@rubytech/create-maxy-code 0.1.306 → 0.1.308

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.306",
+  "version": "0.1.308",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/admin-access-password/__tests__/index.test.ts

@@ -0,0 +1,114 @@
+import { describe, it, expect } from 'vitest'
+import { mkdtempSync, writeFileSync, readFileSync, existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  hashAccessPassword,
+  setAccessPassword,
+  clearAccessPassword,
+  verifyAccessPassword,
+  anyAccessPasswordConfigured,
+  accessStoreUnreadable,
+  migrateLegacyRemotePassword,
+} from '../src/index'
+
+function tmpUsers(content: unknown): string {
+  const dir = mkdtempSync(join(tmpdir(), 'aap-'))
+  const f = join(dir, 'users.json')
+  writeFileSync(f, JSON.stringify(content, null, 2))
+  return f
+}
+
+describe('admin-access-password', () => {
+  it('sets accessHash on the target record only, preserving siblings', async () => {
+    const f = tmpUsers([
+      { userId: 'a', pin: 'pinA', phone: '+1' },
+      { userId: 'b', pin: 'pinB' },
+    ])
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    const users = JSON.parse(readFileSync(f, 'utf-8'))
+    expect(users[0].accessHash).toMatch(/^[0-9a-f]+:[0-9a-f]+$/)
+    expect(users[0].pin).toBe('pinA')
+    expect(users[0].phone).toBe('+1')
+    expect(users[1].accessHash).toBeUndefined()
+  })
+
+  it('verifyAccessPassword returns the matching userId, null on miss', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }, { userId: 'b', pin: 'y' }])
+    await setAccessPassword('b', 'Sw0rdfish!', f)
+    expect(await verifyAccessPassword('Sw0rdfish!', f)).toBe('b')
+    expect(await verifyAccessPassword('wrong', f)).toBeNull()
+  })
+
+  it("clearAccessPassword removes only that record's hash", async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }])
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    clearAccessPassword('a', f)
+    const users = JSON.parse(readFileSync(f, 'utf-8'))
+    expect(users[0].accessHash).toBeUndefined()
+    expect(users[0].pin).toBe('x')
+  })
+
+  it('anyAccessPasswordConfigured reflects presence', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }])
+    expect(anyAccessPasswordConfigured(f)).toBe(false)
+    await setAccessPassword('a', 'Sw0rdfish!', f)
+    expect(anyAccessPasswordConfigured(f)).toBe(true)
+  })
+
+  it('verifyAccessPassword returns null when no record has accessHash', async () => {
+    const f = tmpUsers([{ userId: 'a', pin: 'x' }])
+    expect(await verifyAccessPassword('anything', f)).toBeNull()
+  })
+
+  it('accessStoreUnreadable: false for absent/clean, true for corrupt (fail-closed signal)', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'aapu-'))
+    const absent = join(dir, 'users.json')
+    expect(accessStoreUnreadable(absent)).toBe(false) // absent → not unreadable
+    writeFileSync(absent, JSON.stringify([{ userId: 'a', pin: 'x' }]))
+    expect(accessStoreUnreadable(absent)).toBe(false) // clean → readable
+    writeFileSync(absent, '{ this is not json')
+    expect(accessStoreUnreadable(absent)).toBe(true)  // corrupt → unreadable → caller fails closed
+  })
+})
+
+describe('migrateLegacyRemotePassword', () => {
+  function setup(usersContent: unknown, legacy?: string): { usersFile: string; legacyFile: string } {
+    const dir = mkdtempSync(join(tmpdir(), 'aapm-'))
+    const usersFile = join(dir, 'users.json')
+    const legacyFile = join(dir, '.remote-password')
+    writeFileSync(usersFile, JSON.stringify(usersContent, null, 2))
+    if (legacy !== undefined) writeFileSync(legacyFile, legacy)
+    return { usersFile, legacyFile }
+  }
+
+  it('moves the legacy hash into the owner record and deletes the file', async () => {
+    const legacyHash = await hashAccessPassword('OwnerPass1!')
+    const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x' }], legacyHash)
+    const r = migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')
+    expect(r).toBe('migrated')
+    expect(existsSync(legacyFile)).toBe(false)
+    const users = JSON.parse(readFileSync(usersFile, 'utf-8'))
+    expect(users[0].accessHash).toBe(legacyHash)
+  })
+
+  it('is idempotent — second run is noop', async () => {
+    const legacyHash = await hashAccessPassword('OwnerPass1!')
+    const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x' }], legacyHash)
+    migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-no-legacy')
+  })
+
+  it('no owner record → leaves the legacy file in place', async () => {
+    const legacyHash = await hashAccessPassword('OwnerPass1!')
+    const { usersFile, legacyFile } = setup([{ userId: 'someoneelse', pin: 'x' }], legacyHash)
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-no-owner')
+    expect(existsSync(legacyFile)).toBe(true)
+  })
+
+  it('owner already has accessHash → deletes stale legacy file, noop', async () => {
+    const { usersFile, legacyFile } = setup([{ userId: 'owner', pin: 'x', accessHash: 'aa:bb' }], 'cc:dd')
+    expect(migrateLegacyRemotePassword(usersFile, legacyFile, 'owner')).toBe('noop-owner-has-hash')
+    expect(existsSync(legacyFile)).toBe(false)
+  })
+})

package/payload/platform/lib/admin-access-password/dist/index.d.ts

@@ -0,0 +1,40 @@
+export interface AccessUserEntry {
+    userId: string;
+    pin: string;
+    phone?: string;
+    accessHash?: string;
+    [k: string]: unknown;
+}
+export declare function hashAccessPassword(password: string): Promise<string>;
+declare function matchesHash(password: string, stored: string): Promise<boolean>;
+/** Write `accessHash` onto the userId's record. Throws if the record is absent. */
+export declare function setAccessPassword(userId: string, password: string, usersFile: string): Promise<void>;
+/** Remove `accessHash` from the userId's record. No-op if absent. */
+export declare function clearAccessPassword(userId: string, usersFile: string): void;
+/** Return the userId whose accessHash matches, or null. */
+export declare function verifyAccessPassword(password: string, usersFile: string): Promise<string | null>;
+/** True when at least one record carries an accessHash. */
+export declare function anyAccessPasswordConfigured(usersFile: string): boolean;
+/**
+ * True when users.json is present on disk but cannot be read or parsed. The
+ * gate's `isRemoteAuthConfigured` checks this so a transient read fault on a
+ * configured install fails CLOSED (stays "configured" → login screen, not the
+ * setup flow) instead of downgrading to "unconfigured". A genuinely absent or
+ * cleanly-empty store is NOT unreadable.
+ */
+export declare function accessStoreUnreadable(usersFile: string): boolean;
+export type MigrateResult = 'migrated' | 'noop-no-legacy' | 'noop-no-owner' | 'noop-owner-has-hash';
+/**
+ * One-time, idempotent. If the legacy single-password file exists and the
+ * owner record has no accessHash, copy the legacy hash (already scrypt
+ * "salt:hash") onto the owner and delete the legacy file. If the owner already
+ * has an accessHash, the legacy file is stale → delete it. If no owner record
+ * exists yet, leave the legacy file untouched (verify still reads it as a
+ * candidate during this window — see readLegacyRemoteHash).
+ */
+export declare function migrateLegacyRemotePassword(usersFile: string, legacyFile: string, ownerUserId: string): MigrateResult;
+/** Read a still-present legacy single-password hash, or null. Used by verify
+ *  as one additional candidate before the boot migration runs. */
+export declare function readLegacyRemoteHash(legacyFile: string): string | null;
+export { matchesHash as verifyHashCandidate };
+//# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/admin-access-password/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CACrB;AAWD,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI1E;AAED,iBAAe,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS7E;AAiBD,mFAAmF;AACnF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAM1G;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAQ3E;AAED,2DAA2D;AAC3D,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAStG;AAED,2DAA2D;AAC3D,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAItE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGhE;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,GAAG,gBAAgB,GAAG,eAAe,GAAG,qBAAqB,CAAA;AAEnG;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,aAAa,CAgBf;AAED;kEACkE;AAClE,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAItE;AAED,OAAO,EAAE,WAAW,IAAI,mBAAmB,EAAE,CAAA"}

package/payload/platform/lib/admin-access-password/dist/index.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashAccessPassword = hashAccessPassword;
+exports.setAccessPassword = setAccessPassword;
+exports.clearAccessPassword = clearAccessPassword;
+exports.verifyAccessPassword = verifyAccessPassword;
+exports.anyAccessPasswordConfigured = anyAccessPasswordConfigured;
+exports.accessStoreUnreadable = accessStoreUnreadable;
+exports.migrateLegacyRemotePassword = migrateLegacyRemotePassword;
+exports.readLegacyRemoteHash = readLegacyRemoteHash;
+exports.verifyHashCandidate = matchesHash;
+// Per-admin device access passwords. Single owner of the `accessHash` field
+// on users.json admin records. Imported by both platform/ui (src) and the
+// admin MCP plugin (dist) — mirrors platform/lib/admins-write.
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SCRYPT_KEYLEN = 64;
+function scryptAsync(password, salt) {
+    return new Promise((resolve, reject) => {
+        (0, node_crypto_1.scrypt)(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
+            if (err)
+                reject(err);
+            else
+                resolve(key);
+        });
+    });
+}
+async function hashAccessPassword(password) {
+    const salt = (0, node_crypto_1.randomBytes)(32);
+    const hash = await scryptAsync(password, salt);
+    return `${salt.toString('hex')}:${hash.toString('hex')}`;
+}
+async function matchesHash(password, stored) {
+    const colon = stored.indexOf(':');
+    if (colon === -1)
+        return false;
+    const salt = Buffer.from(stored.slice(0, colon), 'hex');
+    const storedHash = Buffer.from(stored.slice(colon + 1), 'hex');
+    if (storedHash.length !== SCRYPT_KEYLEN)
+        return false;
+    let computed;
+    try {
+        computed = await scryptAsync(password, salt);
+    }
+    catch {
+        return false;
+    }
+    return (0, node_crypto_1.timingSafeEqual)(computed, storedHash);
+}
+function readUsers(usersFile) {
+    if (!(0, node_fs_1.existsSync)(usersFile))
+        return [];
+    const raw = (0, node_fs_1.readFileSync)(usersFile, 'utf-8').trim();
+    if (!raw)
+        return [];
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed))
+        throw new Error('users.json is not an array');
+    return parsed;
+}
+function writeUsersAtomic(usersFile, users) {
+    const tmp = `${usersFile}.tmp-${process.pid}`;
+    (0, node_fs_1.writeFileSync)(tmp, JSON.stringify(users, null, 2) + '\n', { mode: 0o600 });
+    (0, node_fs_1.renameSync)(tmp, usersFile);
+}
+/** Write `accessHash` onto the userId's record. Throws if the record is absent. */
+async function setAccessPassword(userId, password, usersFile) {
+    const users = readUsers(usersFile);
+    const idx = users.findIndex(u => u.userId === userId);
+    if (idx === -1)
+        throw new Error(`no users.json record for userId=${userId}`);
+    users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) };
+    writeUsersAtomic(usersFile, users);
+}
+/** Remove `accessHash` from the userId's record. No-op if absent. */
+function clearAccessPassword(userId, usersFile) {
+    const users = readUsers(usersFile);
+    const idx = users.findIndex(u => u.userId === userId);
+    if (idx === -1)
+        return;
+    const { accessHash, ...rest } = users[idx];
+    void accessHash;
+    users[idx] = rest;
+    writeUsersAtomic(usersFile, users);
+}
+/** Return the userId whose accessHash matches, or null. */
+async function verifyAccessPassword(password, usersFile) {
+    let users;
+    try {
+        users = readUsers(usersFile);
+    }
+    catch {
+        return null;
+    }
+    for (const u of users) {
+        if (typeof u.accessHash === 'string' && (await matchesHash(password, u.accessHash))) {
+            return u.userId;
+        }
+    }
+    return null;
+}
+/** True when at least one record carries an accessHash. */
+function anyAccessPasswordConfigured(usersFile) {
+    let users;
+    try {
+        users = readUsers(usersFile);
+    }
+    catch {
+        return false;
+    }
+    return users.some(u => typeof u.accessHash === 'string' && u.accessHash.length > 0);
+}
+/**
+ * True when users.json is present on disk but cannot be read or parsed. The
+ * gate's `isRemoteAuthConfigured` checks this so a transient read fault on a
+ * configured install fails CLOSED (stays "configured" → login screen, not the
+ * setup flow) instead of downgrading to "unconfigured". A genuinely absent or
+ * cleanly-empty store is NOT unreadable.
+ */
+function accessStoreUnreadable(usersFile) {
+    if (!(0, node_fs_1.existsSync)(usersFile))
+        return false;
+    try {
+        readUsers(usersFile);
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * One-time, idempotent. If the legacy single-password file exists and the
+ * owner record has no accessHash, copy the legacy hash (already scrypt
+ * "salt:hash") onto the owner and delete the legacy file. If the owner already
+ * has an accessHash, the legacy file is stale → delete it. If no owner record
+ * exists yet, leave the legacy file untouched (verify still reads it as a
+ * candidate during this window — see readLegacyRemoteHash).
+ */
+function migrateLegacyRemotePassword(usersFile, legacyFile, ownerUserId) {
+    if (!(0, node_fs_1.existsSync)(legacyFile))
+        return 'noop-no-legacy';
+    const legacy = (0, node_fs_1.readFileSync)(legacyFile, 'utf-8').trim();
+    const users = readUsers(usersFile);
+    const idx = users.findIndex(u => u.userId === ownerUserId);
+    if (idx === -1)
+        return 'noop-no-owner';
+    const existing = users[idx].accessHash;
+    if (typeof existing === 'string' && existing.length > 0) {
+        (0, node_fs_1.unlinkSync)(legacyFile);
+        return 'noop-owner-has-hash';
+    }
+    if (!legacy.includes(':')) {
+        (0, node_fs_1.unlinkSync)(legacyFile);
+        return 'noop-no-legacy';
+    }
+    users[idx] = { ...users[idx], accessHash: legacy };
+    writeUsersAtomic(usersFile, users);
+    (0, node_fs_1.unlinkSync)(legacyFile);
+    return 'migrated';
+}
+/** Read a still-present legacy single-password hash, or null. Used by verify
+ *  as one additional candidate before the boot migration runs. */
+function readLegacyRemoteHash(legacyFile) {
+    if (!(0, node_fs_1.existsSync)(legacyFile))
+        return null;
+    const raw = (0, node_fs_1.readFileSync)(legacyFile, 'utf-8').trim();
+    return raw.includes(':') ? raw : null;
+}
+//# sourceMappingURL=index.js.map

package/payload/platform/lib/admin-access-password/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AA4BA,gDAIC;AA6BD,8CAMC;AAGD,kDAQC;AAGD,oDASC;AAGD,kEAIC;AASD,sDAGC;AAYD,kEAoBC;AAID,oDAIC;AAEuB,0CAAmB;AAvJ3C,4EAA4E;AAC5E,0EAA0E;AAC1E,+DAA+D;AAC/D,6CAAkE;AAClE,qCAAyF;AAEzF,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,QAAQ,GAAG,CAAC,CAAA;AAClB,MAAM,aAAa,GAAG,EAAE,CAAA;AAUxB,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAA,oBAAM,EAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5F,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;gBACf,OAAO,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,MAAM,IAAI,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAA;IAC5B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAc;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IAC9D,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IACrD,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3E,OAAO,IAAA,6BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,SAAS,CAAC,SAAiB;IAClC,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACzE,OAAO,MAA2B,CAAA;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,SAAiB,EAAE,KAAwB;IACnE,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAA;IAC7C,IAAA,uBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,IAAA,oBAAU,EAAC,GAAG,EAAE,SAAS,CAAC,CAAA;AAC5B,CAAC;AAED,mFAAmF;AAC5E,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,QAAgB,EAAE,SAAiB;IACzF,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAA;IAC5E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC9E,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,qEAAqE;AACrE,SAAgB,mBAAmB,CAAC,MAAc,EAAE,SAAiB;IACnE,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACrD,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAM;IACtB,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1C,KAAK,UAAU,CAAA;IACf,KAAK,CAAC,GAAG,CAAC,GAAG,IAAuB,CAAA;IACpC,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;AACpC,CAAC;AAED,2DAA2D;AACpD,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,SAAiB;IAC5E,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;IAC1D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,CAAC,CAAC,MAAM,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,2DAA2D;AAC3D,SAAgB,2BAA2B,CAAC,SAAiB;IAC3D,IAAI,KAAwB,CAAA;IAC5B,IAAI,CAAC;QAAC,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACrF,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CAAC,SAAiB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IACxC,IAAI,CAAC;QAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAAC,OAAO,KAAK,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAA;IAAC,CAAC;AAClE,CAAC;AAID;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CACzC,SAAiB,EACjB,UAAkB,EAClB,WAAmB;IAEnB,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,gBAAgB,CAAA;IACpD,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAA;IAClC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;IAC1D,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,eAAe,CAAA;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,CAAA;IACtC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;QACtB,OAAO,qBAAqB,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAAC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAC;QAAC,OAAO,gBAAgB,CAAA;IAAC,CAAC;IAC9E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAClD,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAClC,IAAA,oBAAU,EAAC,UAAU,CAAC,CAAA;IACtB,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;kEACkE;AAClE,SAAgB,oBAAoB,CAAC,UAAkB;IACrD,IAAI,CAAC,IAAA,oBAAU,EAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,MAAM,GAAG,GAAG,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IACpD,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AACvC,CAAC"}

package/payload/platform/lib/admin-access-password/src/index.ts

@@ -0,0 +1,152 @@
+// Per-admin device access passwords. Single owner of the `accessHash` field
+// on users.json admin records. Imported by both platform/ui (src) and the
+// admin MCP plugin (dist) — mirrors platform/lib/admins-write.
+import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto'
+import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync } from 'node:fs'
+
+const SCRYPT_N = 16384
+const SCRYPT_R = 8
+const SCRYPT_P = 1
+const SCRYPT_KEYLEN = 64
+
+export interface AccessUserEntry {
+  userId: string
+  pin: string
+  phone?: string
+  accessHash?: string
+  [k: string]: unknown
+}
+
+function scryptAsync(password: string, salt: Buffer): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    scrypt(password, salt, SCRYPT_KEYLEN, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, key) => {
+      if (err) reject(err)
+      else resolve(key)
+    })
+  })
+}
+
+export async function hashAccessPassword(password: string): Promise<string> {
+  const salt = randomBytes(32)
+  const hash = await scryptAsync(password, salt)
+  return `${salt.toString('hex')}:${hash.toString('hex')}`
+}
+
+async function matchesHash(password: string, stored: string): Promise<boolean> {
+  const colon = stored.indexOf(':')
+  if (colon === -1) return false
+  const salt = Buffer.from(stored.slice(0, colon), 'hex')
+  const storedHash = Buffer.from(stored.slice(colon + 1), 'hex')
+  if (storedHash.length !== SCRYPT_KEYLEN) return false
+  let computed: Buffer
+  try { computed = await scryptAsync(password, salt) } catch { return false }
+  return timingSafeEqual(computed, storedHash)
+}
+
+function readUsers(usersFile: string): AccessUserEntry[] {
+  if (!existsSync(usersFile)) return []
+  const raw = readFileSync(usersFile, 'utf-8').trim()
+  if (!raw) return []
+  const parsed = JSON.parse(raw)
+  if (!Array.isArray(parsed)) throw new Error('users.json is not an array')
+  return parsed as AccessUserEntry[]
+}
+
+function writeUsersAtomic(usersFile: string, users: AccessUserEntry[]): void {
+  const tmp = `${usersFile}.tmp-${process.pid}`
+  writeFileSync(tmp, JSON.stringify(users, null, 2) + '\n', { mode: 0o600 })
+  renameSync(tmp, usersFile)
+}
+
+/** Write `accessHash` onto the userId's record. Throws if the record is absent. */
+export async function setAccessPassword(userId: string, password: string, usersFile: string): Promise<void> {
+  const users = readUsers(usersFile)
+  const idx = users.findIndex(u => u.userId === userId)
+  if (idx === -1) throw new Error(`no users.json record for userId=${userId}`)
+  users[idx] = { ...users[idx], accessHash: await hashAccessPassword(password) }
+  writeUsersAtomic(usersFile, users)
+}
+
+/** Remove `accessHash` from the userId's record. No-op if absent. */
+export function clearAccessPassword(userId: string, usersFile: string): void {
+  const users = readUsers(usersFile)
+  const idx = users.findIndex(u => u.userId === userId)
+  if (idx === -1) return
+  const { accessHash, ...rest } = users[idx]
+  void accessHash
+  users[idx] = rest as AccessUserEntry
+  writeUsersAtomic(usersFile, users)
+}
+
+/** Return the userId whose accessHash matches, or null. */
+export async function verifyAccessPassword(password: string, usersFile: string): Promise<string | null> {
+  let users: AccessUserEntry[]
+  try { users = readUsers(usersFile) } catch { return null }
+  for (const u of users) {
+    if (typeof u.accessHash === 'string' && (await matchesHash(password, u.accessHash))) {
+      return u.userId
+    }
+  }
+  return null
+}
+
+/** True when at least one record carries an accessHash. */
+export function anyAccessPasswordConfigured(usersFile: string): boolean {
+  let users: AccessUserEntry[]
+  try { users = readUsers(usersFile) } catch { return false }
+  return users.some(u => typeof u.accessHash === 'string' && u.accessHash.length > 0)
+}
+
+/**
+ * True when users.json is present on disk but cannot be read or parsed. The
+ * gate's `isRemoteAuthConfigured` checks this so a transient read fault on a
+ * configured install fails CLOSED (stays "configured" → login screen, not the
+ * setup flow) instead of downgrading to "unconfigured". A genuinely absent or
+ * cleanly-empty store is NOT unreadable.
+ */
+export function accessStoreUnreadable(usersFile: string): boolean {
+  if (!existsSync(usersFile)) return false
+  try { readUsers(usersFile); return false } catch { return true }
+}
+
+export type MigrateResult = 'migrated' | 'noop-no-legacy' | 'noop-no-owner' | 'noop-owner-has-hash'
+
+/**
+ * One-time, idempotent. If the legacy single-password file exists and the
+ * owner record has no accessHash, copy the legacy hash (already scrypt
+ * "salt:hash") onto the owner and delete the legacy file. If the owner already
+ * has an accessHash, the legacy file is stale → delete it. If no owner record
+ * exists yet, leave the legacy file untouched (verify still reads it as a
+ * candidate during this window — see readLegacyRemoteHash).
+ */
+export function migrateLegacyRemotePassword(
+  usersFile: string,
+  legacyFile: string,
+  ownerUserId: string,
+): MigrateResult {
+  if (!existsSync(legacyFile)) return 'noop-no-legacy'
+  const legacy = readFileSync(legacyFile, 'utf-8').trim()
+  const users = readUsers(usersFile)
+  const idx = users.findIndex(u => u.userId === ownerUserId)
+  if (idx === -1) return 'noop-no-owner'
+  const existing = users[idx].accessHash
+  if (typeof existing === 'string' && existing.length > 0) {
+    unlinkSync(legacyFile)
+    return 'noop-owner-has-hash'
+  }
+  if (!legacy.includes(':')) { unlinkSync(legacyFile); return 'noop-no-legacy' }
+  users[idx] = { ...users[idx], accessHash: legacy }
+  writeUsersAtomic(usersFile, users)
+  unlinkSync(legacyFile)
+  return 'migrated'
+}
+
+/** Read a still-present legacy single-password hash, or null. Used by verify
+ *  as one additional candidate before the boot migration runs. */
+export function readLegacyRemoteHash(legacyFile: string): string | null {
+  if (!existsSync(legacyFile)) return null
+  const raw = readFileSync(legacyFile, 'utf-8').trim()
+  return raw.includes(':') ? raw : null
+}
+
+export { matchesHash as verifyHashCandidate }

package/payload/platform/lib/admin-access-password/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/payload/platform/lib/models/dist/index.d.ts

@@ -1,4 +1,3 @@
-export declare const FABLE_MODEL = "claude-fable-5[1m]";
 export declare const OPUS_MODEL = "claude-opus-4-8[1m]";
 export declare const SONNET_MODEL = "claude-sonnet-4-6";
 export declare const HAIKU_MODEL = "claude-haiku-4-5";
@@ -12,4 +11,10 @@ export declare const MODEL_DISPLAY_NAMES: Record<string, string>;
 /** The dropdown label for a model id: friendly name when canonical, else the
  *  raw id (never misrepresents an off-map persisted lever). */
 export declare function modelDisplayName(id: string): string;
+/** The exact selectable model ids (no aliases). Server-side re-seat validation
+ *  (Task 876) uses this so a body-supplied model can never reach the spawn argv
+ *  unchecked — a removed model (e.g. claude-fable-5) or a bare alias ('opus')
+ *  is rejected before the fork. */
+export declare const SELECTABLE_MODELS: readonly string[];
+export declare function isSelectableModel(id: string): boolean;
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/models/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAChD,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;qEAEqE;AACrE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAKtD,CAAC;AAEF;+DAC+D;AAC/D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;qEAEqE;AACrE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAItD,CAAC;AAEF;+DAC+D;AAC/D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;mCAGmC;AACnC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4C,CAAC;AAC5F,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/payload/platform/lib/models/dist/index.js

@@ -3,18 +3,17 @@
 // Templates, docs, and skills reference these values as strings;
 // all TypeScript consumers import from here.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MODEL_DISPLAY_NAMES = exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = exports.FABLE_MODEL = void 0;
+exports.SELECTABLE_MODELS = exports.MODEL_DISPLAY_NAMES = exports.MODEL_CONTEXT_WINDOW = exports.HAIKU_MODEL = exports.SONNET_MODEL = exports.OPUS_MODEL = void 0;
 exports.contextWindow = contextWindow;
 exports.modelDisplayName = modelDisplayName;
-// Fable and Opus default to the 1M-context variant ([1m] is Claude Code's
+exports.isSelectableModel = isSelectableModel;
+// Opus defaults to the 1M-context variant ([1m] is Claude Code's
 // context-extension suffix, valid in settings.json "model" and agent
 // frontmatter); Sonnet/Haiku stay on the standard 200k window.
-exports.FABLE_MODEL = "claude-fable-5[1m]";
 exports.OPUS_MODEL = "claude-opus-4-8[1m]";
 exports.SONNET_MODEL = "claude-sonnet-4-6";
 exports.HAIKU_MODEL = "claude-haiku-4-5";
 exports.MODEL_CONTEXT_WINDOW = {
-    [exports.FABLE_MODEL]: 1_000_000,
     [exports.OPUS_MODEL]: 1_000_000,
     [exports.SONNET_MODEL]: 200_000,
     [exports.HAIKU_MODEL]: 200_000,
@@ -27,7 +26,6 @@ function contextWindow(model) {
  *  native-CC model dropdown (Task 820). A lever id outside this map renders
  *  with its raw id as the label (the composer's append-fallback). */
 exports.MODEL_DISPLAY_NAMES = {
-    [exports.FABLE_MODEL]: "Fable 5 (1M context)",
     [exports.OPUS_MODEL]: "Opus 4.8 (1M context)",
     [exports.SONNET_MODEL]: "Sonnet 4.6",
     [exports.HAIKU_MODEL]: "Haiku 4.5",
@@ -37,4 +35,12 @@ exports.MODEL_DISPLAY_NAMES = {
 function modelDisplayName(id) {
     return exports.MODEL_DISPLAY_NAMES[id] ?? id;
 }
+/** The exact selectable model ids (no aliases). Server-side re-seat validation
+ *  (Task 876) uses this so a body-supplied model can never reach the spawn argv
+ *  unchecked — a removed model (e.g. claude-fable-5) or a bare alias ('opus')
+ *  is rejected before the fork. */
+exports.SELECTABLE_MODELS = [exports.OPUS_MODEL, exports.SONNET_MODEL, exports.HAIKU_MODEL];
+function isSelectableModel(id) {
+    return exports.SELECTABLE_MODELS.includes(id);
+}
 //# sourceMappingURL=index.js.map

package/payload/platform/lib/models/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAkB7C,sCAEC;AAcD,4CAEC;AAlCD,0EAA0E;AAC1E,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,WAAW,GAAG,oBAAoB,CAAC;AACnC,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,mBAAW,CAAC,EAAE,SAAS;IACxB,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED;;qEAEqE;AACxD,QAAA,mBAAmB,GAA2B;IACzD,CAAC,mBAAW,CAAC,EAAE,sBAAsB;IACrC,CAAC,kBAAU,CAAC,EAAE,uBAAuB;IACrC,CAAC,oBAAY,CAAC,EAAE,YAAY;IAC5B,CAAC,mBAAW,CAAC,EAAE,WAAW;CAC3B,CAAC;AAEF;+DAC+D;AAC/D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,2BAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAgB7C,sCAEC;AAaD,4CAEC;AAOD,8CAEC;AAxCD,iEAAiE;AACjE,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED;;qEAEqE;AACxD,QAAA,mBAAmB,GAA2B;IACzD,CAAC,kBAAU,CAAC,EAAE,uBAAuB;IACrC,CAAC,oBAAY,CAAC,EAAE,YAAY;IAC5B,CAAC,mBAAW,CAAC,EAAE,WAAW;CAC3B,CAAC;AAEF;+DAC+D;AAC/D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,2BAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;mCAGmC;AACtB,QAAA,iBAAiB,GAAsB,CAAC,kBAAU,EAAE,oBAAY,EAAE,mBAAW,CAAC,CAAC;AAC5F,SAAgB,iBAAiB,CAAC,EAAU;IAC1C,OAAO,yBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/payload/platform/lib/models/src/index.ts

@@ -2,16 +2,14 @@
 // Templates, docs, and skills reference these values as strings;
 // all TypeScript consumers import from here.
 
-// Fable and Opus default to the 1M-context variant ([1m] is Claude Code's
+// Opus defaults to the 1M-context variant ([1m] is Claude Code's
 // context-extension suffix, valid in settings.json "model" and agent
 // frontmatter); Sonnet/Haiku stay on the standard 200k window.
-export const FABLE_MODEL = "claude-fable-5[1m]";
 export const OPUS_MODEL = "claude-opus-4-8[1m]";
 export const SONNET_MODEL = "claude-sonnet-4-6";
 export const HAIKU_MODEL = "claude-haiku-4-5";
 
 export const MODEL_CONTEXT_WINDOW: Record<string, number> = {
-  [FABLE_MODEL]: 1_000_000,
   [OPUS_MODEL]: 1_000_000,
   [SONNET_MODEL]: 200_000,
   [HAIKU_MODEL]: 200_000,
@@ -26,7 +24,6 @@ export function contextWindow(model: string): number {
  *  native-CC model dropdown (Task 820). A lever id outside this map renders
  *  with its raw id as the label (the composer's append-fallback). */
 export const MODEL_DISPLAY_NAMES: Record<string, string> = {
-  [FABLE_MODEL]: "Fable 5 (1M context)",
   [OPUS_MODEL]: "Opus 4.8 (1M context)",
   [SONNET_MODEL]: "Sonnet 4.6",
   [HAIKU_MODEL]: "Haiku 4.5",
@@ -37,3 +34,12 @@ export const MODEL_DISPLAY_NAMES: Record<string, string> = {
 export function modelDisplayName(id: string): string {
   return MODEL_DISPLAY_NAMES[id] ?? id;
 }
+
+/** The exact selectable model ids (no aliases). Server-side re-seat validation
+ *  (Task 876) uses this so a body-supplied model can never reach the spawn argv
+ *  unchecked — a removed model (e.g. claude-fable-5) or a bare alias ('opus')
+ *  is rejected before the fork. */
+export const SELECTABLE_MODELS: readonly string[] = [OPUS_MODEL, SONNET_MODEL, HAIKU_MODEL];
+export function isSelectableModel(id: string): boolean {
+  return SELECTABLE_MODELS.includes(id);
+}

package/payload/platform/package.json

@@ -6,8 +6,8 @@
     "services/*"
   ],
   "scripts": {
-    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json",
+    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",