@rubytech/create-maxy-code 0.1.377 → 0.1.378

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.377",
+  "version": "0.1.378",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:e15d80a5ac347f9eb8167ecdc10e2ce092db72ca3d6dfa5d0d8ac85d6676ec2a
+content-hash: sha256:7346bd77231c42932ee9d106a401168e51098338ea8967d9fbadbd61f4740144
 brand: maxy-code
 product-name: Maxy
 ---
@@ -2531,7 +2531,7 @@ either is a regression.
 | `/session` | Admin cookie session: PIN-gated mint, validate, rotate. | `GET /`, `POST /` |
 | `/sessions` | Legacy admin-server conversation routes. No UI consumer remains after the ConversationsModal was retired; the surviving handlers are deletion candidates and not described here. | (legacy, no live caller) |
 | `/sidebar-sessions` | Sole data path for the sidebar Sessions list. One JSONL on disk equals one row. The row's delete button is the only way a row disappears. Each row carries `sessionId`, `title`, `startedAt`, `live`, `isSubagent`, `pid: number \| null` (basename of the matched `sessions/<pid>.json`), and `projectDir` (the directory holding the JSONL — consumed by the delete route). The payload also carries top-level `accountId` so the pane renders the full UUID label whose first ~8 chars prefix-match the truncated Remote Control daemon entry in claude.ai/code. The legacy `rcUrl` field is gone — the row's external-link affordance now POSTs `/session-rc-spawn` to start a fresh local `claude --remote-control <name> --session-id <sid>` PTY on every click. | `GET /` |
-| `/session-delete` | POST `{ sessionId, projectDir }`. Best-effort SIGTERM of the live PID (resolved from `sessions/<pid>.json` body match) then unlink the JSONL + `<sid>.meta.json` sidecar. Absent PID file is not an error. Containment: `projectDir` must live under `<CLAUDE_CONFIG_DIR>/projects/`. | `POST /` |
+| `/session-delete` | POST `{ sessionId }`. Thin proxy over the manager: POST `/:id/stop` (idempotent) then DELETE `/:id`. Forwards the caller's canonical `accountId` (`getAccountIdForSession(cacheKey)`) as `?accountId=<uuid>` on both calls. The manager's fs-watcher is armed only on the house account's project slug, so a session under any other account has no watcher row; without the forwarded accountId the manager 404s a live cross-account session on stop (silently swallowed by this route's `stop.status !== 404` tolerance) and its transcript on delete. With it, the manager derives the project slug from the account (`<accountsRoot>/<accountId>` → slug), gates on file existence alone, and (stop) reads the on-disk scope record to kill a cross-account scope unit that survived a manager restart. Absent accountId → the manager keeps its watcher-row fallback. The sibling `/session-stop` (the standalone End control) forwards `accountId` identically, for the same reason. | `POST /` |
 | `/session-rc-spawn` | POST `{ sessionId?, name? }`. Fire-and-forget `claude --remote-control [name] [--session-id <sid>]`. Present `sessionId` resumes; absent starts a fresh session (also used by the sidebar's "New session" button — it no longer opens claude.ai/code directly). Proxies to the manager's `/rc-spawn`, which waits up to **60 s** (raised from 12 s) for the spawned PTY to bind and returns `{ spawnedPid, sessionId, bridgeSessionId, slug, outcome, reason }`. For a webchat-bound spawn (every admin-gated host's "New session", returning a same-origin `/chat?session=<id>` target — `resolveRcSpawnOutcome` → `sameOrigin:true`) the Sidebar navigates the **current** tab via `window.location.assign`, replacing the dashboard in place (back returns to it); only a claude.ai/code slug (`sameOrigin:false`, the bare-admin resume bridge, never a new-session outcome) navigates a separately-opened tab. On `timeout` or `spawn-failed` it shows an error modal (reason + sessionId) and **never** opens a bare claude.ai/code tab. The new process registers itself as its own Remote Control entry in claude.ai/code. | `POST /` |
 | `/claude-sessions` | **Spawn surface only**. `POST /` is the Sidebar new-session-with-prompt path, cookie-auth only (the recorder loopback caller was removed; LinkedIn ingest moved to `/rc-spawn`). The former UI-facing handlers (SSE row feed, list, resume, stop, rename, archive, delete, `/:id/meta`, `/:id/input`, `/:id/log`) were removed — the maxy dashboard no longer manages or displays sessions. | `POST /` |
 
@@ -2543,7 +2543,7 @@ either is a regression.
 
 **`/chat` Conversations flyout + zero-sessions splash.** The admin `/chat` `HeaderMenu` carries a **Conversations** item (rendered only when `onOpenConversations` is wired, which scopes it to `/chat`) that opens an in-chat session-management pane (`app/chat/SessionList.tsx`) hosted by `chat/page.tsx` — distinct from, and sharing endpoints with, the `Sidebar` Sessions list (which stays hidden on narrow viewports). It enumerates the admin's own webchat sessions via `GET /api/admin/sidebar-sessions` (carries the per-row `live` marker and `archived` flag, install-wide), lists them newest-first with the live one marked and archived rows folded under a collapsible subsection, and offers per-row resume (`/chat?session=<id>`), rename, archive/unarchive, two-tap delete, an **End** control on the live row (`session-stop`), plus a New-session control (`session-rc-spawn`) and a copyable full id. When the canonical pointer is `known:false` (`canonical-empty`) and enumeration returns zero rows, the surface renders a splash (brand logo + New session) instead of a dead bootstrap thread; a freshly-spawned New session is `known:true`, so its greeting is preserved. Client breadcrumbs: `[chat-conversations] op=enumerate owned=<n>` and `op=action name=<open|rename|archive|delete|stop> sessionId=<id8>` (`op=action-failed … status=…` on a non-2xx). Detail lives in `.docs/admin-webchat-native-channel.md` ("Conversations flyout + zero-sessions splash").
 
-**`/chat` header conversation label.** When `/chat` has an active titled conversation, the admin/operator `HeaderMenu` centre shows that title in place of the brand icon + name (the `chat-logo` image is suppressed; the operator's first grid track keeps an empty width-reserved placeholder so centring is unchanged). `AdminChat` resolves the active session's title from the same `GET /api/admin/sidebar-sessions` list (active id = the `?session=` target, or the canonical session for the operator), adopting the row's `title` only when `titleSource ∈ {user, ai, first-message}`; a `prefix`-only row (the 8-char UUID fallback) or no matching row keeps the brand block. The label re-resolves on active-id change. One breadcrumb fires on every resolve: `[admin-ui] op=header-label sessionId=<id8> variant=<admin|operator> present=<bool> source=<user|ai|first-message|none> reason=<resolved|untitled|no-match|fetch-failed>`. The lite variant header is unchanged. Sessions named only by a resolved `personName` (public-webchat visitor / admin-webchat author rows, which stay `titleSource:'prefix'`) currently fall back to the icon; adopting those into the header label is tracked as a separate follow-up.
+**`/chat` header always shows the account name.** The admin/operator `HeaderMenu` centre always renders the active account's name alongside the brand logo, on every chat surface, regardless of the active conversation — `headerTitle = businessName || brand.productName`. There is no per-conversation header title: the active conversation's label stays in the sidebar and the Conversations flyout (each resolves its own per-session title independently), never in the header. The account name is `LocalBusiness.name`, resolved by `fetchAccountName(accountId)` in `neo4j-store.ts` with **no theme gate** — unlike `fetchBranding` (which returns null unless a colour/logo property is also set, and stays the source for actual theming). The house account is seeded with `LocalBusiness.name = <brand productName>` (`seed-neo4j.sh`, coalesced ON MATCH so a re-seed backfills a name-less node and never clobbers a name the business-profile recorder set later), so the sub-account picker's house row shows the product name (e.g. "SiteDesk"), not the raw accountId UUID. When a name is absent the resolver emits `[branding] account-name-fallback accountId=<id8>… reason=no-name`, and the picker falls back to the accountId; the seed + backfill is the name source. The lite variant header is unchanged.
 
 **`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble showing the message text and, beneath it, a subtle always-visible time-of-day stamp (no label); delivered agent replies render as plain prose with the same time-of-day stamp beneath (the reply-document filename line stays, as prose); the stamp is HH:MM from the turn's `ts` (locale-formatted, right-aligned inside the operator bubble, left-aligned under agent prose), and a turn whose `ts` is null/unparseable shows no stamp, never an empty line — so only delivered operator and agent-reply turns are stamped, while tool runs, the collapsed "Thinking" block, and the agent-error banner stay time-free; a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx`, `app/chat/__tests__/transcript-render.test.tsx`). **Day-divider:** both renderers insert a centered `.day-divider` row between two consecutive timeline items on different local calendar days (label `Today`/`Yesterday`, else `Sat 14 Jun 2026`), so a thread spanning midnight is never an ambiguous run of HH:MM; the first dated item gets a leading divider, a null/unparseable `ts` marks no boundary, dividers are computed over the filtered `visibleItems`, and in `/chat` a day crossover flushes any open tool/think run first so a collapsed run never spans it. Per-bubble HH:MM stamps are unchanged. Shared helpers `dayKey`/`dayLabel`/`itemTs`/`DayDivider` live in `app/whatsapp/Transcript.tsx`.
 
@@ -2618,7 +2618,19 @@ recreates that path's directories under the open folder, scope-checked level by
 level, and writes the file under its original basename. A flat upload (no
 `relpath`) is unchanged.
 
-**`/data` operator surface.** `/data` mounts the operator
+**Data — admin Sidebar pane vs operator `/data` route.** The
+file/search UI is the headless `DataFileBrowser` component. On the **admin**
+dashboard it is a Sidebar surface: a "Data" nav row (beside Artefacts/Sessions)
+sets `activeNav='data'` and, via `onSelectData` → `AdminShell`'s `dataOpen`
+state, renders `DataFileBrowser` (through `DataPaneSurface`) in the shell's main
+column — chromed by the admin `HeaderMenu` + `Sidebar`, no full-page nav, no
+remount. Off `/` the row navigates to `/?data=1`, hydrated on mount
+(`hydrateDataFromUrl`); the pane is mutually exclusive with the WhatsApp
+Transcript. The admin burger no longer carries a Data item. The **operator**
+surface has no Sidebar, so the operator keeps the burger → `/data` full-screen
+route described next; only the admin path changed.
+
+**`/data` operator surface.** The `/data` route mounts the operator
 `HeaderMenu` (logo-left / name-centre / burger-right; flyout = Chat / Data /
 Log out) above the toolbar — the burger's Chat item returns to `/`, replacing
 the former standalone Home button. The search bar flexes to fill its toolbar
@@ -2792,6 +2804,14 @@ authoritative. This section names the surfaces and what backs each.
 > operator surface is documented in full in the internal doc
 > `maxy-code/.docs/operator-dashboard.md`.
 >
+> **Operator `/chat`.** The reduced operator chrome renders on
+> *every* operator chat surface, not just root `/`: the `/chat` server handler
+> serves `operator.html` for an operator host (`chat.html` only for admin
+> hosts), so `/chat` and `/chat?session=<id>` mount the same single-column
+> operator shell. Unlike the operator root — which forces the canonical session
+> — operator `/chat` honors `?session=`, opening a specific session inside the
+> reduced shell. Admin-host `/chat` is unchanged (full developer shell).
+>
 > **Width.** The operator header, the operator chat column, and the `/data`
 > header+toolbar+body all render in one centred column bounded to
 > `--chat-measure` (48rem). That token is a `:root` design token (beside
@@ -2818,6 +2838,7 @@ authoritative. This section names the surfaces and what backs each.
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. **The "Projects" row is brand-aware:** its visible term and the graph label it filters to both come from the injected `window.__BRAND__.primaryContainer` (`brand.json` → `server/index.ts` inject → `brand.ts` `brandPrimaryContainer()`), so Maxy reads "Projects" → `:Project`, SiteDesk "Jobs" → `:Job`, Real Agent "Properties" → `:Property`. A brand JSON missing `primaryContainer` falls back to Project/Projects (server logs `[brand] op=primaryContainer-default reason=absent brand=<hostname>`; the populated case logs `[brand] op=inject primaryContainer=<label>/<term>`). | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). Below a 400 px list width each row's action icons collapse to a single `MoreHorizontal` ellipsis trigger; its popover menu lists the same actions as the inline icons but labels them with concise verbs (`Resume in claude.ai/code`, `Open in webchat`, `Stop`, `Archive` / `Unarchive`, `Rename`, `Delete`, `Re-seat`) rather than the inline icon buttons' verbose per-session aria-labels — the inline buttons keep those verbose labels because an icon-only control needs the full descriptive accessible name. **Re-seat:** Re-seat is a member action of the one `SessionRowActions` cluster, not a separate sibling control — wide it is the sliders icon inline with the other icons (sharing the cluster geometry and alignment); collapsed it is the `Re-seat` menu item, which expands the model/mode/effort form inline inside the overflow menu. The form (`SessionReseatControl`) forks the session via `/api/admin/session-reseat` and navigates to the fork (the same fork mechanism `/chat`'s pickers drive); its model picker defaults to the row's current model (a `model` field on each row, read from the JSONL tail), and mode and effort each carry a "Keep" option that omits the field. The overflow menu and the Re-seat form render through a `document.body` portal, fixed-positioned from the trigger's rect (right-aligned, flipped above the trigger when there is no room below), so neither is clipped by `.side-list`'s `overflow-y:auto`; Escape, a pointerdown outside the trigger/popover, and any scroll or resize dismiss them. | `/claude-sessions/events`, `/claude-sessions`, `/session-reseat` |
+| Data pane | A "Data" nav row beside Artefacts/Sessions. Uses the same `activeNav` toggle, but its content — the headless `DataFileBrowser` (graph search + `{installDir}/data/` file browser) — renders in the shell's **main column** via `DataPaneSurface`, like the WhatsApp Transcript, not in the side-list; there is no side-list block under `activeNav==='data'`. `AdminShell` owns a `dataOpen` main-column state (mutually exclusive with the WhatsApp selection); the row lifts the choice through `onSelectData`. On `/` it opens in place; from any other route (`/graph`, `/chat`, `/browser`) it navigates to `/?data=1`, which the root shell hydrates on mount (`hydrateDataFromUrl`, then strips the query). The admin burger no longer carries a Data item (the operator surface, which has no Sidebar, keeps the burger → `/data` route). Client breadcrumbs: `[admin-ui] sidebar-nav surface=data …`, `[admin-ui] data-open route=… via=<in-place\|navigate>`, `[admin-ui] data-hydrate route=/`. | `sidebar-artefacts.ts`, `files.ts`, `graph-search.ts` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". **Re-seat:** each channel conversation row carries a `SessionRowActions` cluster whose sole action is Re-seat (the row is a `conv-with-actions` shell whose open click moved onto an inner button so the cluster can sit beside it), so a WhatsApp/Telegram session's model/mode/effort is re-seatable from the dashboard exactly like a webchat row — wide it is the inline sliders icon, and below the 400 px width it folds into the `…` overflow menu identically to the Sessions rows; the channel reader row carries the same `model` field for the picker default. A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. A centered day-divider row (`.day-divider`) marks each local calendar-day crossover between consecutive turns so a thread spanning midnight is unambiguous. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |

package/payload/platform/plugins/docs/references/admin-ui.md

@@ -57,7 +57,7 @@ either is a regression.
 | `/session` | Admin cookie session: PIN-gated mint, validate, rotate. | `GET /`, `POST /` |
 | `/sessions` | Legacy admin-server conversation routes. No UI consumer remains after the ConversationsModal was retired; the surviving handlers are deletion candidates and not described here. | (legacy, no live caller) |
 | `/sidebar-sessions` | Sole data path for the sidebar Sessions list. One JSONL on disk equals one row. The row's delete button is the only way a row disappears. Each row carries `sessionId`, `title`, `startedAt`, `live`, `isSubagent`, `pid: number \| null` (basename of the matched `sessions/<pid>.json`), and `projectDir` (the directory holding the JSONL — consumed by the delete route). The payload also carries top-level `accountId` so the pane renders the full UUID label whose first ~8 chars prefix-match the truncated Remote Control daemon entry in claude.ai/code. The legacy `rcUrl` field is gone — the row's external-link affordance now POSTs `/session-rc-spawn` to start a fresh local `claude --remote-control <name> --session-id <sid>` PTY on every click. | `GET /` |
-| `/session-delete` | POST `{ sessionId, projectDir }`. Best-effort SIGTERM of the live PID (resolved from `sessions/<pid>.json` body match) then unlink the JSONL + `<sid>.meta.json` sidecar. Absent PID file is not an error. Containment: `projectDir` must live under `<CLAUDE_CONFIG_DIR>/projects/`. | `POST /` |
+| `/session-delete` | POST `{ sessionId }`. Thin proxy over the manager: POST `/:id/stop` (idempotent) then DELETE `/:id`. Forwards the caller's canonical `accountId` (`getAccountIdForSession(cacheKey)`) as `?accountId=<uuid>` on both calls. The manager's fs-watcher is armed only on the house account's project slug, so a session under any other account has no watcher row; without the forwarded accountId the manager 404s a live cross-account session on stop (silently swallowed by this route's `stop.status !== 404` tolerance) and its transcript on delete. With it, the manager derives the project slug from the account (`<accountsRoot>/<accountId>` → slug), gates on file existence alone, and (stop) reads the on-disk scope record to kill a cross-account scope unit that survived a manager restart. Absent accountId → the manager keeps its watcher-row fallback. The sibling `/session-stop` (the standalone End control) forwards `accountId` identically, for the same reason. | `POST /` |
 | `/session-rc-spawn` | POST `{ sessionId?, name? }`. Fire-and-forget `claude --remote-control [name] [--session-id <sid>]`. Present `sessionId` resumes; absent starts a fresh session (also used by the sidebar's "New session" button — it no longer opens claude.ai/code directly). Proxies to the manager's `/rc-spawn`, which waits up to **60 s** (raised from 12 s) for the spawned PTY to bind and returns `{ spawnedPid, sessionId, bridgeSessionId, slug, outcome, reason }`. For a webchat-bound spawn (every admin-gated host's "New session", returning a same-origin `/chat?session=<id>` target — `resolveRcSpawnOutcome` → `sameOrigin:true`) the Sidebar navigates the **current** tab via `window.location.assign`, replacing the dashboard in place (back returns to it); only a claude.ai/code slug (`sameOrigin:false`, the bare-admin resume bridge, never a new-session outcome) navigates a separately-opened tab. On `timeout` or `spawn-failed` it shows an error modal (reason + sessionId) and **never** opens a bare claude.ai/code tab. The new process registers itself as its own Remote Control entry in claude.ai/code. | `POST /` |
 | `/claude-sessions` | **Spawn surface only**. `POST /` is the Sidebar new-session-with-prompt path, cookie-auth only (the recorder loopback caller was removed; LinkedIn ingest moved to `/rc-spawn`). The former UI-facing handlers (SSE row feed, list, resume, stop, rename, archive, delete, `/:id/meta`, `/:id/input`, `/:id/log`) were removed — the maxy dashboard no longer manages or displays sessions. | `POST /` |
 
@@ -69,7 +69,7 @@ either is a regression.
 
 **`/chat` Conversations flyout + zero-sessions splash.** The admin `/chat` `HeaderMenu` carries a **Conversations** item (rendered only when `onOpenConversations` is wired, which scopes it to `/chat`) that opens an in-chat session-management pane (`app/chat/SessionList.tsx`) hosted by `chat/page.tsx` — distinct from, and sharing endpoints with, the `Sidebar` Sessions list (which stays hidden on narrow viewports). It enumerates the admin's own webchat sessions via `GET /api/admin/sidebar-sessions` (carries the per-row `live` marker and `archived` flag, install-wide), lists them newest-first with the live one marked and archived rows folded under a collapsible subsection, and offers per-row resume (`/chat?session=<id>`), rename, archive/unarchive, two-tap delete, an **End** control on the live row (`session-stop`), plus a New-session control (`session-rc-spawn`) and a copyable full id. When the canonical pointer is `known:false` (`canonical-empty`) and enumeration returns zero rows, the surface renders a splash (brand logo + New session) instead of a dead bootstrap thread; a freshly-spawned New session is `known:true`, so its greeting is preserved. Client breadcrumbs: `[chat-conversations] op=enumerate owned=<n>` and `op=action name=<open|rename|archive|delete|stop> sessionId=<id8>` (`op=action-failed … status=…` on a non-2xx). Detail lives in `.docs/admin-webchat-native-channel.md` ("Conversations flyout + zero-sessions splash").
 
-**`/chat` header conversation label.** When `/chat` has an active titled conversation, the admin/operator `HeaderMenu` centre shows that title in place of the brand icon + name (the `chat-logo` image is suppressed; the operator's first grid track keeps an empty width-reserved placeholder so centring is unchanged). `AdminChat` resolves the active session's title from the same `GET /api/admin/sidebar-sessions` list (active id = the `?session=` target, or the canonical session for the operator), adopting the row's `title` only when `titleSource ∈ {user, ai, first-message}`; a `prefix`-only row (the 8-char UUID fallback) or no matching row keeps the brand block. The label re-resolves on active-id change. One breadcrumb fires on every resolve: `[admin-ui] op=header-label sessionId=<id8> variant=<admin|operator> present=<bool> source=<user|ai|first-message|none> reason=<resolved|untitled|no-match|fetch-failed>`. The lite variant header is unchanged. Sessions named only by a resolved `personName` (public-webchat visitor / admin-webchat author rows, which stay `titleSource:'prefix'`) currently fall back to the icon; adopting those into the header label is tracked as a separate follow-up.
+**`/chat` header always shows the account name.** The admin/operator `HeaderMenu` centre always renders the active account's name alongside the brand logo, on every chat surface, regardless of the active conversation — `headerTitle = businessName || brand.productName`. There is no per-conversation header title: the active conversation's label stays in the sidebar and the Conversations flyout (each resolves its own per-session title independently), never in the header. The account name is `LocalBusiness.name`, resolved by `fetchAccountName(accountId)` in `neo4j-store.ts` with **no theme gate** — unlike `fetchBranding` (which returns null unless a colour/logo property is also set, and stays the source for actual theming). The house account is seeded with `LocalBusiness.name = <brand productName>` (`seed-neo4j.sh`, coalesced ON MATCH so a re-seed backfills a name-less node and never clobbers a name the business-profile recorder set later), so the sub-account picker's house row shows the product name (e.g. "SiteDesk"), not the raw accountId UUID. When a name is absent the resolver emits `[branding] account-name-fallback accountId=<id8>… reason=no-name`, and the picker falls back to the accountId; the seed + backfill is the name source. The lite variant header is unchanged.
 
 **`/chat` Claude-desktop transcript presentation.** The admin webchat keeps the shared `Transcript` shell (stream, follow-tail) but injects a /chat-only item renderer via the component's optional `renderItems` prop: `renderChatTimeline` in `app/chat/transcript-render.tsx`. Presentation: operator turns render as a right-aligned grey bubble showing the message text and, beneath it, a subtle always-visible time-of-day stamp (no label); delivered agent replies render as plain prose with the same time-of-day stamp beneath (the reply-document filename line stays, as prose); the stamp is HH:MM from the turn's `ts` (locale-formatted, right-aligned inside the operator bubble, left-aligned under agent prose), and a turn whose `ts` is null/unparseable shows no stamp, never an empty line — so only delivered operator and agent-reply turns are stamped, while tool runs, the collapsed "Thinking" block, and the agent-error banner stay time-free; a maximal consecutive run of `tool-call`/`tool-result` turns renders as one collapsed grey one-liner ("Used N tools ›") whose expansion shows every call and result payload — a lone call still gets the one-liner, and prose or a directive row ends a run. The WhatsApp reader (`/whatsapp`) omits the prop and keeps the default `renderTimeline`, so its rendering is unchanged; both presentations are test-pinned (`app/whatsapp/__tests__/Transcript-*.test.tsx`, `app/chat/__tests__/transcript-render.test.tsx`). **Day-divider:** both renderers insert a centered `.day-divider` row between two consecutive timeline items on different local calendar days (label `Today`/`Yesterday`, else `Sat 14 Jun 2026`), so a thread spanning midnight is never an ambiguous run of HH:MM; the first dated item gets a leading divider, a null/unparseable `ts` marks no boundary, dividers are computed over the filtered `visibleItems`, and in `/chat` a day crossover flushes any open tool/think run first so a collapsed run never spans it. Per-bubble HH:MM stamps are unchanged. Shared helpers `dayKey`/`dayLabel`/`itemTs`/`DayDivider` live in `app/whatsapp/Transcript.tsx`.
 
@@ -144,7 +144,19 @@ recreates that path's directories under the open folder, scope-checked level by
 level, and writes the file under its original basename. A flat upload (no
 `relpath`) is unchanged.
 
-**`/data` operator surface.** `/data` mounts the operator
+**Data — admin Sidebar pane vs operator `/data` route.** The
+file/search UI is the headless `DataFileBrowser` component. On the **admin**
+dashboard it is a Sidebar surface: a "Data" nav row (beside Artefacts/Sessions)
+sets `activeNav='data'` and, via `onSelectData` → `AdminShell`'s `dataOpen`
+state, renders `DataFileBrowser` (through `DataPaneSurface`) in the shell's main
+column — chromed by the admin `HeaderMenu` + `Sidebar`, no full-page nav, no
+remount. Off `/` the row navigates to `/?data=1`, hydrated on mount
+(`hydrateDataFromUrl`); the pane is mutually exclusive with the WhatsApp
+Transcript. The admin burger no longer carries a Data item. The **operator**
+surface has no Sidebar, so the operator keeps the burger → `/data` full-screen
+route described next; only the admin path changed.
+
+**`/data` operator surface.** The `/data` route mounts the operator
 `HeaderMenu` (logo-left / name-centre / burger-right; flyout = Chat / Data /
 Log out) above the toolbar — the burger's Chat item returns to `/`, replacing
 the former standalone Home button. The search bar flexes to fill its toolbar
@@ -318,6 +330,14 @@ authoritative. This section names the surfaces and what backs each.
 > operator surface is documented in full in the internal doc
 > `maxy-code/.docs/operator-dashboard.md`.
 >
+> **Operator `/chat`.** The reduced operator chrome renders on
+> *every* operator chat surface, not just root `/`: the `/chat` server handler
+> serves `operator.html` for an operator host (`chat.html` only for admin
+> hosts), so `/chat` and `/chat?session=<id>` mount the same single-column
+> operator shell. Unlike the operator root — which forces the canonical session
+> — operator `/chat` honors `?session=`, opening a specific session inside the
+> reduced shell. Admin-host `/chat` is unchanged (full developer shell).
+>
 > **Width.** The operator header, the operator chat column, and the `/data`
 > header+toolbar+body all render in one centred column bounded to
 > `--chat-measure` (48rem). That token is a `:root` design token (beside
@@ -344,6 +364,7 @@ authoritative. This section names the surfaces and what backs each.
 | Mode trigger | Per-`(accountId, userId)` `SpawnPreference` for `permissionMode` and `model`; persists across reload, tab, device. | `session-defaults.ts` |
 | Nav rows (Chat / People / Agents / Projects / Tasks / Artefacts) | People, Agents, Tasks open the artefact-pane Graph filtered to the matching label. Chat selects the active conversation. Artefacts swaps the list to editable documents. **The "Projects" row is brand-aware:** its visible term and the graph label it filters to both come from the injected `window.__BRAND__.primaryContainer` (`brand.json` → `server/index.ts` inject → `brand.ts` `brandPrimaryContainer()`), so Maxy reads "Projects" → `:Project`, SiteDesk "Jobs" → `:Job`, Real Agent "Properties" → `:Property`. A brand JSON missing `primaryContainer` falls back to Project/Projects (server logs `[brand] op=primaryContainer-default reason=absent brand=<hostname>`; the populated case logs `[brand] op=inject primaryContainer=<label>/<term>`). | `graph-search.ts`, `graph-subgraph.ts`, `sidebar-artefacts.ts` |
 | Sessions list (Active / Archived / All) | Live row store driven by SSE; manual reconcile button on the segmented control re-fetches the full id set. Every listed row carries two launch actions: the claude.ai/code resume (`ExternalLink`) and a chat-launch (`MessageSquare`) that opens `/chat?session=<full sessionId>` — the admin webchat pointed at that exact session; sending there resumes a stopped session with the webchat channel bound to that id (see `admin-webchat-native-channel.md`, "Session-targeted mode"). At the ≤720 px drawer breakpoint each row stacks into two lines — dot + title + id/stamp, then the action icons — with a divider between rows and actions at full opacity (the desktop hover-gated 0.5 opacity never resolves on touch). Below a 400 px list width each row's action icons collapse to a single `MoreHorizontal` ellipsis trigger; its popover menu lists the same actions as the inline icons but labels them with concise verbs (`Resume in claude.ai/code`, `Open in webchat`, `Stop`, `Archive` / `Unarchive`, `Rename`, `Delete`, `Re-seat`) rather than the inline icon buttons' verbose per-session aria-labels — the inline buttons keep those verbose labels because an icon-only control needs the full descriptive accessible name. **Re-seat:** Re-seat is a member action of the one `SessionRowActions` cluster, not a separate sibling control — wide it is the sliders icon inline with the other icons (sharing the cluster geometry and alignment); collapsed it is the `Re-seat` menu item, which expands the model/mode/effort form inline inside the overflow menu. The form (`SessionReseatControl`) forks the session via `/api/admin/session-reseat` and navigates to the fork (the same fork mechanism `/chat`'s pickers drive); its model picker defaults to the row's current model (a `model` field on each row, read from the JSONL tail), and mode and effort each carry a "Keep" option that omits the field. The overflow menu and the Re-seat form render through a `document.body` portal, fixed-positioned from the trigger's rect (right-aligned, flipped above the trigger when there is no room below), so neither is clipped by `.side-list`'s `overflow-y:auto`; Escape, a pointerdown outside the trigger/popover, and any scroll or resize dismiss them. | `/claude-sessions/events`, `/claude-sessions`, `/session-reseat` |
+| Data pane | A "Data" nav row beside Artefacts/Sessions. Uses the same `activeNav` toggle, but its content — the headless `DataFileBrowser` (graph search + `{installDir}/data/` file browser) — renders in the shell's **main column** via `DataPaneSurface`, like the WhatsApp Transcript, not in the side-list; there is no side-list block under `activeNav==='data'`. `AdminShell` owns a `dataOpen` main-column state (mutually exclusive with the WhatsApp selection); the row lifts the choice through `onSelectData`. On `/` it opens in place; from any other route (`/graph`, `/chat`, `/browser`) it navigates to `/?data=1`, which the root shell hydrates on mount (`hydrateDataFromUrl`, then strips the query). The admin burger no longer carries a Data item (the operator surface, which has no Sidebar, keeps the burger → `/data` route). Client breadcrumbs: `[admin-ui] sidebar-nav surface=data …`, `[admin-ui] data-open route=… via=<in-place\|navigate>`, `[admin-ui] data-hydrate route=/`. | `sidebar-artefacts.ts`, `files.ts`, `graph-search.ts` |
 | Channel reader nav rows (WhatsApp / Telegram) | One conditional nav row **per interactive channel that has ≥1 admin session**. Each row carries its brand glyph (WhatsApp `#25D366`, Telegram `#229ED9`); a channel with no admin session shows no row, and no install ever shows an always-empty "No conversations" row. The channel list loads **once on sidebar mount** (the per-channel counts must be known before the nav renders), so a failed load shows one muted, non-clickable line instead of channel rows. Clicking a channel row lists that channel's admin conversations; each conversation row shows a **display name** resolved by precedence `operatorName ?? whatsappName ?? senderId ?? title`: the bound `Person givenName familyName` when a `senderId`→`userId` binding exists, else the persisted WhatsApp display name (`pushName`, read from the latest `:Message:WhatsAppMessage.senderName`), else the raw `senderId`, else the agent title; the agent session title is the hover tooltip only. Under the name each row shows a **last-message-time breadcrumb** (`conv-timestamp`, same markup as the Sessions rows) formatted from the row's `lastMessageAt` (the last parseable turn's `ts`); a session with no parseable turn shows no time, never "Invalid Date". **Re-seat:** each channel conversation row carries a `SessionRowActions` cluster whose sole action is Re-seat (the row is a `conv-with-actions` shell whose open click moved onto an inner button so the cluster can sit beside it), so a WhatsApp/Telegram session's model/mode/effort is re-seatable from the dashboard exactly like a webchat row — wide it is the inline sliders icon, and below the 400 px width it folds into the `…` overflow menu identically to the Sessions rows; the channel reader row carries the same `model` field for the picker default. A click on a conversation **opens its transcript on the home surface**: on `/` it selects in place, and from any other route (`/graph`, `/data`, `/browser`) it navigates to `/?wa=<sessionId>&projectDir=<dir>`, which the root shell hydrates on mount (then strips the query so a later refresh does not re-pin a closed conversation). Server logs `[wa-reader] op=operator-name-fallback senderId=… source=whatsapp-pushname` when the pushName fallback fires and `[wa-reader] op=conversations count=<n> withTimestamp=<m>` per list build; the client logs `[admin-ui] wa-open route=… via=<in-place\|navigate> …` and `[admin-ui] wa-hydrate route=/ …`. | `/whatsapp-reader/conversations` |
 | Channel transcript (`<Transcript>`) | Reads one session's JSONL over SSE (`/whatsapp-reader/stream`) and renders both sides plus tool calls — the turns claude.ai/code hides because channel inbound is stamped `isMeta`. Every turn shows its time-of-day (HH:MM from the turn's `ts`; a null/unparseable `ts` shows no time, never "Invalid Date"). `tool-call`/`tool-result` turns render as **collapsed cards** (chevron + label + time, default collapsed, expandable per card; one card's state never affects another) so the human↔agent text is not buried in JSON; the three conversation kinds always render in full. The thread **follows the tail**: it opens at the newest turn and pins to the bottom on each live append **only while the operator is already within 32 px of the bottom** — a scroll up suppresses the jump so reading history is never yanked. While the operator is scrolled up a **jump-to-bottom control** (`.wa-jump`, bottom-right of the viewport) appears; clicking it scrolls to the newest turn and re-arms follow-tail, and it hides again at the bottom. The thread scrolls inside its grid cell (header/sidebar/footer fixed). The stream sends a 20 s heartbeat so an idle Cloudflare tunnel does not idle-drop, tags each frame with a byte-offset `id:`, and resumes from the client's `Last-Event-ID` on reconnect (no duplicate backlog); the client clears the "Stream disconnected" banner on reopen and latches it only on a terminal CLOSED state. The thread also interleaves a collapsed `⚙ directive injected (N B)` row per turn, sorted by timestamp just before the turn it informed; expanding one fetches the exact stored `prompt-optimiser-directive` bytes for that turn. The entries are listed by `GET /whatsapp-reader/directives?sessionId=` and the bytes served by `GET /whatsapp-reader/directive?sessionId=&name=`, both admin-gated and account-scoped; a missing store degrades to no rows. A centered day-divider row (`.day-divider`) marks each local calendar-day crossover between consecutive turns so a thread spanning midnight is unambiguous. | `/whatsapp-reader/stream`, `/whatsapp-reader/directives`, `/whatsapp-reader/directive` |
 | Conversations row hover actions | Inline rename, archive, delete, JSONL view / download per row. The historical `.conversations-modal` CSS block exists in `globals.css` but is no longer mounted from any TSX — Sidebar.tsx now owns every per-row affordance directly. | `claude-sessions.ts` |

package/payload/platform/scripts/lib/read-brand-json.sh

@@ -67,3 +67,22 @@ business_type_cypher() {
     echo "'$slug'"
   fi
 }
+
+#   cypher_string_literal <value>
+#     Emits a Cypher literal for an arbitrary string: the bare keyword null
+#     for empty input, otherwise the value wrapped in single quotes with
+#     backslashes and single quotes escaped. Unlike business_type_cypher
+#     (which quotes a closed-enum slug that needs no escaping), this is for
+#     free-text values such as brand.json#productName, so it escapes to keep
+#     an apostrophe (e.g. "O'Brien") from breaking the MERGE.
+cypher_string_literal() {
+  local s="$1"
+  if [ -z "$s" ]; then
+    echo "null"
+    return 0
+  fi
+  local q="'"
+  s="${s//\\/\\\\}"   # backslash -> two backslashes
+  s="${s//$q/\\$q}"   # single quote -> backslash + quote
+  printf "%s\n" "$q$s$q"
+}

package/payload/platform/scripts/seed-neo4j.sh

@@ -125,6 +125,14 @@ LOCALBUSINESS_BUSINESS_TYPE=$(derive_business_type "$BRAND_JSON_VALUE")
 LOCALBUSINESS_BT_CYPHER=$(business_type_cypher "$LOCALBUSINESS_BUSINESS_TYPE")
 LOCALBUSINESS_BT_LOG="${LOCALBUSINESS_BUSINESS_TYPE:-none}"
 
+# The house LocalBusiness carries the brand product name (e.g. "SiteDesk") so
+# the sub-account picker and header render a name, not the raw accountId UUID.
+# Coalesced ON MATCH below so a name set later by the business-profile recorder
+# is never clobbered, and a re-seed backfills a name-less existing node.
+read_brand_json_key "$BRAND_JSON" "productName"
+LOCALBUSINESS_PRODUCT_NAME="$BRAND_JSON_VALUE"
+LOCALBUSINESS_NAME_CYPHER=$(cypher_string_literal "$LOCALBUSINESS_PRODUCT_NAME")
+
 # Pre-count distinguishes created vs already-exists for the log line.
 # Simpler than an in-cypher transient flag; the extra round-trip is
 # sub-millisecond on a local Neo4j.
@@ -137,15 +145,32 @@ if ! LOCALBUSINESS_EXISTING_RAW=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PA
 fi
 LOCALBUSINESS_EXISTING=$(echo "$LOCALBUSINESS_EXISTING_RAW" | tail -1 | tr -d ' \r')
 
+# Pre-read the current name so the log line reports set|preserved. A name-less
+# or absent node is backfilled to the product name; an existing non-null name
+# is preserved by the coalesce below. --format plain wraps a string value in
+# double quotes, so strip them alongside whitespace.
+if ! LOCALBUSINESS_PRENAME_RAW=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" \
+    --format plain \
+    "MATCH (lb:LocalBusiness {accountId: '$ACCOUNT_ID'}) RETURN coalesce(lb.name, '')" 2>&1); then
+  LOCALBUSINESS_REASON=$(echo "$LOCALBUSINESS_PRENAME_RAW" | tr '\n' '|' | head -c 500)
+  echo "  [install-invariant] localbusiness-bootstrap accountId=${ACCOUNT_ID:0:8} result=failed reason=$LOCALBUSINESS_REASON" >&2
+  exit 1
+fi
+LOCALBUSINESS_PRENAME=$(echo "$LOCALBUSINESS_PRENAME_RAW" | tail -1 | tr -d ' \r"')
+
 # $ACCOUNT_ID is a UUID minted by the resolver; $LOCALBUSINESS_BT_CYPHER is
 # either a single-quoted slug from a closed enum (brands/*/brand.json) or the
+# bare keyword null; $LOCALBUSINESS_NAME_CYPHER is a Cypher string literal from
+# brand.json#productName, single-quote-escaped by cypher_string_literal, or the
 # bare keyword null. No operator input is interpolated.
 if ! LOCALBUSINESS_OUT=$("$CYPHER_SHELL" -u "$NEO4J_USER" -p "$NEO4J_PASSWORD" -a "$NEO4J_URI" 2>&1 << CYPHER_EOF
 MERGE (lb:LocalBusiness {accountId: '$ACCOUNT_ID'})
   ON CREATE SET lb.createdBySource = 'installer',
                 lb.createdAt = datetime(),
-                lb.businessType = $LOCALBUSINESS_BT_CYPHER
-  ON MATCH SET lb.businessType = coalesce(lb.businessType, $LOCALBUSINESS_BT_CYPHER)
+                lb.businessType = $LOCALBUSINESS_BT_CYPHER,
+                lb.name = $LOCALBUSINESS_NAME_CYPHER
+  ON MATCH SET lb.businessType = coalesce(lb.businessType, $LOCALBUSINESS_BT_CYPHER),
+               lb.name = coalesce(lb.name, $LOCALBUSINESS_NAME_CYPHER)
 RETURN lb.accountId;
 CYPHER_EOF
 ); then
@@ -159,7 +184,23 @@ if [ "$LOCALBUSINESS_EXISTING" = "0" ]; then
 else
   LOCALBUSINESS_RESULT="already-exists"
 fi
-echo "  [install-invariant] localbusiness-bootstrap accountId=${ACCOUNT_ID:0:8} businessType=$LOCALBUSINESS_BT_LOG result=$LOCALBUSINESS_RESULT"
+
+# name verdict: absent brand productName sets nothing; a fresh node is created
+# with the name; a pre-existing non-null name is preserved by the coalesce;
+# a pre-existing name-less node is backfilled. Gate on the existence pre-count
+# first: for a node that did not exist, the pre-name MATCH returned zero rows
+# (so $LOCALBUSINESS_PRENAME holds the header line, not a value) — that garbage
+# is never read here. Greppable so a future name-less seed surfaces as a signal.
+if [ -z "$LOCALBUSINESS_PRODUCT_NAME" ]; then
+  LOCALBUSINESS_NAME_LOG="absent-no-productName"
+elif [ "$LOCALBUSINESS_EXISTING" = "0" ]; then
+  LOCALBUSINESS_NAME_LOG="set"
+elif [ -n "$LOCALBUSINESS_PRENAME" ]; then
+  LOCALBUSINESS_NAME_LOG="preserved"
+else
+  LOCALBUSINESS_NAME_LOG="set"
+fi
+echo "  [install-invariant] localbusiness-bootstrap accountId=${ACCOUNT_ID:0:8} businessType=$LOCALBUSINESS_BT_LOG result=$LOCALBUSINESS_RESULT name=$LOCALBUSINESS_NAME_LOG"
 
 # ------------------------------------------------------------------
 # 4. Create AdminUser node + ADMIN_OF relationship

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA4BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAgFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA+oFpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAe3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA4BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAgFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,cAAc,EAAE,cAAc,CAAA;IAC9B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkDD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAwJD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAqtFpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -33,7 +33,7 @@ import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
 import { runConnectorAuthLogin } from './connector-auth.js';
 import { isEffortLevel, isNewSessionEffortLevel, isPermissionMode, SONNET_MODEL } from '../../../lib/models/dist/index.js';
 import { spawnClaudeSession, stopSession, writeInterruptToPty, isLive, onPtyExit, livePtyCount, liveSessionIds, getPtyTrackerForTests, livePidForSession, classifyLiveness, priorExitedCountForSession, PERMISSION_MODES, openFdCount, registerRcSpawnPty, } from './pty-spawner.js';
-import { writeScopeRecord, removeScopeRecord } from './scope-record.js';
+import { writeScopeRecord, removeScopeRecord, readAllScopeRecords } from './scope-record.js';
 import { writeReseatMarker, resolveReseatChain, clearReseatMarker } from './reseat-ledger.js';
 import { getScopeMainPid, defaultProcessSignals, defaultSystemctlRunner } from './systemd-scope.js';
 import { readSidecar, updateSidecar, appendBridgeId, writeSidecar } from './session-sidecar.js';
@@ -319,6 +319,22 @@ export function tailIsOpenTurn(jsonlPath) {
 /** Resolve any of the 4 keys to the canonical (sessionId, row) pair.
  *  Tries: intrinsic sessionId, bridgeSessionId, bridgeSuffix, numeric pid.
  *  Returns undefined when nothing matches. */
+/** Task 1324 — resolve the on-disk project slug for a supplied `accountId`,
+ *  mirroring the /rc-spawn account derivation (`accountsRoot =
+ *  dirname(platformRoot)/data/accounts`) and config.ts's
+ *  `accountIdFromSessionCwd` invariant that an account's spawn cwd is
+ *  `<accountsRoot>/<accountId>`. Returns null when the accountId names no
+ *  account dir in the registry, so the caller can 400 the mismatch instead of
+ *  scanning a slug that cannot exist. The caller is responsible for
+ *  shape-validating `accountId` (UUID) BEFORE calling — the value is joined
+ *  into a filesystem path here, so an unvalidated caller would open a path
+ *  traversal. */
+function accountSlugForId(platformRoot, accountId) {
+    const accountDir = join(dirname(platformRoot), 'data', 'accounts', accountId);
+    if (!existsSync(join(accountDir, 'account.json')))
+        return null;
+    return projectSlugForCwd(accountDir);
+}
 function resolveRow(watcher, id) {
     const direct = watcher.getBySessionId(id);
     if (direct)
@@ -1573,12 +1589,45 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', `/${id}/stop`, 400, Date.now() - start);
             return c.json({ error: 'invalid-session-id' }, 400);
         }
+        const accountId = c.req.query('accountId') || undefined;
         const row = resolveRow(deps.watcher, id);
+        const sessionId = row?.sessionId ?? id;
+        // Task 1324 — account-scoped resolution for the `!row` branch. On a
+        // multi-account install the watcher is armed only on the house slug, so a
+        // cross-account session has no row. When the admin UI forwards the caller's
+        // canonical accountId, resolve the session from `sessionId + accountId`
+        // instead of the watcher, so a false 404 no longer swallows the stop. The
+        // token to actually terminate a scope unit that survived a manager restart
+        // comes from the on-disk scope record (keyed by sessionId, account-agnostic)
+        // — the watcher row is the only other source and it is absent here.
+        let accountScoped = false;
+        let scopeTokenFromRecord = null;
         if (!row && !isLive(id)) {
-            timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
-            return c.json({ error: 'session-not-found' }, 404);
+            if (accountId) {
+                // Resolve the slug once (UUID gate first — accountId is joined into a
+                // path). A null result means the id names no account in the registry.
+                const slug = UUID_PATTERN.test(accountId) ? accountSlugForId(deps.platformRoot, accountId) : null;
+                if (slug === null) {
+                    deps.logger(`stop-account-mismatch sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
+                    timed(deps.logger, 'POST', `/${id}/stop`, 400, Date.now() - start);
+                    return c.json({ error: 'accountId not in this install registry' }, 400);
+                }
+                const hasTop = existsSync(jsonlPathForSlug(deps.claudeConfigDir, slug, sessionId));
+                const hasArchived = existsSync(jsonlPathForSlug(deps.claudeConfigDir, slug, sessionId, { archived: true }));
+                const rec = readAllScopeRecords(sessionsDir, deps.logger).find((r) => r.sessionId === sessionId);
+                if (!hasTop && !hasArchived && !rec) {
+                    deps.logger(`stop-not-found sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)} reason=file-missing`);
+                    timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
+                    return c.json({ error: 'session-not-found' }, 404);
+                }
+                accountScoped = true;
+                scopeTokenFromRecord = rec?.scopeUnitToken ?? null;
+            }
+            else {
+                timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
+                return c.json({ error: 'session-not-found' }, 404);
+            }
         }
-        const sessionId = row?.sessionId ?? id;
         // Task 455 — snapshot the live pid and prior-exited-count BEFORE
         // stopSession runs (the call mutates module state). When prior history
         // exists, emit a single observability line naming the pid the lookup
@@ -1597,7 +1646,9 @@ export function buildHttpApp(deps) {
             // Task 427 — when the row was reattached after a manager restart,
             // `livePtys` has no entry but `row.scopeUnitToken` is set; pass it
             // so stopSession can take the row-scope fallback path.
-            rowScopeUnitToken: row?.scopeUnitToken ?? null,
+            // Task 1324 — for a cross-account session there is no row; the token
+            // comes from the on-disk scope record instead, resolved above.
+            rowScopeUnitToken: row?.scopeUnitToken ?? scopeTokenFromRecord,
             // Task 451 — paired with rowScopeUnitToken so the row-scope branch
             // can post-flight verify the kill via kill(pid, 0).
             rowPid: row?.pid ?? null,
@@ -1607,6 +1658,13 @@ export function buildHttpApp(deps) {
         // formatting (Task 250 contract); this is the single audit line the
         // operator and tests can grep against to confirm which branch ran.
         deps.logger(`[stop-session] path=${outcome.path} outcome=${outcome.scopeOutcome} sessionId=${sessionId.slice(0, 8)} unit=${row?.scopeUnitToken ?? 'none'} pid=${row?.pid ?? 'unknown'}`);
+        // Task 1324 — one diffable audit line whenever the stop resolved from the
+        // caller's accountId rather than a watcher row. Distinct from the unified
+        // line above so a log read can tell the account-scoped path from the
+        // house-account row/liveptys paths.
+        if (accountScoped) {
+            deps.logger(`[stop-session] path=account-scoped outcome=${outcome.scopeOutcome} sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
+        }
         // Task 250 — surface scope-stop failures as 500 so the operator sees
         // the End-click fail when systemd cannot stop the unit. The liveptys
         // happy path keeps its original 204 response (Task 250 contract).
@@ -1660,6 +1718,7 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'DELETE', `/${id}`, 400, Date.now() - start);
             return c.json({ error: 'invalid-session-id' }, 400);
         }
+        const accountId = c.req.query('accountId') || undefined;
         const row = resolveRow(deps.watcher, id);
         const sessionId = row?.sessionId ?? id;
         if (isLive(sessionId)) {
@@ -1669,20 +1728,48 @@ export function buildHttpApp(deps) {
         }
         // Task 260 — purge from BOTH locations: a row may have its JSONL
         // at the top level (live or just-ended) or under archive/ (archived).
-        // Task 1298 — resolve the slug that actually holds the JSONL first;
-        // the list (sidebar-sessions.ts) walks every slug, so delete must too.
-        // Fall back to spawnCwd's slug only when nothing is found anywhere —
-        // hasTop/hasArchived will both be false regardless, so the fallback
-        // only affects which (nonexistent) paths appear in the 404 case.
-        const resolvedSlug = slugForExistingJsonl(deps.claudeConfigDir, sessionId) ?? projectSlugForCwd(deps.spawnCwd);
+        // Task 1324 — when the admin UI forwards the caller's canonical accountId,
+        // derive the slug from it and gate ONLY on file existence, bypassing the
+        // watcher row (which is single-account-scoped and absent for any session
+        // outside the manager's house account). When accountId is absent, keep the
+        // Task 1298 watcher-row path unchanged for back-compat, but log the
+        // degraded fallback so the account-less path is visible in the log.
+        let resolvedSlug;
+        if (accountId) {
+            // Resolve the slug once (UUID gate first — accountId is joined into a
+            // path). A null result means the id names no account in the registry.
+            const acctSlug = UUID_PATTERN.test(accountId) ? accountSlugForId(deps.platformRoot, accountId) : null;
+            if (acctSlug === null) {
+                deps.logger(`delete-account-mismatch sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
+                timed(deps.logger, 'DELETE', `/${id}`, 400, Date.now() - start);
+                return c.json({ error: 'accountId not in this install registry' }, 400);
+            }
+            resolvedSlug = acctSlug;
+        }
+        else {
+            deps.logger(`delete-fallback sessionId=${sessionId.slice(0, 8)} reason=no-accountId-supplied`);
+            // Task 1298 — resolve the slug that actually holds the JSONL; the list
+            // (sidebar-sessions.ts) walks every slug, so delete must too. Fall back
+            // to spawnCwd's slug only when nothing is found anywhere.
+            resolvedSlug = slugForExistingJsonl(deps.claudeConfigDir, sessionId) ?? projectSlugForCwd(deps.spawnCwd);
+        }
         const topJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
         const archivedJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
         const topSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
         const archivedSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
         const hasTop = existsSync(topJsonl);
         const hasArchived = existsSync(archivedJsonl);
-        if (!row || (!hasTop && !hasArchived)) {
-            deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
+        // Account-scoped path gates on file existence alone (the row is expected to
+        // be absent). Fallback path keeps the `!row` term so a bare id with no row
+        // still 404s as `not-found-anywhere` (Task 1298 contract).
+        const notFound = accountId ? (!hasTop && !hasArchived) : (!row || (!hasTop && !hasArchived));
+        if (notFound) {
+            if (accountId) {
+                deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)} reason=file-missing`);
+            }
+            else {
+                deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
+            }
             timed(deps.logger, 'DELETE', `/${id}`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }