@rubytech/create-maxy-code 0.1.303 → 0.1.304

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.303",
+  "version": "0.1.304",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/hooks/__tests__/prompt-optimiser-compliance.test.sh

@@ -56,6 +56,10 @@ CHANNEL_REFRAME='{"type":"user","isMeta":true,"message":{"role":"user","content"
 # payload, not the wrapper (the always-present instruction text would otherwise
 # make every reframed turn look non-trivial).
 CHANNEL_REFRAME_TRIVIAL='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"whatsapp-channel\">## Context\nyes\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.</channel>"}}'
+# Task 853 — multi-target (unified server) shape: the harness wraps with the
+# registration key `channel`, and the server embeds an inner source tag, so the
+# reframe arrives DOUBLE-wrapped. The strip must iterate to reach ## Context.
+CHANNEL_REFRAME_MULTI='{"type":"user","isMeta":true,"message":{"role":"user","content":"<channel source=\"channel\">\n<channel source=\"whatsapp\">\n## Context\nplease draft the works order PDF for order 926\n\n## Instruction\nChoose the installed specialist that owns this request and dispatch it with the Agent tool.\n</channel>\n</channel>"}}'
 
 assert_flagged() {
   local name="$1" t="$2" out
@@ -169,6 +173,14 @@ assert_not_flagged "reframe turn + Agent dispatch -> not flagged" \
 # even though the wrapper text is long.
 assert_not_flagged "reframe turn with one-word Context payload -> not flagged (trivial)" \
   "$(mk_transcript "$CHANNEL_REFRAME_TRIVIAL" "$ASSISTANT_TEXT")"
+# 18b. Task 853 — double-wrapped multi-target reframe + inline authoring, no
+# marker -> flagged. A single-strip would leave the inner tag and never see
+# ## Context (the Task 805 re-blinding class).
+assert_flagged "multi-target double-wrapped reframe + inline authoring -> flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME_MULTI" "$ASSISTANT_REPLY" "$ASSISTANT_BASH" "$ASSISTANT_WRITE")"
+# 18c. Same double-wrapped reframe with an Agent dispatch -> not flagged.
+assert_not_flagged "multi-target double-wrapped reframe + Agent dispatch -> not flagged" \
+  "$(mk_transcript "$CHANNEL_REFRAME_MULTI" "$ASSISTANT_REPLY" "$ASSISTANT_AGENT")"
 # 19. Channel-wrapped NON-reframe turn (no ## Instruction section — webchat
 # today, Task 776) with no marker -> not directive-equivalent, not flagged.
 assert_not_flagged "channel-wrapped non-reframe turn, no marker -> not flagged" \

package/payload/platform/plugins/admin/hooks/prompt-optimiser-compliance.sh

@@ -129,16 +129,20 @@ if boundary is None:
 
 slice_rows = rows[boundary:]
 
-# Strip a leading <channel ...>...</channel> wrapper to reach the inner prompt
-# (WhatsApp/native-channel prompts arrive wrapped).
+# Strip leading <channel ...>...</channel> wrapper(s) to reach the inner
+# prompt. WhatsApp/native-channel prompts arrive wrapped once; a multi-target
+# (unified-server, Task 853) prompt arrives DOUBLE-wrapped — the harness wraps
+# with the registration key `channel` and the server embeds an inner
+# <channel source="<door>"> tag — so iterate until the payload surfaces.
 inner = prompt_text
 is_channel = False
-if inner.startswith("<channel"):
+while inner.startswith("<channel"):
     end = inner.find(">")
     close = inner.rfind("</channel>")
-    if end != -1 and close != -1 and close > end:
-        inner = inner[end + 1:close].strip()
-        is_channel = True
+    if end == -1 or close == -1 or close <= end:
+        break
+    inner = inner[end + 1:close].strip()
+    is_channel = True
 
 # Task 805 — a channel-wrapped reframe turn (the ## Context / ## Instruction
 # sections of composeAdminContent) is directive-equivalent: the directive hook suppresses

package/payload/platform/plugins/admin/skills/access-manager/SKILL.md

@@ -16,6 +16,7 @@ Applies when the business owner wants to control who can access a gated public a
 - Admin asks to revoke or extend someone's access
 - Admin asks to set an agent's access mode (open or gated)
 - Admin asks to resend an invitation
+- Admin asks to enrol a worker with both a phone and an email (one person, two contact doors)
 
 ## Constraints
 

package/payload/platform/plugins/admin/skills/access-manager/references/operations.md

@@ -126,6 +126,28 @@ The endpoint is loopback-only; it accepts the element ID returned from the cyphe
 
 Present a `confirm` component before the revocation lands. Explain that the visitor is logged out immediately and must wait for a fresh invitation to re-access.
 
+## Enrol a Phone+Email Worker
+
+**Outcome:** One `Person` node carries both the worker's phone (E.164) and an email `AccessGrant` for the target agent, so the WhatsApp phone door and the email magic-link door resolve to the same person. Returns the `personId` and a grant summary.
+
+Do NOT write this via cypher — the UI server owns the enrolment write. After confirming, run:
+
+```bash
+curl -s -X POST http://localhost:19200/api/admin/enrol-person \
+  -H 'Content-Type: application/json' \
+  -d '{"phone": "+447700900123", "email": "worker@example.com", "agentSlug": "<slug>"}'
+```
+
+The endpoint is loopback-only. It normalises the phone to E.164 digits, lowercases the email, resolves the `accountId` server-side, and MERGEs — re-enrolling the same (account, phone) is idempotent. The response is `{"personId": "...", "grant": {"grantId": "...", "status": "...", "contactValue": "..."}}`; present both to the admin. A 400 names the malformed field (`invalid-phone` / `invalid-email`).
+
+The returned `status` is the grant's true state. Enrolling never un-revokes: if `status` is `"revoked"`, the worker stays locked out until the admin explicitly re-invites (the grant was deliberately revoked, and enrolment must not silently undo that). Tell the admin and offer the invite flow.
+
+No invite email is sent. If the worker needs web access, they request a magic link themselves from the agent's gate page (the request-magic-link flow), or the admin runs the normal invite/resend operation against the same email — it lands on the same person.
+
+This does not touch WhatsApp `dmPolicy` / `allowFrom` — whether the phone may message the agent stays operator config.
+
+Present a `confirm` component before enrolling, showing: the worker's phone, email, and the target agent.
+
 ## Extend Access
 
 **Outcome:** Grant's `expiresAt` is pushed forward by the requested duration.

package/payload/platform/plugins/docs/references/admin-session.md

@@ -26,6 +26,8 @@ The HMAC secret lives at `~/.${brand}/credentials/admin-session-secret` (mode `0
 
 **Observability.** `[session-rehydrate-from-token] sessionKey=… accountId=… userId=… ageMs=…` fires once per successful rehydrate in `server.log`. A tampered token fails HMAC and returns `invalid-token` silently (no log line — would otherwise be a noise/attack-amplifier surface); the request's downstream `[session] middleware-reject status=401 code=session-not-registered` is sufficient.
 
+**Adjacent 401 surface — remote-auth gate.** The PIN-session reject-code taxonomy (`session-missing`, `session-not-registered`, `session-expired-age`, `grant-expired` — the `AdminRejectCode` union in `platform/ui/app/lib/useAdminFetch.ts`) shares its 401 transport with one code from a different security domain: the remote-auth gate (`server/index.ts`, the `__remote_session` cookie's 24h TTL) answers an expired/missing/invalid remote-auth token on any `/api/*` path with `401 {"code":"remote-auth-required"}` — document navigations keep getting the login HTML with a redirect. Client handling is deliberately split: the PIN codes route to enter-pin recovery, while `remote-auth-required` triggers a full page reload (the gate then serves the login page for the current path), because a PIN screen behind an expired remote-auth token cannot reach its own API. The gate's log line is `[remote-auth] login required … respond=401|html`.
+
 ## SDK-resume contract on PIN-rebind
 
 The Anthropic SDK is stateless against its own JSONL: every cold-create with `resume: <agentSessionId>` reads `${CLAUDE_CONFIG_DIR}/projects/<encoded-cwd>/<agentSessionId>.jsonl` verbatim. The Maxy graph (`Conversation.agentSessionId`) is just the pointer into the JSONL, not a parallel transcript. The PIN-rebind contract preserves this:

package/payload/platform/plugins/whatsapp/skills/connect-whatsapp/SKILL.md

@@ -47,7 +47,7 @@ The self phone from Phase 1 is automatically registered as an admin phone. If th
 
 ### Phase 3: Public Agent Selection
 
-WhatsApp inbound from non-admin phones routes to a public agent configured in the WhatsApp config — not the account-level `defaultAgent`. The user must explicitly choose which agent handles WhatsApp. There is no automatic fallback; if no public agent is set, WhatsApp silently rejects non-admin messages.
+WhatsApp inbound from non-admin phones routes only for **authenticated-public** senders: the sender must be allowed by the DM policy **and** resolve to an enrolled `:Person` (their phone is on a Person record for this account). An allowed-but-unenrolled sender is dropped with `[whatsapp:route] op=dropped reason=public-unresolved`. Each routed sender gets their own per-person, reply-only session. The public-agent setting below is the WhatsApp config's designated public agent; it does not change how an authenticated-public sender is routed.
 
 1. **Check current state** — Call `whatsapp-config` with `action: "get-public-agent"` to see if one is already set. Also call `account-manage` to list the available public agents.
 
@@ -55,11 +55,11 @@ WhatsApp inbound from non-admin phones routes to a public agent configured in th
 
 3. **Set the public agent** — Call `whatsapp-config` with `action: "set-public-agent"` and `slug: "{chosen-slug}"`.
 
-4. **Open the DM policy** — Call `whatsapp-config` with `action: "update-config"`, `dmPolicy: "open"`, and `allowFrom: ["*"]`. Without this, all non-admin messages are silently dropped regardless of which public agent is configured.
+4. **Set the DM policy** — Call `whatsapp-config` with `action: "update-config"`, `dmPolicy: "allowlist"`, and the enrolled customers' phones in `allowFrom`. Without a policy that allows the sender, all non-admin messages are silently dropped regardless of which public agent is configured. Even an allowed sender only routes once enrolled as a `:Person` carrying that phone.
 
-5. **Confirm** — "WhatsApp messages from customers will be handled by {agent name}."
+5. **Confirm** — "Enrolled customers on the allowlist will get their own WhatsApp conversation with the agent."
 
-If only one public agent exists, confirm it as the choice rather than asking. If no public agents exist, tell the user: "You don't have a public agent yet. WhatsApp will be connected but won't respond to customer messages until you create one and set it with `whatsapp-config action: set-public-agent`."
+If only one public agent exists, confirm it as the choice rather than asking. If no public agents exist, the public-agent setting can be skipped — it does not gate authenticated-public routing.
 
 ## Relinking
 

package/payload/platform/services/claude-session-manager/dist/channel-mcp.d.ts

@@ -0,0 +1,15 @@
+import type { ChannelTargetSet } from './channel-targets.js';
+export declare const CHANNEL_SERVER_NAME = "channel";
+export interface ChannelMcpServerEntry {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+}
+export declare function buildChannelMcpServers(p: {
+    sessionId: string;
+    targets: ChannelTargetSet;
+}): Record<string, ChannelMcpServerEntry>;
+export declare function channelDevChannelsArgv(): string[];
+export declare function channelMcpConfigPath(sessionId: string, dir: string): string;
+export declare function buildChannelArgv(mcpConfigPath: string): string[];
+//# sourceMappingURL=channel-mcp.d.ts.map

package/payload/platform/services/claude-session-manager/dist/channel-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-mcp.d.ts","sourceRoot":"","sources":["../src/channel-mcp.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,eAAO,MAAM,mBAAmB,YAAY,CAAA;AAE5C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC5B;AAED,wBAAgB,sBAAsB,CAAC,CAAC,EAAE;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,gBAAgB,CAAA;CAC1B,GAAG,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAexC;AAED,wBAAgB,sBAAsB,IAAI,MAAM,EAAE,CAEjD;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhE"}

package/payload/platform/services/claude-session-manager/dist/channel-mcp.js

@@ -0,0 +1,34 @@
+// Task 850 — attach builder for the UNIFIED channel server. Registered (in
+// place of the per-kind wa/webchat servers) only when a session is bound to ≥2
+// channel kinds. The agent sees exactly one `reply` tool; the server reads the
+// whole target set from `CHANNEL_TARGETS` and fans each reply to every bound
+// target's existing gateway reply endpoint. Pure (no fs) like wa-channel-mcp.ts.
+import { join } from 'node:path';
+export const CHANNEL_SERVER_NAME = 'channel';
+export function buildChannelMcpServers(p) {
+    // Every target carries the same built server path (the generalized
+    // whatsapp-channel dist). Pick whichever kind is bound.
+    const anyTarget = p.targets.whatsapp ?? p.targets.webchat;
+    if (!anyTarget)
+        throw new Error('buildChannelMcpServers: empty target set');
+    return {
+        [CHANNEL_SERVER_NAME]: {
+            command: 'node',
+            args: [anyTarget.serverPath],
+            env: {
+                CHANNEL_SESSION_ID: p.sessionId,
+                CHANNEL_TARGETS: JSON.stringify(p.targets),
+            },
+        },
+    };
+}
+export function channelDevChannelsArgv() {
+    return ['--dangerously-load-development-channels', `server:${CHANNEL_SERVER_NAME}`];
+}
+export function channelMcpConfigPath(sessionId, dir) {
+    return join(dir, `maxy-channel-${sessionId.replace(/[^A-Za-z0-9_-]/g, '_')}.json`);
+}
+export function buildChannelArgv(mcpConfigPath) {
+    return ['--mcp-config', mcpConfigPath, ...channelDevChannelsArgv()];
+}
+//# sourceMappingURL=channel-mcp.js.map

package/payload/platform/services/claude-session-manager/dist/channel-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-mcp.js","sourceRoot":"","sources":["../src/channel-mcp.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,iFAAiF;AAEjF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAGhC,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAA;AAQ5C,MAAM,UAAU,sBAAsB,CAAC,CAGtC;IACC,mEAAmE;IACnE,wDAAwD;IACxD,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAA;IACzD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC3E,OAAO;QACL,CAAC,mBAAmB,CAAC,EAAE;YACrB,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC;YAC5B,GAAG,EAAE;gBACH,kBAAkB,EAAE,CAAC,CAAC,SAAS;gBAC/B,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;aAC3C;SACF;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CAAC,yCAAyC,EAAE,UAAU,mBAAmB,EAAE,CAAC,CAAA;AACrF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE,GAAW;IACjE,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,SAAS,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;AACpF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,aAAqB;IACpD,OAAO,CAAC,cAAc,EAAE,aAAa,EAAE,GAAG,sBAAsB,EAAE,CAAC,CAAA;AACrE,CAAC"}

package/payload/platform/services/claude-session-manager/dist/channel-targets.d.ts

@@ -0,0 +1,26 @@
+export interface WhatsAppTarget {
+    kind: 'whatsapp';
+    senderId: string;
+    gatewayUrl: string;
+    serverPath: string;
+}
+export interface WebchatTarget {
+    kind: 'webchat';
+    key: string;
+    gatewayUrl: string;
+    serverPath: string;
+}
+export type ChannelTarget = WhatsAppTarget | WebchatTarget;
+/** Per-session bound targets, at most one per kind. */
+export interface ChannelTargetSet {
+    whatsapp?: WhatsAppTarget;
+    webchat?: WebchatTarget;
+}
+/** Add (or replace) a target of its kind. Pure. */
+export declare function mergeTarget(set: ChannelTargetSet, t: ChannelTarget): ChannelTargetSet;
+/** The kinds currently bound, in no guaranteed order. */
+export declare function targetKinds(set: ChannelTargetSet): Array<ChannelTarget['kind']>;
+/** True when ≥2 distinct kinds are bound — the case that needs the unified
+ *  server (one reply tool fanning to every target). */
+export declare function isMultiTarget(set: ChannelTargetSet): boolean;
+//# sourceMappingURL=channel-targets.d.ts.map

package/payload/platform/services/claude-session-manager/dist/channel-targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-targets.d.ts","sourceRoot":"","sources":["../src/channel-targets.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AACD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;CACnB;AACD,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,aAAa,CAAA;AAE1D,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB;AAED,mDAAmD;AACnD,wBAAgB,WAAW,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,GAAG,gBAAgB,CAErF;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,GAAG,EAAE,gBAAgB,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAE/E;AAED;uDACuD;AACvD,wBAAgB,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAE5D"}

package/payload/platform/services/claude-session-manager/dist/channel-targets.js

@@ -0,0 +1,19 @@
+// Task 850 — a session's outbound binding is a SET of channel targets, at most
+// one per kind, replacing the whatsapp-XOR-webchat single binding. The manager
+// assembles this set from the per-kind binding stores and decides whether to
+// register the unified `channel` server (≥2 kinds) or the existing per-kind
+// server (1 kind).
+/** Add (or replace) a target of its kind. Pure. */
+export function mergeTarget(set, t) {
+    return { ...set, [t.kind]: t };
+}
+/** The kinds currently bound, in no guaranteed order. */
+export function targetKinds(set) {
+    return Object.keys(set).filter((k) => set[k]);
+}
+/** True when ≥2 distinct kinds are bound — the case that needs the unified
+ *  server (one reply tool fanning to every target). */
+export function isMultiTarget(set) {
+    return targetKinds(set).length >= 2;
+}
+//# sourceMappingURL=channel-targets.js.map

package/payload/platform/services/claude-session-manager/dist/channel-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-targets.js","sourceRoot":"","sources":["../src/channel-targets.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,mBAAmB;AAsBnB,mDAAmD;AACnD,MAAM,UAAU,WAAW,CAAC,GAAqB,EAAE,CAAgB;IACjE,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAA;AAChC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,WAAW,CAAC,GAAqB;IAC/C,OAAQ,MAAM,CAAC,IAAI,CAAC,GAAG,CAAkC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AACjF,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,aAAa,CAAC,GAAqB;IACjD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAA;AACrC,CAAC"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAU3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAoND;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAi+DpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAY3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAoND;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA6/DpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -25,6 +25,8 @@ import { existsSync, statSync, createReadStream, watchFile, unwatchFile, rmSync,
 import { tmpdir } from 'node:os';
 import { buildWaChannelMcpServers, buildWaChannelArgv, waChannelMcpConfigPath, isDevChannelPrompt } from './wa-channel-mcp.js';
 import { buildWebchatChannelMcpServers, buildWebchatChannelArgv, webchatChannelMcpConfigPath } from './webchat-channel-mcp.js';
+import { buildChannelMcpServers, buildChannelArgv, channelMcpConfigPath } from './channel-mcp.js';
+import { mergeTarget, isMultiTarget, targetKinds } from './channel-targets.js';
 import { randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
@@ -1660,11 +1662,13 @@ export function buildHttpApp(deps) {
             ? webchatChannelRaw
             : undefined;
         // Task 724 — the bridge routes EVERY role=admin channel inbound here, not
-        // just WhatsApp, and supplies the real channel (+ role:'admin', senderId) so
-        // the classification sidecar below records the actual channel. The WaGateway
+        // just WhatsApp, and supplies the real channel (+ role, senderId) so the
+        // classification sidecar below records the actual channel. The WaGateway
         // supplies channel:'whatsapp'; the one-shot admin jobs (LinkedIn ingest,
-        // session-end review) supply no channel and get no sidecar.
-        const adminRole = body.role === 'admin' ? 'admin' : undefined;
+        // session-end review) supply no channel and get no sidecar. Task 852 widens
+        // the accepted role to 'public' (authenticated-public WhatsApp person) and
+        // the sidecar records the actual role.
+        const rcRole = body.role === 'admin' || body.role === 'public' ? body.role : undefined;
         const adminChannel = typeof body.channel === 'string' && CHANNELS.includes(body.channel)
             ? body.channel
             : undefined;
@@ -1737,7 +1741,13 @@ export function buildHttpApp(deps) {
         // / PIN / manager) omits it, so we read the binding back. Either way the same
         // per-session --mcp-config + development-channels argv is injected, so
         // `mcp__whatsapp-channel__reply` is present on every live PTY for the session.
+        // Task 850 — resolve the effective binding for EACH kind (no XOR). A gateway
+        // /rc-spawn supplies waChannel/webchatChannel and we write it through; a bare
+        // resume reads it back. The old whatsapp-XOR-webchat refusal is removed: a
+        // session may now be bound to BOTH kinds (one :Person reachable on phone and
+        // web), and the two are fanned by one unified channel server below.
         let effectiveWaChannel;
+        let effectiveWebchatChannel;
         if (sessionId) {
             if (waChannel) {
                 effectiveWaChannel = waChannel;
@@ -1750,38 +1760,6 @@ export function buildHttpApp(deps) {
                     deps.logger(`[rc-spawn] op=wa-channel-rebind sessionId=${sessionId.slice(0, 8)} senderId=${stored.senderId} source=store`);
                 }
             }
-        }
-        let waPath = null;
-        if (effectiveWaChannel && sessionId) {
-            const waServers = buildWaChannelMcpServers({
-                sessionId,
-                senderId: effectiveWaChannel.senderId,
-                gatewayUrl: effectiveWaChannel.gatewayUrl,
-                serverPath: effectiveWaChannel.serverPath,
-            });
-            waPath = waChannelMcpConfigPath(sessionId, tmpdir());
-            try {
-                writeFileSync(waPath, JSON.stringify({ mcpServers: waServers }, null, 2), 'utf8');
-                argv.push(...buildWaChannelArgv(waPath));
-                deps.logger(`[rc-spawn] op=wa-channel senderId=${effectiveWaChannel.senderId} gateway=${effectiveWaChannel.gatewayUrl} path=${waPath}`);
-            }
-            catch (err) {
-                waPath = null;
-                deps.logger(`[rc-spawn] op=wa-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
-            }
-        }
-        // Task 772 — webchat native channel, the webchat twin of the waChannel
-        // block above. Same contract: a gateway spawn carries `webchatChannel` and
-        // write-throughs the binding; a bare resume reads it back, so
-        // `mcp__webchat-channel__reply` is present on every live PTY for the
-        // session. A session is whatsapp XOR webchat — enforced here: when a
-        // WhatsApp binding is already effective for this session, the webchat
-        // attach is refused (two channel servers on one PTY is never valid).
-        let effectiveWebchatChannel;
-        if (sessionId && effectiveWaChannel && (webchatChannel || deps.webchatChannelStore?.get(sessionId))) {
-            deps.logger(`[rc-spawn] op=webchat-channel-refused sessionId=${sessionId.slice(0, 8)} reason=wa-channel-already-bound`);
-        }
-        else if (sessionId) {
             if (webchatChannel) {
                 effectiveWebchatChannel = webchatChannel;
                 deps.webchatChannelStore?.set(sessionId, webchatChannel);
@@ -1794,23 +1772,71 @@ export function buildHttpApp(deps) {
                 }
             }
         }
+        // Task 850 — assemble the bound target set and choose the channel server:
+        //   - ≥2 kinds: ONE unified `channel` server (one reply tool fanning to every
+        //     target's existing gateway endpoint). The mature per-kind servers are
+        //     untouched for single-target sessions.
+        //   - 1 kind: the existing per-kind server, unchanged.
+        // waPath/webchatPath are the "is this kind carried on the PTY" signals the
+        // standing binding-lost invariant below reads; the unified server carries
+        // both, so both paths are set to the unified config path.
+        let targetSet = {};
+        if (effectiveWaChannel)
+            targetSet = mergeTarget(targetSet, { kind: 'whatsapp', ...effectiveWaChannel });
+        if (effectiveWebchatChannel)
+            targetSet = mergeTarget(targetSet, { kind: 'webchat', ...effectiveWebchatChannel });
+        let waPath = null;
         let webchatPath = null;
-        if (effectiveWebchatChannel && sessionId) {
-            const webchatServers = buildWebchatChannelMcpServers({
-                sessionId,
-                key: effectiveWebchatChannel.key,
-                gatewayUrl: effectiveWebchatChannel.gatewayUrl,
-                serverPath: effectiveWebchatChannel.serverPath,
-            });
-            webchatPath = webchatChannelMcpConfigPath(sessionId, tmpdir());
+        if (sessionId && isMultiTarget(targetSet)) {
+            const unifiedServers = buildChannelMcpServers({ sessionId, targets: targetSet });
+            const unifiedPath = channelMcpConfigPath(sessionId, tmpdir());
             try {
-                writeFileSync(webchatPath, JSON.stringify({ mcpServers: webchatServers }, null, 2), 'utf8');
-                argv.push(...buildWebchatChannelArgv(webchatPath));
-                deps.logger(`[rc-spawn] op=webchat-channel key=${effectiveWebchatChannel.key} gateway=${effectiveWebchatChannel.gatewayUrl} path=${webchatPath}`);
+                writeFileSync(unifiedPath, JSON.stringify({ mcpServers: unifiedServers }, null, 2), 'utf8');
+                argv.push(...buildChannelArgv(unifiedPath));
+                waPath = unifiedPath;
+                webchatPath = unifiedPath;
+                deps.logger(`[rc-spawn] op=channel-unified sessionId=${sessionId.slice(0, 8)} bound=[${targetKinds(targetSet).join(',')}] path=${unifiedPath}`);
             }
             catch (err) {
-                webchatPath = null;
-                deps.logger(`[rc-spawn] op=webchat-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
+                deps.logger(`[rc-spawn] op=channel-unified-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
+            }
+        }
+        else {
+            if (effectiveWaChannel && sessionId) {
+                const waServers = buildWaChannelMcpServers({
+                    sessionId,
+                    senderId: effectiveWaChannel.senderId,
+                    gatewayUrl: effectiveWaChannel.gatewayUrl,
+                    serverPath: effectiveWaChannel.serverPath,
+                });
+                waPath = waChannelMcpConfigPath(sessionId, tmpdir());
+                try {
+                    writeFileSync(waPath, JSON.stringify({ mcpServers: waServers }, null, 2), 'utf8');
+                    argv.push(...buildWaChannelArgv(waPath));
+                    deps.logger(`[rc-spawn] op=wa-channel senderId=${effectiveWaChannel.senderId} gateway=${effectiveWaChannel.gatewayUrl} path=${waPath}`);
+                }
+                catch (err) {
+                    waPath = null;
+                    deps.logger(`[rc-spawn] op=wa-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
+                }
+            }
+            if (effectiveWebchatChannel && sessionId) {
+                const webchatServers = buildWebchatChannelMcpServers({
+                    sessionId,
+                    key: effectiveWebchatChannel.key,
+                    gatewayUrl: effectiveWebchatChannel.gatewayUrl,
+                    serverPath: effectiveWebchatChannel.serverPath,
+                });
+                webchatPath = webchatChannelMcpConfigPath(sessionId, tmpdir());
+                try {
+                    writeFileSync(webchatPath, JSON.stringify({ mcpServers: webchatServers }, null, 2), 'utf8');
+                    argv.push(...buildWebchatChannelArgv(webchatPath));
+                    deps.logger(`[rc-spawn] op=webchat-channel key=${effectiveWebchatChannel.key} gateway=${effectiveWebchatChannel.gatewayUrl} path=${webchatPath}`);
+                }
+                catch (err) {
+                    webchatPath = null;
+                    deps.logger(`[rc-spawn] op=webchat-channel-write-failed err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
+                }
             }
         }
         // Task 626 — the initial message is the trailing positional, processed as
@@ -1944,7 +1970,7 @@ export function buildHttpApp(deps) {
         // when one exists. Non-fatal: the PTY here is already serving a live thread —
         // a failed classification sidecar must not tear it down, so it logs and the
         // session keeps running (the pre-fix reader-blind behaviour, no worse).
-        const classifyChannel = adminRole === 'admin' ? adminChannel : undefined;
+        const classifyChannel = rcRole !== undefined ? adminChannel : undefined;
         const classifySenderId = adminSenderId ?? effectiveWaChannel?.senderId ?? effectiveWebchatChannel?.key;
         if (sessionId && classifyChannel && classifySenderId) {
             const classifySidecarPath = sidecarPathForSessionId(deps.spawnCwd, sessionId);
@@ -1952,7 +1978,10 @@ export function buildHttpApp(deps) {
                 try {
                     writeSidecar(classifySidecarPath, {
                         senderId: classifySenderId,
-                        role: 'admin',
+                        // Task 852 — the actual role from the body ('admin' | 'public'),
+                        // not a hardcoded 'admin'; rcRole is defined whenever
+                        // classifyChannel is.
+                        role: rcRole,
                         channel: classifyChannel,
                         url: null,
                         startedAt: new Date().toISOString(),