@rubytech/create-maxy-code 0.1.374 → 0.1.375

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.374",
+  "version": "0.1.375",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/neo4j/schema.cypher

@@ -15,15 +15,20 @@
 // Constraints
 // ----------------------------------------------------------
 
-// Person.email must be unique across all Person nodes.
+// Person.email must be unique per account (Task 1304 — account scope is a
+// property, not an edge, so email alone cannot be the natural key: two
+// accounts can each hold a Person with the same email).
 // Allows multiple nulls — phone-only contacts are not affected.
+DROP CONSTRAINT person_email_unique IF EXISTS;
 CREATE CONSTRAINT person_email_unique IF NOT EXISTS
-FOR (p:Person) REQUIRE p.email IS UNIQUE;
+FOR (p:Person) REQUIRE (p.accountId, p.email) IS UNIQUE;
 
-// Person.telephone must be unique (phone-first channels: WhatsApp, SMS, Telegram)
+// Person.telephone must be unique per account (phone-first channels:
+// WhatsApp, SMS, Telegram). Composite for the same reason as email above.
 // Allows multiple nulls — email-only contacts are not affected.
+DROP CONSTRAINT person_telephone_unique IF EXISTS;
 CREATE CONSTRAINT person_telephone_unique IF NOT EXISTS
-FOR (p:Person) REQUIRE p.telephone IS UNIQUE;
+FOR (p:Person) REQUIRE (p.accountId, p.telephone) IS UNIQUE;
 
 // Service.serviceId must be unique within the Maxy account
 CREATE CONSTRAINT service_id_unique IF NOT EXISTS

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add, admin-remove, admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false
@@ -39,6 +39,12 @@ tools:
   - name: account_purge
     publicAllowlist: false
     adminAllowlist: true
+  - name: account_channel_routing
+    publicAllowlist: false
+    adminAllowlist: true
+  - name: account_channel_routing_set
+    publicAllowlist: false
+    adminAllowlist: true
   - name: admin-add
     publicAllowlist: false
     adminAllowlist: true

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -27,7 +27,7 @@ import { publishSite } from "./tools/publish-site.js";
 import { resolveCapabilitiesHere } from "./tools/capabilities-here.js";
 import { runCatalogueCensus } from "./lib/catalogue-census.js";
 import { lifelineTool } from "../../../../lib/mcp-lifeline/dist/index.js";
-import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
+import { listAccountsFromDir, isHouseAccount, archiveAccountDir, provisionClientAccount, findHouseAccount, getChannelRoutingAccountId, setChannelRoutingAccountId, ACCOUNT_NODE_COUNT_CYPHER, ACCOUNT_PURGE_CYPHER, } from "./tools/account-lifecycle.js";
 function refusalGuidance(kind) {
     switch (kind) {
         case "unsafe-slug":
@@ -3249,14 +3249,14 @@ eagerTool(server, "action-edit", "Edit a pending action's input and then execute
 // PLATFORM_ROOT rather than the per-session ACCOUNT_ID.
 // ---------------------------------------------------------------------------
 const ACCOUNTS_ROOT = resolve(PLATFORM_ROOT, "..", "data/accounts");
-eagerTool(server, "account_list", "List every account on this install (one house + N clients) with its role. Managed-service operator tool — the active account drives which account a switched session reads and writes.", {}, async () => {
+eagerTool(server, "account_list", "List every sub-account on this install (one house + N clients) with its role. Managed-service operator tool — the active sub-account drives which account a switched session reads and writes.", {}, async () => {
     const accounts = listAccountsFromDir(ACCOUNTS_ROOT);
     const lines = accounts.map((a) => `${a.accountId} role=${a.role}${a.isHouse ? " (house)" : ""}`);
     return {
         content: [{ type: "text", text: accounts.length ? lines.join("\n") : "No accounts found." }],
     };
 });
-eagerTool(server, "account_create", "Provision a new CLIENT account on this install (managed service). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\"), seeds default plugins, and adds you (the install owner) to the account's admins so you can switch to it. Returns the new accountId. Operator-only; never creates the house account (that is the install itself).", {}, async () => {
+eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\"), seeds default plugins, and adds you (the install owner) to the sub-account's admins so you can switch to it. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {}, async () => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_create");
     const newId = randomUUID();
@@ -3278,7 +3278,7 @@ eagerTool(server, "account_create", "Provision a new CLIENT account on this inst
         if (!dirExists) {
             return { content: [{ type: "text", text: `account_create FAILED: scaffold did not produce ${accountJson}` }], isError: true };
         }
-        return { content: [{ type: "text", text: `Created client account ${newId}. Switch to it from the account picker to work in its data.` }] };
+        return { content: [{ type: "text", text: `Created client sub-account ${newId}. Switch to it from the sub-account picker to work in its data.` }] };
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -3286,7 +3286,7 @@ eagerTool(server, "account_create", "Provision a new CLIENT account on this inst
         return { content: [{ type: "text", text: `account_create FAILED: ${msg}` }], isError: true };
     }
 });
-eagerTool(server, "account_delete", "Archive a CLIENT account: move its directory to data/accounts/.trash/ so it no longer appears in the account list. Graph data is RETAINED — run account_purge with the typed confirmation to irreversibly delete it. Refuses to archive the house account. Pass the accountId to archive.", {
+eagerTool(server, "account_delete", "Archive a CLIENT sub-account: move its directory to data/accounts/.trash/ so it no longer appears in the sub-account list. Graph data is RETAINED — run account_purge with the typed confirmation to irreversibly delete it. Refuses to archive the house sub-account. Pass the accountId to archive.", {
     accountId: z.string().describe("The client accountId (UUID) to archive."),
 }, async ({ accountId }) => {
     if (!ACCOUNT_ID)
@@ -3295,7 +3295,7 @@ eagerTool(server, "account_delete", "Archive a CLIENT account: move its director
         return { content: [{ type: "text", text: `account_delete: ${accountId} is not a registered account on this install.` }], isError: true };
     }
     if (isHouseAccount(ACCOUNTS_ROOT, accountId)) {
-        return { content: [{ type: "text", text: `account_delete refused: ${accountId} is the house account and cannot be archived.` }], isError: true };
+        return { content: [{ type: "text", text: `account_delete refused: ${accountId} is the house sub-account and cannot be archived.` }], isError: true };
     }
     const ts = new Date().toISOString().replace(/[:.]/g, "").replace(/-/g, "");
     try {
@@ -3308,14 +3308,14 @@ eagerTool(server, "account_delete", "Archive a CLIENT account: move its director
         return { content: [{ type: "text", text: `account_delete FAILED: ${msg}` }], isError: true };
     }
 });
-eagerTool(server, "account_purge", "IRREVERSIBLY delete every graph node carrying an account's accountId (DETACH DELETE). Two-step safety: account_delete archives first; this purges. Requires a typed confirmation equal to the accountId itself — any mismatch refuses. Refuses the house account. Returns the node count before and after (after must be zero).", {
+eagerTool(server, "account_purge", "IRREVERSIBLY delete every graph node carrying a sub-account's accountId (DETACH DELETE). Two-step safety: account_delete archives first; this purges. Requires a typed confirmation equal to the accountId itself — any mismatch refuses. Refuses the house sub-account. Returns the node count before and after (after must be zero).", {
     accountId: z.string().describe("The accountId (UUID) whose graph data to purge."),
     confirm: z.string().describe("Type the accountId exactly to confirm the irreversible purge."),
 }, async ({ accountId, confirm }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_purge");
     if (isHouseAccount(ACCOUNTS_ROOT, accountId)) {
-        return { content: [{ type: "text", text: `account_purge refused: ${accountId} is the house account.` }], isError: true };
+        return { content: [{ type: "text", text: `account_purge refused: ${accountId} is the house sub-account.` }], isError: true };
     }
     if (confirm !== accountId) {
         return { content: [{ type: "text", text: `account_purge refused: confirmation does not match the accountId. Type the accountId exactly to confirm.` }], isError: true };
@@ -3341,6 +3341,41 @@ eagerTool(server, "account_purge", "IRREVERSIBLY delete every graph node carryin
         await session.close();
     }
 });
+eagerTool(server, "account_channel_routing", "Reports which sub-account WhatsApp/Telegram inbound currently attaches to on this install. There is exactly one WhatsApp number per install (not one per sub-account) — this is the single install-wide routing target, defaulting to the house sub-account.", {}, async () => {
+    const house = findHouseAccount(ACCOUNTS_ROOT);
+    if (!house) {
+        return { content: [{ type: "text", text: "account_channel_routing: no house account found on this install." }], isError: true };
+    }
+    const target = getChannelRoutingAccountId(ACCOUNTS_ROOT) ?? house.accountId;
+    const isDefault = target === house.accountId;
+    return {
+        content: [{ type: "text", text: `WhatsApp/Telegram inbound currently routes to: ${target}${isDefault ? " (house, default)" : ""}` }],
+    };
+});
+eagerTool(server, "account_channel_routing_set", "Repoints the single install-wide WhatsApp/Telegram inbound stream to the given sub-account. Refuses an accountId that is not a registered sub-account on this install. Takes effect on the next inbound message — no restart needed.", {
+    accountId: z.string().describe("The sub-account UUID to route WhatsApp/Telegram inbound to."),
+}, async ({ accountId }) => {
+    if (!ACCOUNT_ID)
+        return refuseNoAccount("account_channel_routing_set");
+    const known = listAccountsFromDir(ACCOUNTS_ROOT);
+    if (!known.some((a) => a.accountId === accountId)) {
+        return { content: [{ type: "text", text: `account_channel_routing_set refused: ${accountId} is not a registered sub-account on this install.` }], isError: true };
+    }
+    const house = findHouseAccount(ACCOUNTS_ROOT);
+    if (!house) {
+        return { content: [{ type: "text", text: "account_channel_routing_set FAILED: no house account found on this install." }], isError: true };
+    }
+    const previous = getChannelRoutingAccountId(ACCOUNTS_ROOT) ?? house.accountId;
+    try {
+        setChannelRoutingAccountId(ACCOUNTS_ROOT, accountId);
+        process.stderr.write(`[platform-account-id] op=repoint from=${previous.slice(0, 8)} to=${accountId.slice(0, 8)}\n`);
+        return { content: [{ type: "text", text: `WhatsApp/Telegram inbound now routes to ${accountId}.` }] };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return { content: [{ type: "text", text: `account_channel_routing_set FAILED: ${msg}` }], isError: true };
+    }
+});
 // Cleanup on exit (SIGTERM for systemd service stops on Pi)
 const cleanup = async () => {
     await closeDriver();