@rubytech/create-maxy-code 0.1.309 → 0.1.311

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.309",
+  "version": "0.1.311",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:8fd7006bd54f69d5932bc831cf46f9ced8e01318f5fac0963f4285bc1e4b21a0
+content-hash: sha256:2dbfcb8246f85a6b6adc588c742acaaa57d81196907dc3bcef07a1c6ae2ad013
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2515,7 +2515,7 @@ authoritative. This section names the surfaces and what backs each.
 | `+ New session` button | Opens `NewSessionModal`, which POSTs `{channel, permissionMode, model, initialMessage}` to `/api/admin/claude-sessions`. | `claude-sessions.ts` |
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
-| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every resumable row (not `resumable === false` public rows) carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). | `/claude-sessions/events`, `/claude-sessions` |
+| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). | `/claude-sessions/events`, `/claude-sessions` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |

package/payload/platform/plugins/admin/skills/plugin-management/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: plugin-management
-description: "Install, remove, enable, and configure plugins and account settings via conversation."
+description: "Install, remove, enable, and configure plugins and account settings via conversation. This is how an operator turns the assistant's capabilities and integrations on and off — \"turn on email\", \"enable WhatsApp\", \"add a Telegram integration\", \"connect a new integration\", \"what can you connect to\", \"what plugins are available\", \"set up an integration\", \"disable X\", or changing an account setting. Each plugin is an integration or capability the assistant can gain; this skill is the surface for adding, removing, or reconfiguring them."
 ---
 
 # Plugin Management

package/payload/platform/plugins/admin/skills/specialist-management/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: specialist-management
-description: "Install, remove, and manage specialist subagents and premium plugin agents."
+description: "Install, remove, and manage specialist subagents and premium plugin agents — the dedicated helpers the assistant can hand work to. This is how an operator adds a new helper or worker agent: \"add a content writer\", \"set up a research agent\", \"give me a helper that writes documents\", \"add an agent that does X\", \"hire an assistant for Y\", \"what specialists can I add\", or removing one. Each specialist is a focused agent the assistant delegates a domain to (writing, research, and the like)."
 ---
 
 # Specialist Management

package/payload/platform/plugins/cloudflare/skills/cloudflare/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: cloudflare
-description: Cloudflare operations for the install — tunnel setup/diagnosis/reset, DNS edits, Pages hosting, and D1 data capture. The agent drives `cloudflared` and `wrangler` directly via Bash and reads the matching reference before each operation class; success is always a live behavioural signal (external HTTP 200, a deployed URL, a D1 round-trip), never an exit code.
+description: Cloudflare operations for the install — tunnel setup/diagnosis/reset, DNS edits, Pages hosting, and D1 data capture. This is the skill behind operator-facing goals like "set up the operator dashboard", "set up the operator host", "give me (or a colleague) a remote dashboard to run the assistant", "let me access the assistant from anywhere", "put my dashboard or site online", "point a custom domain at this", and "why is my site or hostname returning a 404 / 502". It provisions the operator-dashboard host — the trimmed remote control panel (sessions, chat, data; no graph, no browser) — by adding the tunnel ingress and the operator-domains.json classification, stands up admin / public / operator hostnames over the Cloudflare tunnel so the install is reachable on the internet, hosts static sites on Pages, and captures form submissions to D1. The agent drives `cloudflared` and `wrangler` directly via Bash and reads the matching reference before each operation class; success is always a live behavioural signal (external HTTP 200, a deployed URL, a D1 round-trip), never an exit code.
 ---
 
 # Cloudflare operations

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -284,7 +284,7 @@ authoritative. This section names the surfaces and what backs each.
 | `+ New session` button | Opens `NewSessionModal`, which POSTs `{channel, permissionMode, model, initialMessage}` to `/api/admin/claude-sessions`. | `claude-sessions.ts` |
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
-| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every resumable row (not `resumable === false` public rows) carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). | `/claude-sessions/events`, `/claude-sessions` |
+| Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). | `/claude-sessions/events`, `/claude-sessions` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |

package/payload/platform/scripts/check-no-esm-require.mjs

@@ -59,6 +59,10 @@ const ALLOWLIST = new Set([
   // before the `../paths` mock fires, to point USERS_FILE/REMOTE_PASSWORD_FILE
   // at a temp dir off the operator's real home config.
   'platform/ui/app/lib/__tests__/remote-auth-per-admin.test.ts',
+  // Same vi.hoisted pattern: the files-write test builds a tmp platform/data
+  // tree and sets MAXY_PLATFORM_ROOT before the route module (and its
+  // data-path/attachments deps) read the env at import.
+  'platform/ui/server/routes/admin/__tests__/files-write.test.ts',
 ])
 
 const REQUIRE_CALL_RE = /\brequire\s*\(/

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts

@@ -37,6 +37,7 @@ export interface HttpDeps extends Omit<SpawnDeps, 'onSessionReady' | 'watcher'>
 }
 export declare function forkArgvSegment(fromSessionId: string, newSessionId: string, model: string): string[];
 export declare function reseatIdentityPrompt(model: string): string;
+export declare function authenticatedIdentityPrompt(name: string | null): string;
 export declare function formatReseatLine(fromModel: string | null, toModel: string, oldSessionId: string, newSessionId: string, observed: string | null): string;
 export declare function firstPostArmAssistantModel(lines: string[], armTimeMs: number): string | null;
 /** Task 189 — Hono instance with the test-only fan-out trigger attached.

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAY3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAqBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAwGD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAQD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAimEpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAY3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAsBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAwGD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAQD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAgqEpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -32,6 +32,7 @@ import { execFileSync } from 'node:child_process';
 import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
 import { spawnClaudeSession, stopSession, writeInputToPty, isLive, onPtyExit, livePtyCount, liveSessionIds, getPtyTrackerForTests, livePidForSession, priorExitedCountForSession, PERMISSION_MODES, openFdCount, registerRcSpawnPty, } from './pty-spawner.js';
 import { writeScopeRecord, removeScopeRecord } from './scope-record.js';
+import { writeReseatMarker, resolveReseatChain, clearReseatMarker } from './reseat-ledger.js';
 import { getScopeMainPid, defaultProcessSignals, defaultSystemctlRunner } from './systemd-scope.js';
 import { readSidecar, updateSidecar, appendBridgeId, writeSidecar } from './session-sidecar.js';
 import { resolveSettingsPermissionMode } from './settings-permission-mode.js';
@@ -199,6 +200,21 @@ export function forkArgvSegment(fromSessionId, newSessionId, model) {
 export function reseatIdentityPrompt(model) {
     return `This conversation now runs on the model ${model}. Earlier messages may show you identifying as a different model; that is stale context from before a model change — disregard it and state ${model} as your current model if asked.`;
 }
+// Task 889 — the authenticated-admin identity line for a webchat-bound admin
+// rc session. The rc-spawn path composes no fresh-spawn system prompt, so this
+// --append-system-prompt segment is the agent's only signal of who it is
+// talking to. Re-passed on every spawn (fresh and resume) because the append
+// fact is not persisted in the JSONL; without it the agent guesses the
+// Anthropic account email visible in its context. `name` is the resolved
+// `AdminUser` display name, or null/empty when the identity could not be
+// resolved — the not-resolvable line is still injected to suppress the guess.
+export function authenticatedIdentityPrompt(name) {
+    const trimmed = name?.trim() ?? '';
+    if (trimmed.length > 0) {
+        return `This admin webchat session is authenticated as ${trimmed}. If you are asked who you are talking to or who this session is authenticated as, answer ${trimmed}; never infer the operator's identity from an email address or account label visible in your context.`;
+    }
+    return `This admin webchat session's authenticated identity could not be resolved. If you are asked who you are talking to or who this session is authenticated as, say the identity is not resolvable; never infer it from an email address or account label visible in your context.`;
+}
 // Task 876 — the re-seat post-condition line. Emitted ONLY after a real
 // assistant turn on the fork is read (intention is not logged, per the
 // observability contract): a re-seat that silently lands on the wrong model
@@ -1767,6 +1783,13 @@ export function buildHttpApp(deps) {
         const adminUserId = typeof body.adminUserId === 'string' && body.adminUserId.length > 0 && body.adminUserId.length <= 128
             ? body.adminUserId
             : undefined;
+        // Task 889 — the resolved authenticated-admin display name, resolved by the
+        // UI from USER_ID -> AdminUser (the manager holds no Neo4j driver) and
+        // shape-bounded here. Absent => the identity line renders its not-resolvable
+        // form. Only consumed for webchat-bound admin spawns.
+        const authenticatedName = typeof body.authenticatedName === 'string' && body.authenticatedName.length > 0 && body.authenticatedName.length <= 256
+            ? body.authenticatedName
+            : undefined;
         // Task 682 — per-session userId override. Server-resolved by the UI from the
         // authoritative users.json/account.json (never message content) and shape-
         // validated here the same way as personId. Absent for owner self-phone and
@@ -1842,6 +1865,28 @@ export function buildHttpApp(deps) {
                 return c.json({ error: 're-seat target id already exists' }, 400);
             }
         }
+        // Task 896 — a plain resume (NOT a fork spawn) of a re-seated source id must
+        // not start a second live process beside the fork. Resolve the marker chain
+        // to the deepest live fork and redirect there. A stale marker (the fork's
+        // JSONL is gone) is cleared and the resume proceeds normally.
+        if (forkFromSessionId === null && sessionId) {
+            // The fork must have a LIVE (non-archived) transcript to be a valid
+            // redirect target. findExistingJsonlForSessionId also matches archive/, so
+            // it would redirect to an archived dead-end; the live path is the check.
+            const chain = resolveReseatChain(sessionsDir, sessionId, (id) => existsSync(jsonlPathForSessionId(deps.spawnCwd, id)));
+            if (chain.redirected) {
+                const fork = chain.target;
+                const liveRow = deps.watcher.getBySessionId(fork);
+                const bridgeSessionId = liveRow?.bridgeSessionId ?? `session_${fork}`;
+                deps.logger(`[rc-spawn] op=reseat-redirect from=${sessionId.slice(0, 8)} to=${fork.slice(0, 8)} hops=${chain.hops.length}`);
+                timed(deps.logger, 'POST', '/rc-spawn', 200, Date.now() - start);
+                return c.json({ spawnedPid: liveRow?.pid ?? null, sessionId: fork, bridgeSessionId, slug: bridgeSessionId, outcome: 'reseated', reason: null, redirected: true }, 200);
+            }
+            if (chain.stale) {
+                clearReseatMarker(sessionsDir, sessionId, deps.logger);
+                deps.logger(`[rc-spawn] op=reseat-marker-stale sessionId=${sessionId.slice(0, 8)}`);
+            }
+        }
         // Task 702 — never run two processes on one sessionId. If we already own a
         // live PTY for this id, the spawn is a no-op (a bridge that lost its
         // in-memory index after a restart re-asks; the live PTY takes the next
@@ -1883,12 +1928,16 @@ export function buildHttpApp(deps) {
         const argv = ['--remote-control'];
         if (name)
             argv.push(name);
+        // Task 889 — append-system-prompt segments are accumulated and pushed once
+        // (below, after channel resolution) so the re-seat model line and the
+        // authenticated-identity line share a single flag.
+        const appendSegments = [];
         // Task 876 — a re-seat forks the source onto the pre-minted target id; the
         // ordinary fresh/resume single-id push is replaced by the fork segment.
         if (forkFromSessionId !== null && reseatModel !== null && sessionId) {
             argv.push(...forkArgvSegment(forkFromSessionId, sessionId, reseatModel));
             // Task 879 — authoritative current-model signal for the fork only.
-            argv.push('--append-system-prompt', reseatIdentityPrompt(reseatModel));
+            appendSegments.push(reseatIdentityPrompt(reseatModel));
         }
         else if (sessionId) {
             argv.push(mode === 'resume' ? '--resume' : '--session-id', sessionId);
@@ -2010,6 +2059,19 @@ export function buildHttpApp(deps) {
                 }
             }
         }
+        // Task 889 — a webchat-bound admin rc session is the /chat admin surface.
+        // Inject the authenticated-identity line (resolved name, or the explicit
+        // not-resolvable form) so the agent states who it is talking to instead of
+        // guessing the account email. Gated on the webchat binding + admin role so
+        // public visitor spawns and the one-shot admin jobs are untouched. The
+        // breadcrumb makes a silent resolution regression visible without a chat.
+        if (effectiveWebchatChannel && rcRole === 'admin') {
+            appendSegments.push(authenticatedIdentityPrompt(authenticatedName ?? null));
+            deps.logger(`[rc-spawn] op=identity-injected userId=${adminUserId ? adminUserId.slice(0, 8) : 'none'} resolved=${authenticatedName ? 1 : 0}`);
+        }
+        if (appendSegments.length > 0) {
+            argv.push('--append-system-prompt', appendSegments.join('\n\n'));
+        }
         // Task 626 — the initial message is the trailing positional, processed as
         // the session's first user turn at PTY startup. One-shot jobs omit `name`
         // so the prompt is the sole positional.
@@ -2441,6 +2503,12 @@ export function buildHttpApp(deps) {
             catch (err) {
                 deps.logger(`[webchat:reseat] op=old-session-stop old-session=${forkFromSessionId} result=error err=${JSON.stringify(err instanceof Error ? err.message : String(err))}`);
             }
+            // Task 896 — record source -> fork so a later resume of the source id is
+            // redirected to the fork instead of spawning a second live process. The
+            // marker is written whether or not the source had a live PTY to stop (the
+            // removed-model case has no live PTY but the source is still re-seated).
+            writeReseatMarker(sessionsDir, forkFromSessionId, sessionId, Date.now(), deps.logger);
+            deps.logger(`[webchat:reseat] op=reseat-retire from=${forkFromSessionId} fork=${sessionId} outcome=marked`);
         }
         timed(deps.logger, 'POST', '/rc-spawn', 200, Date.now() - start);
         // `slug` is the Task 648 canonical field the client navigates by;