@rubytech/create-maxy-code 0.1.33 → 0.1.35

package/payload/platform/plugins/admin/mcp/dist/__tests__/skill-load.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-load.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-load.test.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,+CAA+C;AAC/C,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,oCAAoC;AACpC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAEhE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,SAAS,CACP,OAAO,EACP,SAAS,EACT,uFAAuF,CACxF,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3C,SAAS,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAErD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO;QAC3C,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,mEAAmE;QACnE,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,KAAK,GAAG,sBAAsB,CAAC;QAErC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"skill-load.test.js","sourceRoot":"","sources":["../../src/__tests__/skill-load.test.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,+CAA+C;AAC/C,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,oCAAoC;AACpC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,IAAI,IAAY,CAAC;AAEjB,UAAU,CAAC,GAAG,EAAE;IACd,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3D,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAEhE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACxC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,QAAQ,CAAC,uCAAuC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,SAAS,CACP,OAAO,EACP,SAAS,EACT,uFAAuF,CACxF,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QACxC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC3C,SAAS,CAAC,UAAU,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAE9C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAErD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO;QAC3C,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAEtD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,mEAAmE;QACnE,qEAAqE;QACrE,gCAAgC;QAChC,MAAM,KAAK,GAAG,sBAAsB,CAAC;QAErC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -8,7 +8,6 @@ import { readFile, writeFile } from "node:fs/promises";
 import { resolve, join } from "node:path";
 import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { writeKey, validateKey, keyFilePath } from "../../../../lib/anthropic-key/dist/index.js";
 import { writeAdminEntry, removeAdminFromAccount } from "../../../../lib/admins-write/dist/index.js";
 import { deviceUrlBlock } from "../../../../lib/device-url/dist/index.js";
 import { substituteBrandPlaceholders } from "../../../../lib/brand-templating/dist/index.js";
@@ -34,7 +33,7 @@ if (!PLATFORM_PORT) {
     throw new Error("PLATFORM_PORT environment variable is required — set by getMcpServers() in claude-agent.ts");
 }
 // Brand-aware config — reads configDir, productName, and commercialMode from
-// brand.json stamped at install time. commercialMode (Task 831) gates the
+// brand.json stamped at install time. commercialMode gates the
 // entitlement verifier: false (default) preserves personal-mode installs;
 // true requires a Rubytech-signed entitlement.json or the install runs locked.
 // No fallback: if brand.json is missing or incomplete, the platform wasn't properly installed.
@@ -51,11 +50,11 @@ function resolveBrandConfig() {
         if (!brand.productName) {
             throw new Error(`brand.json at ${brandPath} is missing the productName field`);
         }
-        // Task 924 + 959 — brand.json is the single source of truth for the
+        // brand.json is the single source of truth for the
         // four brand-scoped port fields. An admin MCP probe must see the exact
         // same numbers the rest of the platform binds; silent vncDisplay-derived
         // fallback was a recurrence-class silent-fallback-masks-root-cause
-        // violation (Task 959) and is now loud-fail.
+        // violation and is now loud-fail.
         const brandLabel = String(brand.configDir).replace(/^\./, "");
         if (typeof brand.vncDisplay !== "number") {
             console.error(`[mcp:admin] error reason=cdp-port-unresolved brand=${brandLabel} path=${brandPath} field=vncDisplay json_keys=${Object.keys(brand).join(",")}`);
@@ -124,11 +123,11 @@ async function readAccountConfig() {
 }
 const STAGING_ROOT = resolve(PLATFORM_ROOT, "../premium-plugins");
 const PLUGINS_DIR = resolve(PLATFORM_ROOT, "plugins");
-const CORE_PLUGINS = ["admin", "memory", "docs", "cloudflare", "anthropic"];
+const CORE_PLUGINS = ["admin", "memory", "docs", "cloudflare"];
 // users.json lives under CONFIG_DIR (persistent) — see paths.ts comment for
 // the regression that motivated the move. Both platform/ui and this MCP plugin
 // resolve the same file via brand-aware $HOME/<configDir>, so the device-level
-// admin auth store is single-pathed across both processes (Task 904).
+// admin auth store is single-pathed across both processes.
 const USERS_FILE = resolve(CONFIG_DIR, "users.json");
 /** Maximum number of admin users allowed per tier. */
 const MAX_ADMINS_BY_TIER = {
@@ -219,18 +218,18 @@ function checkPort(port, timeoutMs = 1000) {
 eagerTool(server, "system-status", "Check health of all Maxy platform services: Neo4j, Ollama, Cloudflare tunnel, crontab (Maxy cron entries), VNC, Chrome (CDP), specialist agents, and deployed brand identity.", {}, async () => {
     const checks = {};
     try {
-        // Task 580: NEO4J_URI must be explicit. The outer try/catch surfaces the
+        // NEO4J_URI must be explicit. The outer try/catch surfaces the
         // unset condition as `checks.neo4j = "unreachable: NEO4J_URI unset..."`
         // so system-status still reports cleanly — the misconfig appears in the
         // check output instead of taking down the whole tool.
         const neo4jUri = process.env.NEO4J_URI;
         if (!neo4jUri) {
-            throw new Error("NEO4J_URI unset (Task 580 — no silent default)");
+            throw new Error("NEO4J_URI unset (no silent default)");
         }
         // NOTE: the port-replace below only works when the URI ends in :7687.
         // For non-default bolt ports (e.g. :7688 on realagent) the HTTP port is
         // bolt - 213 (see graph-proxy.ts). Pre-existing fragility — flagged as a
-        // follow-up in .docs/neo4j-uri-audit.md. Not in scope for Task 580.
+        // follow-up in.docs/neo4j-uri-audit.md. Not in scope.
         const res = await fetch(neo4jUri.replace("bolt://", "http://").replace("7687", "7474"), { signal: AbortSignal.timeout(3000) });
         checks.neo4j = res.ok ? "healthy" : `unhealthy (${res.status})`;
     }
@@ -307,15 +306,15 @@ eagerTool(server, "system-status", "Check health of all Maxy platform services:
     catch {
         checks.crontab = "no crontab configured for this user";
     }
-    // VNC display server (this brand's rfbPort — Task 924)
+    // VNC display server (this brand's rfbPort)
     checks.vnc = (await checkPort(BRAND_CONFIG.rfbPort)) ? "running" : "not running";
-    // Chrome CDP (this brand's cdpPort — Task 924); personal-assistant
+    // Chrome CDP (this brand's cdpPort); personal-assistant
     // browser tools depend on this.
     const chromeUp = await checkPort(BRAND_CONFIG.cdpPort);
     checks.chrome = chromeUp
         ? "running"
         : `not running — personal-assistant browser tools degraded (CDP port ${BRAND_CONFIG.cdpPort} not listening)`;
-    // WiFi — current connection state (Task 429)
+    // WiFi — current connection state
     try {
         const wifiScan = execFileSync("nmcli", ["-t", "-f", "ACTIVE,SSID,SIGNAL", "device", "wifi", "list"], { encoding: "utf-8", timeout: 5000 });
         const activeLine = wifiScan.split("\n").find((l) => l.startsWith("yes:"));
@@ -572,12 +571,12 @@ eagerTool(server, "account-update", "Update a user-configurable setting in accou
     }
 });
 // Plugin enable/disable: deterministic write to account.json.enabledPlugins.
-// The pre-tool-use hook denies the agent's direct Edit on account.json (Task 831),
+// The pre-tool-use hook denies the agent's direct Edit on account.json,
 // so the agent can no longer toggle enablement by hand-editing the file. This
 // tool is the legitimate path: validates the plugin name, refuses core plugins,
 // confirms the plugin directory exists, and atomically updates the array.
 // Entitlement-bearing fields (tier, purchasedPlugins) are NOT writable here.
-server.tool("plugin-toggle-enabled", "Enable or disable a plugin in this account by adding/removing its name from account.json's enabledPlugins array. Validates the plugin exists under platform/plugins/, refuses to disable core plugins (admin, memory, docs, cloudflare, anthropic), and writes atomically. Takes effect on next session start. Does NOT change purchasedPlugins or tier — those derive from the signed entitlement payload.", {
+server.tool("plugin-toggle-enabled", "Enable or disable a plugin in this account by adding/removing its name from account.json's enabledPlugins array. Validates the plugin exists under platform/plugins/, refuses to disable core plugins (admin, memory, docs, cloudflare), and writes atomically. Takes effect on next session start. Does NOT change purchasedPlugins or tier — those derive from the signed entitlement payload.", {
     pluginName: z.string().describe("Plugin slug (lowercase a-z0-9-)."),
     action: z.enum(["enable", "disable"]).describe("enable adds to enabledPlugins; disable removes."),
 }, async ({ pluginName, action }) => {
@@ -637,7 +636,7 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
         return { content: [{ type: "text", text: `${TAG} ${err instanceof Error ? err.message : String(err)}` }], isError: true };
     }
     // Enforce per-tier admin limit. Effective tier comes from the signed
-    // entitlement payload (Task 831) — editing account.json.tier directly
+    // entitlement payload — editing account.json.tier directly
     // has no effect; the verifier uses the signed value and emits a
     // [entitlement] tampered: line if disk and signed diverge.
     try {
@@ -679,7 +678,7 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
     }
     const pinHash = hashPin(plaintextPin);
     const userId = crypto.randomUUID();
-    // Three-store admin auth invariant (Task 850 → Task 904): users.json
+    // Three-store admin auth invariant: users.json
     // (device-level PIN auth) and account.json admins[] (account-level role)
     // route through the shared `admins-write` helper so the dual write has a
     // single chokepoint. Per-leg `[admins-write]` and legacy `[admin-auth-store]`
@@ -705,12 +704,12 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
     }
     // 3. Write to Neo4j (graph-level): AdminUser + Person + OWNS atomically,
     //    plus ADMIN_OF edge to the LocalBusiness for this account.
-    //    Task 830 — deterministic identity creation: never delegate node
+    //    deterministic identity creation: never delegate node
     //    creation to the LLM. Person reuse rule mirrors writeAdminUserAndPerson
     //    in platform/ui/app/lib/neo4j-store.ts (case-insensitive exact match
     //    on givenName + familyName; partial-name ambiguity does NOT match —
     //    rationalisation is a separate agent-mediated concern).
-    //    Task 850 — Neo4j-leg failure now returns is_error: true with the
+    //    Neo4j-leg failure now returns is_error: true with the
     //    [admin-auth-store] line; previously it set a soft warning string and
     //    returned success, which is what hid the Adam Mackay incident from
     //    the recovery agent. The user is still functional via users.json +
@@ -725,7 +724,7 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
             const firstSpace = trimmedName.search(/\s/);
             const givenName = firstSpace === -1 ? trimmedName : trimmedName.slice(0, firstSpace).trim();
             const familyName = firstSpace === -1 ? null : (trimmedName.slice(firstSpace + 1).trim() || null);
-            // Task 897: stamp `accountId` on every AdminUser at MERGE time, both
+            // stamp `accountId` on every AdminUser at MERGE time, both
             // ON CREATE and ON MATCH (the latter via COALESCE so a pre-existing
             // value isn't overwritten if it differs — which would itself be a
             // graph-invariant violation worth surfacing). Pre-897 the missing
@@ -770,7 +769,7 @@ eagerTool(server, "admin-add", "Add a new admin user to this account. Creates a
             if (result.records.length > 0) {
                 personReused = result.records[0].get("reused");
             }
-            // Task 897 — post-write assertion mirroring Task 785 in neo4j-store.ts.
+            // post-write assertion mirroring the one in neo4j-store.ts.
             // MATCH back the AdminUser we just wrote and verify every required
             // field landed. Loud-fail the tool call if accountId or name is null
             // so a Cypher regression that drops the field is grep-detectable.
@@ -897,7 +896,7 @@ eagerTool(server, "admin-list", "List all admins for this account with their nam
     if (admins.length === 0) {
         return { content: [{ type: "text", text: `${TAG} No admins configured for this account.` }] };
     }
-    // Enrich with names from Neo4j AdminUser (canonical, Task 829). Best
+    // Enrich with names from Neo4j AdminUser (canonical). Best
     // effort — render "(unknown)" for any userId without a graph entry.
     const userMap = new Map();
     try {
@@ -1197,9 +1196,9 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
 }, async ({ type, lines = 50, sessionKey, conversationId }) => {
     try {
         const LOG_DIR = resolve(getAccountDir(), "logs");
-        // Task 1006 — sessionKey is the single identifier on disk.
+        // sessionKey is the single identifier on disk.
         // `conversationId` is retained as a legacy alias that maps to the
-        // sessionKey-named file; Task 1007 will collapse the alias in the UI.
+        // sessionKey-named file will collapse the alias in the UI.
         const idForResolve = sessionKey ?? conversationId;
         if (idForResolve) {
             if (!existsSync(LOG_DIR)) {
@@ -1207,7 +1206,7 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
             }
             const prefixMap = {
                 "agent-stream": "claude-agent-stream",
-                system: "claude-agent-stream", // Task 850 — backwards-compatible alias for agent-stream
+                system: "claude-agent-stream", // backwards-compatible alias for agent-stream
                 error: "claude-agent-stderr",
                 session: "sse-events",
                 public: "public-agent-stream",
@@ -1249,7 +1248,7 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
         if (sessionKey) {
             const prefixes = {
                 "agent-stream": "claude-agent-stream-",
-                system: "claude-agent-stream-", // Task 850 — backwards-compatible alias
+                system: "claude-agent-stream-", // backwards-compatible alias
                 error: "claude-agent-stderr-",
                 session: "sse-events-",
                 public: "public-agent-stream-",
@@ -1363,7 +1362,7 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
             }).toString();
             return { content: [{ type: "text", text: `# vnc-boot.log\n\n${result}` }] };
         }
-        // Task 850 — agent-stream and the legacy system alias both map to
+        // agent-stream and the legacy system alias both map to
         // claude-agent-stream-. The fall-through default also covers them.
         const prefix = resolvedType === "error" ? "claude-agent-stderr-"
             : resolvedType === "session" ? "sse-events-"
@@ -1388,7 +1387,7 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
         return { content: [{ type: "text", text: `Failed to read logs: ${err instanceof Error ? err.message : String(err)}` }] };
     }
 });
-// Task 918 — operator-authored skills are written to disk as a plugin so the
+// operator-authored skills are written to disk as a plugin so the
 // existing plugin-manifest loader picks them up (parsePluginFrontmatter +
 // assemblePublicPluginContent + loadEmbeddedPlugins all read from
 // <PLATFORM_ROOT>/plugins/<dir>/). Canonical = <accountDir>/plugins/<plugin>
@@ -1396,7 +1395,7 @@ eagerTool(server, "logs-read", "Read recent logs. Stream logs (type=agent-stream
 // <PLATFORM_ROOT>/plugins/<plugin> is rehydrated at admin session start by
 // autoDeliverUserPlugins. The agent supplies pluginName/skillName/body —
 // path is computed by this tool from ACCOUNT_ID. Symmetric write counterpart
-// to plugin-read (Task 916).
+// to plugin-read.
 eagerTool(server, "store-skill", "Save an operator-authored skill on disk as part of an admin-managed plugin. " +
     "The skill becomes immediately discoverable by the admin agent (and the public agent if publicEmbed=true). " +
     "Path is computed internally from the active account; the agent supplies content + names only. " +
@@ -1528,7 +1527,7 @@ eagerTool(server, "plugin-read", "Read a plugin definition (PLUGIN.md) or one of
         const resolvedFile = file ?? "PLUGIN.md";
         const pluginPath = resolve(PLATFORM_ROOT, "plugins", pluginName, resolvedFile);
         if (!existsSync(pluginPath)) {
-            // Task 964/1000 — when the agent's pluginName/file combination misses
+            // when the agent's pluginName/file combination misses
             // a skill that DOES live under `plugins/*/skills/<slug>/SKILL.md`,
             // surface the corrected pluginName AND the canonical file path so
             // the next call is deterministic. Both wrong-`file` and wrong-`pluginName`
@@ -1595,12 +1594,12 @@ eagerTool(server, "plugin-read", "Read a plugin definition (PLUGIN.md) or one of
         };
     }
 });
-// Task 964 — agent-side `Glob` fallthrough when "set up cloudflare" maps a
+// agent-side `Glob` fallthrough when "set up cloudflare" maps a
 // SKILL.md to the wrong plugin: skill-find walks
 // `${PLATFORM_ROOT}/plugins/*/skills/<skillName>/SKILL.md` once and returns
 // the owner. With one tool call the agent learns the correct plugin name.
 //
-// Task 1015 — `skill-load` (below) is the canonical single-call surface that
+// `skill-load` (below) is the canonical single-call surface that
 // most agents want (resolve + read body in one shot). `skill-find` is kept
 // for callers that need only the path (e.g. tooling that lists owners
 // without reading the body).
@@ -1634,11 +1633,11 @@ server.tool("skill-find", "Find which plugin owns a skill by name. Walks plugins
         isError: true,
     };
 });
-// Task 1015 — `skill-load` collapses skill resolve+read into one call.
+// `skill-load` collapses skill resolve+read into one call.
 //
 // Why: 21 prose call sites previously said *"Load `admin/skills/plainly/SKILL.md`
 // via `plugin-read`"*. The LLM kept passing the path as `pluginName`, tripping
-// the not-found branch with the corrected-pluginName hint that Task 1000 added.
+// the not-found branch with the corrected-pluginName hint.
 // The recurring failure is recorded in the corrections ledger. One slug-arg
 // tool removes the path-format ambiguity at the source.
 //
@@ -1674,7 +1673,7 @@ eagerTool(server, "skill-load", "Load a plugin skill's SKILL.md body by skill na
             };
         }
         const content = substituteBrandPlaceholders(outcome.body, outcome.absolutePath);
-        // Task 1021 — prepend a skill-input-contract notice when the skill's
+        // prepend a skill-input-contract notice when the skill's
         // frontmatter declares `requiredInputs:`. The notice tells the agent
         // to route missing inputs through AskUserQuestion (per IDENTITY.md
         // "Skill-input resolution"); the embedded `<!-- skill-input-contract
@@ -1703,7 +1702,7 @@ eagerTool(server, "skill-load", "Load a plugin skill's SKILL.md body by skill na
         };
     }
 });
-// Task 066 — the inline UI-component tool is gone from the admin surface
+// the inline UI-component tool is gone from the admin surface
 // on native Claude Code. The PTY runtime has no host bridge for the UI
 // primitives the legacy tool wrapped; calling it logged a "rendered"
 // sentinel that read like a successful render to the agent while the
@@ -1759,32 +1758,6 @@ server.tool("remote-auth-set-password", "Set the remote access password. Hashes
         };
     }
 });
-eagerTool(server, "api-key-store", "Validate and store an Anthropic API key. Key must start with sk-ant- and be at least 90 characters. " +
-    "Writes to the platform's brand-specific config directory. Takes effect immediately for the public agent.", { apiKey: z.string() }, async ({ apiKey }) => {
-    try {
-        writeKey(apiKey);
-        return { content: [{ type: "text", text: `API key stored at ${keyFilePath()}.` }] };
-    }
-    catch (err) {
-        return {
-            content: [{ type: "text", text: err instanceof Error ? err.message : String(err) }],
-            isError: true,
-        };
-    }
-});
-eagerTool(server, "api-key-verify", "Verify the stored Anthropic API key works by making a minimal probe call. " +
-    "Returns one of: valid (key works, credits available), billing (key valid but credit balance too low — " +
-    "user must add credits at console.anthropic.com/settings/billing), auth_error (key rejected — invalid or revoked), " +
-    "missing (no key file found), error (could not verify — network issue or Anthropic outage). " +
-    "Call this on greeting, during system checks, or after storing a new key.", {}, async () => {
-    const result = await validateKey();
-    return {
-        content: [{
-                type: "text",
-                text: `Status: ${result.status}\n${result.message}`,
-            }],
-    };
-});
 // ===================================================================
 // Utility tools
 // ===================================================================
@@ -1837,7 +1810,7 @@ eagerTool(server, "qr-generate", "Generate a QR code from text or a URL. Returns
     }
 });
 // ===================================================================
-// WiFi management (Task 429)
+// WiFi management
 // ===================================================================
 eagerTool(server, "wifi", "Manage WiFi connections on this device. Actions: " +
     "scan (list visible networks with signal strength and security), " +
@@ -2110,7 +2083,7 @@ server.tool("premium-list", "List available premium plugins and their delivery s
             };
         }
         const config = await readAccountConfig();
-        // Effective purchasedPlugins from signed entitlement (Task 831).
+        // Effective purchasedPlugins from signed entitlement.
         const entitlement = await currentEntitlement();
         const purchased = entitlement.purchasedPlugins;
         const enabled = Array.isArray(config.enabledPlugins) ? config.enabledPlugins : [];
@@ -2217,7 +2190,7 @@ server.tool("premium-deliver", "Deliver a purchased premium plugin. Copies plugi
             isError: true,
         };
     }
-    // Effective purchasedPlugins from signed entitlement (Task 831). The
+    // Effective purchasedPlugins from signed entitlement. The
     // raw account.json value is ignored on commercial installs; verifier
     // returns the signed list (or [] on anonymous-fallback).
     const entitlement = await resolveEntitlement(ENTITLEMENT_BRAND, {
@@ -2582,7 +2555,7 @@ function cleanupPendingAction(actionId) {
     }
 }
 async function persistApprovalToolCall(opts) {
-    // Write doctrine (Task 673): a ToolCall without its owning Conversation is
+    // Write doctrine: a ToolCall without its owning Conversation is
     // noise — every admin tool call belongs to a chat. When conversationId is
     // missing or its Conversation cannot be matched, we log and skip the
     // persist rather than create an orphan ToolCall node. The legacy