@rubytech/create-maxy-code 0.1.312 → 0.1.314

package/payload/platform/plugins/quickbooks/mcp/dist/lib/secrets.js

@@ -0,0 +1,107 @@
+// QuickBooks Online per-account secret store.
+//
+// Plain 0600 JSON, NOT the encrypted outlook TokenStore. Two processes read and
+// write this store: the MCP tool server (this package) and the UI server's
+// callback route (platform/ui/server/routes/quickbooks.ts). They never import
+// across the build-tree boundary — they agree on the on-disk shape defined here
+// and in the callback route. Plain JSON keeps that contract trivially shareable;
+// the secrets/ dir is brand-isolated and delete-protected (admin/files.ts), the
+// same protection the cloudflare token store relies on.
+import { mkdirSync, readFileSync, writeFileSync, existsSync, rmSync, } from "node:fs";
+import { resolve, join } from "node:path";
+/** A consent state nonce: URL-safe characters only, never a path fragment. */
+const STATE_RE = /^[A-Za-z0-9_-]+$/;
+function accountsDir(platformRoot) {
+    return resolve(platformRoot, "..", "data/accounts");
+}
+export function accountSecretsDir(platformRoot, accountId) {
+    return join(accountsDir(platformRoot), accountId, "secrets");
+}
+function storePath(platformRoot, accountId) {
+    return join(accountSecretsDir(platformRoot, accountId), "quickbooks.json");
+}
+function pendingDir(platformRoot, accountId) {
+    return join(accountSecretsDir(platformRoot, accountId), "quickbooks-pending");
+}
+function pendingPath(platformRoot, accountId, state) {
+    if (!STATE_RE.test(state)) {
+        throw new Error(`invalid consent state nonce: ${JSON.stringify(state)}`);
+    }
+    return join(pendingDir(platformRoot, accountId), `${state}.json`);
+}
+export function readStore(platformRoot, accountId) {
+    const file = storePath(platformRoot, accountId);
+    if (!existsSync(file))
+        return null;
+    try {
+        return JSON.parse(readFileSync(file, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+function writeStore(platformRoot, accountId, store) {
+    const dir = accountSecretsDir(platformRoot, accountId);
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(storePath(platformRoot, accountId), JSON.stringify(store, null, 2), {
+        mode: 0o600,
+    });
+}
+export function setCredentials(platformRoot, accountId, creds) {
+    const prev = readStore(platformRoot, accountId);
+    writeStore(platformRoot, accountId, {
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        environment: creds.environment,
+        connections: prev?.connections ?? {},
+    });
+}
+export function upsertConnection(platformRoot, accountId, realmId, conn) {
+    const store = readStore(platformRoot, accountId);
+    if (!store) {
+        throw new Error("cannot store a connection before credentials are set");
+    }
+    store.connections[realmId] = conn;
+    writeStore(platformRoot, accountId, store);
+}
+export function removeConnection(platformRoot, accountId, realmId) {
+    const store = readStore(platformRoot, accountId);
+    if (!store)
+        return;
+    delete store.connections[realmId];
+    writeStore(platformRoot, accountId, store);
+}
+export function writePending(platformRoot, accountId, pending) {
+    const file = pendingPath(platformRoot, accountId, pending.state);
+    mkdirSync(pendingDir(platformRoot, accountId), { recursive: true });
+    writeFileSync(file, JSON.stringify(pending, null, 2), { mode: 0o600 });
+}
+export function readPending(platformRoot, accountId, state) {
+    let file;
+    try {
+        file = pendingPath(platformRoot, accountId, state);
+    }
+    catch {
+        return null;
+    }
+    if (!existsSync(file))
+        return null;
+    try {
+        return JSON.parse(readFileSync(file, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+export function deletePending(platformRoot, accountId, state) {
+    let file;
+    try {
+        file = pendingPath(platformRoot, accountId, state);
+    }
+    catch {
+        return;
+    }
+    if (existsSync(file))
+        rmSync(file);
+}
+//# sourceMappingURL=secrets.js.map

package/payload/platform/plugins/quickbooks/mcp/dist/lib/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/lib/secrets.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,wDAAwD;AAExD,OAAO,EACL,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AA4B1C,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,kBAAkB,CAAC;AAEpC,SAAS,WAAW,CAAC,YAAoB;IACvC,OAAO,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,YAAoB,EAAE,SAAiB;IACvE,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,YAAoB,EAAE,SAAiB;IACxD,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,SAAiB;IACzD,OAAO,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,YAAoB,EAAE,SAAiB,EAAE,KAAa;IACzE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,YAAoB,EAAE,SAAiB;IAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAY,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,SAAiB,EAAE,KAAc;IACzE,MAAM,GAAG,GAAG,iBAAiB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAChF,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,YAAoB,EACpB,SAAiB,EACjB,KAAwF;IAExF,MAAM,IAAI,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAChD,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,WAAW,EAAE,IAAI,EAAE,WAAW,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,SAAiB,EACjB,OAAe,EACf,IAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAClC,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,YAAoB,EACpB,SAAiB,EACjB,OAAe;IAEf,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,YAAoB,EACpB,SAAiB,EACjB,OAAkB;IAElB,MAAM,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjE,SAAS,CAAC,UAAU,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,YAAoB,EACpB,SAAiB,EACjB,KAAa;IAEb,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAc,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAoB,EACpB,SAAiB,EACjB,KAAa;IAEb,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC"}

package/payload/platform/plugins/quickbooks/mcp/package.json

@@ -0,0 +1,19 @@
+{
+  "name": "@maxy/quickbooks",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "zod": "^3.24.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "@types/node": "^22.0.0"
+  }
+}

package/payload/platform/plugins/quickbooks/skills/quickbooks/SKILL.md

@@ -0,0 +1,37 @@
+---
+name: quickbooks
+description: Connect QuickBooks Online and work with the books. Use when the operator wants to link QuickBooks, read invoices/customers/bills/reports, or create and update accounting records. Covers the one-time Intuit app registration and per-company consent relay, then the agent-driven read/write surface.
+---
+
+# QuickBooks Online connector
+
+QuickBooks Online lives in Intuit's cloud. Maxy never owns the OAuth app — the operator brings their own Intuit app, and a human consents per company. After that, reads and writes are yours.
+
+Success is: the operator's credentials are stored, at least one company shows up under `quickbooks-connections`, and a `quickbooks-query` returns that company's data.
+
+## The two human steps (relay these — never click for them)
+
+**1. Register an Intuit app.** The operator (not the agent) does this once at https://developer.intuit.com. They create an app, enable the Accounting scope, and copy its **client ID** and **client secret**. In the app's Keys & OAuth settings they add a **Redirect URI** that must be exactly the brand's public site URL followed by `/api/quickbooks/callback` (for example `https://app.<brand-domain>/api/quickbooks/callback`). Intuit rejects `localhost` for production, which is why the callback rides the public host. For a first run, the sandbox keys (free, up to five sandbox companies) are the right starting point.
+
+**2. Consent per company.** You generate the consent link with `quickbooks-authorize-url`; a human opens it, signs into Intuit, and authorizes one company. Intuit redirects their browser back to the callback, which stores the refresh token. Repeat per company for the accountant case (one Intuit app can hold many company grants).
+
+## Procedure
+
+1. Once the operator has the client ID and secret, store them: `quickbooks-credentials-set` with `environment` set to `sandbox` or `production`.
+2. Generate the consent link: `quickbooks-authorize-url` with `redirectUri` set to the **exact** registered redirect URI. Hand the returned URL to a human. The link is valid 15 minutes.
+3. After they authorize, confirm with `quickbooks-connections` — the company's `realmId` should appear.
+4. Read and write against that `realmId`.
+
+## Working with the books
+
+- **Read anything** with `quickbooks-query`, e.g. `SELECT * FROM Invoice WHERE TxnDate > '2026-01-01'`, `SELECT * FROM Customer`, `SELECT * FROM Bill MAXRESULTS 50`.
+- **Reports** with `quickbooks-report`, e.g. `ProfitAndLoss` with `{ start_date, end_date }`, or `BalanceSheet`.
+- **Write** with the entity tools (`quickbooks-invoice-create`, `quickbooks-customer-create`, `quickbooks-bill-create`, `quickbooks-payment-create`) or the generic `quickbooks-entity-create` for anything else. Updates require the record's current `Id` and `SyncToken` in the body (read it back first with a query).
+
+## Keeping connections healthy
+
+A refresh token dies silently after about 100 days of inactivity or if the operator revokes it. Run `quickbooks-token-audit` periodically; `alive=false` means that company needs the consent relay run again before it is used. Reads are metered (a free monthly allowance) and writes are free — prefer a targeted query over pulling everything.
+
+## What stays the operator's job
+
+Moving an Intuit app from sandbox to production requires Intuit's production security assessment. That is the operator's responsibility and is not automated here.

package/payload/platform/scripts/check-no-esm-require.mjs

@@ -63,6 +63,10 @@ const ALLOWLIST = new Set([
   // tree and sets MAXY_PLATFORM_ROOT before the route module (and its
   // data-path/attachments deps) read the env at import.
   'platform/ui/server/routes/admin/__tests__/files-write.test.ts',
+  // Same vi.hoisted pattern: the public-reader test builds a tmp DATA_ROOT
+  // before the `data-path` mock fires, so the serve endpoint reads real
+  // sidecar fixtures written under it.
+  'platform/ui/server/routes/__tests__/public-reader.test.ts',
 ])
 
 const REQUIRE_CALL_RE = /\brequire\s*\(/

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAiB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAkLtD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.d.ts","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAQA,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAkB7C,CAAA;AAED,gEAAgE;AAChE,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAiMtD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js

@@ -16,6 +16,7 @@ export const MAXY_MCP_PLUGINS = [
     "graph-viewer",
     "memory",
     "outlook",
+    "quickbooks",
     "replicate",
     "scheduling",
     "telegram",
@@ -155,6 +156,21 @@ export const CANONICAL_MAXY_TOOL_NAMES = [
     "mcp__plugin_outlook_outlook__outlook-mail-list",
     "mcp__plugin_outlook_outlook__outlook-mail-search",
     "mcp__plugin_outlook_outlook__outlook-mailbox-info",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-authorize-url",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-bill-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-connections",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-credentials-set",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-customer-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-customer-update",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-disconnect",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-entity-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-entity-update",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-invoice-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-invoice-update",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-payment-create",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-query",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-report",
+    "mcp__plugin_quickbooks_quickbooks__quickbooks-token-audit",
     "mcp__plugin_replicate_replicate__image-generate",
     "mcp__plugin_replicate_replicate__replicate-key-store",
     "mcp__plugin_replicate_replicate__replicate-key-verify",

package/payload/platform/services/claude-session-manager/dist/canonical-tool-names.generated.js.map

@@ -1 +1 @@
-{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,WAAW;IACX,YAAY;IACZ,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,qDAAqD;IACrD,oDAAoD;IACpD,oDAAoD;IACpD,gDAAgD;IAChD,kDAAkD;IAClD,mDAAmD;IACnD,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}
+{"version":3,"file":"canonical-tool-names.generated.js","sourceRoot":"","sources":["../src/canonical-tool-names.generated.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,kEAAkE;AAClE,yDAAyD;AACzD,kFAAkF;AAClF,EAAE;AACF,yEAAyE;AACzE,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,OAAO;IACP,KAAK;IACL,SAAS;IACT,UAAU;IACV,OAAO;IACP,OAAO;IACP,cAAc;IACd,QAAQ;IACR,SAAS;IACT,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,UAAU;IACV,SAAS;IACT,UAAU;IACV,MAAM;IACN,WAAW;CACZ,CAAA;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IAC1D,yCAAyC;IACzC,yCAAyC;IACzC,yCAAyC;IACzC,sCAAsC;IACtC,yCAAyC;IACzC,wCAAwC;IACxC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,4CAA4C;IAC5C,qCAAqC;IACrC,yCAAyC;IACzC,4CAA4C;IAC5C,oCAAoC;IACpC,sCAAsC;IACtC,0CAA0C;IAC1C,uCAAuC;IACvC,sCAAsC;IACtC,sDAAsD;IACtD,mDAAmD;IACnD,6CAA6C;IAC7C,wCAAwC;IACxC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,sCAAsC;IACtC,wCAAwC;IACxC,+BAA+B;IAC/B,qCAAqC;IACrC,sCAAsC;IACtC,yCAAyC;IACzC,4CAA4C;IAC5C,uDAAuD;IACvD,+CAA+C;IAC/C,2CAA2C;IAC3C,gDAAgD;IAChD,oDAAoD;IACpD,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,gDAAgD;IAChD,6CAA6C;IAC7C,6CAA6C;IAC7C,iDAAiD;IACjD,oDAAoD;IACpD,+CAA+C;IAC/C,2CAA2C;IAC3C,2CAA2C;IAC3C,+CAA+C;IAC/C,+CAA+C;IAC/C,+CAA+C;IAC/C,8CAA8C;IAC9C,+CAA+C;IAC/C,6CAA6C;IAC7C,+CAA+C;IAC/C,+CAA+C;IAC/C,6CAA6C;IAC7C,6CAA6C;IAC7C,sCAAsC;IACtC,2CAA2C;IAC3C,2CAA2C;IAC3C,sCAAsC;IACtC,4CAA4C;IAC5C,uCAAuC;IACvC,4CAA4C;IAC5C,8CAA8C;IAC9C,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qCAAqC;IACrC,sCAAsC;IACtC,uCAAuC;IACvC,qDAAqD;IACrD,sDAAsD;IACtD,uDAAuD;IACvD,wDAAwD;IACxD,iEAAiE;IACjE,kEAAkE;IAClE,6DAA6D;IAC7D,8CAA8C;IAC9C,wDAAwD;IACxD,gDAAgD;IAChD,qDAAqD;IACrD,sDAAsD;IACtD,wDAAwD;IACxD,wCAAwC;IACxC,wCAAwC;IACxC,iDAAiD;IACjD,wDAAwD;IACxD,0DAA0D;IAC1D,0CAA0C;IAC1C,6CAA6C;IAC7C,wCAAwC;IACxC,mDAAmD;IACnD,+CAA+C;IAC/C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,8CAA8C;IAC9C,oDAAoD;IACpD,kDAAkD;IAClD,+CAA+C;IAC/C,mDAAmD;IACnD,2CAA2C;IAC3C,qDAAqD;IACrD,+CAA+C;IAC/C,sDAAsD;IACtD,gDAAgD;IAChD,2CAA2C;IAC3C,gDAAgD;IAChD,0CAA0C;IAC1C,mDAAmD;IACnD,0CAA0C;IAC1C,kDAAkD;IAClD,yCAAyC;IACzC,kDAAkD;IAClD,2CAA2C;IAC3C,yCAAyC;IACzC,2CAA2C;IAC3C,4CAA4C;IAC5C,mDAAmD;IACnD,uDAAuD;IACvD,qDAAqD;IACrD,oDAAoD;IACpD,oDAAoD;IACpD,gDAAgD;IAChD,kDAAkD;IAClD,mDAAmD;IACnD,6DAA6D;IAC7D,2DAA2D;IAC3D,2DAA2D;IAC3D,+DAA+D;IAC/D,+DAA+D;IAC/D,+DAA+D;IAC/D,0DAA0D;IAC1D,6DAA6D;IAC7D,6DAA6D;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,8DAA8D;IAC9D,qDAAqD;IACrD,sDAAsD;IACtD,2DAA2D;IAC3D,iDAAiD;IACjD,sDAAsD;IACtD,uDAAuD;IACvD,yDAAyD;IACzD,oDAAoD;IACpD,mDAAmD;IACnD,wDAAwD;IACxD,iDAAiD;IACjD,wDAAwD;IACxD,kDAAkD;IAClD,oDAAoD;IACpD,iDAAiD;IACjD,wCAAwC;IACxC,gDAAgD;IAChD,0DAA0D;IAC1D,sCAAsC;IACtC,kDAAkD;IAClD,gDAAgD;IAChD,kEAAkE;IAClE,uDAAuD;IACvD,oDAAoD;IACpD,oDAAoD;IACpD,qDAAqD;IACrD,oDAAoD;IACpD,kDAAkD;IAClD,gDAAgD;IAChD,yCAAyC;IACzC,uCAAuC;IACvC,oCAAoC;IACpC,qCAAqC;IACrC,uCAAuC;IACvC,qCAAqC;IACrC,qCAAqC;IACrC,sCAAsC;IACtC,oCAAoC;IACpC,iCAAiC;IACjC,kCAAkC;IAClC,mCAAmC;IACnC,oCAAoC;IACpC,oCAAoC;IACpC,kDAAkD;IAClD,kDAAkD;IAClD,mDAAmD;IACnD,+CAA+C;IAC/C,gDAAgD;IAChD,gDAAgD;IAChD,kDAAkD;IAClD,oDAAoD;CACrD,CAAA"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAY3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAsBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAwGD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAQD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAgqEpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAY3B,OAAO,EAgBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAsBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAgFhE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAwGD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAiBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AAmBD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA6sEpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -191,6 +191,14 @@ const AUTO_ARCHIVE_SPECIALIST = 'database-operator';
 export function forkArgvSegment(fromSessionId, newSessionId, model) {
     return ['--resume', fromSessionId, '--fork-session', '--session-id', newSessionId, '--model', model];
 }
+// Task 928 — the re-seat fork carries an optional permission mode (pushed as the
+// `--permission-mode` argv flag) and an optional effort (merged into the
+// per-spawn inline `--settings` as `effortLevel`). Both are validated here as a
+// shape defence-in-depth: the UI route is the authoritative allowlist gate, but
+// a malformed value must never reach the child argv. Mirrors the canonical sets
+// in webchat.ts / rc-daemon. `dontAsk` and `max` are excluded (not fork-writable).
+const FORK_PERMISSION_MODES = new Set(['default', 'acceptEdits', 'plan', 'auto', 'bypassPermissions']);
+const FORK_EFFORT_LEVELS = new Set(['low', 'medium', 'high', 'xhigh']);
 // Task 879 — the re-seated fork inherits the source's history, including the
 // source's earlier self-identification on the OLD model. The rc-spawn path does
 // not compose --append-system-prompt (only fresh spawnSession does), so the
@@ -762,6 +770,11 @@ export function buildHttpApp(deps) {
         const personId = typeof body.personId === 'string' && body.personId.length > 0 && body.personId.length <= 128
             ? body.personId
             : undefined;
+        // Task 884 — open-mode visitor anchor (the maxy_visitor cookie). Validated
+        // as a UUID, the same shape /api/session mints; absent on gated spawns.
+        const visitorId = typeof body.visitorId === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(body.visitorId)
+            ? body.visitorId
+            : undefined;
         // Task 756 — the per-conversation webchat native channel for a public
         // spawn. Shape-validated here (all three fields are non-empty strings, the
         // gateway is loopback http) before it reaches the spawn, which composes it
@@ -849,6 +862,7 @@ export function buildHttpApp(deps) {
             conversationNodeId,
             sliceToken,
             personId,
+            visitorId,
             webchatChannel,
         });
         if (!result.ok) {
@@ -1768,6 +1782,11 @@ export function buildHttpApp(deps) {
         // path to import the models lib, so it guards on shape, not the exact list).
         const forkFromSessionId = typeof body.forkFromSessionId === 'string' && UUID_PATTERN.test(body.forkFromSessionId) ? body.forkFromSessionId : null;
         const reseatModel = typeof body.model === 'string' && /^claude-[a-z0-9.-]+(\[1m\])?$/i.test(body.model) ? body.model : null;
+        // Task 928 — fork-carried levers. `null` when the field is present but not in
+        // the allowlist (rejected below, on the fork path only); `undefined` when
+        // absent (the fork keeps the settings-resolved mode / the harness default effort).
+        const reseatPermissionMode = typeof body.permissionMode === 'string' ? (FORK_PERMISSION_MODES.has(body.permissionMode) ? body.permissionMode : null) : undefined;
+        const reseatEffort = typeof body.effort === 'string' ? (FORK_EFFORT_LEVELS.has(body.effort) ? body.effort : null) : undefined;
         // Task 626 — per-visitor slice ringfence for the public session-end review
         // rc session. Shape-gated identically to /public-spawn so a body-controlled
         // value cannot reach the child env. Absent on channel-admin / LinkedIn.
@@ -1864,6 +1883,17 @@ export function buildHttpApp(deps) {
                 timed(deps.logger, 'POST', '/rc-spawn', 400, Date.now() - start);
                 return c.json({ error: 're-seat target id already exists' }, 400);
             }
+            // Task 928 — a present-but-disallowed mode/effort is a hard reject (no
+            // spawn), not a silent drop, so a UI bug cannot land a fork on an
+            // unintended lever.
+            if (reseatPermissionMode === null) {
+                timed(deps.logger, 'POST', '/rc-spawn', 400, Date.now() - start);
+                return c.json({ error: 're-seat permissionMode is not allowed' }, 400);
+            }
+            if (reseatEffort === null) {
+                timed(deps.logger, 'POST', '/rc-spawn', 400, Date.now() - start);
+                return c.json({ error: 're-seat effort is not allowed' }, 400);
+            }
         }
         // Task 896 — a plain resume (NOT a fork spawn) of a re-seated source id must
         // not start a second live process beside the fork. Resolve the marker chain
@@ -1936,6 +1966,11 @@ export function buildHttpApp(deps) {
         // ordinary fresh/resume single-id push is replaced by the fork segment.
         if (forkFromSessionId !== null && reseatModel !== null && sessionId) {
             argv.push(...forkArgvSegment(forkFromSessionId, sessionId, reseatModel));
+            // Task 928 — the picked permission mode rides the fork as the canonical CLI
+            // flag (the same flag the daemon spawn uses). Absent => the fork keeps the
+            // settings-resolved mode, unchanged from a model-only re-seat.
+            if (reseatPermissionMode)
+                argv.push('--permission-mode', reseatPermissionMode);
             // Task 879 — authoritative current-model signal for the fork only.
             appendSegments.push(reseatIdentityPrompt(reseatModel));
         }
@@ -1949,7 +1984,14 @@ export function buildHttpApp(deps) {
         // waived so the disclaimer is suppressed whatever mode the session resolves
         // to. Per Task 574 doctrine the waiver is per-spawn (never written into
         // settings.json / .claude.json, which would permanently waive it).
-        argv.push('--settings', JSON.stringify({ skipDangerousModePermissionPrompt: true, skipAutoPermissionPrompt: true }));
+        // Task 928 — the picked effort rides the fork in the SAME per-spawn inline
+        // settings (never the shared settings.json — that would change every later
+        // spawn's effort fleet-wide). effortLevel only when this is a fork with a
+        // valid effort; a model-only or mode-only re-seat leaves it unset.
+        const inlineSettings = { skipDangerousModePermissionPrompt: true, skipAutoPermissionPrompt: true };
+        if (forkFromSessionId !== null && reseatEffort)
+            inlineSettings.effortLevel = reseatEffort;
+        argv.push('--settings', JSON.stringify(inlineSettings));
         // Task 677 P2 — admin WhatsApp native channel. When the caller supplies
         // waChannel, register the per-sender channel server in its own --mcp-config
         // (additive; rc-spawn carries no --strict-mcp-config) and activate it as a
@@ -2117,12 +2159,15 @@ export function buildHttpApp(deps) {
         // settings.json permissions.defaultMode (else 'default'); mirror that
         // resolution for the classification sidecar and the lifeline.
         const settingsPermissionMode = resolveSettingsPermissionMode(deps.claudeConfigDir);
+        // Task 928 — when the fork carries a picked mode, the argv flag governs (not
+        // settings.json), so the lifeline and the sidecar must report the picked mode.
+        const effectiveRcPermissionMode = forkFromSessionId !== null && reseatPermissionMode ? reseatPermissionMode : settingsPermissionMode;
         // Step 2 — the exact claude argv (the inner command). The systemd-run
         // wrap is composed by the spawnPty adapter; logging the inner argv
         // here is enough for an operator to reproduce by hand. The wrapped
         // argv is fully reconstructible from this line + the spawn adapter
         // source (Task 250 / 556).
-        deps.logger(`[rc-spawn] op=argv unitToken=${unitToken} cwd=${deps.spawnCwd} permissionMode=${settingsPermissionMode} argv=${JSON.stringify([deps.claudeBin, ...argv])}`);
+        deps.logger(`[rc-spawn] op=argv unitToken=${unitToken} cwd=${deps.spawnCwd} permissionMode=${effectiveRcPermissionMode} argv=${JSON.stringify([deps.claudeBin, ...argv])}`);
         emitRcLife(deps.logger, 'argv', 'rc-spawn', 'node-pty', rcLifeMode, unitToken, {
             cwd: deps.spawnCwd,
             argv: JSON.stringify([deps.claudeBin, ...argv]),
@@ -2222,7 +2267,7 @@ export function buildHttpApp(deps) {
                         // choice); the /chat chip renders this. effectivePermissionMode
                         // stays null: the Task 278 tail is auto-only and rc-spawn
                         // passes no --debug=auto-mode.
-                        permissionMode: settingsPermissionMode,
+                        permissionMode: effectiveRcPermissionMode,
                         effectivePermissionMode: null,
                         model: null,
                         hidden: false,
@@ -2235,6 +2280,11 @@ export function buildHttpApp(deps) {
                         // Task 865 — admin-webchat author identity from the rc-spawn body;
                         // null for public and one-shot sessions, which carry none.
                         adminUserId: adminUserId ?? null,
+                        // Task 884 — open-mode anchor + per-agent scope are stamped only on
+                        // the /public-spawn path; the rc-spawn write carries neither, so
+                        // both are null here.
+                        visitorId: null,
+                        agentSlug: null,
                     }, deps.logger);
                     deps.watcher.refreshSidecar?.(sessionId);
                 }