@rubytech/create-maxy-code 0.1.32 → 0.1.34

package/payload/platform/scripts/log-adherence-check.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# log-adherence-check.sh — Task 1006 existence contract diagnostic.
+# log-adherence-check.sh existence contract diagnostic.
 #
 # Reads every sessionKey under the active install's per-account logs and
 # asserts that a resolvable claude-agent-stream-<sessionKey>.log exists for
@@ -91,7 +91,7 @@ for k in "${UNIQUE[@]:-}"; do
   fi
 done
 
-# Task 1013 — duplicate-basename check. Two stream-log files for one
+# duplicate-basename check. Two stream-log files for one
 # sessionKey across account dirs is the structural-failure signature this
 # task exists to make impossible. The build gate prevents the writer-side
 # regression that produces it (sessions.ts:568 wrong-identifier path); this
@@ -112,7 +112,7 @@ DUP_BASENAMES=0
 for k in "${!BASENAME_COUNT[@]}"; do
   if [[ ${BASENAME_COUNT[$k]} -gt 1 ]]; then
     DUP_BASENAMES=$((DUP_BASENAMES + 1))
-    echo "${TS} [log-tee] dup-basename sessionKey=${k:0:8} count=${BASENAME_COUNT[$k]} surface=adherence-script — Task 1013 P0: writer collapse regressed" >> "$SERVER_LOG" 2>/dev/null || true
+    echo "${TS} [log-tee] dup-basename sessionKey=${k:0:8} count=${BASENAME_COUNT[$k]} surface=adherence-script P0: writer collapse regressed" >> "$SERVER_LOG" 2>/dev/null || true
   fi
 done
 

package/payload/platform/scripts/logs-read.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # logs-read.sh — Shell counterpart to the logs-read MCP tool.
 #
-# Task 1006: stream logs are per-session, not per-day or per-conversation.
+# stream logs are per-session, not per-day or per-conversation.
 # The primary mode reads a single {prefix}-{sessionKey}.log file — the
 # operator types a sessionKey prefix and the surface returns the bytes from
 # first [spawn] to final [process-exit] without filtering. sessionKey is
@@ -17,7 +17,7 @@
 #        heartbeat, public, server, mcp, vnc, chat-attempts
 # For per-session types (agent-stream/system/session/error/public): sessionKey
 # is required in the first mode. For platform-scoped types (server/vnc/
-# heartbeat): the id is ignored. chat-attempts is --tail-only (Task 1018):
+# heartbeat): the id is ignored. chat-attempts is --tail-only:
 # cross-grep of edge.log + server.log for the chat-ingress quartet within
 # the most recent N minutes.
 #
@@ -95,7 +95,7 @@ account_suffix() {
 
 # --- Prefix map (mirrors MCP tool exactly) ---
 # Per-conversation types: stream log + its siblings (stderr, sse, public).
-# Task 850 — `agent-stream` is the canonical name for the per-conversation
+# `agent-stream` is the canonical name for the per-conversation
 # tool-use/tool-result archive; `system` is kept as a backwards-compatible
 # alias.
 prefix_for_type() {
@@ -120,16 +120,16 @@ is_per_conversation_type() {
 SEARCH_TYPES="agent-stream error session public server mcp vnc"
 VALID_TYPES="agent-stream, system, session, error, heartbeat, public, server, mcp, vnc, chat-attempts"
 
-# Task 1018 — chat-attempts cross-grep prefixes. One row per chat-ingress
+# chat-attempts cross-grep prefixes. One row per chat-ingress
 # checkpoint emitted across edge.log + server.log: edge-side inbound/outcome,
 # admin-auth gate verdict, chat-route handler entry. Absence of a row at any
 # checkpoint localises the failure to one stage of the ingress pipeline.
 CHAT_ATTEMPT_GREP='\[edge-admin\] inbound|\[edge-admin\] outcome|\[admin-auth\] outcome|\[chat-route\] entered'
 
 # Authoritative sessionKey character set.
-# Writer-side (Task 1008) emits `sk_<hex16>` filenames; the underscore must
+# Writer-side emits `sk_<hex16>` filenames; the underscore must
 # stay in this regex or every post-1008 file becomes unretrievable
-# (Task 1010). UUID v4 sessionKeys (legacy and current alternate format)
+#. UUID v4 sessionKeys (legacy and current alternate format)
 # also pass. Widening past this set is unsafe: session_key is concatenated
 # into a glob below (`${prefix}${session_key}*.log`), so any character bash
 # treats as a metacharacter (`*`, `?`, `[`, `;`, `$`, etc.) would escape
@@ -166,7 +166,7 @@ validate_type() {
   esac
 }
 
-# Task 1018 — chat-attempts cross-grep mode. Combines edge.log + server.log
+# chat-attempts cross-grep mode. Combines edge.log + server.log
 # lines matching the chat-ingress quartet, filtered to the last N minutes,
 # sorted chronologically. Default window: 5 minutes (matches the typical
 # "agent doesn't respond" report window — operator sees the silence,
@@ -250,7 +250,7 @@ chat_attempts_mode() {
 
 # --- Per-session mode: prefix-match {prefix}{sessionKey-prefix}*.log ---
 #
-# Task 1006 — one filename shape per session: {prefix}{sessionKey}.log.
+# one filename shape per session: {prefix}{sessionKey}.log.
 # The operator types an 8-char-or-greater sessionKey prefix; we glob
 # `${prefix}${session_key}*.log` across every account log dir. The earlier
 # full vs preflush two-shape contract is gone: sessionKey is the single
@@ -278,9 +278,9 @@ per_conversation_mode() {
 
   # Reject shell metacharacters in session_key — the prefix-match glob below
   # would otherwise turn user input into a shell pattern. SessionKeys are
-  # `sk_<hex16>` (Task 1008) or UUID v4; both fit $SESSIONKEY_REGEX defined
-  # near the top of the script. Task 1010 widened this from `[a-zA-Z0-9-]`
-  # after the Task 1008 underscore-bearing format made every post-1008
+  # `sk_<hex16>` or UUID v4; both fit $SESSIONKEY_REGEX defined
+  # near the top of the script. widened this from `[a-zA-Z0-9-]`
+  # after the underscore-bearing format made every post-1008
   # session unretrievable.
   if [[ ! "$session_key" =~ $SESSIONKEY_REGEX ]]; then
     # Observability: surface the rejection before the operator-visible error
@@ -349,7 +349,7 @@ per_conversation_mode() {
     exit 0
   fi
 
-  # Task 1006 — missing-on-resolve emission. Best-effort; never fails the
+  # missing-on-resolve emission. Best-effort; never fails the
   # invocation when server.log is unwritable.
   local miss_ts
   miss_ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
@@ -463,7 +463,7 @@ tail_mode() {
   local log_type="${1:-agent-stream}"
   local lines="${2:-50}"
 
-  # Task 1018 — chat-attempts is cross-grep + time-windowed, not single-file
+  # chat-attempts is cross-grep + time-windowed, not single-file
   # tail. Dispatch before validate_type's numeric `lines` check (which would
   # be wrong here — argument 2 is `minutes`, not `lines`).
   if [[ "$log_type" == "chat-attempts" ]]; then

package/payload/platform/scripts/logs-read.test.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Task 1006 — bash harness for logs-read.sh single-shape resolution.
+# bash harness for logs-read.sh single-shape resolution.
 #
 # Covers the three cases the new contract demands:
 #   1. sessionKey-named file present → bytes returned, exit 0.

package/payload/platform/scripts/migrate-import.sh

@@ -116,11 +116,11 @@ echo "[import] Account dir:    $ACCOUNT_DIR"
 # ------------------------------------------------------------------
 # Neo4j connection
 # ------------------------------------------------------------------
-# NEO4J_URI is hard-required (Task 788). The previous default
+# NEO4J_URI is hard-required. The previous default
 # `bolt://localhost:7687` would silently route the import to the wrong Neo4j on
 # any brand-dedicated install, masking the actual configuration error.
 if [ -z "${NEO4J_URI:-}" ]; then
-  echo "[import] ERROR: NEO4J_URI required (no default — see Task 788)" >&2
+  echo "[import] ERROR: NEO4J_URI required (no default)" >&2
   echo "[import] ERROR: Set NEO4J_URI=bolt://localhost:<brand.neo4jPort> before running." >&2
   exit 1
 fi
@@ -372,11 +372,11 @@ if [ -f "$PINS_FILE" ]; then
       python3 -c "import hashlib; print(hashlib.sha256('$MASTER_PIN'.encode()).hexdigest())" > "$PIN_DIR/.admin-pin"
       echo "[import] masterPin hash written to $PIN_DIR/.admin-pin"
 
-      # Auth gate is users.json-authoritative (Task 791). seed-neo4j.sh creates
+      # Auth gate is users.json-authoritative. seed-neo4j.sh creates
       # users.json from .admin-pin, but only at install time — and install runs
       # before this script writes .admin-pin. Self-contained migration writes
       # users.json directly, mirroring seed-neo4j.sh's migration branch.
-      # Task 904 — write to the persistent location (outside the install wipe
+      # write to the persistent location (outside the install wipe
       # zone) so subsequent installs do not overwrite this row with a stale backup.
       USERS_FILE="$PIN_DIR/users.json"
       if [ ! -f "$USERS_FILE" ]; then

package/payload/platform/scripts/redact-install-logs.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Existing-pi install-log redaction (Task 744).
+# Existing-pi install-log redaction.
 #
 # Idempotent one-shot remediation for Pis that completed installation BEFORE
 # the install-log redaction landed at packages/create-maxy-code/src/index.ts:152.

package/payload/platform/scripts/seed-neo4j.sh

@@ -16,11 +16,11 @@ INSTALL_DIR="$(dirname "$PROJECT_DIR")"
 ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"
 NEO4J_DIR="$PROJECT_DIR/neo4j"
 
-# NEO4J_URI is hard-required (Task 787). The previous default
+# NEO4J_URI is hard-required. The previous default
 # `bolt://localhost:7687` would silently route the seed to the wrong Neo4j on
 # any brand-dedicated install — masking every other defect downstream.
 if [ -z "${NEO4J_URI:-}" ]; then
-  echo "Error: NEO4J_URI required (no default — see Task 787)" >&2
+  echo "Error: NEO4J_URI required (no default)" >&2
   exit 1
 fi
 NEO4J_USER="${NEO4J_USER:-neo4j}"
@@ -45,7 +45,7 @@ CYPHER_SHELL="cypher-shell"
 # ------------------------------------------------------------------
 
 # Resolve existing account by identity (users.json[0].userId) or mint a new one on fresh install.
-# Orphan siblings under data/accounts/ — non-matching dirs left behind by Task 380's userId
+# Orphan siblings under data/accounts/ — non-matching dirs left behind by the userId
 # regeneration — are swept to data/accounts/.trash/<uuid>-<ISO8601-ts>/. Multi-candidate with
 # no identity match aborts loud; .trash/ is operator-emptied, never auto-cleaned.
 # shellcheck source=lib/resolve-account-dir.sh
@@ -60,7 +60,7 @@ if [ -f "$PROJECT_DIR/config/brand.json" ]; then
 fi
 USERS_FILE="$HOME/$_RESOLVER_CONFIG_DIR_NAME/users.json" resolve_and_sweep_account_dir
 
-mkdir -p "$ACCOUNT_DIR/agents/admin" "$ACCOUNT_DIR/.claude" "$ACCOUNT_DIR/specialists/.claude-plugin" "$ACCOUNT_DIR/specialists/agents"
+mkdir -p "$ACCOUNT_DIR/agents/admin" "$ACCOUNT_DIR/agents/public" "$ACCOUNT_DIR/.claude" "$ACCOUNT_DIR/specialists/.claude-plugin" "$ACCOUNT_DIR/specialists/agents"
 
 # Claude Code discovers project-level .claude/ (agents, settings) relative to the
 # nearest .git root. Without a .git in the account directory, Claude Code traverses
@@ -104,14 +104,14 @@ fi
 #   PreToolUse — pre-tool-use.sh: admin write boundaries
 #                playwright-file-guard.sh: intercepts browser_navigate with file:// URLs
 #                webfetch-preflight.mjs: detects JS-SPA shells before WebFetch's
-#                  60s extraction timeout (Task 536). Fail-open on any error;
+#                  60s extraction timeout. Fail-open on any error;
 #                  on positive SPA detection exits 2 with WEBFETCH_CANNOT_READ_JS_SPA.
-#                archive-ingest-surface-gate.sh (Task 855 → Task 894):
+#                archive-ingest-surface-gate.sh:
 #                  narrows the database-operator subagent's effective surface
 #                  during conversation-archive ingestion to exactly one Bash
 #                  entry (memory/bin/conversation-archive-ingest.sh --source
-#                  <enum>) plus read-only neighbours. The Task-894 generalised
-#                  ingest path replaces the WhatsApp-specific Task-855 path.
+#                  <enum>) plus read-only neighbours. The generalised
+#                  ingest path replaces the WhatsApp-specific legacy path.
 #                  Defensive blocks remain on the deleted legacy MCP tool names
 #                  (mcp__memory__whatsapp-export-{parse,preview,insight-write,
 #                  insight-pass}, mcp__memory__memory-archive-write when
@@ -199,11 +199,8 @@ SETTINGS_EOF
 
 # Always overwrite IDENTITY.md — Rubytech-controlled, pure behaviour.
 cp "$TEMPLATES_DIR/agents/admin/IDENTITY.md" "$ACCOUNT_DIR/agents/admin/IDENTITY.md"
-if [ -d "$ACCOUNT_DIR/agents/public" ]; then
-  cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$ACCOUNT_DIR/agents/public/IDENTITY.md"
-else
-  echo "  Skipping agents/public — directory does not exist (user has not created a public agent)"
-fi
+cp "$TEMPLATES_DIR/agents/public/IDENTITY.md" "$ACCOUNT_DIR/agents/public/IDENTITY.md"
+echo "  agents/public/IDENTITY.md installed"
 
 # Always overwrite specialist plugin — Rubytech-controlled, not user-editable.
 # Specialists are a Claude Code plugin loaded via --plugin-dir. The plugin lives at
@@ -235,13 +232,10 @@ rm -f "$ACCOUNT_DIR/.claude/agents/"*.md 2>/dev/null || true
 # SOUL.md — user-controlled personalisation. Only create if missing. Never overwrite.
 [ -f "$ACCOUNT_DIR/agents/admin/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/admin/SOUL.md" "$ACCOUNT_DIR/agents/admin/SOUL.md"
 
-# Public agent files — only provision if the user has created a public agent (directory exists).
-# config.json is what makes the agent visible in the sidebar; creating it here would
-# resurrect an agent the user deliberately deleted.
-if [ -d "$ACCOUNT_DIR/agents/public" ]; then
-  [ -f "$ACCOUNT_DIR/agents/public/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/public/SOUL.md" "$ACCOUNT_DIR/agents/public/SOUL.md"
-  [ -f "$ACCOUNT_DIR/agents/public/config.json" ] || cp "$TEMPLATES_DIR/agents/public/config.json" "$ACCOUNT_DIR/agents/public/config.json"
-fi
+# Public agent SOUL.md + config.json — create if missing, never overwrite.
+# IDENTITY.md is handled in the Rubytech-controlled block above.
+[ -f "$ACCOUNT_DIR/agents/public/SOUL.md" ] || cp "$TEMPLATES_DIR/agents/public/SOUL.md" "$ACCOUNT_DIR/agents/public/SOUL.md"
+[ -f "$ACCOUNT_DIR/agents/public/config.json" ] || cp "$TEMPLATES_DIR/agents/public/config.json" "$ACCOUNT_DIR/agents/public/config.json"
 
 # AGENTS.md — specialist registry. Pre-populated from templates, maintained by admin agent at runtime.
 # Always overwrite on re-seed (Rubytech-controlled initial state, like IDENTITY.md).
@@ -272,7 +266,7 @@ if [ ! -f "$ACCOUNT_DIR/account.json" ]; then
   fi
 fi
 
-# Backfill defaultAgent in account.json if missing (existing accounts pre-Task 108).
+# Backfill defaultAgent in account.json if missing (existing accounts earlier).
 # Uses the first non-admin agent directory that has a config.json.
 if [ -f "$ACCOUNT_DIR/account.json" ] && ! grep -q '"defaultAgent"' "$ACCOUNT_DIR/account.json"; then
   _DEFAULT_SLUG=""
@@ -393,13 +387,13 @@ if [ -f "$CONFIG_DIR/brand.json" ]; then
   [ -n "$_BRAND_CFG_DIR" ] && _CONFIG_DIR_NAME="$_BRAND_CFG_DIR"
 fi
 ADMIN_PIN_FILE="$HOME/$_CONFIG_DIR_NAME/.admin-pin"
-# Task 904 — users.json lives under $HOME/$_CONFIG_DIR_NAME, not the wipe zone.
+# users.json lives under $HOME/$_CONFIG_DIR_NAME, not the wipe zone.
 USERS_FILE="$HOME/$_CONFIG_DIR_NAME/users.json"
 mkdir -p "$HOME/$_CONFIG_DIR_NAME"
 
 # Only create users.json if it doesn't exist AND .admin-pin exists (migration case).
 # Fresh installs: users.json is created by set-pin POST during onboarding.
-# .admin-pin is legacy — no longer read by the platform (Task 431).
+#.admin-pin is legacy — no longer read by the platform.
 if [ ! -f "$USERS_FILE" ] && [ -f "$ADMIN_PIN_FILE" ]; then
   USER_ID="$(cat /proc/sys/kernel/random/uuid 2>/dev/null || python3 -c 'import uuid; print(uuid.uuid4())')"
   PIN_HASH="$(cat "$ADMIN_PIN_FILE")"
@@ -432,7 +426,7 @@ elif [ -f "$USERS_FILE" ]; then
   USER_ID=$(python3 -c "import json; print(json.load(open('$USERS_FILE'))[0]['userId'])" 2>/dev/null || true)
   [ -n "$USER_ID" ] && echo "  Existing users.json found, userId=$USER_ID"
 
-  # Backfill admins in account.json if missing (existing accounts pre-Task 248).
+  # Backfill admins in account.json if missing (existing accounts earlier).
   if [ -f "$ACCOUNT_DIR/account.json" ] && ! grep -q '"admins"' "$ACCOUNT_DIR/account.json"; then
     python3 -c "
 import json
@@ -462,9 +456,9 @@ echo "==> Connecting to Neo4j at $NEO4J_URI as $NEO4J_USER"
 
 # Schema migrations run before the main schema apply so renames don't collide
 # with the new declarations. Each statement is idempotent (`IF EXISTS`):
-#   - Task 249: `user_profile_account_unique` replaced by composite (accountId, userId).
-#   - Task 249: `preference_category` index replaced by (accountId, userId, category).
-#   - Task 748: `knowledge_fulltext` (3 labels) replaced by `entity_search` (~40 labels)
+#: `user_profile_account_unique` replaced by composite (accountId, userId).
+#: `preference_category` index replaced by (accountId, userId, category).
+#: `knowledge_fulltext` (3 labels) replaced by `entity_search` (~40 labels)
 #     with the universal label/property union. The new index is created by the
 #     schema apply below; dropping the old name here is what lets cypher-shell
 #     run both in one pass without conflict.
@@ -500,10 +494,10 @@ if [ -n "${USER_ID:-}" ]; then
   CREATED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
 
   echo "==> Creating AdminUser node for userId=$USER_ID"
-  # Task 912 — stamp accountId + role='owner' at seed so the graph-write gate's
+  # stamp accountId + role='owner' at seed so the graph-write gate's
   # account-scoped MATCH (au:AdminUser {accountId: $accountId}) succeeds on the
   # first user-domain write. Pre-912 the seed only set name + createdAt, leaving
-  # accountId NULL and tripping the Task 685 gate on every fresh install. The
+  # accountId NULL and tripping the gate on every fresh install. The
   # ON MATCH branch COALESCEs to preserve any existing non-null value.
   "$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" << CYPHER_EOF
 MERGE (au:AdminUser {userId: '$USER_ID'})
@@ -523,12 +517,12 @@ CYPHER_EOF
   echo "  [seed] AdminUser stamped userId=${USER_ID:0:8} accountId=${ACCOUNT_ID:0:8} role=owner"
 
   # ------------------------------------------------------------------
-  # 3b. Backfill orphaned conversations (Task 380)
+  # 3b. Backfill orphaned conversations
   # ------------------------------------------------------------------
   # When userId was regenerated on every install, conversations created with
   # previous userIds became invisible. Reassign them to the current userId.
   # Scoped to this accountId. Only touches conversations where userId is set
-  # but doesn't match the current user (NULL userId is Task 378's domain).
+  # but doesn't match the current user (NULL userId is the domain).
   echo "==> Backfilling orphaned admin conversations for userId=$USER_ID"
   BACKFILL_RESULT=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" << BACKFILL_EOF
 MATCH (c:Conversation {accountId: '$ACCOUNT_ID', agentType: 'admin'})
@@ -542,7 +536,7 @@ BACKFILL_EOF
 fi
 
 # ------------------------------------------------------------------
-# 4. Sweep any legacy OnboardingState nodes (Task 068)
+# 4. Sweep any legacy OnboardingState nodes
 # ------------------------------------------------------------------
 # The onboarding state machine is gone. Existing devices upgrading to this
 # release may still carry an :OnboardingState node from a prior install;

package/payload/platform/scripts/test-laptop-vnc-boot.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Task 929 — laptop VNC + Chromium boot acceptance test.
+# laptop VNC + Chromium boot acceptance test.
 #
 # Asserts the four green conditions from .tasks/929 §Verification:
 #   1. The configured Chromium binary's realpath does NOT contain `/snap/`.
@@ -29,7 +29,7 @@ pass()   { echo "OK: $*"; }
 [ -r "$BRAND_JSON" ] || fail "${BRAND_JSON} unreadable"
 command -v jq >/dev/null 2>&1 || fail "jq not on PATH (apt install jq)"
 CONFIG_DIR=$(jq -r '.configDir // ".maxy"' "$BRAND_JSON")
-# Task 959 — brand.json is the single source of truth for cdpPort at
+# brand.json is the single source of truth for cdpPort at
 # runtime; a missing field is a doctrinal violation, not a fallback.
 if ! CDP_PORT=$(jq -er '.cdpPort' "$BRAND_JSON" 2>/dev/null); then
   _keys=$(jq -r 'keys | join(",")' "$BRAND_JSON" 2>/dev/null || echo "unparseable")
@@ -85,4 +85,4 @@ if ! echo "$TAIL_AFTER_START" | grep -q "VNC + browser stack running"; then
 fi
 pass "[4/4] ${VNC_LOG} reports VNC + browser stack running with no Chromium failed-to-start"
 
-echo "Task 929 acceptance: PASS (4/4)"
+echo "acceptance: PASS (4/4)"

package/payload/platform/scripts/verify-skill-tool-surface.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Pre-publish acceptance gate (Task 744).
+# Pre-publish acceptance gate.
 #
 # Statically intersects what each shipped skill *prescribes* (every
 # backtick-quoted `mcp__<server>__<tool>` token in SKILL.md and references/*.md)
@@ -27,7 +27,22 @@ set -euo pipefail
 REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
 cd "$REPO_ROOT"
 
-python3 - <<'PYEOF'
+# Script uses PEP 604 union syntax (`X | None`); requires Python ≥3.10.
+# macOS system /usr/bin/python3 is 3.9, so pin to the highest 3.10+ available.
+PY=""
+for cand in python3.13 python3.12 python3.11 python3.10; do
+  if command -v "$cand" >/dev/null 2>&1; then PY="$cand"; break; fi
+done
+if [ -z "$PY" ]; then
+  v=$(python3 -c 'import sys; print("%d.%d" % sys.version_info[:2])')
+  case "$v" in 3.1[0-9]|3.[2-9][0-9]|[4-9].*) PY=python3 ;; esac
+fi
+if [ -z "$PY" ]; then
+  echo "FATAL: verify-skill-tool-surface needs Python >= 3.10 (PEP 604 syntax); none found" >&2
+  exit 1
+fi
+
+"$PY" - <<'PYEOF'
 import os, re, sys
 
 REPO_ROOT = os.getcwd()

package/payload/platform/scripts/vnc.sh

@@ -21,7 +21,7 @@
 # brand.json at install time and re-read at runtime; missing fields are
 # derived from `vncDisplay` via the ordinal offset rule.
 #
-# Task 664 retired the admin-UI terminal surface entirely. This script
+# retired the admin-UI terminal surface entirely. This script
 # no longer spawns GUI terminal emulators of any kind; upgrades and
 # cloudflare-setup actions run via the detached action runner
 # (/api/admin/actions/*) rather than an in-browser terminal.
@@ -42,7 +42,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PLATFORM_ROOT="${MAXY_PLATFORM_ROOT:-$(dirname "$SCRIPT_DIR")}"
 BRAND_JSON="${PLATFORM_ROOT}/config/brand.json"
 
-# Task 959 — brand.json is the single source of truth at runtime; missing
+# brand.json is the single source of truth at runtime; missing
 # fields loud-fail rather than silently substituting a vncDisplay-derived
 # offset (silent-fallback-masks-root-cause recurrence). The install-time
 # offset rule in packages/create-maxy-code/src/index.ts stamps every brand at
@@ -88,7 +88,7 @@ mkdir -p "$LOG_DIR"
 
 log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >> "$LOG_FILE"; }
 
-# Task 929 — resolve the absolute Chromium binary path from the install-time
+# resolve the absolute Chromium binary path from the install-time
 # config file. The installer (packages/create-maxy-code/src/index.ts
 # ensureNonSnapChromium + writeChromiumBinaryPathFile) writes this file with
 # the non-snap binary chosen for this device — `/usr/bin/chromium` on Pi
@@ -129,7 +129,7 @@ CHROMIUM_CONFINEMENT="non-snap"
 log "[vnc.sh:chromium] bin=${CHROMIUM_BIN} realpath=${CHROMIUM_REALPATH} confinement=${CHROMIUM_CONFINEMENT}"
 
 kill_stale() {
-  # Brand-scoped matchers (Task 553): pkill on --user-data-dir narrows the
+  # Brand-scoped matchers: pkill on --user-data-dir narrows the
   # Chromium kill to this brand's profile only, so two brands on the same
   # device do not stomp on each other. Xtigervnc matcher narrows to this
   # brand's display number.
@@ -163,7 +163,7 @@ kill_stale() {
 # Refuse to start when this brand's display is already held by an unrelated
 # process (e.g. a peer brand's Xtigervnc whose vncDisplay collides, or a
 # manual Xvfb invocation). Loud-fail so the operator sees the held-by-pid
-# rather than silently sharing a display with another stack. Task 553.
+# rather than silently sharing a display with another stack..
 check_display_collision() {
   local lock="/tmp/.X${VNC_DISPLAY_NUM}-lock"
   local socket="/tmp/.X11-unix/X${VNC_DISPLAY_NUM}"
@@ -187,7 +187,7 @@ check_display_collision() {
   exit 1
 }
 
-# Task 924 — refuse to start when any of the three brand-scoped ports
+# refuse to start when any of the three brand-scoped ports
 # (rfbport, websockify, CDP) is held by an unrelated process. Mirrors
 # check_display_collision's loud-fail format and exits non-zero so the
 # operator sees the held-by-pid rather than silently sharing the port.
@@ -302,7 +302,7 @@ start_chrome_on() {
     >> "$LOG_FILE" 2>&1 &
 
   if wait_for_port "${CDP_PORT}"; then
-    # Log-only observability (Task 632): the display-membership invariant is
+    # Log-only observability: the display-membership invariant is
     # asserted but does NOT gate success here. Chromium does not D-Bus-delegate
     # its window creation, so the failure mode is not currently reachable — but
     # making the invariant visible now means future backend swaps (e.g.
@@ -323,7 +323,7 @@ start_chrome() {
 }
 
 # ---------------------------------------------------------------------------
-# Task 664 retired the admin-UI terminal surface entirely: the header
+# retired the admin-UI terminal surface entirely: the header
 # TerminalOverlay + UpdateModal embedded terminal stack is gone. Only
 # the Chromium surface remains for BrowserOverlay.
 # ---------------------------------------------------------------------------
@@ -379,7 +379,7 @@ start_chrome_native() {
     >> "$LOG_FILE" 2>&1 &
 
   if wait_for_port "${CDP_PORT}"; then
-    # Log-only observability (Task 632) — see start_chrome_on for rationale.
+    # Log-only observability — see start_chrome_on for rationale.
     # On Wayland sessions xdotool cannot inspect the compositor, so this
     # check is x11-only; fall back to unconditional windowPresent=unknown.
     if [ "$NATIVE_SESSION_TYPE" = "x11" ] && check_window_on_display "${NATIVE_DISPLAY}"; then

package/payload/platform/services/claude-session-manager/dist/config.d.ts

@@ -12,10 +12,24 @@ export interface ManagerConfig {
     claudeBin: string;
     spawnCwd: string;
     urlCaptureTimeoutMs: number;
+    /** upper bound on the spawn-time bridge-binding race. The
+     *  spawn promise blocks until the jsonl-observer binds a JSONL to the
+     *  captured URL's bridge suffix; on timeout the PTY is killed and the
+     *  spawn returns 504. */
+    observeTimeoutMs: number;
     killGraceMs: number;
     jsonlReadMaxBytes: number;
     host: HostResolution;
-    /** Task 013 — per-`role=public` spawn rate limit. Loaded from
+    /** per-account directory resolved at boot. Mirrors the
+     *  installer's `resolveInstallAccountId` walk: the first sub-directory of
+     *  `<installDir>/data/accounts/` containing `account.json`. Per-spawn the
+     *  composer reads `<accountDir>/agents/<role>/{IDENTITY.md,SOUL.md}` and
+     *  injects them as `<identity>` / `<soul>` sentinels in the
+     *  `--append-system-prompt` block; absence of an account dir refuses
+     *  manager start with `account-dir-unresolved` (no silent fallback to
+     *  stock Claude Code). */
+    accountDir: string;
+    /** per-`role=public` spawn rate limit. Loaded from
      * `brand.json.publicSpawnLimits` if present, else defaults; env vars
      * `MAXY_PUBLIC_SPAWN_CAP` / `MAXY_PUBLIC_SPAWN_WINDOW_MS` override every
      * per-channel bucket (operator escape hatch). */

package/payload/platform/services/claude-session-manager/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAA;AAGhC,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD;;4DAEwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB;;;qDAGiD;IACjD,iBAAiB,EAAE,iBAAiB,CAAA;CACrC;AA6HD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAmC9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAGL,KAAK,iBAAiB,EACvB,MAAM,yBAAyB,CAAA;AAGhC,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD;;4DAEwD;IACxD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,mBAAmB,EAAE,MAAM,CAAA;IAC3B;;;6BAGyB;IACzB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,IAAI,EAAE,cAAc,CAAA;IACpB;;;;;;;8BAO0B;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB;;;qDAGiD;IACjD,iBAAiB,EAAE,iBAAiB,CAAA;CACrC;AAuJD,wBAAgB,UAAU,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAkD9E"}

package/payload/platform/services/claude-session-manager/dist/config.js

@@ -1,9 +1,10 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { homedir, hostname, networkInterfaces } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { DEFAULT_PUBLIC_SPAWN_LIMITS, } from './spawn-rate-limiter.js';
 const DEFAULT_PORT = 19400;
 const DEFAULT_URL_TIMEOUT_MS = 30_000;
+const DEFAULT_OBSERVE_TIMEOUT_MS = 5_000;
 const DEFAULT_KILL_GRACE_MS = 5_000;
 const DEFAULT_JSONL_READ_MAX_BYTES = 1 * 1024 * 1024;
 const DEFAULT_BRAND_PORT = 19200;
@@ -103,6 +104,33 @@ function resolveLanIPv4() {
     const names = Object.keys(ifaces).join(',') || '(no interfaces detected)';
     return { ip: null, diagnostic: `no non-loopback IPv4 across interfaces: ${names}` };
 }
+/** walk `<installDir>/data/accounts/` for the first sub-directory
+ *  containing `account.json`. Mirrors the installer's `resolveInstallAccountId`
+ *  (packages/create-maxy-code/src/index.ts) so the runtime reads the same
+ *  account the installer wrote. Returns null when no account is found; the
+ *  caller surfaces `account-dir-unresolved` and refuses to start.
+ *
+ *  `installDir` = parent of `PLATFORM_ROOT` (the systemd unit passes
+ *  `PLATFORM_ROOT=<installDir>/platform`, so `dirname()` is exact). */
+function resolveAccountDir(platformRoot) {
+    const installDir = dirname(platformRoot);
+    const accountsRoot = join(installDir, 'data', 'accounts');
+    if (!existsSync(accountsRoot))
+        return null;
+    let entries;
+    try {
+        entries = readdirSync(accountsRoot);
+    }
+    catch {
+        return null;
+    }
+    for (const entry of entries) {
+        const candidate = join(accountsRoot, entry);
+        if (existsSync(join(candidate, 'account.json')))
+            return candidate;
+    }
+    return null;
+}
 function resolveBrandPort(env) {
     const raw = env.MAXY_BRAND_PORT ?? env.PORT;
     if (!raw)
@@ -121,6 +149,17 @@ export function loadConfig(env = process.env) {
     const claudeBin = env.CLAUDE_BIN ?? 'claude';
     const spawnCwd = env.CLAUDE_SESSION_MANAGER_SPAWN_CWD ?? process.cwd();
     const brand = loadBrand(env);
+    const platformRoot = env.PLATFORM_ROOT ?? env.MAXY_PLATFORM_ROOT;
+    if (!platformRoot) {
+        // `loadBrand` already validates this, but Typescript narrowing needs the
+        // re-check here so `resolveAccountDir` sees a non-undefined string.
+        throw new Error('[claude-session-manager] PLATFORM_ROOT unresolved after loadBrand — internal error');
+    }
+    const accountDir = resolveAccountDir(platformRoot);
+    if (!accountDir) {
+        throw new Error(`[claude-session-manager] account-dir-unresolved: no <installDir>/data/accounts/<uuid>/account.json under ${dirname(platformRoot)}/data/accounts. ` +
+            'The installer (seed-neo4j.sh / writeInstallDefaults) must run before manager start.');
+    }
     const lan = resolveLanIPv4();
     const brandPort = resolveBrandPort(env);
     const osHost = hostname();
@@ -134,6 +173,7 @@ export function loadConfig(env = process.env) {
         claudeBin,
         spawnCwd,
         urlCaptureTimeoutMs: DEFAULT_URL_TIMEOUT_MS,
+        observeTimeoutMs: DEFAULT_OBSERVE_TIMEOUT_MS,
         killGraceMs: DEFAULT_KILL_GRACE_MS,
         jsonlReadMaxBytes: DEFAULT_JSONL_READ_MAX_BYTES,
         host: {
@@ -143,6 +183,7 @@ export function loadConfig(env = process.env) {
             tunnelUrl,
             lanIPv4Diagnostic: lan.diagnostic,
         },
+        accountDir,
         publicSpawnLimits: applyEnvOverride(brand.fields.publicSpawnLimits, env),
     };
 }

package/payload/platform/services/claude-session-manager/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EACL,2BAA2B,GAG5B,MAAM,yBAAyB,CAAA;AA0BhC,MAAM,YAAY,GAAG,KAAK,CAAA;AAC1B,MAAM,sBAAsB,GAAG,MAAM,CAAA;AACrC,MAAM,qBAAqB,GAAG,KAAK,CAAA;AACnC,MAAM,4BAA4B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACpD,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAQhC,MAAM,mBAAmB,GAAuB;IAC9C,SAAS;IACT,UAAU;IACV,UAAU;IACV,SAAS;IACT,OAAO;CACR,CAAA;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,QAAqB;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACpD,MAAM,CAAC,GAAG,GAA4C,CAAA;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAA;IACpG,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;QAC9E,CAAC,CAAC,CAAC,CAAC,QAAQ;QACZ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACvB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,QAAQ,GAAG,2BAA2B,CAAA;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACpD,MAAM,CAAC,GAAG,GAAiD,CAAA;IAC3D,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QACrE,CAAC,CAAE,CAAC,CAAC,UAAsC;QAC3C,CAAC,CAAC,EAAE,CAAC,CAAA;IACP,MAAM,UAAU,GAAG,EAAkC,CAAA;IACrD,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACrC,UAAU,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO;QACL,UAAU;QACV,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB,EAAE,GAAsB;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB,CAAA;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,2BAA2B,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,EAAkC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;IAC7F,MAAM,WAAW,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACrF,MAAM,cAAc,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACxF,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG;YACpB,GAAG,EAAE,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG;YAC7C,QAAQ,EAAE,cAAc,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ;SAC3D,CAAA;IACH,CAAC;IACD,IAAI,WAAW,KAAK,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;IACtF,IAAI,cAAc,KAAK,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,cAAc,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB;IACvC,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,kBAAkB,CAAA;IAChE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yGAAyG;YACvG,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC5D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,kDAAkD,SAAS,yEAAyE,CACrI,CAAA;IACH,CAAC;IACD,IAAI,KAA8B,CAAA;IAClC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAA4B,CAAA;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/E,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,kBAAkB,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IAClG,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,0CAA0C,SAAS,mCAAmC,CACvF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACzE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAA;AAC3E,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAClC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAA;IACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,2CAA2C,KAAK,EAAE,EAAE,CAAA;AACrF,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAsB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,IAAI,CAAA;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,kBAAkB,CAAA;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,kBAAkB,CAAA;IACzE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,IAAI,YAAY,CAAC,CAAA;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,kCAAkC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;IACrF,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAA;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,gCAAgC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAEtE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,MAAM,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAA;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM;QACnC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3D,CAAC,CAAC,IAAI,CAAA;IAER,OAAO;QACL,IAAI;QACJ,UAAU;QACV,SAAS;QACT,QAAQ;QACR,mBAAmB,EAAE,sBAAsB;QAC3C,WAAW,EAAE,qBAAqB;QAClC,iBAAiB,EAAE,4BAA4B;QAC/C,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,QAAQ;YACR,SAAS;YACT,iBAAiB,EAAE,GAAG,CAAC,UAAU;SAClC;QACD,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC;KACzE,CAAA;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC9D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EACL,2BAA2B,GAG5B,MAAM,yBAAyB,CAAA;AAwChC,MAAM,YAAY,GAAG,KAAK,CAAA;AAC1B,MAAM,sBAAsB,GAAG,MAAM,CAAA;AACrC,MAAM,0BAA0B,GAAG,KAAK,CAAA;AACxC,MAAM,qBAAqB,GAAG,KAAK,CAAA;AACnC,MAAM,4BAA4B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACpD,MAAM,kBAAkB,GAAG,KAAK,CAAA;AAQhC,MAAM,mBAAmB,GAAuB;IAC9C,SAAS;IACT,UAAU;IACV,UAAU;IACV,SAAS;IACT,OAAO;CACR,CAAA;AAED,SAAS,WAAW,CAAC,GAAY,EAAE,QAAqB;IACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACpD,MAAM,CAAC,GAAG,GAA4C,CAAA;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAA;IACpG,MAAM,QAAQ,GACZ,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;QAC9E,CAAC,CAAC,CAAC,CAAC,QAAQ;QACZ,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAA;IACvB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAA;AAC1B,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,QAAQ,GAAG,2BAA2B,CAAA;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACpD,MAAM,CAAC,GAAG,GAAiD,CAAA;IAC3D,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QACrE,CAAC,CAAE,CAAC,CAAC,UAAsC;QAC3C,CAAC,CAAC,EAAE,CAAC,CAAA;IACP,MAAM,UAAU,GAAG,EAAkC,CAAA;IACrD,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACrC,UAAU,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,OAAO;QACL,UAAU;QACV,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;KAC/C,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB,EAAE,GAAsB;IACzE,MAAM,MAAM,GAAG,GAAG,CAAC,qBAAqB,CAAA;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,2BAA2B,CAAA;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAA;IACjD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,EAAkC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;IAC7F,MAAM,WAAW,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACrF,MAAM,cAAc,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;IACxF,KAAK,MAAM,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG;YACpB,GAAG,EAAE,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,GAAG;YAC7C,QAAQ,EAAE,cAAc,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,QAAQ;SAC3D,CAAA;IACH,CAAC;IACD,IAAI,WAAW,KAAK,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,CAAC,CAAC,CAAA;IACtF,IAAI,cAAc,KAAK,IAAI;QAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,cAAc,CAAA;IAClE,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAsB;IACvC,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,kBAAkB,CAAA;IAChE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yGAAyG;YACvG,kEAAkE,CACrE,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAA;IAC5D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,kDAAkD,SAAS,yEAAyE,CACrI,CAAA;IACH,CAAC;IACD,IAAI,KAA8B,CAAA;IAClC,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAA4B,CAAA;IACjF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAC/E,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,kBAAkB,MAAM,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAA;IAClG,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CACb,0CAA0C,SAAS,mCAAmC,CACvF,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACzE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAA;AAC3E,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAA;IAClC,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC7C,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAA;IACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,2CAA2C,KAAK,EAAE,EAAE,CAAA;AACrF,CAAC;AAED;;;;;;;uEAOuE;AACvE,SAAS,iBAAiB,CAAC,YAAoB;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;QAC3C,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;IACnE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAsB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,IAAI,CAAA;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,kBAAkB,CAAA;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,kBAAkB,CAAA;IACzE,OAAO,CAAC,CAAA;AACV,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,2BAA2B,IAAI,YAAY,CAAC,CAAA;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,kCAAkC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAA;IACrF,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAA;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,gCAAgC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IAEtE,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5B,MAAM,YAAY,GAAG,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,kBAAkB,CAAA;IAChE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAA;IACvG,CAAC;IACD,MAAM,UAAU,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;IAClD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,4GAA4G,OAAO,CAAC,YAAY,CAAC,kBAAkB;YACjJ,qFAAqF,CACxF,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,EAAE,CAAA;IAC5B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,MAAM,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAA;IACrE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM;QACnC,CAAC,CAAC,WAAW,KAAK,CAAC,MAAM,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;QAC3D,CAAC,CAAC,IAAI,CAAA;IAER,OAAO;QACL,IAAI;QACJ,UAAU;QACV,SAAS;QACT,QAAQ;QACR,mBAAmB,EAAE,sBAAsB;QAC3C,gBAAgB,EAAE,0BAA0B;QAC5C,WAAW,EAAE,qBAAqB;QAClC,iBAAiB,EAAE,4BAA4B;QAC/C,IAAI,EAAE;YACJ,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,GAAG,CAAC,EAAE;YACf,QAAQ;YACR,SAAS;YACT,iBAAiB,EAAE,GAAG,CAAC,UAAU;SAClC;QACD,UAAU;QACV,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,EAAE,GAAG,CAAC;KACzE,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts

@@ -7,10 +7,10 @@ export interface HttpDeps extends Omit<SpawnDeps, 'store' | 'onJsonlObserved'> {
     store: SessionStore;
     killGraceMs: number;
     jsonlReadMaxBytes: number;
-    /** Task 013 — gates `POST /spawn role=public` on per-(senderId, channel)
+    /** gates `POST /spawn role=public` on per-(senderId, channel)
      *  and global token buckets. `admin` spawns bypass entirely. */
     publicSpawnLimiter: RateLimiter;
-    /** Task 013 — attaches a JSONL tail watcher to each `role=public` session
+    /** attaches a JSONL tail watcher to each `role=public` session
      *  so tool_use→tool_result pairs emit `tool-call` log lines without an
      *  operator having to parse the transcript by hand. */
     publicToolAudit: AuditRegistry;

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAA4E,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAI3H,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAc3D,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAC5E,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB;oEACgE;IAChE,kBAAkB,EAAE,WAAW,CAAA;IAC/B;;2DAEuD;IACvD,eAAe,EAAE,aAAa,CAAA;CAC/B;AA2ED,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAwgBjD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAA4E,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAK3H,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AA+C3D,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,iBAAiB,CAAC;IAC5E,KAAK,EAAE,YAAY,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB;oEACgE;IAChE,kBAAkB,EAAE,WAAW,CAAA;IAC/B;;2DAEuD;IACvD,eAAe,EAAE,aAAa,CAAA;CAC/B;AAgED,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CA+iBjD"}