@rubytech/create-maxy-code 0.1.372 → 0.1.374

package/dist/__tests__/cgroup-memory-controller-install-flow.test.js

@@ -0,0 +1,41 @@
+// Static-grep contract for configureCgroupMemoryController()'s placement in
+// the install flow — same precedent as watchdog-deferred-arming.test.ts for
+// an installer side-effecting step that shells out with sudo and can't be
+// safely executed in a unit test. The pure decision rule itself is covered
+// by cgroup-memory-controller.test.ts.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+const here = dirname(fileURLToPath(import.meta.url));
+const INDEX_TS = resolve(here, "../../src/index.ts");
+const SRC = readFileSync(INDEX_TS, "utf-8");
+function fnBody(name) {
+    const start = SRC.indexOf(`function ${name}`);
+    assert.ok(start >= 0, `could not locate ${name} in index.ts`);
+    const nextFn = SRC.indexOf("\nfunction ", start + 1);
+    assert.ok(nextFn > start, `could not bound ${name} body`);
+    return SRC.slice(start, nextFn);
+}
+test("configureCgroupMemoryController is called inside installService()'s Linux branch", () => {
+    const installServiceStart = SRC.indexOf("function installService(");
+    assert.ok(installServiceStart >= 0, "installService() not found");
+    const darwinReturn = SRC.indexOf("installServiceDarwin();\n    return;", installServiceStart);
+    assert.ok(darwinReturn > installServiceStart, "expected the darwin early-return inside installService()");
+    const callSite = SRC.indexOf("configureCgroupMemoryController();", darwinReturn);
+    assert.ok(callSite > darwinReturn, "configureCgroupMemoryController() must be called after the darwin early-return (Linux-only)");
+});
+test("configureCgroupMemoryController never throws on a patch failure (non-fatal, matches the sysctl.d precedent)", () => {
+    const body = fnBody("configureCgroupMemoryController");
+    assert.ok(body.includes("try {"), "expected a try/catch around the sudo cp — a read-only /boot must not abort install");
+    assert.ok(body.includes("catch"), "expected a catch branch");
+});
+test("configureCgroupMemoryController always logs a resolved op=cgroup-memory-status line", () => {
+    const body = fnBody("configureCgroupMemoryController");
+    const occurrences = body.match(/op=cgroup-memory-status/g) ?? [];
+    assert.ok(occurrences.length >= 4, `expected at least 4 branches to log op=cgroup-memory-status, found ${occurrences.length}`);
+});
+test("configureCgroupMemoryController imports the pure decision rule from cgroup-memory-controller.js", () => {
+    assert.ok(SRC.includes('from "./cgroup-memory-controller.js"'), "index.ts must import memoryControllerMissing/cmdlineAlreadyPatched/patchCmdline rather than re-implementing the parsing");
+});

package/dist/__tests__/cgroup-memory-controller.test.js

@@ -0,0 +1,32 @@
+// Pure decision rule for Task 1297: does this host's kernel have the memory
+// cgroup controller enabled, and if not, does its boot cmdline already carry
+// the fix. The wrapper in index.ts owns the fs reads and the sudo cp; this
+// suite exercises only the pure functions — inputs in, decision out.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { CGROUP_MEMORY_CMDLINE_FLAGS, memoryControllerMissing, cmdlineAlreadyPatched, patchCmdline, } from "../cgroup-memory-controller.js";
+test("memoryControllerMissing: false when memory is in the controller list", () => {
+    assert.equal(memoryControllerMissing("cpuset cpu io memory pids\n"), false);
+});
+test("memoryControllerMissing: true when memory is absent (the Pi default)", () => {
+    assert.equal(memoryControllerMissing("cpuset cpu io pids\n"), true);
+});
+test("memoryControllerMissing: true on an empty controller list", () => {
+    assert.equal(memoryControllerMissing(""), true);
+});
+test("cmdlineAlreadyPatched: true when the flags are present", () => {
+    const cmdline = "console=tty1 root=PARTUUID=abc rootwait cgroup_enable=memory cgroup_memory=1\n";
+    assert.equal(cmdlineAlreadyPatched(cmdline), true);
+});
+test("cmdlineAlreadyPatched: false on an unpatched line", () => {
+    const cmdline = "console=serial0,115200 console=tty1 root=PARTUUID=e9d78c4e-02 rootwait quiet splash\n";
+    assert.equal(cmdlineAlreadyPatched(cmdline), false);
+});
+test("patchCmdline: appends the flags with a single trailing newline", () => {
+    const cmdline = "console=tty1 root=PARTUUID=abc rootwait\n";
+    assert.equal(patchCmdline(cmdline), `console=tty1 root=PARTUUID=abc rootwait ${CGROUP_MEMORY_CMDLINE_FLAGS}\n`);
+});
+test("patchCmdline: works when the source has no trailing newline", () => {
+    const cmdline = "console=tty1 root=PARTUUID=abc rootwait";
+    assert.equal(patchCmdline(cmdline), `console=tty1 root=PARTUUID=abc rootwait ${CGROUP_MEMORY_CMDLINE_FLAGS}\n`);
+});

package/dist/cgroup-memory-controller.js

@@ -0,0 +1,33 @@
+// Pure logic for Task 1297: the Pi kernel ships with the memory cgroup
+// controller disabled by default (/sys/fs/cgroup/cgroup.controllers has no
+// `memory`), which makes every MemoryHigh=/MemoryMax= this platform
+// configures (Task 1176, Task 1222) a silent no-op — confirmed fleet-wide
+// across all 5 Pis via live inspection. The wrapper in index.ts owns the fs
+// reads, locating the boot cmdline file, and the sudo cp. This module owns
+// only the decision + the patched-content computation — inputs in, decision
+// out. No reboot logic here or in the wrapper; a boot-param change only takes
+// effect on the operator's next reboot.
+export const CGROUP_MEMORY_CMDLINE_FLAGS = "cgroup_enable=memory cgroup_memory=1";
+/** True when the cgroup-v2 root controller list (the raw content of
+ *  /sys/fs/cgroup/cgroup.controllers) lacks `memory`. Inline rather than
+ *  imported from platform/services/claude-session-manager because the
+ *  installer is its own npm package and doesn't bundle platform services.
+ *  Mirrors (negated) memoryControllerInList() in
+ *  platform/services/claude-session-manager/src/rc-daemon.ts; future
+ *  divergence between the two should be caught by the test suite. */
+export function memoryControllerMissing(controllers) {
+    return !controllers.split(/\s+/).filter(Boolean).includes("memory");
+}
+/** True when the boot cmdline file already carries the enable flags —
+ *  patching again would duplicate them. */
+export function cmdlineAlreadyPatched(cmdline) {
+    return cmdline.includes("cgroup_enable=memory");
+}
+/** Append the enable flags to the single-line boot cmdline file. Callers
+ *  must gate on cmdlineAlreadyPatched() first — this always appends, so
+ *  calling it twice on the same content would duplicate the flags. Trims
+ *  any trailing whitespace before appending, then restores exactly one
+ *  trailing newline (cmdline.txt convention: one line, trailing newline). */
+export function patchCmdline(cmdline) {
+    return `${cmdline.replace(/\s+$/, "")} ${CGROUP_MEMORY_CMDLINE_FLAGS}\n`;
+}

package/dist/index.js

@@ -19,6 +19,7 @@ import { installAllBrewPackages } from "./brew-install.js";
 import { parseSwVers, isSupportedMacosVersion } from "./macos-version.js";
 import { decideChromiumAction, isSnapConfinedPath } from "./snap-chromium.js";
 import { classifyPortHolder } from "./preflight-port-classifier.js";
+import { memoryControllerMissing, cmdlineAlreadyPatched, patchCmdline } from "./cgroup-memory-controller.js";
 import { parsePluginList, computeInstallActions, parseExternalPlugins, findUnregisteredResyncs, } from "./lib/plugin-install.js";
 import { findPremiumMcpDirs } from "./lib/premium-mcp-discover.js";
 import { pickBindDecision, mergeSmbConf, formatSambaMarker, SAMBA_ENABLE_UNITS, } from "./samba-provision.js";
@@ -3243,6 +3244,56 @@ function installServiceDarwin() {
         console.log(`  Server may still be starting. Check http://localhost:${PORT} in a moment.`);
     }
 }
+/** Task 1297 — the Pi kernel ships with the memory cgroup controller
+ *  disabled by default (/sys/fs/cgroup/cgroup.controllers has no `memory`),
+ *  which makes every MemoryHigh=/MemoryMax= this platform configures (Task
+ *  1176, Task 1222) a silent no-op — confirmed fleet-wide, not theorized.
+ *  Patches the boot cmdline so the NEXT reboot activates it; never triggers
+ *  the reboot itself. Non-fatal: a read-only /boot partition, an absent
+ *  cmdline file (x86 hosts don't have one and don't need this), or a host
+ *  where the controller is already enabled (laptop, hart) all resolve to a
+ *  logged status line and a clean return — matching the sysctl.d QUIC
+ *  drop-in step's failure handling immediately below this function's call
+ *  site. */
+function configureCgroupMemoryController() {
+    let controllers;
+    try {
+        controllers = readFileSync("/sys/fs/cgroup/cgroup.controllers", "utf-8");
+    }
+    catch {
+        logFile("[install] op=cgroup-memory-status enabled=unknown patched=unknown reason=no-cgroup-v2-root");
+        return;
+    }
+    if (!memoryControllerMissing(controllers)) {
+        logFile("[install] op=cgroup-memory-status enabled=true patched=false");
+        return;
+    }
+    const cmdlinePath = existsSync("/boot/firmware/cmdline.txt")
+        ? "/boot/firmware/cmdline.txt"
+        : existsSync("/boot/cmdline.txt")
+            ? "/boot/cmdline.txt"
+            : null;
+    if (!cmdlinePath) {
+        logFile("[install] op=cgroup-memory-status enabled=false patched=false reason=no-cmdline-file");
+        return;
+    }
+    const cmdline = readFileSync(cmdlinePath, "utf-8");
+    if (cmdlineAlreadyPatched(cmdline)) {
+        logFile("[install] op=cgroup-memory-status enabled=false patched=true");
+        return;
+    }
+    try {
+        const tmpPath = "/tmp/cmdline.txt.maxy-cgroup-patch";
+        writeFileSync(tmpPath, patchCmdline(cmdline));
+        console.log("  [privileged] cp");
+        shell("cp", [tmpPath, cmdlinePath], { sudo: true });
+        spawnSync("rm", ["-f", tmpPath]);
+        logFile("[install] op=cgroup-memory-status enabled=false patched=true");
+    }
+    catch {
+        logFile("[install] op=cgroup-memory-status enabled=false patched=false reason=patch-failed");
+    }
+}
 function installService() {
     log("11", TOTAL, `Starting ${BRAND.productName}...`);
     // Linux falls through to the systemd-user body below; darwin renders +
@@ -3265,6 +3316,9 @@ function installService() {
         spawnSync("sudo", ["sysctl", "--system"], { stdio: "ignore", timeout: 10_000 });
     }
     catch { /* non-critical — values applied on next reboot */ }
+    // Task 1297 — activate the fleet-wide memory ceiling (Task 1176/1222) by
+    // enabling the kernel controller it has silently depended on since it shipped.
+    configureCgroupMemoryController();
     const serviceDir = resolve(process.env.HOME ?? "/root", ".config/systemd/user");
     mkdirSync(serviceDir, { recursive: true });
     // Create systemd user service

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.372",
+  "version": "0.1.374",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/lib/models/dist/index.d.ts

@@ -1,5 +1,5 @@
 export declare const OPUS_MODEL = "claude-opus-4-8[1m]";
-export declare const SONNET_MODEL = "claude-sonnet-4-6";
+export declare const SONNET_MODEL = "claude-sonnet-5";
 export declare const HAIKU_MODEL = "claude-haiku-4-5";
 export declare const MODEL_CONTEXT_WINDOW: Record<string, number>;
 /** Look up context window size; defaults to 200k for unknown models. */

package/payload/platform/lib/models/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAChD,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;qEAEqE;AACrE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAItD,CAAC;AAEF;+DAC+D;AAC/D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;mCAGmC;AACnC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4C,CAAC;AAC5F,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;qCAKqC;AACrC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;wDAIwD;AACxD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAaD,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,0EAA2E,CAAC;AACzG,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AAED,sDAAsD;AACtD,eAAO,MAAM,aAAa,6CAA8C,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AACzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AASD;kFACkF;AAClF,eAAO,MAAM,sBAAsB,qFAA4C,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;oEACoE;AACpE,eAAO,MAAM,qBAAqB,4DAA6C,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE;;;;;yCAKyC;AACzC,eAAO,MAAM,yBAAyB,oDAAqC,CAAC;AAC5E,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,qBAAqB,CAErF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,UAAU,wBAAwB,CAAC;AAChD,eAAO,MAAM,YAAY,oBAAoB,CAAC;AAC9C,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAE9C,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIvD,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;qEAEqE;AACrE,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAItD,CAAC;AAEF;+DAC+D;AAC/D,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;mCAGmC;AACnC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4C,CAAC;AAC5F,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;;;qCAKqC;AACrC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE9C;AAED;;;;wDAIwD;AACxD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEnD;AAaD,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,0EAA2E,CAAC;AACzG,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,cAAc,CAEvE;AAED,sDAAsD;AACtD,eAAO,MAAM,aAAa,6CAA8C,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AACzD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AASD;kFACkF;AAClF,eAAO,MAAM,sBAAsB,qFAA4C,CAAC;AAChF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;oEACoE;AACpE,eAAO,MAAM,qBAAqB,4DAA6C,CAAC;AAChF,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE;;;;;yCAKyC;AACzC,eAAO,MAAM,yBAAyB,oDAAqC,CAAC;AAC5E,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAC/E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,qBAAqB,CAErF"}

package/payload/platform/lib/models/dist/index.js

@@ -16,7 +16,7 @@ exports.isNewSessionEffortLevel = isNewSessionEffortLevel;
 // context-extension suffix, valid in settings.json "model" and agent
 // frontmatter); Sonnet/Haiku stay on the standard 200k window.
 exports.OPUS_MODEL = "claude-opus-4-8[1m]";
-exports.SONNET_MODEL = "claude-sonnet-4-6";
+exports.SONNET_MODEL = "claude-sonnet-5";
 exports.HAIKU_MODEL = "claude-haiku-4-5";
 exports.MODEL_CONTEXT_WINDOW = {
     [exports.OPUS_MODEL]: 1_000_000,
@@ -32,7 +32,7 @@ function contextWindow(model) {
  *  with its raw id as the label (the composer's append-fallback). */
 exports.MODEL_DISPLAY_NAMES = {
     [exports.OPUS_MODEL]: "Opus 4.8 (1M context)",
-    [exports.SONNET_MODEL]: "Sonnet 4.6",
+    [exports.SONNET_MODEL]: "Sonnet 5",
     [exports.HAIKU_MODEL]: "Haiku 4.5",
 };
 /** The dropdown label for a model id: friendly name when canonical, else the

package/payload/platform/lib/models/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAgB7C,sCAEC;AAaD,4CAEC;AAOD,8CAEC;AAQD,kCAEC;AAOD,4CAEC;AAgBD,4CAEC;AAKD,sCAEC;AA2BD,0DAEC;AAjHD,iEAAiE;AACjE,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,mBAAmB,CAAC;AACnC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED;;qEAEqE;AACxD,QAAA,mBAAmB,GAA2B;IACzD,CAAC,kBAAU,CAAC,EAAE,uBAAuB;IACrC,CAAC,oBAAY,CAAC,EAAE,YAAY;IAC5B,CAAC,mBAAW,CAAC,EAAE,WAAW;CAC3B,CAAC;AAEF;+DAC+D;AAC/D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,2BAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;mCAGmC;AACtB,QAAA,iBAAiB,GAAsB,CAAC,kBAAU,EAAE,oBAAY,EAAE,mBAAW,CAAC,CAAC;AAC5F,SAAgB,iBAAiB,CAAC,EAAU;IAC1C,OAAO,yBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;qCAKqC;AACrC,SAAgB,WAAW,CAAC,EAAU;IACpC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;wDAIwD;AACxD,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,yBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,uEAAuE;AACvE,oCAAoC;AAEpC,4EAA4E;AAC/D,QAAA,gBAAgB,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAU,CAAC;AAEzG,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAQ,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,sDAAsD;AACzC,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAEzE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAQ,qBAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,iFAAiF;AAEjF;kFACkF;AACrE,QAAA,sBAAsB,GAAG,CAAC,GAAG,wBAAgB,EAAE,SAAS,CAAU,CAAC;AAGhF;oEACoE;AACvD,QAAA,qBAAqB,GAAG,CAAC,MAAM,EAAE,GAAG,qBAAa,EAAE,KAAK,CAAU,CAAC;AAGhF;;;;;yCAKyC;AAC5B,QAAA,yBAAyB,GAAG,CAAC,GAAG,qBAAa,EAAE,KAAK,CAAU,CAAC;AAE5E,SAAgB,uBAAuB,CAAC,KAAa;IACnD,OAAQ,iCAA+C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAAA,0DAA0D;AAC1D,iEAAiE;AACjE,6CAA6C;;;AAgB7C,sCAEC;AAaD,4CAEC;AAOD,8CAEC;AAQD,kCAEC;AAOD,4CAEC;AAgBD,4CAEC;AAKD,sCAEC;AA2BD,0DAEC;AAjHD,iEAAiE;AACjE,qEAAqE;AACrE,+DAA+D;AAClD,QAAA,UAAU,GAAG,qBAAqB,CAAC;AACnC,QAAA,YAAY,GAAG,iBAAiB,CAAC;AACjC,QAAA,WAAW,GAAG,kBAAkB,CAAC;AAEjC,QAAA,oBAAoB,GAA2B;IAC1D,CAAC,kBAAU,CAAC,EAAE,SAAS;IACvB,CAAC,oBAAY,CAAC,EAAE,OAAO;IACvB,CAAC,mBAAW,CAAC,EAAE,OAAO;CACvB,CAAC;AAEF,wEAAwE;AACxE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,4BAAoB,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;AAChD,CAAC;AAED;;qEAEqE;AACxD,QAAA,mBAAmB,GAA2B;IACzD,CAAC,kBAAU,CAAC,EAAE,uBAAuB;IACrC,CAAC,oBAAY,CAAC,EAAE,UAAU;IAC1B,CAAC,mBAAW,CAAC,EAAE,WAAW;CAC3B,CAAC;AAEF;+DAC+D;AAC/D,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,2BAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED;;;mCAGmC;AACtB,QAAA,iBAAiB,GAAsB,CAAC,kBAAU,EAAE,oBAAY,EAAE,mBAAW,CAAC,CAAC;AAC5F,SAAgB,iBAAiB,CAAC,EAAU;IAC1C,OAAO,yBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED;;;;;qCAKqC;AACrC,SAAgB,WAAW,CAAC,EAAU;IACpC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;;wDAIwD;AACxD,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,yBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,4EAA4E;AAC5E,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAClF,uEAAuE;AACvE,oCAAoC;AAEpC,4EAA4E;AAC/D,QAAA,gBAAgB,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,CAAU,CAAC;AAEzG,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAQ,wBAAsC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,sDAAsD;AACzC,QAAA,aAAa,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAEzE,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAQ,qBAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,gFAAgF;AAChF,6EAA6E;AAC7E,iFAAiF;AAEjF;kFACkF;AACrE,QAAA,sBAAsB,GAAG,CAAC,GAAG,wBAAgB,EAAE,SAAS,CAAU,CAAC;AAGhF;oEACoE;AACvD,QAAA,qBAAqB,GAAG,CAAC,MAAM,EAAE,GAAG,qBAAa,EAAE,KAAK,CAAU,CAAC;AAGhF;;;;;yCAKyC;AAC5B,QAAA,yBAAyB,GAAG,CAAC,GAAG,qBAAa,EAAE,KAAK,CAAU,CAAC;AAE5E,SAAgB,uBAAuB,CAAC,KAAa;IACnD,OAAQ,iCAA+C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC"}

package/payload/platform/lib/models/src/index.ts

@@ -6,7 +6,7 @@
 // context-extension suffix, valid in settings.json "model" and agent
 // frontmatter); Sonnet/Haiku stay on the standard 200k window.
 export const OPUS_MODEL = "claude-opus-4-8[1m]";
-export const SONNET_MODEL = "claude-sonnet-4-6";
+export const SONNET_MODEL = "claude-sonnet-5";
 export const HAIKU_MODEL = "claude-haiku-4-5";
 
 export const MODEL_CONTEXT_WINDOW: Record<string, number> = {
@@ -25,7 +25,7 @@ export function contextWindow(model: string): number {
  *  with its raw id as the label (the composer's append-fallback). */
 export const MODEL_DISPLAY_NAMES: Record<string, string> = {
   [OPUS_MODEL]: "Opus 4.8 (1M context)",
-  [SONNET_MODEL]: "Sonnet 4.6",
+  [SONNET_MODEL]: "Sonnet 5",
   [HAIKU_MODEL]: "Haiku 4.5",
 };
 

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:5a6d4386724cd93c9816d776b1ef8e12f8ecb87b3690953b828147dcaef2c72f
+content-hash: sha256:e15d80a5ac347f9eb8167ecdc10e2ce092db72ca3d6dfa5d0d8ac85d6676ec2a
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2535,7 +2535,7 @@ either is a regression.
 | `/session-rc-spawn` | POST `{ sessionId?, name? }`. Fire-and-forget `claude --remote-control [name] [--session-id <sid>]`. Present `sessionId` resumes; absent starts a fresh session (also used by the sidebar's "New session" button — it no longer opens claude.ai/code directly). Proxies to the manager's `/rc-spawn`, which waits up to **60 s** (raised from 12 s) for the spawned PTY to bind and returns `{ spawnedPid, sessionId, bridgeSessionId, slug, outcome, reason }`. For a webchat-bound spawn (every admin-gated host's "New session", returning a same-origin `/chat?session=<id>` target — `resolveRcSpawnOutcome` → `sameOrigin:true`) the Sidebar navigates the **current** tab via `window.location.assign`, replacing the dashboard in place (back returns to it); only a claude.ai/code slug (`sameOrigin:false`, the bare-admin resume bridge, never a new-session outcome) navigates a separately-opened tab. On `timeout` or `spawn-failed` it shows an error modal (reason + sessionId) and **never** opens a bare claude.ai/code tab. The new process registers itself as its own Remote Control entry in claude.ai/code. | `POST /` |
 | `/claude-sessions` | **Spawn surface only**. `POST /` is the Sidebar new-session-with-prompt path, cookie-auth only (the recorder loopback caller was removed; LinkedIn ingest moved to `/rc-spawn`). The former UI-facing handlers (SSE row feed, list, resume, stop, rename, archive, delete, `/:id/meta`, `/:id/input`, `/:id/log`) were removed — the maxy dashboard no longer manages or displays sessions. | `POST /` |
 
-**Admin session management moved entirely to claude's own interfaces** (claude.ai/code, claude desktop). A manager-owned per-account `claude rc --spawn same-dir` daemon registers the device as a Remote Control target there; the composer creates / resumes / stops / renames / archives / deletes sessions, with model + permission-mode applied at inception. The model lever is `account.json.adminModel` → `CLAUDE_CONFIG_DIR/settings.json "model"`, written by the daemon supervisor at boot; the reasoning-effort lever is `account.json.effort` → `settings.json "effortLevel"` (accepted values `low|medium|high|xhigh`; any other value, e.g. legacy `"auto"`, leaves the key unset so claude's own default governs), written by the same read-merge-write at boot. A third inception lever, permission mode, is added: `account.json.adminPermissionMode` → `settings.json "permissions.defaultMode"` (the 5 composer-writable modes `default|acceptEdits|plan|auto|bypassPermissions`; `dontAsk` is out of scope). Unlike model/effort (top-level keys), this lever **deep-merges** the nested `permissions.defaultMode`, owning only that key and preserving sibling `permissions` keys (allow/deny/…) — what the binary and the spawn lifeline actually read. **For admin sessions, permission mode is fixed (Bypass) and not operator-chosen, while model and effort ARE operator-chosen at launch** via the composer's `+` new-session popover — a radio model list (Opus / Sonnet / Haiku) plus a 5-stop Faster→Smarter effort slider (Low / Medium / High / Extra / Max, where `max` applies via the `--effort` argv rather than `settings.json`); the popover description lives in `.docs/admin-webchat-native-channel.md`. Absent a pick (and on every resume), the daemon-pinned defaults govern: the `/chat` composer *footer* carries no live re-seat pickers — `rc-daemon.ts` pins settings.json `model`/`effortLevel`/`permissions.defaultMode` to `claude-opus-4-8[1m]` / `medium` / `bypassPermissions` regardless of `account.json` (read by the rc-spawn webchat path), and `pty-spawner.ts` forces the claude.ai/code PTY `--permission-mode` to `bypassPermissions` for `role=admin`. Public sessions are fixed to `claude-sonnet-4-6` (the `/public-spawn` chokepoint + `buildPublicWebchatSpawnRequest`), keeping `dontAsk`. The composer footer instead renders a **read-only** params row (mode · model · effort labels) plus a context-window usage figure (`pct% · ~used/~window`), all sourced from the session pointer; the full path is in `.docs/admin-webchat-native-channel.md`. The composer cannot re-seat a session, so the "no transcript" 400 on a brand-new chat is unreachable; the `/api/admin/session-reseat` + `/api/webchat/settings` routes and the dashboard re-seat form stay as off-composer surfaces. When the live session runs in `default` ("Ask permissions") mode, a tool the agent attempts that needs approval surfaces an Allow/Deny card in the composer (tool, description, argument preview); a click sends the verdict over Claude Code's channel permission relay and the tool runs or is refused — webchat is the only interactive ask surface (WhatsApp stays text-only; Telegram has no agent channel). Beyond the composer, the maxy admin UI keeps a single "New session" link (`https://claude.ai/code`, opens in a new tab) and no separate session list, viewer, controls, or model/mode picker. The daemon supervisor lives at [`platform/services/claude-session-manager/src/rc-daemon.ts`](../../../services/claude-session-manager/src/rc-daemon.ts). The `/session-defaults` route and `SpawnPreference` node were deleted with the picker. `/new-session-failure`, `/new-session-submit`, and `/claude-capabilities` are now orphaned (consumed only by the deleted NewSessionModal) — see [`.tasks/501`](../../../.tasks/) for their removal.
+**Admin session management moved entirely to claude's own interfaces** (claude.ai/code, claude desktop). A manager-owned per-account `claude rc --spawn same-dir` daemon registers the device as a Remote Control target there; the composer creates / resumes / stops / renames / archives / deletes sessions, with model + permission-mode applied at inception. The model lever is `account.json.adminModel` → `CLAUDE_CONFIG_DIR/settings.json "model"`, written by the daemon supervisor at boot; the reasoning-effort lever is `account.json.effort` → `settings.json "effortLevel"` (accepted values `low|medium|high|xhigh`; any other value, e.g. legacy `"auto"`, leaves the key unset so claude's own default governs), written by the same read-merge-write at boot. A third inception lever, permission mode, is added: `account.json.adminPermissionMode` → `settings.json "permissions.defaultMode"` (the 5 composer-writable modes `default|acceptEdits|plan|auto|bypassPermissions`; `dontAsk` is out of scope). Unlike model/effort (top-level keys), this lever **deep-merges** the nested `permissions.defaultMode`, owning only that key and preserving sibling `permissions` keys (allow/deny/…) — what the binary and the spawn lifeline actually read. **For admin sessions, permission mode is fixed (Bypass) and not operator-chosen, while model and effort ARE operator-chosen at launch** via the composer's `+` new-session popover — a radio model list (Opus / Sonnet / Haiku) plus a 5-stop Faster→Smarter effort slider (Low / Medium / High / Extra / Max, where `max` applies via the `--effort` argv rather than `settings.json`); the popover description lives in `.docs/admin-webchat-native-channel.md`. Absent a pick (and on every resume), the daemon-pinned defaults govern: the `/chat` composer *footer* carries no live re-seat pickers — `rc-daemon.ts` pins settings.json `model`/`effortLevel`/`permissions.defaultMode` to `claude-opus-4-8[1m]` / `medium` / `bypassPermissions` regardless of `account.json` (read by the rc-spawn webchat path), and `pty-spawner.ts` forces the claude.ai/code PTY `--permission-mode` to `bypassPermissions` for `role=admin`. Public sessions are fixed to `claude-sonnet-5` (the `/public-spawn` chokepoint + `buildPublicWebchatSpawnRequest`), keeping `dontAsk`. The composer footer instead renders a **read-only** params row (mode · model · effort labels) plus a context-window usage figure (`pct% · ~used/~window`), all sourced from the session pointer; the full path is in `.docs/admin-webchat-native-channel.md`. The composer cannot re-seat a session, so the "no transcript" 400 on a brand-new chat is unreachable; the `/api/admin/session-reseat` + `/api/webchat/settings` routes and the dashboard re-seat form stay as off-composer surfaces. When the live session runs in `default` ("Ask permissions") mode, a tool the agent attempts that needs approval surfaces an Allow/Deny card in the composer (tool, description, argument preview); a click sends the verdict over Claude Code's channel permission relay and the tool runs or is refused — webchat is the only interactive ask surface (WhatsApp stays text-only; Telegram has no agent channel). Beyond the composer, the maxy admin UI keeps a single "New session" link (`https://claude.ai/code`, opens in a new tab) and no separate session list, viewer, controls, or model/mode picker. The daemon supervisor lives at [`platform/services/claude-session-manager/src/rc-daemon.ts`](../../../services/claude-session-manager/src/rc-daemon.ts). The `/session-defaults` route and `SpawnPreference` node were deleted with the picker. `/new-session-failure`, `/new-session-submit`, and `/claude-capabilities` are now orphaned (consumed only by the deleted NewSessionModal) — see [`.tasks/501`](../../../.tasks/) for their removal.
 
 **Row title resolution.** Both the sidebar (`/sidebar-sessions`) and the manager's own row payload resolve a row's title in the same order: operator rename → Claude Code `ai-title` → first non-CLI user message → 8-char sessionId prefix. The operator-rename tier is the on-disk `<accountDir>/session-titles.json` (the manager's `UserTitleStore`), keyed by the CC sessionId — the sidebar reads that same file, so a write to the store lights up both surfaces with one write.
 

package/payload/platform/plugins/admin/skills/plugin-management/SKILL.md

@@ -94,7 +94,7 @@ When the user asks to change output style, thinking view, effort, context mode,
 
 | Setting | Field | Values |
 |---------|-------|--------|
-| Admin model | `adminModel` | Any Anthropic model ID (e.g. `"claude-sonnet-4-6"`) |
+| Admin model | `adminModel` | Any Anthropic model ID (e.g. `"claude-sonnet-5"`) |
 | Public model | `publicModel` | Any Anthropic model ID (e.g. `"claude-haiku-4-5"`) |
 | Output style | `outputStyle` | `"default"` \| `"explanatory"` |
 | Thinking view | `thinkingView` | `"default"` \| `"expanded"` \| `"collapsed"` |

package/payload/platform/plugins/admin/skills/public-agent-manager/SKILL.md

@@ -82,7 +82,7 @@ Present as a `select` field within the agent configuration `form` during creatio
 | Model | ID | Suitability | Cost |
 |-------|-----|------------|------|
 | Haiku | `claude-haiku-4-5` | Fast, cost-effective. FAQ, routing, high-volume. | Low |
-| Sonnet | `claude-sonnet-4-6` | Balanced. Nuanced conversation, qualification, support. | Standard |
+| Sonnet | `claude-sonnet-5` | Balanced. Nuanced conversation, qualification, support. | Standard |
 | Opus | `claude-opus-4-8[1m]` | Maximum intelligence. Complex sales, consultative selling. | Premium |
 
 ## SOUL.md Scope Enforcement
@@ -161,7 +161,7 @@ After creation, no template metadata persists in the agent's files. The resultin
    - `knowledgeKeywords` (`text`): label "Knowledge keywords (max 5, comma-separated)", placeholder with examples relevant to the agent's role
    - `model` (`select`): label "Model", options with descriptions:
      - `claude-haiku-4-5` — "Haiku — Fast, cost-effective. FAQ, routing, high-volume."
-     - `claude-sonnet-4-6` — "Sonnet — Balanced. Nuanced conversation, qualification, support."
+     - `claude-sonnet-5` — "Sonnet — Balanced. Nuanced conversation, qualification, support."
      - `claude-opus-4-8[1m]` — "Opus — Maximum intelligence. Complex sales, consultative selling."
    - `showAgentName` (`select`): label "Chat header title", options: `false` — "Business name (default)", `true` — "Agent display name", `"none"` — "None (logo only)"
    The `model` field should have a `defaultValue` of `"claude-haiku-4-5"`.

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -61,7 +61,7 @@ either is a regression.
 | `/session-rc-spawn` | POST `{ sessionId?, name? }`. Fire-and-forget `claude --remote-control [name] [--session-id <sid>]`. Present `sessionId` resumes; absent starts a fresh session (also used by the sidebar's "New session" button — it no longer opens claude.ai/code directly). Proxies to the manager's `/rc-spawn`, which waits up to **60 s** (raised from 12 s) for the spawned PTY to bind and returns `{ spawnedPid, sessionId, bridgeSessionId, slug, outcome, reason }`. For a webchat-bound spawn (every admin-gated host's "New session", returning a same-origin `/chat?session=<id>` target — `resolveRcSpawnOutcome` → `sameOrigin:true`) the Sidebar navigates the **current** tab via `window.location.assign`, replacing the dashboard in place (back returns to it); only a claude.ai/code slug (`sameOrigin:false`, the bare-admin resume bridge, never a new-session outcome) navigates a separately-opened tab. On `timeout` or `spawn-failed` it shows an error modal (reason + sessionId) and **never** opens a bare claude.ai/code tab. The new process registers itself as its own Remote Control entry in claude.ai/code. | `POST /` |
 | `/claude-sessions` | **Spawn surface only**. `POST /` is the Sidebar new-session-with-prompt path, cookie-auth only (the recorder loopback caller was removed; LinkedIn ingest moved to `/rc-spawn`). The former UI-facing handlers (SSE row feed, list, resume, stop, rename, archive, delete, `/:id/meta`, `/:id/input`, `/:id/log`) were removed — the maxy dashboard no longer manages or displays sessions. | `POST /` |
 
-**Admin session management moved entirely to claude's own interfaces** (claude.ai/code, claude desktop). A manager-owned per-account `claude rc --spawn same-dir` daemon registers the device as a Remote Control target there; the composer creates / resumes / stops / renames / archives / deletes sessions, with model + permission-mode applied at inception. The model lever is `account.json.adminModel` → `CLAUDE_CONFIG_DIR/settings.json "model"`, written by the daemon supervisor at boot; the reasoning-effort lever is `account.json.effort` → `settings.json "effortLevel"` (accepted values `low|medium|high|xhigh`; any other value, e.g. legacy `"auto"`, leaves the key unset so claude's own default governs), written by the same read-merge-write at boot. A third inception lever, permission mode, is added: `account.json.adminPermissionMode` → `settings.json "permissions.defaultMode"` (the 5 composer-writable modes `default|acceptEdits|plan|auto|bypassPermissions`; `dontAsk` is out of scope). Unlike model/effort (top-level keys), this lever **deep-merges** the nested `permissions.defaultMode`, owning only that key and preserving sibling `permissions` keys (allow/deny/…) — what the binary and the spawn lifeline actually read. **For admin sessions, permission mode is fixed (Bypass) and not operator-chosen, while model and effort ARE operator-chosen at launch** via the composer's `+` new-session popover — a radio model list (Opus / Sonnet / Haiku) plus a 5-stop Faster→Smarter effort slider (Low / Medium / High / Extra / Max, where `max` applies via the `--effort` argv rather than `settings.json`); the popover description lives in `.docs/admin-webchat-native-channel.md`. Absent a pick (and on every resume), the daemon-pinned defaults govern: the `/chat` composer *footer* carries no live re-seat pickers — `rc-daemon.ts` pins settings.json `model`/`effortLevel`/`permissions.defaultMode` to `claude-opus-4-8[1m]` / `medium` / `bypassPermissions` regardless of `account.json` (read by the rc-spawn webchat path), and `pty-spawner.ts` forces the claude.ai/code PTY `--permission-mode` to `bypassPermissions` for `role=admin`. Public sessions are fixed to `claude-sonnet-4-6` (the `/public-spawn` chokepoint + `buildPublicWebchatSpawnRequest`), keeping `dontAsk`. The composer footer instead renders a **read-only** params row (mode · model · effort labels) plus a context-window usage figure (`pct% · ~used/~window`), all sourced from the session pointer; the full path is in `.docs/admin-webchat-native-channel.md`. The composer cannot re-seat a session, so the "no transcript" 400 on a brand-new chat is unreachable; the `/api/admin/session-reseat` + `/api/webchat/settings` routes and the dashboard re-seat form stay as off-composer surfaces. When the live session runs in `default` ("Ask permissions") mode, a tool the agent attempts that needs approval surfaces an Allow/Deny card in the composer (tool, description, argument preview); a click sends the verdict over Claude Code's channel permission relay and the tool runs or is refused — webchat is the only interactive ask surface (WhatsApp stays text-only; Telegram has no agent channel). Beyond the composer, the maxy admin UI keeps a single "New session" link (`https://claude.ai/code`, opens in a new tab) and no separate session list, viewer, controls, or model/mode picker. The daemon supervisor lives at [`platform/services/claude-session-manager/src/rc-daemon.ts`](../../../services/claude-session-manager/src/rc-daemon.ts). The `/session-defaults` route and `SpawnPreference` node were deleted with the picker. `/new-session-failure`, `/new-session-submit`, and `/claude-capabilities` are now orphaned (consumed only by the deleted NewSessionModal) — see [`.tasks/501`](../../../.tasks/) for their removal.
+**Admin session management moved entirely to claude's own interfaces** (claude.ai/code, claude desktop). A manager-owned per-account `claude rc --spawn same-dir` daemon registers the device as a Remote Control target there; the composer creates / resumes / stops / renames / archives / deletes sessions, with model + permission-mode applied at inception. The model lever is `account.json.adminModel` → `CLAUDE_CONFIG_DIR/settings.json "model"`, written by the daemon supervisor at boot; the reasoning-effort lever is `account.json.effort` → `settings.json "effortLevel"` (accepted values `low|medium|high|xhigh`; any other value, e.g. legacy `"auto"`, leaves the key unset so claude's own default governs), written by the same read-merge-write at boot. A third inception lever, permission mode, is added: `account.json.adminPermissionMode` → `settings.json "permissions.defaultMode"` (the 5 composer-writable modes `default|acceptEdits|plan|auto|bypassPermissions`; `dontAsk` is out of scope). Unlike model/effort (top-level keys), this lever **deep-merges** the nested `permissions.defaultMode`, owning only that key and preserving sibling `permissions` keys (allow/deny/…) — what the binary and the spawn lifeline actually read. **For admin sessions, permission mode is fixed (Bypass) and not operator-chosen, while model and effort ARE operator-chosen at launch** via the composer's `+` new-session popover — a radio model list (Opus / Sonnet / Haiku) plus a 5-stop Faster→Smarter effort slider (Low / Medium / High / Extra / Max, where `max` applies via the `--effort` argv rather than `settings.json`); the popover description lives in `.docs/admin-webchat-native-channel.md`. Absent a pick (and on every resume), the daemon-pinned defaults govern: the `/chat` composer *footer* carries no live re-seat pickers — `rc-daemon.ts` pins settings.json `model`/`effortLevel`/`permissions.defaultMode` to `claude-opus-4-8[1m]` / `medium` / `bypassPermissions` regardless of `account.json` (read by the rc-spawn webchat path), and `pty-spawner.ts` forces the claude.ai/code PTY `--permission-mode` to `bypassPermissions` for `role=admin`. Public sessions are fixed to `claude-sonnet-5` (the `/public-spawn` chokepoint + `buildPublicWebchatSpawnRequest`), keeping `dontAsk`. The composer footer instead renders a **read-only** params row (mode · model · effort labels) plus a context-window usage figure (`pct% · ~used/~window`), all sourced from the session pointer; the full path is in `.docs/admin-webchat-native-channel.md`. The composer cannot re-seat a session, so the "no transcript" 400 on a brand-new chat is unreachable; the `/api/admin/session-reseat` + `/api/webchat/settings` routes and the dashboard re-seat form stay as off-composer surfaces. When the live session runs in `default` ("Ask permissions") mode, a tool the agent attempts that needs approval surfaces an Allow/Deny card in the composer (tool, description, argument preview); a click sends the verdict over Claude Code's channel permission relay and the tool runs or is refused — webchat is the only interactive ask surface (WhatsApp stays text-only; Telegram has no agent channel). Beyond the composer, the maxy admin UI keeps a single "New session" link (`https://claude.ai/code`, opens in a new tab) and no separate session list, viewer, controls, or model/mode picker. The daemon supervisor lives at [`platform/services/claude-session-manager/src/rc-daemon.ts`](../../../services/claude-session-manager/src/rc-daemon.ts). The `/session-defaults` route and `SpawnPreference` node were deleted with the picker. `/new-session-failure`, `/new-session-submit`, and `/claude-capabilities` are now orphaned (consumed only by the deleted NewSessionModal) — see [`.tasks/501`](../../../.tasks/) for their removal.
 
 **Row title resolution.** Both the sidebar (`/sidebar-sessions`) and the manager's own row payload resolve a row's title in the same order: operator rename → Claude Code `ai-title` → first non-CLI user message → 8-char sessionId prefix. The operator-rename tier is the on-disk `<accountDir>/session-titles.json` (the manager's `UserTitleStore`), keyed by the CC sessionId — the sidebar reads that same file, so a write to the store lights up both surfaces with one write.
 

package/payload/platform/scripts/rss-sampler.sh

@@ -56,14 +56,30 @@ while true; do
   # interface, not CLI prose); skip the line on any host where systemctl is
   # absent, the slice is unknown, or MemoryHigh is unset/infinity.
   if command -v systemctl >/dev/null 2>&1; then
-    slice_props=$(systemctl --user show claude-ptys.slice -p MemoryCurrent -p MemoryHigh 2>/dev/null || true)
+    slice_props=$(systemctl --user show claude-ptys.slice -p MemoryCurrent -p MemoryHigh -p ControlGroup 2>/dev/null || true)
     slice_current=$(printf '%s\n' "$slice_props" | sed -n 's/^MemoryCurrent=//p')
     slice_high=$(printf '%s\n' "$slice_props" | sed -n 's/^MemoryHigh=//p')
+    slice_cgroup=$(printf '%s\n' "$slice_props" | sed -n 's/^ControlGroup=//p')
     if [[ "$slice_current" =~ ^[0-9]+$ && "$slice_high" =~ ^[0-9]+$ && "$slice_high" -gt 0 ]]; then
       slice_current_mb=$(( slice_current / 1048576 ))
       slice_high_mb=$(( slice_high / 1048576 ))
       slice_ratio=$(( slice_current * 100 / slice_high ))
-      echo "[rss] op=slice-pressure slice=claude-ptys current=${slice_current_mb} high=${slice_high_mb} ratio=${slice_ratio}" >> "$LOG_PATH"
+      # Task 1297 — memory.events `high` is the cgroup's own count of times
+      # this slice crossed MemoryHigh (a throttle event). The concern this
+      # answers: a MemoryHigh throttle could itself slow the brand server
+      # enough to miss its systemd watchdog heartbeat — this makes that
+      # correlation checkable from logs instead of guessed.
+      high_events=0
+      if [[ -n "$slice_cgroup" && -r "/sys/fs/cgroup${slice_cgroup}/memory.events" ]]; then
+        high_events=$(sed -n 's/^high //p' "/sys/fs/cgroup${slice_cgroup}/memory.events" 2>/dev/null || echo 0)
+        [[ "$high_events" =~ ^[0-9]+$ ]] || high_events=0
+      fi
+      echo "[rss] op=slice-pressure slice=claude-ptys current=${slice_current_mb} high=${slice_high_mb} ratio=${slice_ratio} highEvents=${high_events}" >> "$LOG_PATH"
+      # Task 1297 — the exact standing-sampler line the task names: real
+      # cgroup-accounted cohort total (not the claude.exe-only pgrep sum used
+      # by the plain per-cycle line above) against the real ceiling, so
+      # sizing can be tuned from evidence instead of guessed.
+      echo "[realagent-mem-census] rss_total=${slice_current} ceiling=${slice_high} sessions_live=${claude_count}" >> "$LOG_PATH"
     fi
   fi
 

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAyBzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAgFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAynFpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA4BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAgFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAgoFpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -44,7 +44,7 @@ import { createRcChildLog } from './rc-child-log.js';
 // --append-system-prompt for channel-bound admin sessions.
 import { extractVoiceSection } from './system-prompt.js';
 import { readJsonlSession } from './jsonl-enumerator.js';
-import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, detectRemoteControlSlug, classifyBindBlocker, } from './jsonl-path.js';
+import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, slugForExistingJsonl, jsonlPathForSlug, sidecarPathForSlug, detectRemoteControlSlug, classifyBindBlocker, } from './jsonl-path.js';
 import { basename, dirname, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
 import { credentialsPathForConfigDir, snapshotAuthForFailureReason } from './auth-snapshot.js';
@@ -933,7 +933,7 @@ export function buildHttpApp(deps) {
         const specialist = typeof body.specialist === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist)
             ? body.specialist
             : undefined;
-        // Task 956 — public sessions are pinned to Sonnet 4.6 (operator decision:
+        // Task 956 — public sessions are pinned to Sonnet 5 (operator decision:
         // admin-only Bypass/Opus; public stays Sonnet + fail-closed dontAsk). The
         // role==='public' force is the chokepoint covering every public spawn
         // (webchat + WhatsApp); other roles keep their body-supplied model.
@@ -1669,17 +1669,24 @@ export function buildHttpApp(deps) {
         }
         // Task 260 — purge from BOTH locations: a row may have its JSONL
         // at the top level (live or just-ended) or under archive/ (archived).
-        const topJsonl = jsonlPathForSessionId(deps.spawnCwd, sessionId);
-        const archivedJsonl = jsonlPathForSessionId(deps.spawnCwd, sessionId, { archived: true });
-        const topSidecar = sidecarPathForSessionId(deps.spawnCwd, sessionId);
-        const archivedSidecar = sidecarPathForSessionId(deps.spawnCwd, sessionId, { archived: true });
+        // Task 1298 — resolve the slug that actually holds the JSONL first;
+        // the list (sidebar-sessions.ts) walks every slug, so delete must too.
+        // Fall back to spawnCwd's slug only when nothing is found anywhere —
+        // hasTop/hasArchived will both be false regardless, so the fallback
+        // only affects which (nonexistent) paths appear in the 404 case.
+        const resolvedSlug = slugForExistingJsonl(deps.claudeConfigDir, sessionId) ?? projectSlugForCwd(deps.spawnCwd);
+        const topJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
+        const archivedJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
+        const topSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
+        const archivedSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
         const hasTop = existsSync(topJsonl);
         const hasArchived = existsSync(archivedJsonl);
         if (!row || (!hasTop && !hasArchived)) {
+            deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
             timed(deps.logger, 'DELETE', `/${id}`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }
-        const subdir = join(claudeStateRoot(), 'projects', projectSlugForCwd(deps.spawnCwd), sessionId);
+        const subdir = join(claudeStateRoot(), 'projects', resolvedSlug, sessionId);
         let bytes = 0;
         try {
             bytes = hasTop ? statSync(topJsonl).size : hasArchived ? statSync(archivedJsonl).size : 0;