@rubytech/create-maxy-code 0.1.330 → 0.1.332

package/payload/platform/plugins/admin/mcp/dist/tools/__tests__/account-lifecycle.test.js

@@ -0,0 +1,57 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, existsSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir } from "../account-lifecycle.js";
+const HOUSE = "11111111-1111-1111-1111-111111111111";
+const CLIENT = "22222222-2222-2222-2222-222222222222";
+function seed(root, id, role) {
+    mkdirSync(join(root, id), { recursive: true });
+    writeFileSync(join(root, id, "account.json"), JSON.stringify({ accountId: id, role }));
+}
+const mk = () => mkdtempSync(join(tmpdir(), "acct-lifecycle-"));
+test("listAccountsFromDir returns registered accounts with roles", () => {
+    const root = mk();
+    try {
+        seed(root, HOUSE, "house");
+        seed(root, CLIENT, "client");
+        mkdirSync(join(root, "not-a-uuid")); // ignored
+        const list = listAccountsFromDir(root).sort((a, b) => a.accountId.localeCompare(b.accountId));
+        assert.equal(list.length, 2);
+        assert.deepEqual(list.find((a) => a.accountId === HOUSE), { accountId: HOUSE, role: "house", isHouse: true });
+        assert.deepEqual(list.find((a) => a.accountId === CLIENT), { accountId: CLIENT, role: "client", isHouse: false });
+    }
+    finally {
+        rmSync(root, { recursive: true });
+    }
+});
+test("isHouseAccount distinguishes house from client", () => {
+    const root = mk();
+    try {
+        seed(root, HOUSE, "house");
+        seed(root, CLIENT, "client");
+        assert.equal(isHouseAccount(root, HOUSE), true);
+        assert.equal(isHouseAccount(root, CLIENT), false);
+    }
+    finally {
+        rmSync(root, { recursive: true });
+    }
+});
+test("archiveAccountDir moves the dir to .trash and reports it absent", () => {
+    const root = mk();
+    try {
+        seed(root, CLIENT, "client");
+        const { trashPath, dirAbsent } = archiveAccountDir(root, CLIENT, "20260618T000000Z");
+        assert.equal(dirAbsent, true);
+        assert.equal(existsSync(join(root, CLIENT)), false);
+        assert.equal(existsSync(trashPath), true);
+        assert.equal(existsSync(join(trashPath, "account.json")), true);
+        // archived account is no longer in the registry
+        assert.equal(listAccountsFromDir(root).length, 0);
+    }
+    finally {
+        rmSync(root, { recursive: true });
+    }
+});
+//# sourceMappingURL=account-lifecycle.test.js.map

package/payload/platform/plugins/admin/mcp/dist/tools/__tests__/account-lifecycle.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-lifecycle.test.js","sourceRoot":"","sources":["../../../src/tools/__tests__/account-lifecycle.test.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACpF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjG,MAAM,KAAK,GAAG,sCAAsC,CAAC;AACrD,MAAM,MAAM,GAAG,sCAAsC,CAAC;AAEtD,SAAS,IAAI,CAAC,IAAY,EAAE,EAAU,EAAE,IAAY;IAClD,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AACD,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEhE,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;IACtE,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU;QAC/C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;IAC1D,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,MAAM,IAAI,GAAG,EAAE,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC7B,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACrF,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,gDAAgD;QAChD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAClD,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.d.ts

@@ -0,0 +1,34 @@
+export interface AccountSummary {
+    accountId: string;
+    role: string;
+    isHouse: boolean;
+}
+/** Enumerate the registry: every UUID dir with a parseable account.json, with
+ *  its role. An unparseable account.json is excluded (corruption discipline,
+ *  mirrors account-enumeration). */
+export declare function listAccountsFromDir(accountsDir: string): AccountSummary[];
+/** True iff `id` is the house account. Used to refuse delete/purge of the house. */
+export declare function isHouseAccount(accountsDir: string, id: string): boolean;
+/** Move a live account dir into `data/accounts/.trash/<id>-<ts>/`. Graph rows are
+ *  retained (purge is a separate, typed-confirmation step). Returns the trash
+ *  path and whether the live dir is now absent (the verified post-condition). */
+export declare function archiveAccountDir(accountsDir: string, id: string, ts: string): {
+    trashPath: string;
+    dirAbsent: boolean;
+};
+/** Scaffold a new client account dir by invoking the shared
+ *  `provision_account_dir` shell function (the same path setup-account.sh uses
+ *  for the house). Synchronous — throws on non-zero exit, which the caller turns
+ *  into a tool error. */
+export declare function provisionClientAccount(opts: {
+    platformRoot: string;
+    accountsDir: string;
+    accountId: string;
+    usersFile: string;
+}): string;
+/** Cypher for the account-scoped node count and the irreversible purge. The
+ *  purge deletes every node carrying the accountId (account scope is a property,
+ *  never an edge — see CLAUDE.md), detaching its relationships. */
+export declare const ACCOUNT_NODE_COUNT_CYPHER = "MATCH (n) WHERE n.accountId = $id RETURN count(n) AS c";
+export declare const ACCOUNT_PURGE_CYPHER = "MATCH (n) WHERE n.accountId = $id DETACH DELETE n";
+//# sourceMappingURL=account-lifecycle.d.ts.map

package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-lifecycle.d.ts","sourceRoot":"","sources":["../../src/tools/account-lifecycle.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;oCAEoC;AACpC,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,cAAc,EAAE,CAoBzE;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED;;iFAEiF;AACjF,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,MAAM,EACnB,EAAE,EAAE,MAAM,EACV,EAAE,EAAE,MAAM,GACT;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAO3C;AAED;;;yBAGyB;AACzB,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,MAAM,CAoBT;AAED;;mEAEmE;AACnE,eAAO,MAAM,yBAAyB,2DAA2D,CAAC;AAClG,eAAO,MAAM,oBAAoB,sDAAsD,CAAC"}

package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.js

@@ -0,0 +1,78 @@
+// Account lifecycle helpers (Task 983) — pure / side-effecting building blocks
+// for the admin-core account_create / account_list / account_delete /
+// account_purge tools. Kept out of index.ts (which connects its stdio transport
+// at import time and so cannot be imported by a unit test) so the enumeration,
+// house-guard, archive, and provision logic are testable in isolation.
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync } from "node:fs";
+import { join, resolve } from "node:path";
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Enumerate the registry: every UUID dir with a parseable account.json, with
+ *  its role. An unparseable account.json is excluded (corruption discipline,
+ *  mirrors account-enumeration). */
+export function listAccountsFromDir(accountsDir) {
+    let names;
+    try {
+        names = readdirSync(accountsDir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of names) {
+        if (!UUID_RE.test(name))
+            continue;
+        const configPath = resolve(accountsDir, name, "account.json");
+        try {
+            const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+            const role = typeof cfg.role === "string" ? cfg.role : "";
+            out.push({ accountId: name, role, isHouse: role === "house" });
+        }
+        catch {
+            // missing/unparseable account.json — not a registered account
+        }
+    }
+    return out;
+}
+/** True iff `id` is the house account. Used to refuse delete/purge of the house. */
+export function isHouseAccount(accountsDir, id) {
+    return listAccountsFromDir(accountsDir).some((a) => a.accountId === id && a.isHouse);
+}
+/** Move a live account dir into `data/accounts/.trash/<id>-<ts>/`. Graph rows are
+ *  retained (purge is a separate, typed-confirmation step). Returns the trash
+ *  path and whether the live dir is now absent (the verified post-condition). */
+export function archiveAccountDir(accountsDir, id, ts) {
+    const liveDir = join(accountsDir, id);
+    const trashRoot = join(accountsDir, ".trash");
+    mkdirSync(trashRoot, { recursive: true });
+    const trashPath = join(trashRoot, `${id}-${ts}`);
+    renameSync(liveDir, trashPath);
+    return { trashPath, dirAbsent: !existsSync(liveDir) };
+}
+/** Scaffold a new client account dir by invoking the shared
+ *  `provision_account_dir` shell function (the same path setup-account.sh uses
+ *  for the house). Synchronous — throws on non-zero exit, which the caller turns
+ *  into a tool error. */
+export function provisionClientAccount(opts) {
+    const accountDir = join(opts.accountsDir, opts.accountId);
+    execFileSync("bash", ["-c", '. "$SCRIPT_DIR/lib/provision-account-dir.sh"; provision_account_dir "$ACCT_DIR" "$ACCT_ID" client'], {
+        env: {
+            ...process.env,
+            TEMPLATES_DIR: join(opts.platformRoot, "templates"),
+            PROJECT_DIR: opts.platformRoot,
+            SCRIPT_DIR: join(opts.platformRoot, "scripts"),
+            USERS_FILE: opts.usersFile,
+            ACCT_DIR: accountDir,
+            ACCT_ID: opts.accountId,
+        },
+        encoding: "utf-8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    return accountDir;
+}
+/** Cypher for the account-scoped node count and the irreversible purge. The
+ *  purge deletes every node carrying the accountId (account scope is a property,
+ *  never an edge — see CLAUDE.md), detaching its relationships. */
+export const ACCOUNT_NODE_COUNT_CYPHER = "MATCH (n) WHERE n.accountId = $id RETURN count(n) AS c";
+export const ACCOUNT_PURGE_CYPHER = "MATCH (n) WHERE n.accountId = $id DETACH DELETE n";
+//# sourceMappingURL=account-lifecycle.js.map

package/payload/platform/plugins/admin/mcp/dist/tools/account-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-lifecycle.js","sourceRoot":"","sources":["../../src/tools/account-lifecycle.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,sEAAsE;AACtE,gFAAgF;AAChF,+EAA+E;AAC/E,uEAAuE;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAQlF;;oCAEoC;AACpC,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAuB,CAAC;YAChF,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,EAAU;IAC5D,OAAO,mBAAmB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;AACvF,CAAC;AAED;;iFAEiF;AACjF,MAAM,UAAU,iBAAiB,CAC/B,WAAmB,EACnB,EAAU,EACV,EAAU;IAEV,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC9C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC/B,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;AACxD,CAAC;AAED;;;yBAGyB;AACzB,MAAM,UAAU,sBAAsB,CAAC,IAKtC;IACC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,YAAY,CACV,MAAM,EACN,CAAC,IAAI,EAAE,mGAAmG,CAAC,EAC3G;QACE,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC;YACnD,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC;YAC9C,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,IAAI,CAAC,SAAS;SACxB;QACD,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CACF,CAAC;IACF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;mEAEmE;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,wDAAwD,CAAC;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,mDAAmD,CAAC"}

package/payload/platform/plugins/admin/skills/plainly/SKILL.md

@@ -96,6 +96,13 @@ Length is dictated by the concept's richness AND by what the user has already su
 - **No follow-up offers.** End on the definition.
 - **Strip AI tells.** See the AI-tells catalogue below. Plain English is the *spoken* register, which rules out patterns that AI writing reaches for but humans rarely use in conversation.
 
+## Second pass
+
+Run this after the precision pass, reading the candidate as a reader rather than as the writer. Two questions, and both must pass before the output ships.
+
+- **Would a person say this out loud?** Read it aloud. A sentence that only works on the page (a formula spoken letter by letter, a clause you have to re-read to parse) fails; rewrite it in the spoken register.
+- **Would a stranger flag this as AI?** If a reader who never saw the draft would point at a sentence and call it machine-written, that sentence carries a tell the precision pass missed. Strip it.
+
 ## AI tells to strip
 
 These are patterns common in AI-generated prose but rare in actual human writing, especially in spoken or conversational registers. Strip every one on the precision pass. The list grows as more patterns are surfaced.

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:b3f1611fcb4116496aadfdfa39e64fce9061f0611c6d926545f6c6523688fc73
+content-hash: sha256:7ce8254f9b8096d919d2be7aa4f6c5a30f5e6dbe1f61007ee00f05af81020445
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2601,7 +2601,7 @@ authoritative. This section names the surfaces and what backs each.
 |---|---|---|
 | `+ New session` button | Opens `NewSessionModal`, which POSTs `{channel, permissionMode, model, initialMessage}` to `/api/admin/claude-sessions`. | `claude-sessions.ts` |
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
-| Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
+| Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. **The "Projects" row is brand-aware:** its visible term and the graph label it filters to both come from the injected `window.__BRAND__.primaryContainer` (`brand.json` → `server/index.ts` inject → `brand.ts` `brandPrimaryContainer()`), so Maxy reads "Projects" → `:Project`, SiteOffice "Jobs" → `:Job`, Real Agent "Properties" → `:Property`. A brand JSON missing `primaryContainer` falls back to Project/Projects (server logs `[brand] op=primaryContainer-default reason=absent brand=<hostname>`; the populated case logs `[brand] op=inject primaryContainer=<label>/<term>`). | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). Below a 400 px list width each row's action icons collapse to a single `MoreHorizontal` ellipsis trigger; its popover menu lists the same actions as the inline icons but labels them with concise verbs (`Resume in claude.ai/code`, `Open in webchat`, `Stop`, `Archive` / `Unarchive`, `Rename`, `Delete`, `Re-seat`) rather than the inline icon buttons' verbose per-session aria-labels — the inline buttons keep those verbose labels because an icon-only control needs the full descriptive accessible name. **Re-seat:** Re-seat is a member action of the one `SessionRowActions` cluster, not a separate sibling control — wide it is the sliders icon inline with the other icons (sharing the cluster geometry and alignment); collapsed it is the `Re-seat` menu item, which expands the model/mode/effort form inline inside the overflow menu. The form (`SessionReseatControl`) forks the session via `/api/admin/session-reseat` and navigates to the fork (the same fork mechanism `/chat`'s pickers drive); its model picker defaults to the row's current model (a `model` field on each row, read from the JSONL tail), and mode and effort each carry a "Keep" option that omits the field. The overflow menu and the Re-seat form render through a `document.body` portal, fixed-positioned from the trigger's rect (right-aligned, flipped above the trigger when there is no room below), so neither is clipped by `.side-list`'s `overflow-y:auto`; Escape, a pointerdown outside the trigger/popover, and any scroll or resize dismiss them. | `/claude-sessions/events`, `/claude-sessions`, `/session-reseat` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". **Re-seat:** each channel conversation row carries a `SessionRowActions` cluster whose sole action is Re-seat (the row is a `conv-with-actions` shell whose open click moved onto an inner button so the cluster can sit beside it), so a WhatsApp/Telegram session's model/mode/effort is re-seatable from the dashboard exactly like a webchat row — wide it is the inline sliders icon, and below the 400 px width it folds into the `…` overflow menu identically to the Sessions rows; the channel reader row carries the same `model` field for the picker default. A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. A centered day-divider row (`.day-divider`) marks each local calendar-day crossover between consecutive turns so a thread spanning midnight is unambiguous. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |

package/payload/platform/plugins/aeo/lib/mcp-spawn-tee/index.js

@@ -1,47 +1,47 @@
 #!/usr/bin/env node
 "use strict";
 /**
- * MCP spawn-tee — parent-side stderr capture + lifecycle observability.
+ * MCP spawn-tee — in-process stderr capture + lifecycle observability.
  *
  * Claude Code spawns each MCP server itself; the platform never holds a
- * ChildProcess handle. This wrapper sits between Claude Code and the real
- * MCP server: Claude Code runs `node <this> <real-entry>`, and the wrapper
- * spawns the real entry with `stdio:['inherit','inherit','pipe']` so stdin
- * and stdout (the JSON-RPC channel) pass through byte-identical. Only stderr
- * is intercepted, and only for logging.
+ * ChildProcess handle. This shim sits between Claude Code and the real MCP
+ * server: Claude Code runs `node <this> <real-entry>`, and the shim runs the
+ * real entry IN ITS OWN PROCESS via dynamic import() — one node runtime, not
+ * two. Before importing, it replaces process.stderr.write with a tee so every
+ * stderr byte the server writes is mirrored to the log sinks; stdin and stdout
+ * (the JSON-RPC channel) are never touched.
  *
- * Because the wrapper IS the helper's parent, it observes the helper's true
- * exit code, signal, and lifetime for every death mode — including a SIGKILL
- * or a transport-layer crash that an in-process handler would miss.
+ *   Claude Code CLI → shim (this file) = node running <real-entry> in-process
+ *        stdin/stdout : untouched (JSON-RPC channel)
+ *        stderr       : process.stderr.write teed → per-date + per-session + passthrough
  *
- *   Claude Code CLI → wrapper (this file) → child = node <real-entry>
- *        child stdin/stdout : inherited (Claude Code pipe, untouched)
- *        child stderr       : piped → per-date log + per-session log + passthrough
- *
- * Destinations (Task 706):
+ * Destinations (Task 706) — unchanged:
  *   - `${LOG_DIR}/mcp-<name>-stderr-<date>.log`  — per-date raw (back-compat;
  *     the in-process mcp-stderr-tee and the [mcp-init-error] probe read it).
  *   - `${LOG_DIR}/mcp-<name>-<SESSION_ID>.log`   — per-session raw + lifecycle
- *     lines; wrapper-only, so it never mixes the enumeration copy with the
- *     live copy. Authoritative sink. Absent when SESSION_ID is unset
- *     (enumeration spawn) — then the per-date file is the fallback.
+ *     lines. Authoritative sink. Absent when SESSION_ID is unset (enumeration
+ *     spawn) — then the per-date file is the fallback.
  *   - `server.log` via the loopback log-ingest route — best-effort mirror of
- *     the [mcp-helper] lifecycle lines. A dropped POST loses nothing because
- *     the per-session file already holds the line (written synchronously).
+ *     the [mcp-helper] lifecycle lines.
  *
- * Lifecycle lines, correlation key `session=<id8> server=<name>`:
+ * Lifecycle lines, correlation key `session=<id8> server=<name>` — unchanged:
  *   [mcp-helper] op=spawn ... pid= entry=
  *   [mcp-helper] op=boot  ... head=<first stderr bytes>
- *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=   (always)
+ *   [mcp-helper] op=exit  ... code= signal= lifetimeMs= stderr-tail=
+ *
+ * Process model (Task 989): the shim IS the server's process. op=exit fires
+ * from process.on("exit"), so it covers a normal exit, a non-zero exit, an
+ * uncaught throw (code 1), and a catchable-signal exit (SIGTERM/SIGINT/SIGHUP,
+ * whose handlers record the signal name). An external SIGKILL is uncatchable
+ * and leaves no op=exit line — the per-session stderr tail already on disk and
+ * Claude Code's own transport-drop are the evidence for that death mode.
  *
- * The wrapper never writes to fd 1 (stdout) — that is the JSON-RPC channel.
- * SIGTERM/SIGINT are forwarded to the child so a Claude Code shutdown does
- * not orphan it; the child exit code/signal is propagated verbatim.
+ * The shim never writes to fd 1 (stdout) — that is the JSON-RPC channel.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+const node_url_1 = require("node:url");
 const SERVER_NAME = process.env.MCP_SPAWN_TEE_NAME ?? "unknown";
 const LOG_DIR = process.env.LOG_DIR;
 const SESSION_ID = process.env.SESSION_ID;
@@ -49,24 +49,37 @@ const PLATFORM_PORT = process.env.PLATFORM_PORT;
 const ENTRY = process.argv[2];
 const SESSION_ID8 = SESSION_ID ? SESSION_ID.slice(0, 8) : "—";
 const spawnStamp = Date.now();
-// Per-session raw + lifecycle log (Task 706). Wrapper-only. Empty SESSION_ID
-// (enumeration spawn) → undefined, and the per-date file is the fallback.
+// Per-session raw + lifecycle log (Task 706). Empty SESSION_ID (enumeration
+// spawn) → undefined, and the per-date file is the fallback.
 const perSessionPath = LOG_DIR && SESSION_ID
     ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-${SESSION_ID}.log`)
     : undefined;
 const perDatePath = LOG_DIR
     ? (0, node_path_1.resolve)(LOG_DIR, `mcp-${SERVER_NAME}-stderr-${new Date(spawnStamp).toISOString().slice(0, 10)}.log`)
     : undefined;
-// Rolling tail of child stderr for op=exit. Capped so a chatty child cannot
+// Rolling tail of entry stderr for op=exit. Capped so a chatty server cannot
 // grow the buffer without bound.
 const TAIL_CAP = 2048;
 let stderrTail = "";
 let bootEmitted = false;
+let exitEmitted = false;
+let exitSignal;
+// The real stderr writer, captured before the tee replaces it. Lifecycle lines
+// and stderr passthrough both go through this so they are never re-teed into
+// the per-date sink nor recursed back into the patched writer.
+const rawStderrWrite = process.stderr.write.bind(process.stderr);
+// LOG_DIR is created once, lazily, on the first successful append — not per
+// chunk. teeWrite runs on the server's own stderr hot path now, so a per-call
+// mkdirSync would be two syscalls per log line for nothing.
+let logDirReady = false;
 function appendSafe(path, data) {
     if (!path || !LOG_DIR)
         return;
     try {
-        (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+        if (!logDirReady) {
+            (0, node_fs_1.mkdirSync)(LOG_DIR, { recursive: true });
+            logDirReady = true;
+        }
         (0, node_fs_1.appendFileSync)(path, data);
     }
     catch {
@@ -74,15 +87,16 @@ function appendSafe(path, data) {
     }
 }
 // Best-effort mirror of a lifecycle line to server.log via the loopback
-// log-ingest route. Fire-and-forget: the per-session file is authoritative,
-// so a dropped POST (unreachable port, process exiting) loses nothing.
+// log-ingest route. Fire-and-forget: the per-session file is authoritative, so
+// a dropped POST loses nothing. On the "exit" event the loop is stopping, so
+// the op=exit mirror may not flush — the per-session line, written sync, holds.
 function postToServerLog(suffix, level) {
     if (!PLATFORM_PORT)
         return;
     try {
         const ctrl = new AbortController();
         const t = setTimeout(() => ctrl.abort(), 500);
-        t.unref?.(); // never let the abort timer keep the wrapper's event loop alive
+        t.unref?.(); // never let the abort timer keep the shim's event loop alive
         void fetch(`http://127.0.0.1:${PLATFORM_PORT}/api/admin/log-ingest`, {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -95,14 +109,15 @@ function postToServerLog(suffix, level) {
     }
 }
 // Emit one [mcp-helper] lifecycle line: authoritative per-session file (sync,
-// survives process.exit), the wrapper's own stderr (journald / Claude Code
-// visibility), and a best-effort server.log mirror. `suffix` is the line body
-// after the tag and carries no newline (the log-ingest route rejects newlines).
+// survives process.exit), the shim's own stderr via the RAW writer (journald /
+// Claude Code visibility, never re-teed), and a best-effort server.log mirror.
+// `suffix` is the line body after the tag and carries no newline (the
+// log-ingest route rejects newlines).
 function emitLifecycle(suffix, level) {
     const line = `[mcp-helper] ${suffix}\n`;
     appendSafe(perSessionPath, line);
     try {
-        process.stderr.write(line);
+        rawStderrWrite(line);
     }
     catch { /* stderr closed */ }
     postToServerLog(suffix, level);
@@ -111,49 +126,68 @@ if (!ENTRY) {
     emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason="no entry given (argv[2] missing)"`, "error");
     process.exit(2);
 }
-const child = (0, node_child_process_1.spawn)(process.execPath, [ENTRY], {
-    stdio: ["inherit", "inherit", "pipe"],
-    env: process.env,
-});
-emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} entry=${ENTRY}`, "info");
-child.on("error", (err) => {
-    const msg = err instanceof Error ? err.message : String(err);
-    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`spawn error: ${msg}`)}`, "error");
-    process.exit(127);
+// Replace process.stderr.write with a tee: mirror every server stderr byte to
+// the per-date and per-session sinks, keep a rolling tail for op=exit, emit
+// op=boot on the first bytes, then pass the write through to the real stderr.
+const teeWrite = ((...args) => {
+    const chunk = args[0];
+    appendSafe(perDatePath, chunk); // per-date raw (back-compat)
+    appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
+    const text = typeof chunk === "string" ? chunk : Buffer.from(chunk).toString("utf8");
+    stderrTail = (stderrTail + text).slice(-TAIL_CAP);
+    if (!bootEmitted) {
+        bootEmitted = true;
+        const head = text.split("\n")[0].slice(0, 200);
+        emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+    }
+    return rawStderrWrite(...args); // passthrough
 });
-if (child.stderr) {
-    child.stderr.on("data", (chunk) => {
-        appendSafe(perDatePath, chunk); // per-date raw (back-compat)
-        appendSafe(perSessionPath, chunk); // per-session raw (Task 706)
-        try {
-            process.stderr.write(chunk);
-        }
-        catch { /* stderr closed */ } // passthrough
-        stderrTail = (stderrTail + chunk.toString("utf8")).slice(-TAIL_CAP);
-        if (!bootEmitted) {
-            bootEmitted = true;
-            const head = chunk.toString("utf8").split("\n")[0].slice(0, 200);
-            emitLifecycle(`op=boot session=${SESSION_ID8} server=${SERVER_NAME} head=${JSON.stringify(head)}`, "info");
+process.stderr.write = teeWrite;
+// Catchable-signal handling. The shim drives the exit ONLY when it is the sole
+// listener for the signal — i.e. the imported entry installed no handler of its
+// own. In that case it records the signal (so op=exit carries signal=<sig>) and
+// exits with 128+signum, mirroring the prior wrapper's exit-status convention.
+//
+// When the entry DID install a handler, the shim defers entirely and records
+// nothing: the entry's handler decides the exit code, and op=exit reflects that
+// exit verbatim. This matches the prior two-process model, where a child that
+// caught the signal and exited cleanly was observed as code=0 signal=— (a clean
+// self-exit), not as a signal death. Setting exitSignal here unconditionally
+// would mislabel every graceful signal-driven shutdown as a signal kill.
+function onSignal(sig, code) {
+    return () => {
+        if (process.listenerCount(sig) === 1) {
+            exitSignal = sig;
+            process.exit(code);
         }
-    });
+    };
 }
-const forward = (signal) => { if (!child.killed)
-    child.kill(signal); };
-process.on("SIGTERM", () => forward("SIGTERM"));
-process.on("SIGINT", () => forward("SIGINT"));
-// Signal → number, so a signal-killed child propagates as 128+signum (the
-// shell convention). `code` is null on a signal exit, so `128 + (code ?? 0)`
-// would collapse every signal to 128 and lose the signal identity in the
-// wrapper's own exit status.
-const SIGNUM = { SIGHUP: 1, SIGINT: 2, SIGQUIT: 3, SIGKILL: 9, SIGTERM: 15 };
-child.on("exit", (code, signal) => {
+process.on("SIGTERM", onSignal("SIGTERM", 143));
+process.on("SIGINT", onSignal("SIGINT", 130));
+process.on("SIGHUP", onSignal("SIGHUP", 129));
+// op=exit, emitted once from the process "exit" event. Sync-only — the loop is
+// stopping. When a catchable signal caused the exit, report code=— signal=<sig>
+// to match the prior wrapper's format; otherwise code=<exit code> signal=—.
+process.on("exit", (code) => {
+    if (exitEmitted)
+        return;
+    exitEmitted = true;
     const lifetimeMs = Date.now() - spawnStamp;
     const tail = stderrTail.slice(-200);
-    const level = signal || (code ?? 0) !== 0 ? "error" : "info";
-    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${child.pid ?? -1} ` +
-        `code=${code ?? "—"} signal=${signal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
-    if (signal)
-        process.exit(128 + (SIGNUM[signal] ?? 0));
-    process.exit(code ?? 0);
+    const codeField = exitSignal ? "—" : String(code);
+    const level = exitSignal || code !== 0 ? "error" : "info";
+    emitLifecycle(`op=exit session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} ` +
+        `code=${codeField} signal=${exitSignal ?? "—"} lifetimeMs=${lifetimeMs} stderr-tail=${JSON.stringify(tail)}`, level);
+});
+emitLifecycle(`op=spawn session=${SESSION_ID8} server=${SERVER_NAME} pid=${process.pid} entry=${ENTRY}`, "info");
+// Run the real MCP server in THIS process. Dynamic import() (not top-level
+// await — this file compiles to CommonJS) loads the ESM entry; a load-time
+// failure mirrors the old child spawn-error path (op=error, exit 127). The
+// op=exit handler is suppressed on this path so op=error stays the sole record.
+import((0, node_url_1.pathToFileURL)(ENTRY).href).catch((err) => {
+    const msg = err instanceof Error ? err.message : String(err);
+    exitEmitted = true;
+    emitLifecycle(`op=error session=${SESSION_ID8} server=${SERVER_NAME} reason=${JSON.stringify(`import error: ${msg}`)}`, "error");
+    process.exit(127);
 });
 //# sourceMappingURL=index.js.map