@rubytech/create-maxy-code 0.1.334 → 0.1.337

package/dist/__tests__/watchdog-deferred-arming.test.js

@@ -1,22 +1,29 @@
-// Contract for the hardware watchdog arming point.
+// Contract for the hardware watchdog feature.
 //
-// On a constrained Pi the installer's `RuntimeWatchdogSec=20s` drop-in,
-// armed at install step 1, reboot-looped its own install: the heavy npm/swap
-// steps stalled PID1 past 20s, the board reset, the relaunch stalled again.
-// The fix arms the watchdog only as the final install action, once the heavy
-// build/swap window is over, and applies it via `daemon-reexec` so it is
-// actually active (RuntimeWatchdogUSec non-zero) without waiting for a reboot.
+// History: an early version armed RuntimeWatchdogSec=20s at install step 1
+// and the install reboot-looped its own build. A follow-up deferred the
+// arm to install end and applied it via daemon-reexec. That arm landed at
+// the peak of post-install load (services initialising, chattr +i sweep
+// just finished, neo4j seeding); the 20s timer fired before PID1 caught up
+// and beacons reset immediately after install end with the connection
+// dropped mid-banner.
 //
-// Static-grep, not behaviour: the call site and the apply command live in the
-// top-level install flow of index.ts, which executes real sudo/systemctl.
-// Same pattern as base-toolchain-deps.test.ts — read src/index.ts at runtime
-// as the authoritative source.
+// Raising RuntimeWatchdogSec is inert above the kernel watchdog cap
+// (~15s on BCM2835), so the timer cannot simply be loosened. The feature
+// has been retired. The contract is now:
+//   1. configureHardwareWatchdog() arms nothing — no drop-in write, no
+//      daemon-reexec, no RuntimeWatchdogSec=20s reference.
+//   2. disableHardwareWatchdogForInstall() runs at install start and
+//      removes the drop-in (rm -f) on devices that carry one from an
+//      earlier installer version, plus a daemon-reexec to apply.
+//
+// Static-grep, not behaviour: the call sites live in the top-level install
+// flow of index.ts. Read src/index.ts at runtime as the authoritative source.
 import test from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, resolve } from "node:path";
-// dist/__tests__/watchdog-deferred-arming.test.js → ../../src/index.ts
 const here = dirname(fileURLToPath(import.meta.url));
 const INDEX_TS = resolve(here, "../../src/index.ts");
 const SRC = readFileSync(INDEX_TS, "utf-8");
@@ -28,35 +35,30 @@ function watchdogFnBody() {
     assert.ok(end > start, "could not bound configureHardwareWatchdog body");
     return SRC.slice(start, end);
 }
-test("watchdog is armed after buildPlatform and installService, not at step 1", () => {
-    const watchdogCall = SRC.indexOf("configureHardwareWatchdog();");
-    const build = SRC.indexOf("buildPlatform();");
-    const service = SRC.indexOf("installService();");
-    assert.ok(watchdogCall >= 0, "no configureHardwareWatchdog() call in the install flow");
-    assert.ok(build >= 0 && service >= 0, "expected buildPlatform()/installService() calls");
-    assert.ok(watchdogCall > build, "watchdog must be armed after buildPlatform()");
-    assert.ok(watchdogCall > service, "watchdog must be armed after installService()");
-    // the old step-1 placement (immediately after installSystemDeps()) is gone
-    assert.equal(SRC.includes("installSystemDeps();\n  configureHardwareWatchdog();"), false, "watchdog must not be armed at step 1, right after installSystemDeps()");
-});
-test("watchdog drop-in is applied with daemon-reexec, not daemon-reload", () => {
-    const body = watchdogFnBody();
-    // match the quoted systemctl argument so explanatory comments naming the old
-    // command do not skew the assertion.
-    assert.ok(body.includes('"daemon-reexec"'), "configureHardwareWatchdog must apply via daemon-reexec");
-    assert.equal(body.includes('"daemon-reload"'), false, "daemon-reload does not apply RuntimeWatchdogSec");
+/** Body of disableHardwareWatchdogForInstall(), up to the next top-level function. */
+function disableFnBody() {
+    const start = SRC.indexOf("function disableHardwareWatchdogForInstall");
+    assert.ok(start >= 0, "could not locate disableHardwareWatchdogForInstall in index.ts");
+    // The function lives immediately before configureHardwareWatchdog().
+    const end = SRC.indexOf("function configureHardwareWatchdog", start);
+    assert.ok(end > start, "could not bound disableHardwareWatchdogForInstall body");
+    return SRC.slice(start, end);
+}
+test("watchdog disable runs at install start, before any heavy step", () => {
+    const disableCall = SRC.indexOf("disableHardwareWatchdogForInstall();");
+    const installSystemDeps = SRC.indexOf("installSystemDeps();");
+    assert.ok(disableCall >= 0, "no disableHardwareWatchdogForInstall() call in the install flow");
+    assert.ok(installSystemDeps >= 0, "expected installSystemDeps() call");
+    assert.ok(disableCall < installSystemDeps, "disableHardwareWatchdogForInstall() must precede installSystemDeps() so the heavy steps run unarmed");
 });
-test("idempotent re-run only skips re-arming when the watchdog is live-armed", () => {
-    // A drop-in on disk does not prove the live PID1 has the watchdog active
-    // (prior daemon-reload, or a just-removed disable override). The function must
-    // read RuntimeWatchdogUSec and re-arm when it is 0, so the muvin remediation
-    // (drop-in present, previously disabled) actually arms.
+test("watchdog post-install arm is retired — no drop-in write, no daemon-reexec", () => {
     const body = watchdogFnBody();
-    assert.ok(body.includes("RuntimeWatchdogUSec"), "must read live RuntimeWatchdogUSec before skipping the arm");
-    assert.ok(body.includes('"--value"'), "must read the live watchdog value, not just the drop-in content");
+    assert.equal(body.includes("RuntimeWatchdogSec=20s"), false, "configureHardwareWatchdog must not re-introduce the 20s timer that reboot-looped constrained Pis");
+    assert.equal(body.includes("RebootWatchdogSec=2min"), false, "configureHardwareWatchdog must not re-introduce the reboot timer drop-in line");
+    assert.equal(body.includes('"daemon-reexec"'), false, "configureHardwareWatchdog must not arm via daemon-reexec — the post-install arm killed beacons");
 });
-test("watchdog keeps the 20s runtime / 2min reboot values", () => {
-    const body = watchdogFnBody();
-    assert.ok(body.includes("RuntimeWatchdogSec=20s"), "RuntimeWatchdogSec stays 20s");
-    assert.ok(body.includes("RebootWatchdogSec=2min"), "RebootWatchdogSec stays 2min");
+test("disable-for-install scrubs the drop-in (rm) and daemon-reexecs", () => {
+    const body = disableFnBody();
+    assert.ok(body.includes('"-f"') && body.includes("dropinPath"), "must remove the drop-in (rm -f dropinPath) so the live RuntimeWatchdogUSec returns to 0");
+    assert.ok(body.includes('"daemon-reexec"'), "must daemon-reexec after removing the drop-in so the change applies live without waiting for reboot");
 });

package/dist/index.js

@@ -608,115 +608,77 @@ function writeChromiumBinaryPathFile() {
     console.log(`  Wrote ${target} → ${RESOLVED_CHROMIUM_BIN}`);
     logFile(`  [snap-chromium] wrote ${target} contents=${RESOLVED_CHROMIUM_BIN}`);
 }
-// Arm the systemd system-manager hardware watchdog so a *kernel hang* (the
-// freeze mode: board powered but stuck, /dev/watchdog never petted) reboots the
-// board without a manual power cycle. Distinct from the brand user-service's
-// software watchdog (Type=notify WATCHDOG_USEC), which only restarts the UI
-// process — this resets the whole SoC. Idempotent host-wide drop-in; gated on
-// /dev/watchdog existing (driver loaded) and Linux. Best-effort: a failure
-// warns, never aborts the install. Cannot recover a latched-off brownout (no
-// power = no watchdog) — that needs the external power-cycler documented in
-// deployment.md.
+// Scrub any hardware-watchdog drop-in this installer (or an earlier version)
+// left on the box, then daemon-reexec so the live RuntimeWatchdogUSec returns
+// to systemd's default (0 = off). The hardware-watchdog feature is retired:
+// a RuntimeWatchdogSec=20s timer (inert above the ~15s BCM2835 kernel cap, so
+// it cannot be loosened) reboot-looped constrained Pis — mid-install when armed
+// early, and again at the post-install load peak when armed at install end. It
+// bit both muvin and beacons. configureHardwareWatchdog() no longer arms
+// anything; see its comment for the full rationale. Kernel-freeze recovery is
+// left to the brand service's software watchdog (Type=notify WATCHDOG_USEC),
+// which restarts the UI process rather than resetting the whole SoC.
 //
-// Called as the FINAL install action (not step 1): RuntimeWatchdogSec=20s is a
-// tight timer, and the heavy npm-install/swap-thrash steps stall PID1 past 20s
-// on a constrained Pi. Arming early reboot-looped the install (the board reset
-// mid-build, relaunched under the same load, reset again). Deferring the arm to
-// after the build/swap window, then applying it with `daemon-reexec` so it is
-// active immediately (RuntimeWatchdogUSec non-zero), keeps kernel-hang recovery
-// without the loop.
-// Disable the hardware watchdog drop-in for the duration of the install.
-// configureHardwareWatchdog() writes /etc/systemd/system.conf.d/10-maxy-watchdog.conf
-// (RuntimeWatchdogSec=20s) at the END of every install. That file persists
-// across reboots, so on every install AFTER the first, PID1 already has the
-// watchdog armed from boot. The heavy npm/Playwright/swap step in step [3/11]
-// can stall PID1 past 20s on a constrained Pi, the SoC resets mid-install,
-// boot resumes with the watchdog re-armed, the install never completes, and
-// the box wedges (SSH never returns; observed on beacons).
-//
-// Neutralise the watchdog at install start by overwriting the drop-in with
-// RuntimeWatchdogSec=0 and daemon-reexec to apply it immediately. Re-armed
-// at install end by configureHardwareWatchdog(). If install fails between
-// the two, the box is unarmed — recoverable, far better than reboot-loop.
+// Runs unconditionally at install start. Idempotent: if no drop-in is on
+// disk, this is a no-op.
 function disableHardwareWatchdogForInstall() {
     try {
         if (!isLinux()) {
-            logFile("  hardware watchdog: disable-for-install skipped (not Linux)");
+            logFile("  hardware watchdog: scrub-on-install skipped (not Linux)");
             return;
         }
-        if (!existsSync("/dev/watchdog")) {
-            logFile("  hardware watchdog: disable-for-install skipped (/dev/watchdog absent)");
+        const dropinPath = "/etc/systemd/system.conf.d/10-maxy-watchdog.conf";
+        if (!existsSync(dropinPath)) {
+            logFile(`  hardware watchdog: no prior drop-in to scrub (${dropinPath})`);
             return;
         }
-        const disabled = "[Manager]\nRuntimeWatchdogSec=0\n";
-        const dropinDir = "/etc/systemd/system.conf.d";
-        const dropinPath = `${dropinDir}/10-maxy-watchdog.conf`;
-        const tmpPath = "/tmp/10-maxy-watchdog.conf";
-        writeFileSync(tmpPath, disabled);
-        console.log("  [privileged] disable hardware watchdog for install duration (RuntimeWatchdogSec=0)");
-        shell("mkdir", ["-p", dropinDir], { sudo: true });
-        shell("cp", [tmpPath, dropinPath], { sudo: true });
-        spawnSync("rm", ["-f", tmpPath]);
+        console.log(`  [privileged] remove prior hardware-watchdog drop-in (${dropinPath}) — feature retired`);
+        shell("rm", ["-f", dropinPath], { sudo: true });
         spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
-        logFile(`  hardware watchdog: disabled for install (${dropinPath}, RuntimeWatchdogSec=0; re-armed at install end)`);
+        logFile(`  hardware watchdog: drop-in removed; daemon-reexec applied — RuntimeWatchdogUSec back to default`);
     }
     catch (err) {
-        console.error(`  WARNING: failed to disable hardware watchdog for install: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`  WARNING: failed to scrub hardware-watchdog drop-in: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 function configureHardwareWatchdog() {
+    // The hardware-watchdog drop-in was hostile to constrained Pis. Task 997
+    // deferred the arm to install end so a tight 20s timer would not reboot the
+    // box mid-build. But arming via daemon-reexec at install end lands the live
+    // timer at the very peak of post-install load (services initialising,
+    // chattr +i sweep just finished, neo4j seeding). PID1 cannot feed
+    // /dev/watchdog fast enough — the SoC resets, next boot starts the same
+    // services under the same load, resets again. Beacons reboot-looped on
+    // every install after the previous fix until the operator deleted the
+    // drop-in by hand.
+    //
+    // Raising RuntimeWatchdogSec is inert above the kernel watchdog cap
+    // (~15s on BCM2835), so the timer cannot simply be loosened. Until a
+    // version of this feature actually survives a constrained-Pi install
+    // unattended, it is removed. The disable-at-install-start path
+    // (disableHardwareWatchdogForInstall) stays — it scrubs any prior
+    // drop-in off devices that had it from earlier installer versions, so the
+    // hostile timer is cleared from the fleet on first run of this installer
+    // version. Kernel-freeze recovery is deferred to the in-server software
+    // watchdog (Type=notify WATCHDOG_USEC, already shipped on the brand
+    // service) which restarts the UI process, not the whole SoC.
     try {
         if (!isLinux()) {
             logFile("  hardware watchdog: skipped (not Linux)");
             return;
         }
-        if (!existsSync("/dev/watchdog")) {
-            logFile("  hardware watchdog: skipped (/dev/watchdog absent)");
-            return;
-        }
-        const desired = "[Manager]\nRuntimeWatchdogSec=20s\nRebootWatchdogSec=2min\n";
-        const dropinDir = "/etc/systemd/system.conf.d";
-        const dropinPath = `${dropinDir}/10-maxy-watchdog.conf`;
-        let current = "";
+        const dropinPath = "/etc/systemd/system.conf.d/10-maxy-watchdog.conf";
         if (existsSync(dropinPath)) {
-            try {
-                current = readFileSync(dropinPath, "utf-8");
-            }
-            catch {
-                // Unreadable existing drop-in — treat as changed so we rewrite.
-                current = "";
-            }
-        }
-        if (current !== desired) {
-            const tmpPath = "/tmp/10-maxy-watchdog.conf";
-            writeFileSync(tmpPath, desired);
-            console.log("  [privileged] install systemd hardware watchdog drop-in (RuntimeWatchdogSec=20s RebootWatchdogSec=2min)");
-            shell("mkdir", ["-p", dropinDir], { sudo: true });
-            shell("cp", [tmpPath, dropinPath], { sudo: true });
-            spawnSync("rm", ["-f", tmpPath]);
-        }
-        // Arm now, idempotently. The drop-in being on disk does NOT mean the live
-        // PID1 has the watchdog active — a prior install that only ran daemon-reload,
-        // or a just-removed disable override (RuntimeWatchdogSec=0), leaves the file
-        // present but RuntimeWatchdogUSec=0. So read the live value and only skip the
-        // re-exec when the watchdog is genuinely armed already; otherwise daemon-reexec
-        // re-execs PID1 in place (host-wide; running services are preserved) to apply
-        // the system-manager setting. daemon-reload does not apply RuntimeWatchdogSec.
-        const liveUsec = spawnSync("systemctl", ["show", "-p", "RuntimeWatchdogUSec", "--value"], {
-            encoding: "utf-8",
-            stdio: "pipe",
-            timeout: 5_000,
-        });
-        const usec = (liveUsec.stdout ?? "").trim();
-        if (current === desired && usec !== "" && usec !== "0") {
-            logFile(`  hardware watchdog: already active (${dropinPath}, RuntimeWatchdogUSec=${usec})`);
+            // Defence in depth — disableHardwareWatchdogForInstall() already runs
+            // at install start, but log here too so the install summary makes the
+            // policy explicit even if step 0 was skipped.
+            logFile(`  hardware watchdog: drop-in present at ${dropinPath} but feature is disabled (see disableHardwareWatchdogForInstall)`);
             return;
         }
-        spawnSync("sudo", ["systemctl", "daemon-reexec"], { stdio: "inherit" });
-        logFile(`  hardware watchdog: enabled (${dropinPath}; armed now via daemon-reexec, after the build/swap window)`);
+        logFile("  hardware watchdog: feature disabled (constrained-Pi reboot loops)");
     }
     catch (err) {
-        console.error(`  WARNING: failed to configure hardware watchdog: ${err instanceof Error ? err.message : String(err)}`);
+        console.error(`  WARNING: hardware watchdog post-install probe failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
 function installSystemDeps() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.334",
+  "version": "0.1.337",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"
@@ -13,7 +13,7 @@
     "build": "tsc",
     "bundle": "node scripts/bundle.js",
     "test": "npm run build && node --test 'dist/__tests__/*.test.js'",
-    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
+    "prepublishOnly": "bash ../../platform/scripts/verify-skill-tool-surface.sh && node ../../platform/scripts/check-plugin-tools-mcp-consistency.mjs && node ../../platform/scripts/check-specialist-tool-surface.mjs && node ../../platform/scripts/check-routing-prose-bash.mjs && node ../../platform/scripts/check-no-task-id-leaks.mjs && node ../../platform/scripts/check-no-esm-require.mjs && node ../../platform/scripts/check-no-raw-mcp-registrations.mjs && node ../../platform/scripts/check-skill-load-coverage.mjs && node ../../platform/scripts/check-architecture-skill-no-drift.mjs && node ../../platform/ui/scripts/check-route-wiring.mjs && node ../../platform/ui/scripts/check-edge-admin-routes.mjs && npm run build && node --test 'dist/__tests__/*.test.js' && chmod +x dist/index.js && npm run bundle && bash ../../platform/scripts/smoke-boot-services.sh && node ../../platform/ui/scripts/check-bundle-node-imports.mjs --dir=./payload/server/public/assets"
   },
   "files": [
     "dist",

package/payload/platform/plugins/cloudflare/references/api.md

@@ -247,7 +247,8 @@ The tally is **names only** — a token value is never printed (the redaction bi
 
 ## When to use which path
 
-- **Tunnel create/route/run** → `cloudflared` (OAuth cert), per `manual-setup.md`. The API can manage tunnels too, but the cert path is the established one.
+- **Tunnel create/route** → `cloudflared` with the OAuth cert, per `manual-setup.md`. The API can manage tunnels too, but the cert path is the established one for create/route.
+- **Tunnel run/resume** → `cloudflared tunnel run` authenticates with the per-tunnel credentials-file named in `config.yml`, not the cert, so the connector (and the `resume-tunnel.sh` supervisor) respawns a configured tunnel with no cert present. This is what lets a tunnel created via the API-token credentials-file path resume on reboot like an OAuth one.
 - **Apex CNAME** → API (above) or dashboard (`dashboard-guide.md`). Either flattens correctly.
 - **Pages deploy** → `wrangler` with the reused `<brand>-pages-d1` token, per `hosting-sites.md`.
 - **D1 read/write** → `wrangler d1 execute --remote` with the reused D1-Edit token, per `d1-data-capture.md`.

package/payload/platform/plugins/cloudflare/references/manual-setup.md

@@ -431,6 +431,8 @@ The correct production pattern is already in place on every Maxy device: the bra
 
 **The connector is a supervised, self-healing unit.** `resume-tunnel.sh` does not run cloudflared as a child of the brand service. It spawns it into its own transient systemd **service** — `cloudflared-<brand>.service` under `cloudflared.slice` — with `Restart=always`. Two consequences: a brand-service restart no longer reaps the connector (the cgroup decoupling), and systemd resurrects the connector on **any** exit — crash, OOM, manual kill. The connector also runs with `--no-autoupdate`, so it never downloads a new binary and replaces itself; the version is installer-owned (pinned in the installer, bumped deliberately). `StartLimitIntervalSec=300`/`StartLimitBurst=5` mean a genuinely broken binary surfaces as a `failed` unit instead of looping forever.
 
+**What the supervisor needs to resume.** `resume-tunnel.sh` respawns the connector with `cloudflared … --config "${CFG_DIR}/config.yml" tunnel run`, which authenticates with the per-tunnel **credentials-file** named in that config — not `cert.pem`. The account cert is a create/route credential; the run/resume path never reads it. So a tunnel resumes on reboot whenever `config.yml` and its `credentials-file` are present, whether the tunnel was created via OAuth (this runbook) or supplied as an API-token credentials-file. The supervisor passes `--origincert` only when `cert.pem` exists; absent it, the token connector still runs. For a configured tunnel (a valid `tunnel.state`) where neither a usable credentials-file nor a cert is present, `resume-tunnel.sh` logs `op=resume-refused reason=missing-run-credential` at brand-service start instead of skipping silently — so a non-resumable tunnel is visible at the next start rather than discovered as an outage.
+
 **Observability.** A connector death is now a logged, countable event, not an invisible gap:
 
 ```

package/payload/platform/plugins/cloudflare/skills/cloudflare/SKILL.md

@@ -5,7 +5,7 @@ description: Cloudflare operations for the install — tunnel setup/diagnosis/re
 
 # Cloudflare operations
 
-Invoked from `specialists:personal-assistant`.
+Run by the admin/main session, the operator-infra surface that holds the `Bash` tool. Every step here issues `cloudflared` / `wrangler` over a shell, so this is not specialist work; the admin session loads this skill and runs it directly.
 
 This is the entry point for every Cloudflare task on the install. Pick the operation class, read the matching reference, run the command via Bash, relay the literal output, and prove the outcome with a live signal. There are no Cloudflare MCP tools; the plugin registers none. The agent never browser-automates the dashboard — the operator clicks where a click is genuinely required.
 
@@ -21,7 +21,7 @@ This is the entry point for every Cloudflare task on the install. Pick the opera
 
 ## Two auth paths, by operation class
 
-- **Tunnel auth is OAuth.** `cloudflared tunnel login` writes `cert.pem`; the operator clicks the linkified OAuth URL in their own browser. This is the only path for tunnel create/route/run. See `references/manual-setup.md`.
+- **Tunnel create/route auth is OAuth.** `cloudflared tunnel login` writes `cert.pem`; the operator clicks the linkified OAuth URL in their own browser. The cert authorises tunnel **create** and **route**, and OAuth is the prescribed path for them. **Running** a tunnel is a separate credential: `cloudflared tunnel run` — and the `resume-tunnel.sh` supervisor that respawns the connector on reboot — authenticates with the per-tunnel **credentials-file** named in `config.yml`, not the cert. So a tunnel resumes whether or not `cert.pem` is present; `--origincert` is passed on the run only when the cert exists. See `references/manual-setup.md`.
 - **API auth is the master token.** The operator provisions one fully-scoped master token once (an **advanced**, operator-guided dashboard step — the agent does not automate it) and stores it at the account-scoped secrets file. The agent reads the master only to **provision one stable narrow token per scope** — `<brand>-pages-d1`, `<brand>-dns`, `<brand>-access` — loading it from the secrets file, minting it once if absent (no expiry), persisting it, and reusing it for every later operation in that scope. A standing **reconcile** pass revokes strays. See `references/api.md` for the storage convention, the provisioning-and-reuse flow, the reconcile pass, and the binding redaction discipline.
 
 Neither the master token nor any per-scope token is ever written into a project tree, committed, or echoed into chat — the per-scope tokens persist only in the account-scoped secrets file, never in a deployable project tree.

package/payload/platform/scripts/__tests__/resume-tunnel.test.sh

@@ -522,6 +522,103 @@ TBL
   return 0
 }
 
+# ---------------------------------------------------------------------------
+# Credentials-file (API-token) tunnel resume.
+#
+# A tunnel created via the API-token path has a credentials-file in config.yml
+# and NO cert.pem. `cloudflared tunnel run` authenticates with the
+# credentials-file, not the account cert, so resume-tunnel must spawn such a
+# tunnel WITHOUT --origincert and must NOT refuse it for the missing cert.
+
+# CASE H: token tunnel (credentials-file present, no cert) → spawns without --origincert.
+case_token_tunnel_spawns_without_origincert() {
+  local root; root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+  local home="$root/home"
+  # Token model: remove the OAuth cert; point config.yml at an existing creds json.
+  rm -f "$home/.maxy-code/cloudflared/cert.pem"
+  local creds="$home/.maxy-code/cloudflared/test-tunnel-id.json"
+  echo '{"AccountTag":"x","TunnelSecret":"y","TunnelID":"test-tunnel-id"}' > "$creds"
+  cat > "$home/.maxy-code/cloudflared/config.yml" <<YML
+tunnel: test-tunnel-id
+credentials-file: $creds
+ingress:
+  - service: http_status:404
+YML
+
+  HOME="$home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME"
+  local rc=$?
+  local log; log=$(cat "$home/.maxy-code/logs/cloudflared.log" 2>/dev/null || echo "")
+  cleanup "$root"
+
+  if [[ $rc -ne 0 ]]; then echo "  expected exit 0, got $rc"; return 1; fi
+  echo "$log" | grep -q "spawned service=cloudflared-maxy-code.service" \
+    || { echo "  token tunnel did not spawn"; echo "$log"; return 1; }
+  echo "$log" | grep -q "op=resume-refused" \
+    && { echo "  token tunnel wrongly refused"; echo "$log"; return 1; }
+  echo "$log" | grep -q "\[stub\] arg=--origincert" \
+    && { echo "  --origincert passed for a token tunnel (cert absent)"; echo "$log"; return 1; }
+  return 0
+}
+
+# CASE I: configured tunnel, no usable run credential → loud resume-refused, no spawn.
+# config.yml references a missing credentials-file AND there is no cert.pem.
+case_refuse_when_no_run_credential() {
+  local root; root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+  local home="$root/home"
+  rm -f "$home/.maxy-code/cloudflared/cert.pem"
+  cat > "$home/.maxy-code/cloudflared/config.yml" <<YML
+tunnel: test-tunnel-id
+credentials-file: $home/.maxy-code/cloudflared/does-not-exist.json
+ingress:
+  - service: http_status:404
+YML
+
+  HOME="$home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME"
+  local rc=$?
+  local log; log=$(cat "$home/.maxy-code/logs/cloudflared.log" 2>/dev/null || echo "")
+  cleanup "$root"
+
+  if [[ $rc -ne 0 ]]; then echo "  expected exit 0, got $rc"; return 1; fi
+  echo "$log" | grep -q "op=resume-refused brand=maxy-code tunnel=test-tunnel-id reason=missing-run-credential" \
+    || { echo "  missing resume-refused line"; echo "$log"; return 1; }
+  echo "$log" | grep -q "spawned service=" \
+    && { echo "  spawned despite no run credential"; echo "$log"; return 1; }
+  return 0
+}
+
+# CASE J: corrupt tunnel.state → loud resume-refused, exits 0 (must never block
+# the brand service). Exercises resume_refused on the invalid-state-json path,
+# where TUNNEL_ID is not yet assigned — confirms the helper survives under set -u.
+case_refuse_on_invalid_state_json() {
+  local root; root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+  local home="$root/home"
+  echo 'this is not json {{{' > "$home/.maxy-code/cloudflared/tunnel.state"
+
+  HOME="$home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME"
+  local rc=$?
+  local log; log=$(cat "$home/.maxy-code/logs/cloudflared.log" 2>/dev/null || echo "")
+  cleanup "$root"
+
+  if [[ $rc -ne 0 ]]; then echo "  expected exit 0 on corrupt state, got $rc"; return 1; fi
+  echo "$log" | grep -q "op=resume-refused brand=maxy-code tunnel=unknown reason=invalid-state-json" \
+    || { echo "  missing invalid-state-json resume-refused line"; echo "$log"; return 1; }
+  echo "$log" | grep -q "spawned service=" \
+    && { echo "  spawned on corrupt state"; echo "$log"; return 1; }
+  return 0
+}
+
 run_case "skip when service active" case_skip_when_scope_active
 run_case "spawn succeeds and logs verified" case_spawn_succeeds
 run_case "spawn with no connection logs ERROR exits 0" case_spawn_no_connection
@@ -535,6 +632,9 @@ run_case "reap: audit line names brand tunnel id" case_reap_audit_tunnel_id
 run_case "reap: foreign co-resident connector untouched" case_reap_foreign_untouched
 run_case "reap: SIGTERM survivor escalates to SIGKILL" case_reap_sigkill_escalation
 run_case "reap: skip when active unit's MainPID is unresolved" case_reap_skip_when_mainpid_unresolved
+run_case "token tunnel spawns without --origincert" case_token_tunnel_spawns_without_origincert
+run_case "configured tunnel with no run credential refuses loudly" case_refuse_when_no_run_credential
+run_case "corrupt tunnel.state refuses loudly and exits 0" case_refuse_on_invalid_state_json
 
 echo ""
 echo "Results: $PASS passed, $FAIL failed"

package/payload/platform/scripts/check-routing-prose-bash.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// Routing-prose ↔ `tools:` reconciliation gate (Task 1000).
+//
+// A specialist agent file can name a shell-only Cloudflare CLI in its routing
+// prose — `cloudflared` or `wrangler` — neither of which has an MCP tool: the
+// only way to run them is the CC-native `Bash` tool. When the prose tells the
+// agent to drive one of those CLIs but the file's `tools:` frontmatter grants
+// no `Bash`, the dispatched specialist is structurally unable to do step one.
+// It emits no event; it just flails (Task 1000: `personal-assistant` owned the
+// Cloudflare runbook, lacked `Bash`, and degenerated into VNC pixel-driving to
+// reach a terminal). This gate reconciles declared-need against declared-tools
+// at publish time so the mismatch never ships.
+//
+// Scope: every specialist agent .md under
+// platform/templates/specialists/agents/ and premium-plugins/**/agents/ that
+// carries a `tools:` line. A file with NO `tools:` line is unrestricted
+// (admin-like — inherits all tools including Bash) and is skipped: the gate is
+// about a gated grant contradicting its own prose, not about whether a CLI is
+// named at all.
+//
+// Pure-JS, no build step: runs in `prepublishOnly` before `npm run build`,
+// mirroring check-specialist-tool-surface.mjs. Exits 1 with one
+// `[routing-prose-bash] specialist=… cli=… reason=missing-bash-tool` line per
+// `(specialist, cli)` defect, matching that script's grep-able log shape.
+
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
+import { join, resolve, basename, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+const DEFAULT_MAXY_CODE_ROOT = resolve(SCRIPT_DIR, '..', '..');
+
+// Shell-only Cloudflare CLIs: no MCP tool exists, so naming one in routing
+// prose implies the agent must hold `Bash`.
+const SHELL_ONLY_CLIS = ['cloudflared', 'wrangler'];
+
+const SKIP_AGENT_BASENAMES = new Set(['IDENTITY', 'SOUL', 'AGENTS', 'LEARNINGS']);
+
+function splitFrontmatter(raw) {
+  const m = raw.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+  if (!m) return { frontmatter: null, body: raw };
+  return { frontmatter: m[1], body: m[2] };
+}
+
+// True only when the `tools:` line lists the bare CC-native `Bash` token.
+// Returns null when there is no `tools:` line at all (unrestricted file).
+export function toolsHasBash(frontmatter) {
+  if (!frontmatter) return null;
+  const m = frontmatter.match(/^tools:\s*(.+)$/m);
+  if (!m) return null;
+  const tokens = m[1].split(',').map(t => t.trim());
+  return tokens.includes('Bash');
+}
+
+// Returns the sorted list of shell-only CLIs the body names (word-boundary,
+// case-insensitive). Empty when none are named.
+export function proseNamesClis(body) {
+  const found = [];
+  for (const cli of SHELL_ONLY_CLIS) {
+    if (new RegExp(`\\b${cli}\\b`, 'i').test(body)) found.push(cli);
+  }
+  return found;
+}
+
+// Walk the given agent dirs; return one defect per (specialist, cli) where the
+// prose names a shell-only CLI but the gated `tools:` line lacks `Bash`.
+export function runForDirs(agentDirs) {
+  const defects = [];
+  let inspected = 0;
+  for (const dir of agentDirs) {
+    let entries;
+    try { entries = readdirSync(dir); } catch { continue; }
+    for (const entry of entries.sort()) {
+      const fullPath = join(dir, entry);
+      let st;
+      try { st = statSync(fullPath); } catch { continue; }
+      if (!st.isFile() || !entry.endsWith('.md')) continue;
+      if (SKIP_AGENT_BASENAMES.has(basename(entry, '.md').toUpperCase())) continue;
+      const { frontmatter, body } = splitFrontmatter(readFileSync(fullPath, 'utf-8'));
+      const hasBash = toolsHasBash(frontmatter);
+      if (hasBash === null) continue; // unrestricted file — not a gated grant
+      inspected += 1;
+      if (hasBash) continue;
+      for (const cli of proseNamesClis(body)) {
+        defects.push({ specialistPath: fullPath, cli });
+      }
+    }
+  }
+  return { defects, inspected };
+}
+
+function collectAgentDirs(maxyCodeRoot) {
+  const dirs = [];
+  const templates = join(maxyCodeRoot, 'platform', 'templates', 'specialists', 'agents');
+  if (existsSync(templates)) dirs.push(templates);
+  const premiumRoot = join(maxyCodeRoot, 'premium-plugins');
+  if (existsSync(premiumRoot)) {
+    for (const bundle of readdirSync(premiumRoot).sort()) {
+      const bundleAgents = join(premiumRoot, bundle, 'agents');
+      try { if (statSync(bundleAgents).isDirectory()) dirs.push(bundleAgents); } catch { /* skip */ }
+      const subPluginsDir = join(premiumRoot, bundle, 'plugins');
+      try {
+        if (statSync(subPluginsDir).isDirectory()) {
+          for (const sub of readdirSync(subPluginsDir).sort()) {
+            const subAgents = join(subPluginsDir, sub, 'agents');
+            try { if (statSync(subAgents).isDirectory()) dirs.push(subAgents); } catch { /* skip */ }
+          }
+        }
+      } catch { /* skip */ }
+    }
+  }
+  return dirs;
+}
+
+function main(maxyCodeRoot) {
+  const { defects, inspected } = runForDirs(collectAgentDirs(maxyCodeRoot));
+  for (const d of defects) {
+    const rel = d.specialistPath.startsWith(maxyCodeRoot + '/')
+      ? d.specialistPath.slice(maxyCodeRoot.length + 1)
+      : d.specialistPath;
+    console.error(`[routing-prose-bash] specialist=${rel} cli=${d.cli} reason=missing-bash-tool`);
+  }
+  if (defects.length > 0) {
+    console.error(`[routing-prose-bash] FAIL: ${defects.length} defect(s) across ${inspected} gated specialist(s).`);
+    console.error(`  A specialist whose routing prose names cloudflared/wrangler must list Bash in its tools:, or the prose must move to a Bash-capable surface.`);
+    process.exit(1);
+  }
+  console.log(`[routing-prose-bash] ok inspected=${inspected}`);
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const override = process.env.MAXY_CODE_ROOT;
+  main(override ? resolve(override) : DEFAULT_MAXY_CODE_ROOT);
+}

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -303,26 +303,14 @@ else:
 PY
   fi
 
-  # --- stamp install owner into admins[] (idempotent) ------------------------
-  if [ -n "${USERS_FILE:-}" ] && [ -f "$USERS_FILE" ]; then
-    local USER_ID
-    USER_ID=$(python3 -c "import json; print(json.load(open('$USERS_FILE'))[0]['userId'])" 2>/dev/null || true)
-    if [ -n "$USER_ID" ] && [ -f "$ACCOUNT_DIR/account.json" ]; then
-      USER_ID="$USER_ID" python3 - "$ACCOUNT_DIR/account.json" <<'PY'
-import json, os, sys
-path = sys.argv[1]
-uid = os.environ["USER_ID"]
-with open(path) as f:
-    cfg = json.load(f)
-cfg.setdefault("admins", [])
-if not any(a.get("userId") == uid for a in cfg["admins"]):
-    cfg["admins"].append({"userId": uid, "role": "owner"})
-    with open(path, "w") as f:
-        json.dump(cfg, f, indent=2); f.write("\n")
-    print(f"  Stamped userId={uid} as owner in account.json admins")
-PY
-    fi
-  fi
+  # Task 999 — no admins[] owner stamp at provision time. account.json admins[]
+  # is no longer the access authority: every authenticated install admin sees
+  # every account. The old stamp wrote users.json[0] (the first user, not the
+  # operating admin) into every new account, so a client account a non-first
+  # admin created listed the wrong owner and stayed invisible to them. The
+  # house account's owner record is authored durably by set-pin (writeAdminEntry
+  # in onboarding) and account.json survives reinstalls, so nothing load-bearing
+  # is lost here.
 
   echo "  Account $ACCOUNT_ID at $ACCOUNT_DIR (role=$ROLE)"
 }

package/payload/platform/scripts/resume-tunnel.sh

@@ -36,13 +36,29 @@ log() {
   echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] resume-tunnel: $1" >> "$LOG_FILE"
 }
 
+# Derive brand identifiers + the OAuth cert path up front so every refusal log
+# below can name the brand. BRAND strips the leading dot from CONFIG_DIR
+# (.maxy-code → cloudflared-maxy-code.service). CERT_PATH is the OAuth account
+# cert: it authorises tunnel create/route, NOT tunnel run — a tunnel created via
+# the API-token path runs from its credentials-file with no cert at all.
+BRAND="${CONFIG_DIR#.}"
+SERVICE_UNIT="cloudflared-${BRAND}.service"
+CERT_PATH="$HOME/$CONFIG_DIR/cloudflared/cert.pem"
+
+# A configured tunnel (tunnel.state present) that we decline to spawn is logged
+# loudly, so a non-resumable tunnel is visible at the next service start rather
+# than discovered as an outage. "No state file" stays a silent normal boot.
+resume_refused() {
+  log "[tunnel-supervise] op=resume-refused brand=${BRAND} tunnel=${TUNNEL_ID:-unknown} reason=$1"
+}
+
 # No state file — no tunnel configured. Normal boot.
 [ -f "$STATE_FILE" ] || exit 0
 
 log "reading state from $STATE_FILE (configDir=$CONFIG_DIR)"
 
 if ! STATE=$(jq -r '.' "$STATE_FILE" 2>/dev/null); then
-  log "WARNING: tunnel.state is not valid JSON — skipping resume"
+  resume_refused "invalid-state-json"
   exit 0
 fi
 
@@ -51,17 +67,10 @@ DOMAIN=$(echo "$STATE" | jq -r '.domain // empty')
 CONFIG_PATH=$(echo "$STATE" | jq -r '.configPath // empty')
 
 if [ -z "$TUNNEL_ID" ]; then
-  log "WARNING: tunnel.state has no tunnelId — skipping resume"
+  resume_refused "no-tunnel-id"
   exit 0
 fi
 
-# Derive service unit name: strip leading dot from CONFIG_DIR.
-# .maxy-code → cloudflared-maxy-code.service
-BRAND="${CONFIG_DIR#.}"
-SERVICE_UNIT="cloudflared-${BRAND}.service"
-
-CERT_PATH="$HOME/$CONFIG_DIR/cloudflared/cert.pem"
-
 # Task 833 — single-instance enforcement. cloudflared does not hot-reload
 # config.yml; a config change needs a connector restart. resume-tunnel is the
 # single spawner but historically managed only its OWN connector, so a connector
@@ -156,12 +165,27 @@ fi
 CLOUDFLARED_BIN=$(command -v cloudflared 2>/dev/null || true)
 
 if [ -z "$CLOUDFLARED_BIN" ]; then
-  log "ERROR: cloudflared binary not found — cannot resume tunnel"
+  resume_refused "no-cloudflared-binary"
+  exit 0
+fi
+
+# tunnel run authenticates with the per-tunnel credentials-file declared in
+# config.yml (written by `tunnel create`, present in both the OAuth and the
+# API-token models). The OAuth account cert (--origincert) is a create/route
+# credential; tunnel run never needs it. So a tunnel is resumable whenever its
+# config exists AND a usable run credential is present — either cert.pem (OAuth)
+# or the credentials-file the config references (API-token). --origincert is
+# added to the spawn only when cert.pem exists, so a token-created tunnel with
+# no cert resumes too.
+if [ -z "$CONFIG_PATH" ] || [ ! -f "$CONFIG_PATH" ]; then
+  resume_refused "missing-config"
   exit 0
 fi
 
-if [ -z "$CONFIG_PATH" ] || [ ! -f "$CONFIG_PATH" ] || [ ! -f "$CERT_PATH" ]; then
-  log "ERROR: missing configPath or cert — cannot resume tunnel"
+CRED_FILE=$(sed -n 's/^[[:space:]]*credentials-file:[[:space:]]*//p' "$CONFIG_PATH" 2>/dev/null | head -1 | tr -d '[:space:]')
+
+if [ ! -f "$CERT_PATH" ] && { [ -z "$CRED_FILE" ] || [ ! -f "$CRED_FILE" ]; }; then
+  resume_refused "missing-run-credential"
   exit 0
 fi
 
@@ -184,6 +208,13 @@ LOG_OFFSET=$(wc -c < "$LOG_FILE" 2>/dev/null | awk '{print $1+0}' || echo 0)
 # once the unit is active (it does not block for the process lifetime), so there
 # is no shell child to background. --quiet suppresses systemd-run's "Running as
 # unit:" line; the trailing redirect only captures any error output it prints.
+# Build the connector argv. --origincert is included only for an OAuth tunnel
+# (cert.pem present); a token-created tunnel runs from its credentials-file
+# alone. The array is always non-empty, so it expands safely under `set -u`.
+CONNECTOR_ARGS=( "$CLOUDFLARED_BIN" --no-autoupdate )
+[ -f "$CERT_PATH" ] && CONNECTOR_ARGS+=( --origincert "$CERT_PATH" )
+CONNECTOR_ARGS+=( --config "$CONFIG_PATH" tunnel run )
+
 systemd-run \
   --user \
   --quiet \
@@ -197,7 +228,7 @@ systemd-run \
   -p "StandardOutput=append:$LOG_FILE" \
   -p "StandardError=append:$LOG_FILE" \
   -- \
-  "$CLOUDFLARED_BIN" --no-autoupdate --origincert "$CERT_PATH" --config "$CONFIG_PATH" tunnel run \
+  "${CONNECTOR_ARGS[@]}" \
   >> "$LOG_FILE" 2>&1
 
 # Log spawn receipt so the operator can distinguish the supervised path from legacy nohup.

package/payload/platform/templates/agents/admin/AGENTS.md

@@ -18,6 +18,6 @@
      account-level AGENTS.md from scratch (or extends an existing one).
 
 Example (populated):
-- **specialists:personal-assistant**: Scheduling, platform settings, messaging channels (Telegram, WhatsApp, email, Outlook), tunnel and domain setup, and browser automation. Delegate when the work is on your calendar, configuring the platform, sending or reading messages, or driving a browser.
+- **specialists:personal-assistant**: Scheduling, platform settings, messaging channels (Telegram, WhatsApp, email, Outlook), and browser automation. Delegate when the work is on your calendar, configuring the platform, sending or reading messages, or driving a browser.
 - **specialists:research-assistant**: Deep research on the web, knowledge management, and writing structured summaries with citations from multiple sources. Delegate when the operator wants you to research a topic, read web pages, combine findings into a summary, or reorganise stored knowledge.
 -->

package/payload/platform/templates/specialists/agents/coding-assistant.md

@@ -30,7 +30,7 @@ The operator's machine is the surface — paths admin gives you resolve against
 - Graph writes (memory-write, contact-create, work-create, schedule-event) — those route to `database-operator` or `personal-assistant`.
 - Ingestion of documents, transcripts, or archives into the graph — that routes to `librarian`.
 - Web research and external lookups — those route to `research-assistant`.
-- Messaging, scheduling, browser automation, tunnel and domain setup — those route to `personal-assistant`.
+- Messaging, scheduling, browser automation — those route to `personal-assistant`.
 
 When a brief mixes coding work with one of the above (for example, "clone the repo and write a brochure from its README"), do the coding portion and hand the rest back to admin so it can dispatch the right specialist.
 

package/payload/platform/templates/specialists/agents/personal-assistant.md

@@ -1,6 +1,6 @@
 ---
 name: personal-assistant
-description: "Scheduling, platform settings, messaging channels (Telegram, WhatsApp, email, Outlook), tunnel and domain setup, and browser automation. Delegate when the work is on your calendar, configuring the platform, sending or reading messages, or driving a browser."
+description: "Scheduling, platform settings, messaging channels (Telegram, WhatsApp, email, Outlook), and browser automation. Delegate when the work is on your calendar, configuring the platform, sending or reading messages, or driving a browser."
 summary: "Handles the operational tasks you'd give a personal assistant: scheduling meetings, managing your platform settings, connecting messaging channels, and completing browser-based tasks on your behalf."
 model: claude-sonnet-4-6
 tools: Skill, mcp__plugin_admin_admin__system-status, mcp__plugin_admin_admin__brand-settings, mcp__plugin_admin_admin__account-manage, mcp__plugin_admin_admin__account-update, mcp__plugin_admin_admin__logs-read, mcp__plugin_admin_admin__plugin-read, mcp__plugin_admin_admin__wifi, mcp__plugin_contacts_contacts__contact-create, mcp__plugin_contacts_contacts__contact-lookup, mcp__plugin_contacts_contacts__contact-update, mcp__plugin_contacts_contacts__contact-delete, mcp__plugin_contacts_contacts__contact-list, mcp__plugin_contacts_contacts__contact-export, mcp__plugin_contacts_contacts__contact-erase, mcp__plugin_contacts_contacts__group-create, mcp__plugin_contacts_contacts__group-manage, mcp__plugin_telegram_telegram__message, mcp__plugin_telegram_telegram__message-history, mcp__plugin_telegram_telegram__telegram-webhook-register, mcp__plugin_whatsapp_whatsapp__whatsapp-login-start, mcp__plugin_whatsapp_whatsapp__whatsapp-login-wait, mcp__plugin_whatsapp_whatsapp__whatsapp-status, mcp__plugin_whatsapp_whatsapp__whatsapp-disconnect, mcp__plugin_whatsapp_whatsapp__whatsapp-config, mcp__plugin_whatsapp_whatsapp__whatsapp-activity, mcp__plugin_whatsapp_whatsapp__whatsapp-conversations, mcp__plugin_whatsapp_whatsapp__whatsapp-messages, mcp__plugin_whatsapp_whatsapp__whatsapp-conversation-graph-state, mcp__plugin_whatsapp_whatsapp__whatsapp-group-info, mcp__plugin_email_email__email-provider-info, mcp__plugin_email_email__email-setup, mcp__plugin_email_email__email-read, mcp__plugin_email_email__email-send, mcp__plugin_email_email__email-draft, mcp__plugin_email_email__email-draft-edit, mcp__plugin_email_email__email-draft-send, mcp__plugin_email_email__email-reply, mcp__plugin_email_email__email-search, mcp__plugin_email_email__email-graph-query, mcp__plugin_email_email__email-otp-extract, mcp__plugin_email_email__email-status, mcp__plugin_email_email__email-fetch, mcp__plugin_email_email__email-ingest, mcp__plugin_outlook_outlook__outlook-account-register, mcp__plugin_outlook_outlook__outlook-mail-list, mcp__plugin_outlook_outlook__outlook-mail-search, mcp__plugin_outlook_outlook__outlook-calendar-list, mcp__plugin_outlook_outlook__outlook-calendar-event, mcp__plugin_outlook_outlook__outlook-contacts-list, mcp__plugin_outlook_outlook__outlook-mailbox-info, mcp__plugin_scheduling_scheduling__schedule-event, mcp__plugin_scheduling_scheduling__schedule-list, mcp__plugin_scheduling_scheduling__schedule-get, mcp__plugin_scheduling_scheduling__schedule-update, mcp__plugin_scheduling_scheduling__schedule-cancel, mcp__plugin_scheduling_scheduling__schedule-export-ics, mcp__plugin_scheduling_scheduling__schedule-import-ics, mcp__plugin_scheduling_scheduling__time-resolve, mcp__plugin_memory_memory__memory-search, mcp__plugin_memory_memory__profile-update, mcp__plugin_url-get_url-get__url-get, mcp__plugin_browser_browser__browser-render, mcp__plugin_browser_browser__browser-navigate, mcp__plugin_browser_browser__browser-snapshot, mcp__plugin_browser_browser__browser-click, mcp__plugin_browser_browser__browser-fill, mcp__plugin_browser_browser__browser-fill-form, mcp__plugin_browser_browser__browser-type, mcp__plugin_browser_browser__browser-press-key, mcp__plugin_browser_browser__browser-hover, mcp__plugin_browser_browser__browser-select-option, mcp__plugin_browser_browser__browser-wait-for, mcp__plugin_browser_browser__browser-handle-dialog, mcp__plugin_browser_browser__browser-evaluate, mcp__plugin_browser_browser__browser-console-messages, mcp__plugin_browser_browser__browser-tabs, mcp__plugin_browser_browser__browser-pdf-save, mcp__plugin_browser_browser__browser-screenshot, mcp__plugin_browser_browser__browser-resize
@@ -23,9 +23,10 @@ These three rules win when anything else in this prompt conflicts with them.
 Each domain has a small set of tools and, where it exists, a skill that drives the multi-step flow. Match the brief to the domain, load the skill if one is named, and run the tools the skill prescribes.
 
 - **WhatsApp setup or config:** **After routing, the first tool call MUST be `Skill connect-whatsapp` (for QR pairing and admin-phone setup) or `Skill manage-whatsapp-config` (for DM/group policies). Any channel tool call before the routed skill's content is loaded into context is a contract violation.** Load `skill-load skillName=connect-whatsapp` for QR pairing and admin-phone setup; load `skill-load skillName=manage-whatsapp-config` for DM/group policies and admin-phone management. The skills carry the per-phase flow.
-- **Cloudflare (tunnel, DNS, Pages hosting, D1):** **After routing, the first tool call MUST be `Skill cloudflare`. Any Bash call before the skill content is loaded into context is a contract violation.** Load `skill-load skillName=cloudflare`. The skill routes each operation class to its reference under `plugins/cloudflare/references/` (`manual-setup.md` for the tunnel, `api.md`, `hosting-sites.md`, `d1-data-capture.md`, `reset-guide.md`, `dashboard-guide.md`) and drives `cloudflared` / `wrangler` directly via Bash. There is no shell-script wrapper; PTY stdout is the only surface.
 - **Every other domain** (scheduling, Telegram, email, Outlook, contacts, browser, platform admin) runs through the tool descriptions injected into your system prompt. The rules below apply across these domains regardless of which tool is invoked.
 
+Cloudflare and custom-domain setup (tunnel, DNS, Pages, D1) is **not** your work — it needs a shell you do not hold, so the admin session owns it directly. If such a brief reaches you, hand it back to admin.
+
 ## Cross-domain rules
 
 **Brain-first read before action.** The graph is the canonical store for everyone the operator works with, every scheduled commitment, and every channel configuration. Before composing a message, scheduling an event, or looking up a contact, run `memory-search` (and `profile-read` when the question is about the operator) against the brief. Resolve recipient `elementId`s from the graph, not from the brief's free text — wrapped writers (`schedule-event`, `contact-create`, `work-create`) reject zero-edge calls, and the resolved id is what satisfies them. External lookups (`outlook-mail-search`, `email-search`, Telegram message history, browser navigation) are step 2: run them when the graph confirms there is no local record of the thing you need. Each external result worth keeping goes back to admin so the Recording route on admin's side can persist it.
@@ -38,8 +39,6 @@ Each domain has a small set of tools and, where it exists, a skill that drives t
 
 **WhatsApp ToS.** Automated broadcast is forbidden. The platform blocks broadcast for WhatsApp regardless of channel config; do not try to design around it.
 
-**Cloudflare has two auth paths.** Cloudflare exposes zero MCP tools; load the `cloudflare` skill and follow its references. Tunnel auth is OAuth (`cloudflared tunnel login`) — the operator clicks the linkified URL in their own browser. Everything else (DNS, Pages, D1, Access) is the Cloudflare API, authenticated by a short-lived narrow token the agent mints from the operator's master token (see `plugins/cloudflare/references/api.md`). Do not drive the dashboard with a browser tool, do not browser-automate master-token creation, do not synthesise `cloudflared` flag combinations, and never write or echo a token. Do not edit `cert.pem`, `tunnel.state`, `config.yml`, or `alias-domains.json` outside the runbook. When a sanctioned surface fails, report with evidence (secrets redacted) and cite `plugins/cloudflare/references/reset-guide.md`. After a tunnel setup finishes, verify with `curl -I https://<hostname>`; a non-530 response means the tunnel is live.
-
 **Reading JavaScript-rendered pages.** When you only need to *read* a JS page and `url-get` comes back empty or as a shell, use `browser-render` with the URL. It renders the page in the device's Chromium and returns the rendered HTML plus visible text in one stateless call — it does not keep the page open.
 
 **Automating a page.** When a task needs to *act* on a page (log in, fill a form, click through a flow, drive a web app), use the persistent automation tools. Start with `browser-navigate` to open the page and keep it alive, then `browser-snapshot` to see what is on the page — it returns each interactive element as a role, a name, and a unique CSS selector. Pass those selectors verbatim to `browser-click`, `browser-fill`, `browser-fill-form`, `browser-hover`, and `browser-select-option`. Use `browser-type` / `browser-press-key` for real keyboard input (e.g. Enter to submit), `browser-wait-for` after anything that loads asynchronously, `browser-evaluate` to read page state, and `browser-console-messages` to debug. Arm `browser-handle-dialog` *before* the action that triggers an alert/confirm/prompt, because dialogs block the page. `browser-tabs` opens or switches to a fresh page so stale state from a prior task does not leak in. If an action returns `session-lost`, the page closed — call `browser-navigate` again. Element targeting is by CSS selector (always from a fresh `browser-snapshot`), not by Playwright-style refs. Report CAPTCHA or bot detection as a blocker; do not try to solve it.

package/payload/server/{chunk-GRKG3KNN.js → chunk-NE7G5GT7.js}

@@ -3905,33 +3905,6 @@ function isActiveAgentSlug(accountDir, slug) {
 function getDefaultAccountId() {
   return resolveAccount()?.accountId ?? null;
 }
-function resolveUserAccounts(userId) {
-  if (!existsSync5(ACCOUNTS_DIR)) return [];
-  const results = [];
-  const entries = readdirSync(ACCOUNTS_DIR, { withFileTypes: true });
-  for (const entry of entries) {
-    if (!entry.isDirectory()) continue;
-    const configPath = resolve4(ACCOUNTS_DIR, entry.name, "account.json");
-    if (!existsSync5(configPath)) continue;
-    let config;
-    try {
-      config = JSON.parse(readFileSync6(configPath, "utf-8"));
-    } catch {
-      console.error(`[session] account.json corrupt at ${configPath} \u2014 skipping`);
-      continue;
-    }
-    const adminEntry = config.admins?.find((a) => a.userId === userId);
-    if (adminEntry) {
-      results.push({
-        accountId: config.accountId,
-        accountDir: resolve4(ACCOUNTS_DIR, entry.name),
-        config,
-        role: adminEntry.role
-      });
-    }
-  }
-  return results;
-}
 
 // app/lib/claude-agent/session-store.ts
 import { createHash } from "crypto";
@@ -5781,7 +5754,6 @@ export {
   resolveAgentConfig,
   isActiveAgentSlug,
   getDefaultAccountId,
-  resolveUserAccounts,
   fingerprintSessionKey,
   registerSession,
   validateSession,

package/payload/server/maxy-edge.js

@@ -16,7 +16,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-GRKG3KNN.js";
+} from "./chunk-NE7G5GT7.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts

package/payload/server/server.js

@@ -85,7 +85,6 @@ import {
   resolveCallback,
   resolveClientIp,
   resolveDefaultAgentSlug,
-  resolveUserAccounts,
   runAdminUserSelfHeal,
   safeJson,
   sanitizeClientCorrId,
@@ -106,7 +105,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-GRKG3KNN.js";
+} from "./chunk-NE7G5GT7.js";
 import {
   __commonJS,
   __toESM
@@ -7030,27 +7029,22 @@ function resolveTitle(body, sessionId, userTitles) {
 }
 app3.get("/", requireAdminSession, async (c) => {
   const accountId = process.env.ACCOUNT_ID ?? null;
-  const switcherUserId = (() => {
-    const cacheKey = c.get("cacheKey");
-    return cacheKey ? getUserIdForSession(cacheKey) : void 0;
-  })();
   const accounts = [];
-  if (switcherUserId) {
-    for (const a of resolveUserAccounts(switcherUserId)) {
-      let businessName = null;
-      try {
-        const branding = await fetchBranding(a.accountId);
-        businessName = branding?.name || null;
-      } catch {
-      }
-      accounts.push({
-        accountId: a.accountId,
-        role: a.config.role ?? "",
-        businessName,
-        isHouse: a.config.role === "house"
-      });
+  for (const a of listValidAccounts()) {
+    let businessName = null;
+    try {
+      const branding = await fetchBranding(a.accountId);
+      businessName = branding?.name || null;
+    } catch {
     }
+    accounts.push({
+      accountId: a.accountId,
+      role: a.config.role ?? "",
+      businessName,
+      isHouse: a.config.role === "house"
+    });
   }
+  console.log(`[admin-sessions-list] accounts=${accounts.length}`);
   const configDir2 = claudeConfigDir();
   if (!configDir2) {
     console.error("[admin-sessions-list] CLAUDE_CONFIG_DIR not set; returning empty list");
@@ -7181,38 +7175,6 @@ function validatePin(pin, usersFilePath) {
   const matched = users.find((u) => u.pin === inputHash);
   return matched ? { kind: "match", userId: matched.userId } : { kind: "miss" };
 }
-function scanForOrphanedAccountAdmins(users, accountsDir) {
-  const known = new Set(users.map((u) => u.userId));
-  const orphans = [];
-  if (!existsSync6(accountsDir)) return orphans;
-  let entries;
-  try {
-    entries = readdirSync5(accountsDir);
-  } catch {
-    return orphans;
-  }
-  for (const entry of entries) {
-    if (entry.startsWith(".")) continue;
-    const accountDir = join10(accountsDir, entry);
-    try {
-      if (!statSync3(accountDir).isDirectory()) continue;
-    } catch {
-      continue;
-    }
-    const accountJsonPath = join10(accountDir, "account.json");
-    if (!existsSync6(accountJsonPath)) continue;
-    try {
-      const config = JSON.parse(readFileSync11(accountJsonPath, "utf-8"));
-      const admins = config.admins ?? [];
-      for (const a of admins) {
-        if (typeof a.userId === "string" && !known.has(a.userId)) orphans.push(a.userId);
-      }
-    } catch {
-      continue;
-    }
-  }
-  return orphans;
-}
 
 // app/lib/whatsapp/inbound/resolve-admin-userid.ts
 function classifyAdminUserId(users, admins, senderPhone) {
@@ -10919,6 +10881,9 @@ async function createAdminSession(accountId, thinkingView, userId, userName, rol
     sessionId: initialSessionId
   };
 }
+function operatorRoleFor(config, userId) {
+  return config.admins?.find((a) => a.userId === userId)?.role ?? "admin";
+}
 var app11 = new Hono();
 app11.get("/", async (c) => {
   const signedSessionToken = c.req.query("session_key");
@@ -10983,27 +10948,14 @@ app11.post("/", async (c) => {
     return c.json({ error: "PIN not configured. Complete onboarding first." }, 503);
   }
   if (verdict.kind === "miss") {
-    let users = [];
-    try {
-      users = readUsersFile(USERS_FILE) ?? [];
-    } catch {
-    }
-    const orphanUserIds = scanForOrphanedAccountAdmins(users, ACCOUNTS_DIR);
-    if (orphanUserIds.length > 0) {
-      const prefix = orphanUserIds[0].slice(0, 8);
-      console.log(
-        `[session] PIN auth failed: no matching user; account.json admins[] contains userId=${prefix} with no users.json row \u2014 three-store divergence`
-      );
-    } else {
-      console.log(`[session] PIN auth failed: no matching user`);
-    }
+    console.log(`[session] PIN auth failed: no matching user`);
     return c.json({ error: "Invalid PIN" }, 401);
   }
   const { userId } = verdict;
-  const accounts = resolveUserAccounts(userId);
+  const accounts = listValidAccounts();
   if (accounts.length === 0) {
-    console.log(`[session] user has no accounts: userId=${userId}`);
-    return c.json({ error: "No account access for this user." }, 403);
+    console.log(`[session] no accounts configured on install: userId=${userId}`);
+    return c.json({ error: "No accounts are configured on this install." }, 403);
   }
   if (accounts.length > 1 && !body.accountId) {
     console.log(`[session] multi-account user: userId=${userId} accounts=${accounts.length}`);
@@ -11015,7 +10967,7 @@ app11.post("/", async (c) => {
           businessName = branding?.name || void 0;
         } catch {
         }
-        return { accountId: a.accountId, businessName, role: a.role };
+        return { accountId: a.accountId, businessName, role: operatorRoleFor(a.config, userId) };
       })
     );
     return c.json({ accounts: accountList, userId });
@@ -11026,7 +10978,7 @@ app11.post("/", async (c) => {
     return c.json({ error: "Invalid account selection." }, 403);
   }
   const { userName, avatar } = await resolveUserIdentity(selected.accountId, userId);
-  const payload = await createAdminSession(selected.accountId, selected.config.thinkingView, userId, userName, selected.role, avatar);
+  const payload = await createAdminSession(selected.accountId, selected.config.thinkingView, userId, userName, operatorRoleFor(selected.config, userId), avatar);
   return c.json(payload);
 });
 var session_default = app11;