 mkdir -p "$ROOT/platform/plugins/demo/skills/demo" \
          "$ROOT/platform/templates/specialists" \
+         "$ROOT/premium-plugins/demo-bundle/skills/demo" \
          "$ROOT/.docs"
 
 clean_skill() { printf '# Demo skill\n\nDoes a thing.\n' > "$ROOT/platform/plugins/demo/skills/demo/SKILL.md"; }
@@ -48,6 +49,19 @@ else
 fi
 rm -f "$ROOT/platform/templates/specialists/AGENT.md"
 
+# 3b. `(Task 999)` under a shipped premium bundle -> gate fails + names it.
+#     Premium bundles are copied verbatim into the client payload, so any
+#     citation in their markdown leaks to paying clients the same as core.
+printf '# Demo skill\n\nDoes a thing (Task 999).\n' > "$ROOT/premium-plugins/demo-bundle/skills/demo/SKILL.md"
+out=$(TASK_ID_LEAK_ROOT="$ROOT" node "$GATE" 2>&1); rc=$?
+if [[ "$rc" -ne 0 ]] \
+   && printf '%s' "$out" | grep -q '\[task-id-leak\] file=premium-plugins/demo-bundle/skills/demo/SKILL.md'; then
+  echo "PASS: (Task 999) in shipped premium bundle fails the gate"; PASS=$((PASS+1))
+else
+  echo "FAIL: premium citation not caught (rc=$rc): $out" >&2; FAIL=$((FAIL+1))
+fi
+rm -f "$ROOT/premium-plugins/demo-bundle/skills/demo/SKILL.md"
+
 # 4. `Tasks 12 and 34` plural form under a shipped skill -> gate fails.
 printf '# Demo skill\n\nMerged behaviour (Tasks 12 and 34).\n' > "$ROOT/platform/plugins/demo/skills/demo/SKILL.md"
 out=$(TASK_ID_LEAK_ROOT="$ROOT" node "$GATE" 2>&1); rc=$?
@@ -102,6 +116,20 @@ else
 fi
 clean_skill
 
+# 4f. A `(Task NNN)` citation a soft line-wrap split across two source lines ->
+#     gate fails + names it. Markdown rejoins the lines, so the client agent
+#     still reads `(Task 900)`; a per-line scan sees `Task` and `900` separately
+#     and misses it. printf emits a real newline between `Task` and `900`.
+printf '# Demo skill\n\nThe method-capture flow (Task\n900) fills it in later.\n' > "$ROOT/platform/plugins/demo/skills/demo/SKILL.md"
+out=$(TASK_ID_LEAK_ROOT="$ROOT" node "$GATE" 2>&1); rc=$?
+if [[ "$rc" -ne 0 ]] \
+   && printf '%s' "$out" | grep -q '\[task-id-leak\] file=platform/plugins/demo/skills/demo/SKILL.md'; then
+  echo "PASS: line-wrapped (Task\\n900) citation fails the gate"; PASS=$((PASS+1))
+else
+  echo "FAIL: line-wrapped citation not caught (rc=$rc): $out" >&2; FAIL=$((FAIL+1))
+fi
+clean_skill
+
 # 5. A hex colour `#999` in a shipped .md -> gate does NOT trip (not a citation).
 printf '# Demo skill\n\nUse colour `#999` for labels.\n' > "$ROOT/platform/plugins/demo/skills/demo/SKILL.md"
 out=$(TASK_ID_LEAK_ROOT="$ROOT" node "$GATE" 2>&1); rc=$?

package/payload/platform/scripts/check-no-task-id-leaks.mjs

@@ -67,6 +67,10 @@ const MD_TASK_ID_RE = /\bTasks?[\s-]+\d{2,4}|\btasks?\s+\d{2,4}/
 const MD_SCAN_ROOTS = [
   join(REPO_ROOT, 'platform', 'plugins'),
   join(REPO_ROOT, 'platform', 'templates'),
+  // Premium bundles are copied verbatim into the client payload
+  // (`payload/premium-plugins/<bundle>/`), so their shipped markdown loads into
+  // the client agent the same as core plugins — any citation form leaks.
+  join(REPO_ROOT, 'premium-plugins'),
 ]
 
 function isCommentLine(line) {
@@ -130,9 +134,31 @@ for (const root of SCAN_ROOTS) {
 }
 
 // Markdown scan — shipped operator-loadable docs. Reuses `walk` (which already
-// skips node_modules/dist/build/.next/payload/__tests__) and matches every line
-// against MD_TASK_ID_RE with no comment skip: the whole doc is agent content.
+// skips node_modules/dist/build/.next/payload/__tests__) and matches against
+// MD_TASK_ID_RE with no comment skip: the whole doc is agent content.
 // .docs/ and .tasks/ are not under MD_SCAN_ROOTS, so they stay citation-rich.
+//
+// Scanned per paragraph, not per line: a markdown soft-wrap can split a single
+// citation across two source lines (`... (Task\n659) ...`), which renders as
+// `(Task 659)` but matches neither line in isolation. Consecutive non-blank
+// lines are joined with a space (the soft-break a renderer would insert) and
+// scanned as one string; a blank line ends the paragraph, so the join never
+// crosses a paragraph break. Every match in the paragraph is reported, mapped
+// back to the source line where the match starts, preserving exact-line and
+// multi-citation reporting.
+const MD_TASK_ID_RE_G = new RegExp(MD_TASK_ID_RE.source, 'g')
+
+function flushParagraph(file, joined, lineStarts) {
+  if (joined === '') return
+  for (const m of joined.matchAll(MD_TASK_ID_RE_G)) {
+    let lineNo = lineStarts[0].lineNo
+    for (const ls of lineStarts) {
+      if (ls.offset <= m.index) lineNo = ls.lineNo
+    }
+    leaks.push({ file: relative(REPO_ROOT, file), line: lineNo, content: m[0] })
+  }
+}
+
 for (const root of MD_SCAN_ROOTS) {
   for (const file of walk(root)) {
     if (!file.endsWith('.md')) continue
@@ -143,11 +169,20 @@ for (const root of MD_SCAN_ROOTS) {
       continue
     }
     const lines = content.split('\n')
+    let joined = ''
+    let lineStarts = []
     for (let i = 0; i < lines.length; i++) {
-      const m = lines[i].match(MD_TASK_ID_RE)
-      if (!m) continue
-      leaks.push({ file: relative(REPO_ROOT, file), line: i + 1, content: m[0] })
+      if (lines[i].trim() === '') {
+        flushParagraph(file, joined, lineStarts)
+        joined = ''
+        lineStarts = []
+        continue
+      }
+      if (joined !== '') joined += ' '
+      lineStarts.push({ offset: joined.length, lineNo: i + 1 })
+      joined += lines[i]
     }
+    flushParagraph(file, joined, lineStarts)
   }
 }
 
@@ -159,8 +194,8 @@ if (leaks.length > 0) {
   console.error('')
   console.error('Code files: citations belong in inline comments only, never in operator-visible')
   console.error('strings (stderr/stdout, logs, systemd --description=, error messages, console.*).')
-  console.error('Shipped markdown (platform/plugins, platform/templates): no task citation in any')
-  console.error('form — the whole doc loads into a client-facing agent. Dev docs (.docs/, .tasks/)')
-  console.error('are exempt and keep their citations.')
+  console.error('Shipped markdown (platform/plugins, platform/templates, premium-plugins): no task')
+  console.error('citation in any form — the whole doc loads into a client-facing agent. Dev docs')
+  console.error('(.docs/, .tasks/) are exempt and keep their citations.')
   process.exit(1)
 }

package/payload/platform/services/claude-session-manager/dist/channel-mcp.d.ts

@@ -0,0 +1,15 @@
+import type { ChannelTargetSet } from './channel-targets.js';
+export declare const CHANNEL_SERVER_NAME = "channel";
+export interface ChannelMcpServerEntry {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+}
+export declare function buildChannelMcpServers(p: {
+    sessionId: string;
+    targets: ChannelTargetSet;
+}): Record<string, ChannelMcpServerEntry>;
+export declare function channelDevChannelsArgv(): string[];
+export declare function channelMcpConfigPath(sessionId: string, dir: string): string;
+export declare function buildChannelArgv(mcpConfigPath: string): string[];
+//# sourceMappingURL=channel-mcp.d.ts.map

package/payload/platform/services/claude-session-manager/dist/channel-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-mcp.d.ts","sourceRoot":"","sources":["../src/channel-mcp.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAE5C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,gBAAgB,CAAA;CAC1B,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAexC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhE"}

package/payload/platform/services/claude-session-manager/dist/channel-mcp.js

@@ -0,0 +1,34 @@
+// Task 850 — attach builder for the UNIFIED channel server. Registered (in
+// place of the per-kind wa/webchat servers) only when a session is bound to ≥2
+// channel kinds. The agent sees exactly one `reply` tool; the server reads the
+// whole target set from `CHANNEL_TARGETS` and fans each reply to every bound
+// target's existing gateway reply endpoint. Pure (no fs) like wa-channel-mcp.ts.
+import { join } from 'node:path';
+export const CHANNEL_SERVER_NAME = 'channel';
+export function buildChannelMcpServers(p) {
+    // Every target carries the same built server path (the generalized
+    // whatsapp-channel dist). Pick whichever kind is bound.
+    const anyTarget = p.targets.whatsapp ?? p.targets.webchat;
+    if (!anyTarget)
+        throw new Error('buildChannelMcpServers: empty target set');
+    return {
+        [CHANNEL_SERVER_NAME]: {
+            command: 'node',
+            args: [anyTarget.serverPath],
+            env: {
+                CHANNEL_SESSION_ID: p.sessionId,
+                CHANNEL_TARGETS: JSON.stringify(p.targets),
+            },
+        },
+    };
+}
+export function channelDevChannelsArgv() {
+    return ['--dangerously-load-development-channels', `server:${CHANNEL_SERVER_NAME}`];
+}
+export function channelMcpConfigPath(sessionId, dir) {
+    return join(dir, `maxy-channel-${sessionId.replace(/[^A-Za-z0-9_-]/g, '_')}.json`);
+}
+export function buildChannelArgv(mcpConfigPath) {
+    return ['--mcp-config', mcpConfigPath, ...channelDevChannelsArgv()];
+}
+//# sourceMappingURL=channel-mcp.js.map

package/payload/platform/services/claude-session-manager/dist/channel-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-mcp.js","sourceRoot":"","sources":["../src/channel-mcp.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAQ5C,MAAM,UAAU,sBAAsB,CAAC,CAGtC;IACC,mEAAmE;IACnE,wDAAwD;IACxD,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IACzD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC3E,OAAO;QACL,CAAC,mBAAmB,CAAC,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;YAC5B,GAAG,EAAE;gBACH,kBAAkB,EAAE,CAAC,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;aAC3C;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,yCAAyC,EAAE,UAAU,mBAAmB,EAAE,CAAC,CAAA;AACrF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,GAAW;IACjE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAA;AACrE,CAAC"}

package/payload/platform/services/claude-session-manager/dist/channel-targets.d.ts

@@ -0,0 +1,26 @@
+export interface WhatsAppTarget {
+    kind: 'whatsapp';
+    senderId: string;
+    gatewayUrl: string;
+    serverPath: string;
+}
+export interface WebchatTarget {
+    kind: 'webchat';
+    key: string;
+    gatewayUrl: string;
+    serverPath: string;
+}
+export type ChannelTarget = WhatsAppTarget | WebchatTarget;
+/** Per-session bound targets, at most one per kind. */
+export interface ChannelTargetSet {
+    whatsapp?: WhatsAppTarget;
+    webchat?: WebchatTarget;
+}
+/** Add (or replace) a target of its kind. Pure. */
+export declare function mergeTarget(set: ChannelTargetSet, t: ChannelTarget): ChannelTargetSet;
+/** The kinds currently bound, in no guaranteed order. */
+export declare function targetKinds(set: ChannelTargetSet): Array<ChannelTarget['kind']>;
+/** True when ≥2 distinct kinds are bound — the case that needs the unified
+ *  server (one reply tool fanning to every target). */
+export declare function isMultiTarget(set: ChannelTargetSet): boolean;
+//# sourceMappingURL=channel-targets.d.ts.map

package/payload/platform/services/claude-session-manager/dist/channel-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-targets.d.ts","sourceRoot":"","sources":["../src/channel-targets.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AACD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AACD,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,aAAa,CAAA;AAE1D,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAED,mDAAmD;AACnD,wBAAgB,WAAW,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,GAAG,gBAAgB,CAErF;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAE/E;AAED;uDACuD;AACvD,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAE5D"}

package/payload/platform/services/claude-session-manager/dist/channel-targets.js

@@ -0,0 +1,19 @@
+// Task 850 — a session's outbound binding is a SET of channel targets, at most
+// one per kind, replacing the whatsapp-XOR-webchat single binding. The manager
+// assembles this set from the per-kind binding stores and decides whether to
+// register the unified `channel` server (≥2 kinds) or the existing per-kind
+// server (1 kind).
+/** Add (or replace) a target of its kind. Pure. */
+export function mergeTarget(set, t) {
+    return { ...set, [t.kind]: t };
+}
+/** The kinds currently bound, in no guaranteed order. */
+export function targetKinds(set) {
+    return Object.keys(set).filter((k) => set[k]);
+}
+/** True when ≥2 distinct kinds are bound — the case that needs the unified
+ *  server (one reply tool fanning to every target). */
+export function isMultiTarget(set) {
+    return targetKinds(set).length >= 2;
+}
+//# sourceMappingURL=channel-targets.js.map

package/payload/platform/services/claude-session-manager/dist/channel-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-targets.js","sourceRoot":"","sources":["../src/channel-targets.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,mBAAmB;AAsBnB,mDAAmD;AACnD,MAAM,UAAU,WAAW,CAAC,GAAqB,EAAE,CAAgB;IACjE,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;AAChC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,WAAW,CAAC,GAAqB;IAC/C,OAAQ,MAAM,CAAC,IAAI,CAAC,GAAG,CAAkC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AACjF,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,aAAa,CAAC,GAAqB;IACjD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAA;AACrC,CAAC"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAU3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAoND;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAi+DpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAY3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAoND;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA6/DpD"}