@rubytech/create-maxy-code 0.1.330 → 0.1.332

package/dist/index.js

@@ -2848,14 +2848,31 @@ function registerSpecialistAgents() {
 // time for the post-install banner.
 // ---------------------------------------------------------------------------
 function resolveInstallAccountId() {
+    // Managed-service model: prefer the single `role:"house"` account; fall back
+    // to the sole account in the pre-migration window. Returns "" on no accounts
+    // or genuine drift (zero-house with >1, or multiple houses).
     const accountsDir = join(INSTALL_DIR, "data/accounts");
     if (!existsSync(accountsDir))
         return "";
     try {
+        const candidates = [];
+        const houses = [];
         for (const d of readdirSync(accountsDir)) {
-            if (existsSync(join(accountsDir, d, "account.json")))
-                return d;
+            const configPath = join(accountsDir, d, "account.json");
+            if (!existsSync(configPath))
+                continue;
+            candidates.push(d);
+            try {
+                const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+                if (cfg.role === "house")
+                    houses.push(d);
+            }
+            catch { /* unparseable — not a house candidate */ }
         }
+        if (houses.length === 1)
+            return houses[0];
+        if (houses.length === 0 && candidates.length === 1)
+            return candidates[0];
     }
     catch { /* directory unreadable */ }
     return "";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.330",
+  "version": "0.1.332",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -17,6 +17,7 @@
   "commercialMode": false,
   "vertical": "schema-knowledge-work",
   "shipsPremiumBundles": ["venture-studio", "writer-craft", "teaching", "management-consulting"],
+  "primaryContainer": { "label": "Project", "term": "Projects" },
 
   "defaultColors": {
     "primary": "#7C8C72",

package/payload/platform/lib/account-enumeration/dist/index.d.ts

@@ -6,6 +6,39 @@
  * be hiding).
  */
 export declare function enumerateValidAccountIds(accountsDir: string): string[];
+/**
+ * Returns the single `role:"house"` account UUID under `accountsDir`.
+ *
+ * The registry is the enumerated set of valid account dirs (see
+ * `enumerateValidAccountIds`); among them, exactly one must carry
+ * `role:"house"`. Throws on zero-house or multiple-house — both are drift the
+ * managed-service invariant forbids (`houses=<n>` in the message is the failure
+ * signature operators grep for).
+ *
+ * Deliberately NOT cached: house designation can change at runtime when the
+ * operator provisions/archives accounts via the lifecycle tools, so the role
+ * lookup reads `account.json` fresh each call. (`enumerateValidAccountIds` is
+ * still cached for the dir-validity scan; that set is stable for the process.)
+ *
+ * Legacy tolerance is intentionally NOT here: a pre-migration account with no
+ * `role` does not count as house. `setup-account.sh` stamps `role:"house"` on a
+ * sole unlabelled account at seed time, so by manager boot the invariant holds.
+ */
+export declare function resolveHouseAccountId(accountsDir: string): string;
+/**
+ * Like `resolveHouseAccountId`, but tolerant of the pre-migration window: when
+ * no account carries `role:"house"` AND exactly one valid account exists, that
+ * sole account is returned (it is about to be stamped `role:"house"` by
+ * `setup-account.sh`). This is the resolver every "the install's account" call
+ * site uses (boot account dir, installer account id, channel persist), so a
+ * legacy single-account install never throws while waiting for the seed-time
+ * role stamp — the WhatsApp persist path in particular must not drop a customer
+ * message in that window.
+ *
+ * Still loud-fails on genuine drift: zero accounts, multiple houses, or
+ * zero-house with more than one account (`houses=<n> total=<k>` signature).
+ */
+export declare function resolveHouseOrSoleAccountId(accountsDir: string): string;
 /**
  * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
  * pattern at platform/ui/app/lib/claude-agent/account.ts:9

package/payload/platform/lib/account-enumeration/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAgCtE;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAsBjE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAqBvE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAS9C;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,mCAAmC,GAC3C,SAAS,GACT,oBAAoB,GACpB,UAAU,CAAC;AAEf,MAAM,MAAM,sBAAsB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,mCAAmC,CAAC;IAC5C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAAC;AAEN,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,MAAM,EAAE,GAChB,sBAAsB,CAWxB"}

package/payload/platform/lib/account-enumeration/dist/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enumerateValidAccountIds = enumerateValidAccountIds;
+exports.resolveHouseAccountId = resolveHouseAccountId;
+exports.resolveHouseOrSoleAccountId = resolveHouseOrSoleAccountId;
 exports.getAccountsDirFromEnv = getAccountsDirFromEnv;
 exports._resetEnumerationCache = _resetEnumerationCache;
 exports.validateAccountIdEnv = validateAccountIdEnv;
@@ -71,6 +73,80 @@ function enumerateValidAccountIds(accountsDir) {
     cache.set(accountsDir, valid);
     return valid;
 }
+/**
+ * Returns the single `role:"house"` account UUID under `accountsDir`.
+ *
+ * The registry is the enumerated set of valid account dirs (see
+ * `enumerateValidAccountIds`); among them, exactly one must carry
+ * `role:"house"`. Throws on zero-house or multiple-house — both are drift the
+ * managed-service invariant forbids (`houses=<n>` in the message is the failure
+ * signature operators grep for).
+ *
+ * Deliberately NOT cached: house designation can change at runtime when the
+ * operator provisions/archives accounts via the lifecycle tools, so the role
+ * lookup reads `account.json` fresh each call. (`enumerateValidAccountIds` is
+ * still cached for the dir-validity scan; that set is stable for the process.)
+ *
+ * Legacy tolerance is intentionally NOT here: a pre-migration account with no
+ * `role` does not count as house. `setup-account.sh` stamps `role:"house"` on a
+ * sole unlabelled account at seed time, so by manager boot the invariant holds.
+ */
+function resolveHouseAccountId(accountsDir) {
+    const valid = enumerateValidAccountIds(accountsDir);
+    const houses = [];
+    for (const id of valid) {
+        const configPath = (0, node_path_1.resolve)(accountsDir, id, "account.json");
+        try {
+            const cfg = JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+            if (cfg.role === "house")
+                houses.push(id);
+        }
+        catch {
+            // already excluded from `valid` if unparseable; a race here just skips it
+        }
+    }
+    if (houses.length !== 1) {
+        throw new Error(`[account-registry] resolveHouseAccountId: houses=${houses.length} under ${accountsDir} ` +
+            `(${houses.join(", ") || "none"}) — exactly one role:"house" account is required. ` +
+            `Loud-fail rather than picking one silently.`);
+    }
+    return houses[0];
+}
+/**
+ * Like `resolveHouseAccountId`, but tolerant of the pre-migration window: when
+ * no account carries `role:"house"` AND exactly one valid account exists, that
+ * sole account is returned (it is about to be stamped `role:"house"` by
+ * `setup-account.sh`). This is the resolver every "the install's account" call
+ * site uses (boot account dir, installer account id, channel persist), so a
+ * legacy single-account install never throws while waiting for the seed-time
+ * role stamp — the WhatsApp persist path in particular must not drop a customer
+ * message in that window.
+ *
+ * Still loud-fails on genuine drift: zero accounts, multiple houses, or
+ * zero-house with more than one account (`houses=<n> total=<k>` signature).
+ */
+function resolveHouseOrSoleAccountId(accountsDir) {
+    const valid = enumerateValidAccountIds(accountsDir);
+    const houses = [];
+    for (const id of valid) {
+        const configPath = (0, node_path_1.resolve)(accountsDir, id, "account.json");
+        try {
+            const cfg = JSON.parse((0, node_fs_1.readFileSync)(configPath, "utf-8"));
+            if (cfg.role === "house")
+                houses.push(id);
+        }
+        catch {
+            // already excluded from `valid` if unparseable
+        }
+    }
+    if (houses.length === 1)
+        return houses[0];
+    if (houses.length === 0 && valid.length === 1)
+        return valid[0];
+    throw new Error(`[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} ` +
+        `under ${accountsDir} — expected exactly one role:"house" (or a single unlabelled account). ` +
+        `Loud-fail rather than picking one silently.`);
+}
 /**
  * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
  * pattern at platform/ui/app/lib/claude-agent/account.ts:9

package/payload/platform/lib/account-enumeration/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AA3ID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;AAoCA,4DAgCC;AAoBD,sDAsBC;AAeD,kEAqBC;AAUD,sDASC;AAMD,wDAEC;AA8BD,oDAcC;AAzND;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qCAAoD;AACpD,yCAAoC;AAEpC,MAAM,OAAO,GACX,iEAAiE,CAAC;AAEpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;AAE1C;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAExC,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,qBAAW,EAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACrD,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ;gBAAE,SAAS;YAChC,kEAAkE;YAClE,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,MAAM,UAAU,WAAW,GAAG;YACvF,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,oDAAoD;YACnF,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,2BAA2B,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAA,mBAAO,EAAC,WAAW,EAAE,EAAE,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,sBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAEvD,CAAC;YACF,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CACb,0DAA0D,MAAM,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,GAAG;QAC9F,SAAS,WAAW,yEAAyE;QAC7F,6CAA6C,CAChD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC5C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,4EAA4E;YAC1E,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,SAAgB,sBAAsB;IACpC,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AA8BD,SAAgB,oBAAoB,CAClC,QAA4B,EAC5B,OAAiB;IAEjB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC"}

package/payload/platform/lib/account-enumeration/src/index.ts

@@ -68,6 +68,84 @@ export function enumerateValidAccountIds(accountsDir: string): string[] {
   return valid;
 }
 
+/**
+ * Returns the single `role:"house"` account UUID under `accountsDir`.
+ *
+ * The registry is the enumerated set of valid account dirs (see
+ * `enumerateValidAccountIds`); among them, exactly one must carry
+ * `role:"house"`. Throws on zero-house or multiple-house — both are drift the
+ * managed-service invariant forbids (`houses=<n>` in the message is the failure
+ * signature operators grep for).
+ *
+ * Deliberately NOT cached: house designation can change at runtime when the
+ * operator provisions/archives accounts via the lifecycle tools, so the role
+ * lookup reads `account.json` fresh each call. (`enumerateValidAccountIds` is
+ * still cached for the dir-validity scan; that set is stable for the process.)
+ *
+ * Legacy tolerance is intentionally NOT here: a pre-migration account with no
+ * `role` does not count as house. `setup-account.sh` stamps `role:"house"` on a
+ * sole unlabelled account at seed time, so by manager boot the invariant holds.
+ */
+export function resolveHouseAccountId(accountsDir: string): string {
+  const valid = enumerateValidAccountIds(accountsDir);
+  const houses: string[] = [];
+  for (const id of valid) {
+    const configPath = resolve(accountsDir, id, "account.json");
+    try {
+      const cfg = JSON.parse(readFileSync(configPath, "utf-8")) as {
+        role?: unknown;
+      };
+      if (cfg.role === "house") houses.push(id);
+    } catch {
+      // already excluded from `valid` if unparseable; a race here just skips it
+    }
+  }
+  if (houses.length !== 1) {
+    throw new Error(
+      `[account-registry] resolveHouseAccountId: houses=${houses.length} under ${accountsDir} ` +
+        `(${houses.join(", ") || "none"}) — exactly one role:"house" account is required. ` +
+        `Loud-fail rather than picking one silently.`,
+    );
+  }
+  return houses[0];
+}
+
+/**
+ * Like `resolveHouseAccountId`, but tolerant of the pre-migration window: when
+ * no account carries `role:"house"` AND exactly one valid account exists, that
+ * sole account is returned (it is about to be stamped `role:"house"` by
+ * `setup-account.sh`). This is the resolver every "the install's account" call
+ * site uses (boot account dir, installer account id, channel persist), so a
+ * legacy single-account install never throws while waiting for the seed-time
+ * role stamp — the WhatsApp persist path in particular must not drop a customer
+ * message in that window.
+ *
+ * Still loud-fails on genuine drift: zero accounts, multiple houses, or
+ * zero-house with more than one account (`houses=<n> total=<k>` signature).
+ */
+export function resolveHouseOrSoleAccountId(accountsDir: string): string {
+  const valid = enumerateValidAccountIds(accountsDir);
+  const houses: string[] = [];
+  for (const id of valid) {
+    const configPath = resolve(accountsDir, id, "account.json");
+    try {
+      const cfg = JSON.parse(readFileSync(configPath, "utf-8")) as {
+        role?: unknown;
+      };
+      if (cfg.role === "house") houses.push(id);
+    } catch {
+      // already excluded from `valid` if unparseable
+    }
+  }
+  if (houses.length === 1) return houses[0];
+  if (houses.length === 0 && valid.length === 1) return valid[0];
+  throw new Error(
+    `[account-registry] resolveHouseOrSoleAccountId: houses=${houses.length} total=${valid.length} ` +
+      `under ${accountsDir} — expected exactly one role:"house" (or a single unlabelled account). ` +
+      `Loud-fail rather than picking one silently.`,
+  );
+}
+
 /**
  * Resolves the canonical accounts dir from `MAXY_PLATFORM_ROOT`. Mirrors the
  * pattern at platform/ui/app/lib/claude-agent/account.ts:9

package/payload/platform/lib/mcp-spawn-tee/dist/index.d.ts

@@ -1,41 +1,41 @@
 #!/usr/bin/env node
 /**
- * MCP spawn-tee — parent-side stderr capture + lifecycle observability.
+ * MCP spawn-tee — in-process stderr capture + lifecycle observability.
  *
  * Claude Code spawns each MCP server itself; the platform never holds a
- * ChildProcess handle. This wrapper sits between Claude Code and the real
- * MCP server: Claude Code runs `node <this> <real-entry>`, and the wrapper
- * spawns the real entry with `stdio:['inherit','inherit','pipe']` so stdin
- * and stdout (the JSON-RPC channel) pass through byte-identical. Only stderr
- * is intercepted, and only for logging.
+ * ChildProcess handle. This shim sits between Claude Code and the real MCP
+ * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
+ * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
+ * two. Before importing, it replaces process.stderr.write with a tee so every
+ * stderr byte the server writes is mirrored to the log sinks; stdin and stdout
+ * (the JSON-RPC channel) are never touched.
  *
- * Because the wrapper IS the helper's parent, it observes the helper's true
- * exit code, signal, and lifetime for every death mode — including a SIGKILL
- * or a transport-layer crash that an in-process handler would miss.
+ *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
+ *        stdin/stdout : untouched (JSON-RPC channel)
+ *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
  *
- *   Claude Code CLI → wrapper (this file) → child = node <real-entry>
- *        child stdin/stdout : inherited (Claude Code pipe, untouched)
- *        child stderr       : piped → per-date log + per-session log + passthrough
- *
- * Destinations (Task 706):
+ * Destinations (Task 706) — unchanged:
  *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
  *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
  *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines; wrapper-only, so it never mixes the enumeration copy with the
- *     live copy. Authoritative sink. Absent when SESSION_ID is unset
- *     (enumeration spawn) — then the per-date file is the fallback.
+ *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
+ *     spawn) — then the per-date file is the fallback.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
- *     the [mcp-helper] lifecycle lines. A dropped POST loses nothing because
- *     the per-session file already holds the line (written synchronously).
+ *     the [mcp-helper] lifecycle lines.
  *
- * Lifecycle lines, correlation key `session=<id8> server=<name>`:
+ * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
  *   [mcp-helper] op=spawn ... pid= entry=
  *   [mcp-helper] op=boot  ... head=<first stderr bytes>
- *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=   (always)
+ *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *
+ * Process model (Task 989): the shim IS the server's process. op=exit fires
+ * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
+ * uncaught throw (code 1), and a catchable-signal exit (SIGTERM/SIGINT/SIGHUP,
+ * whose handlers record the signal name). An external SIGKILL is uncatchable
+ * and leaves no op=exit line — the per-session stderr tail already on disk and
+ * Claude Code's own transport-drop are the evidence for that death mode.
  *
- * The wrapper never writes to fd 1 (stdout) — that is the JSON-RPC channel.
- * SIGTERM/SIGINT are forwarded to the child so a Claude Code shutdown does
- * not orphan it; the child exit code/signal is propagated verbatim.
+ * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
  */
 export {};
 //# sourceMappingURL=index.d.ts.map

package/payload/platform/lib/mcp-spawn-tee/dist/index.js

@@ -1,47 +1,47 @@
 #!/usr/bin/env node
 "use strict";
 /**
- * MCP spawn-tee — parent-side stderr capture + lifecycle observability.
+ * MCP spawn-tee — in-process stderr capture + lifecycle observability.
  *
  * Claude Code spawns each MCP server itself; the platform never holds a
- * ChildProcess handle. This wrapper sits between Claude Code and the real
- * MCP server: Claude Code runs `node <this> <real-entry>`, and the wrapper
- * spawns the real entry with `stdio:['inherit','inherit','pipe']` so stdin
- * and stdout (the JSON-RPC channel) pass through byte-identical. Only stderr
- * is intercepted, and only for logging.
+ * ChildProcess handle. This shim sits between Claude Code and the real MCP
+ * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
+ * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
+ * two. Before importing, it replaces process.stderr.write with a tee so every
+ * stderr byte the server writes is mirrored to the log sinks; stdin and stdout
+ * (the JSON-RPC channel) are never touched.
  *
- * Because the wrapper IS the helper's parent, it observes the helper's true
- * exit code, signal, and lifetime for every death mode — including a SIGKILL
- * or a transport-layer crash that an in-process handler would miss.
+ *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
+ *        stdin/stdout : untouched (JSON-RPC channel)
+ *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
  *
- *   Claude Code CLI → wrapper (this file) → child = node <real-entry>
- *        child stdin/stdout : inherited (Claude Code pipe, untouched)
- *        child stderr       : piped → per-date log + per-session log + passthrough
- *
- * Destinations (Task 706):
+ * Destinations (Task 706) — unchanged:
  *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
  *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
  *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines; wrapper-only, so it never mixes the enumeration copy with the
- *     live copy. Authoritative sink. Absent when SESSION_ID is unset
- *     (enumeration spawn) — then the per-date file is the fallback.
+ *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
+ *     spawn) — then the per-date file is the fallback.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
- *     the [mcp-helper] lifecycle lines. A dropped POST loses nothing because
- *     the per-session file already holds the line (written synchronously).
+ *     the [mcp-helper] lifecycle lines.
  *
- * Lifecycle lines, correlation key `session=<id8> server=<name>`:
+ * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
  *   [mcp-helper] op=spawn ... pid= entry=
  *   [mcp-helper] op=boot  ... head=<first stderr bytes>
- *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=   (always)
+ *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *
+ * Process model (Task 989): the shim IS the server's process. op=exit fires
+ * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
+ * uncaught throw (code 1), and a catchable-signal exit (SIGTERM/SIGINT/SIGHUP,
+ * whose handlers record the signal name). An external SIGKILL is uncatchable
+ * and leaves no op=exit line — the per-session stderr tail already on disk and
+ * Claude Code's own transport-drop are the evidence for that death mode.
  *
- * The wrapper never writes to fd 1 (stdout) — that is the JSON-RPC channel.
- * SIGTERM/SIGINT are forwarded to the child so a Claude Code shutdown does
- * not orphan it; the child exit code/signal is propagated verbatim.
+ * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
 const SERVER_NAME = process.env.MCP_SPAWN_TEE_NAME ?? "unknown";
 const LOG_DIR = process.env.LOG_DIR;
 const SESSION_ID = process.env.SESSION_ID;
@@ -49,24 +49,37 @@ const PLATFORM_PORT = process.env.PLATFORM_PORT;
 const ENTRY = process.argv[2];
 const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
 const spawnStamp = Date.now();
-// Per-session raw + lifecycle log (Task 706). Wrapper-only. Empty SESSION_ID
-// (enumeration spawn) → undefined, and the per-date file is the fallback.
+// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
+// spawn) → undefined, and the per-date file is the fallback.
 const perSessionPath = LOG_DIR && SESSION_ID
     ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
     : undefined;
 const perDatePath = LOG_DIR
     ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
     : undefined;
-// Rolling tail of child stderr for op=exit. Capped so a chatty child cannot
+// Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
 // grow the buffer without bound.
 const TAIL_CAP = 2048;
 let stderrTail = "";
 let bootEmitted = false;
+let exitEmitted = false;
+let exitSignal;
+// The real stderr writer, captured before the tee replaces it. Lifecycle lines
+// and stderr passthrough both go through this so they are never re-teed into
+// the per-date sink nor recursed back into the patched writer.
+const rawStderrWrite = process.stderr.write.bind(process.stderr);
+// LOG_DIR is created once, lazily, on the first successful append — not per
+// chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
+// mkdirSync would be two syscalls per log line for nothing.
+let logDirReady = false;
 function appendSafe(path, data) {
     if (!path || !LOG_DIR)
         return;
     try {
-        (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+        if (!logDirReady) {
+            (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+            logDirReady = true;
+        }
         (0, node_fs_1.appendFileSync)(path, data);
     }
     catch {
@@ -74,15 +87,16 @@ function appendSafe(path, data) {
     }
 }
 // Best-effort mirror of a lifecycle line to server.log via the loopback
-// log-ingest route. Fire-and-forget: the per-session file is authoritative,
-// so a dropped POST (unreachable port, process exiting) loses nothing.
+// log-ingest route. Fire-and-forget: the per-session file is authoritative, so
+// a dropped POST loses nothing. On the "exit" event the loop is stopping, so
+// the op=exit mirror may not flush — the per-session line, written sync, holds.
 function postToServerLog(suffix, level) {
     if (!PLATFORM_PORT)
         return;
     try {
         const ctrl = new AbortController();
         const t = setTimeout(() => ctrl.abort(), 500);
-        t.unref?.(); // never let the abort timer keep the wrapper's event loop alive
+        t.unref?.(); // never let the abort timer keep the shim's event loop alive
         void fetch(`http://127.0.0.1:${PLATFORM_PORT}/api/admin/log-ingest`, {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -95,14 +109,15 @@ function postToServerLog(suffix, level) {
     }
 }
 // Emit one [mcp-helper] lifecycle line: authoritative per-session file (sync,
-// survives process.exit), the wrapper's own stderr (journald / Claude Code
-// visibility), and a best-effort server.log mirror. `suffix` is the line body
-// after the tag and carries no newline (the log-ingest route rejects newlines).
+// survives process.exit), the shim's own stderr via the RAW writer (journald /
+// Claude Code visibility, never re-teed), and a best-effort server.log mirror.
+// `suffix` is the line body after the tag and carries no newline (the
+// log-ingest route rejects newlines).
 function emitLifecycle(suffix, level) {
     const line = `[mcp-helper] ${suffix}\n`;
     appendSafe(perSessionPath, line);
     try {
-        process.stderr.write(line);
+        rawStderrWrite(line);
     }
     catch { /* stderr closed */ }
     postToServerLog(suffix, level);
@@ -111,49 +126,68 @@ if (!ENTRY) {
     emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason="no entry given (argv[2] missing)"`, "error");
     process.exit(2);
 }
-const child = (0, node_child_process_1.spawn)(process.execPath, [ENTRY], {
-    stdio: ["inherit", "inherit", "pipe"],
-    env: process.env,
-});
-emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} entry=${ENTRY}`, "info");
-child.on("error", (err) => {
-    const msg = err instanceof Error ? err.message : String(err);
-    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`spawn error: ${msg}`)}`, "error");
-    process.exit(127);
+// Replace process.stderr.write with a tee: mirror every server stderr byte to
+// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// op=boot on the first bytes, then pass the write through to the real stderr.
+const teeWrite = ((...args) => {
+    const chunk = args[0];
+    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
+    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    stderrTail = (stderrTail + text).slice(-TAIL_CAP);
+    if (!bootEmitted) {
+        bootEmitted = true;
+        const head = text.split("\n")[0].slice(0, 200);
+        emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+    }
+    return rawStderrWrite(...args); // passthrough
 });
-if (child.stderr) {
-    child.stderr.on("data", (chunk) => {
-        appendSafe(perDatePath, chunk); // per-date raw (back-compat)
-        appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
-        try {
-            process.stderr.write(chunk);
-        }
-        catch { /* stderr closed */ } // passthrough
-        stderrTail = (stderrTail + chunk.toString("utf8")).slice(-TAIL_CAP);
-        if (!bootEmitted) {
-            bootEmitted = true;
-            const head = chunk.toString("utf8").split("\n")[0].slice(0, 200);
-            emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+process.stderr.write = teeWrite;
+// Catchable-signal handling. The shim drives the exit ONLY when it is the sole
+// listener for the signal — i.e. the imported entry installed no handler of its
+// own. In that case it records the signal (so op=exit carries signal=<sig>) and
+// exits with 128+signum, mirroring the prior wrapper's exit-status convention.
+//
+// When the entry DID install a handler, the shim defers entirely and records
+// nothing: the entry's handler decides the exit code, and op=exit reflects that
+// exit verbatim. This matches the prior two-process model, where a child that
+// caught the signal and exited cleanly was observed as code=0 signal=— (a clean
+// self-exit), not as a signal death. Setting exitSignal here unconditionally
+// would mislabel every graceful signal-driven shutdown as a signal kill.
+function onSignal(sig, code) {
+    return () => {
+        if (process.listenerCount(sig) === 1) {
+            exitSignal = sig;
+            process.exit(code);
         }
-    });
+    };
 }
-const forward = (signal) => { if (!child.killed)
-    child.kill(signal); };
-process.on("SIGTERM", () => forward("SIGTERM"));
-process.on("SIGINT", () => forward("SIGINT"));
-// Signal → number, so a signal-killed child propagates as 128+signum (the
-// shell convention). `code` is null on a signal exit, so `128 + (code ?? 0)`
-// would collapse every signal to 128 and lose the signal identity in the
-// wrapper's own exit status.
-const SIGNUM = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15 };
-child.on("exit", (code, signal) => {
+process.on("SIGTERM", onSignal("SIGTERM", 143));
+process.on("SIGINT", onSignal("SIGINT", 130));
+process.on("SIGHUP", onSignal("SIGHUP", 129));
+// op=exit, emitted once from the process "exit" event. Sync-only — the loop is
+// stopping. When a catchable signal caused the exit, report code=— signal=<sig>
+// to match the prior wrapper's format; otherwise code=<exit code> signal=—.
+process.on("exit", (code) => {
+    if (exitEmitted)
+        return;
+    exitEmitted = true;
     const lifetimeMs = Date.now() - spawnStamp;
     const tail = stderrTail.slice(-200);
-    const level = signal || (code ?? 0) !== 0 ? "error" : "info";
-    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} ` +
-        `code=${code ?? "—"} signal=${signal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
-    if (signal)
-        process.exit(128 + (SIGNUM[signal] ?? 0));
-    process.exit(code ?? 0);
+    const codeField = exitSignal ? "—" : String(code);
+    const level = exitSignal || code !== 0 ? "error" : "info";
+    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} ` +
+        `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
+});
+emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} entry=${ENTRY}`, "info");
+// Run the real MCP server in THIS process. Dynamic import() (not top-level
+// await — this file compiles to CommonJS) loads the ESM entry; a load-time
+// failure mirrors the old child spawn-error path (op=error, exit 127). The
+// op=exit handler is suppressed on this path so op=error stays the sole record.
+import((0, node_url_1.pathToFileURL)(ENTRY).href).catch((err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    exitEmitted = true;
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${msg}`)}`, "error");
+    process.exit(127);
 });
 //# sourceMappingURL=index.js.map