@rubytech/create-maxy-code 0.1.388 → 0.1.391

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { execFileSync, spawn, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync } from "node:fs";
+import { existsSync, mkdirSync, writeFileSync, cpSync, readFileSync, rmSync, readdirSync, appendFileSync, openSync, closeSync, chmodSync, statSync, realpathSync, accessSync, constants as fsConstants } from "node:fs";
 import { registerSpecialistAgentsAt, SpecialistSymlinkCollision } from "./specialist-registration.js";
 import { seedBypassPermissionsSettings, assertBypassPermissionsSeed } from "./permissions-seed.js";
 import { resolve, join, dirname } from "node:path";
@@ -13,8 +13,11 @@ import { findPeerBrandOnDefaultNeo4jPort } from "./peer-brand-detect.js";
 import { resolveNeo4jPidfileScrub } from "./neo4j-pidfile-scrub.js";
 import { runInitLogging } from "./init-logging.js";
 import { requireSupportedPlatform, detectPlatform } from "./platform-detect.js";
+import { decideClaudeUpgradePrivilege } from "./claude-upgrade-privilege.js";
+import { resolveNeo4jDataDir } from "./neo4j-datadir.js";
 import { protectCommands, unprotectCommands, lsattrShowsImmutable } from "./install-immutability.js";
-import { renderPlist } from "./launchd-plist.js";
+import { renderPlist, buildSessionManagerWrapper } from "./launchd-plist.js";
+import { enumerateClaudeCandidates, pickCanonicalClaude } from "./claude-bin.js";
 import { installAllBrewPackages } from "./brew-install.js";
 import { parseSwVers, isSupportedMacosVersion } from "./macos-version.js";
 import { decideChromiumAction, isSnapConfinedPath } from "./snap-chromium.js";
@@ -278,6 +281,29 @@ function canSudo() {
     const result = spawnSync("sudo", ["-n", "true"], { stdio: "pipe", timeout: 5_000 });
     return result.status === 0;
 }
+/** True when the npm global prefix's node_modules dir is writable by the current
+ *  user (nvm/Homebrew installs) — meaning `npm install -g` needs no sudo. */
+function npmGlobalPrefixWritable() {
+    try {
+        const prefix = execFileSync("npm", ["prefix", "-g"], { encoding: "utf-8", timeout: 10_000 }).trim();
+        accessSync(join(prefix, "lib", "node_modules"), fsConstants.W_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve the Homebrew prefix (`/usr/local` on Intel, `/opt/homebrew` on Apple
+ *  Silicon). Falls back to the arch default if `brew --prefix` is unavailable. */
+function resolveBrewPrefix() {
+    try {
+        const out = execFileSync("brew", ["--prefix"], { encoding: "utf-8", timeout: 10_000 }).trim();
+        if (out)
+            return out;
+    }
+    catch { /* fall through to arch default */ }
+    return isArm64() ? "/opt/homebrew" : "/usr/local";
+}
 // verified-not-asserted apt-dep reconciliation.
 // resolve package-name aliases before probing dpkg, so the
 // post-install check no longer false-negatives when apt resolves a virtual
@@ -1023,13 +1049,44 @@ function installNodejs() {
     console.log("  [privileged] apt-get install");
     shell("apt-get", ["install", "-y", "nodejs"], { sudo: true });
 }
+// Task 1395 gap 4 — the single canonical `claude` path resolved for this
+// install, pinned into `.env` as CLAUDE_BIN by installServiceDarwin. Null on
+// Linux (and darwin when unresolved) — callers fall back to bare `claude`.
+let RESOLVED_CLAUDE_BIN = null;
+/** Resolve the highest-version `claude` reachable from the runtime PATH the
+ *  launchd wrapper will use (`/opt/homebrew/bin:/usr/local/bin:$PATH`). Darwin
+ *  only — a Mac can carry two claude binaries at different versions; the
+ *  logged-in one must win, not whichever the bare PATH hits first. */
+function resolveCanonicalClaudeBin() {
+    if (process.platform !== "darwin")
+        return null;
+    const runtimePath = `/opt/homebrew/bin:/usr/local/bin:${process.env.PATH ?? ""}`;
+    const candidates = enumerateClaudeCandidates(runtimePath, {
+        isExecutable: (p) => { try {
+            accessSync(p, fsConstants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        } },
+        realpath: (p) => realpathSync(p),
+        runVersion: (p) => {
+            const r = spawnSync(p, ["--version"], { encoding: "utf-8", timeout: 5_000 });
+            return r.status === 0 ? (r.stdout ?? "").toString() : null;
+        },
+    });
+    return pickCanonicalClaude(candidates);
+}
 function installClaudeCode() {
     let needsInstall = true;
+    // Darwin: pin the canonical claude before the version check so the check (and
+    // any upgrade decision) targets the logged-in binary, not the stale one.
+    const claudeForCheck = (RESOLVED_CLAUDE_BIN = resolveCanonicalClaudeBin()) ?? "claude";
     if (commandExists("claude")) {
         try {
             // `claude --version` prints "2.1.114 (Claude Code)" — extract the semver so
             // the equality check against `npm view` (which returns bare "2.1.114") works.
-            const rawVersion = execFileSync("claude", ["--version"], { encoding: "utf-8", timeout: 10_000 }).trim();
+            const rawVersion = execFileSync(claudeForCheck, ["--version"], { encoding: "utf-8", timeout: 10_000 }).trim();
             const installed = rawVersion.match(/^(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/)?.[1] ?? rawVersion;
             let latest = null;
             try {
@@ -1054,21 +1111,38 @@ function installClaudeCode() {
         log("3", TOTAL, "Installing Claude Code...");
     }
     if (needsInstall) {
-        // `npm install -g` needs write access to the global prefix, which on Linux is
-        // root-owned by default — so we run it under sudo. When sudo requires a password
-        // and the installer is running non-interactively (e.g. systemd-run --scope on
-        // upgrade), sudo fails instantly. Skip the upgrade in that case; the running
-        // installation is assumed adequate. Matches the apt-get skip in step 1.
-        if (isLinux() && !canSudo()) {
+        // `npm install -g` needs write access to the global prefix. On Linux that
+        // prefix is root-owned by default, so we run under sudo — and skip when sudo
+        // is non-interactive (e.g. systemd-run --scope on upgrade), keeping the
+        // running version. On darwin the nvm/Homebrew prefix is user-owned, so the
+        // upgrade runs unprivileged; sudo there would force a password prompt that
+        // hard-fails non-interactively.
+        const platform = requireSupportedPlatform(process.platform);
+        const decision = decideClaudeUpgradePrivilege({
+            platform,
+            prefixWritable: platform === "darwin" ? npmGlobalPrefixWritable() : false,
+            canSudo: canSudo(),
+        });
+        if (decision === "skip") {
+            logFile(`[create-maxy] claude-upgrade skipped reason=no-noninteractive-sudo platform=${platform}`);
             console.log("  Skipping Claude Code upgrade (sudo unavailable non-interactively — keeping installed version)");
         }
         else {
+            const useSudo = decision === "run-sudo";
+            logFile(`[create-maxy] claude-upgrade platform=${platform} sudo=${useSudo}`);
             console.log("  This may take 15–30 minutes on Raspberry Pi...");
-            console.log("  [privileged] npm install -g @anthropic-ai/claude-code@latest");
-            shellRetry("npm", ["install", "-g", ...NPM_NET_FLAGS, "--loglevel", "verbose", "@anthropic-ai/claude-code@latest"], { sudo: true, timeout: 2_400_000 }, // 40 min — Pi downloads can take 25+ min
+            console.log(`  ${useSudo ? "[privileged] " : ""}npm install -g @anthropic-ai/claude-code@latest`);
+            shellRetry("npm", ["install", "-g", ...NPM_NET_FLAGS, "--loglevel", "verbose", "@anthropic-ai/claude-code@latest"], { sudo: useSudo, timeout: 2_400_000 }, // 40 min — Pi downloads can take 25+ min
             3, 30);
         }
     }
+    // Task 1395 gap 4 — a darwin upgrade may have just installed a newer
+    // npm-global claude; re-resolve so the pinned CLAUDE_BIN reflects post-upgrade
+    // state. Keep the pre-upgrade pick if re-resolution finds nothing.
+    RESOLVED_CLAUDE_BIN = resolveCanonicalClaudeBin() ?? RESOLVED_CLAUDE_BIN;
+    if (process.platform === "darwin") {
+        logFile(`  [create-maxy] claude-bin=${RESOLVED_CLAUDE_BIN ?? "unresolved"}`);
+    }
     console.log("  Registering Claude plugin marketplaces...");
     // pre-create the per-brand CLAUDE_CONFIG_DIR so the first
     // `claude plugin marketplace add` has a directory to write into.
@@ -1124,6 +1198,27 @@ function installClaudeCode() {
         console.log("  Removing Playwright plugin (replaced by programmatic CDP server)...");
         spawnSync("claude", ["plugin", "uninstall", "playwright"], { stdio: "inherit", env: claudePluginEnv() });
     }
+    // Task 1386: suspend the joblogic connector on installs that already registered
+    // it. joblogic is now in every brand's plugins.excluded, so fresh payloads never
+    // ship it and it never registers — but an install that ran an older payload still
+    // carries it in `claude plugin list`, where its "jobs"-triggered skill hijacks
+    // generic jobs queries. Guarded on the snapshot above (joblogic's presence is
+    // independent of the playwright uninstall): uninstall only if present, mirroring
+    // the playwright removal. `[joblogic-suspend] present=<bool> uninstalled=<bool>`
+    // is the standing signal — present=false on fresh installs (guard skipped),
+    // present=true uninstalled=true on installs that had it.
+    const joblogicPresent = pluginList.stdout?.includes("joblogic") ?? false;
+    let joblogicUninstalled = false;
+    if (joblogicPresent) {
+        console.log("  Removing suspended joblogic connector plugin...");
+        const removal = spawnSync("claude", ["plugin", "uninstall", "joblogic"], { stdio: "pipe", encoding: "utf-8", env: claudePluginEnv() });
+        joblogicUninstalled = removal.status === 0;
+        if (!joblogicUninstalled) {
+            const stderrShort = (removal.stderr ?? "").split("\n")[0]?.slice(0, 200) ?? "";
+            logFile(`[joblogic-suspend] ERROR uninstall exit=${removal.status} stderr=${JSON.stringify(stderrShort)}`);
+        }
+    }
+    logFile(`[joblogic-suspend] present=${joblogicPresent} uninstalled=${joblogicUninstalled}`);
     // Ensure @playwright/mcp and all its dependencies (including playwright-core)
     // are cached. Wipe any stale npx cache for it first — killed installs on Pi
     // leave corrupt temp dirs that block subsequent npm operations.
@@ -1155,34 +1250,54 @@ function installClaudeCode() {
         console.log(`  Warning: Playwright MCP cache may be incomplete (browser automation may not work).${npxResult.stderr ? ` npx stderr: ${npxResult.stderr.slice(0, 200)}` : ""}`);
     }
 }
-function resetNeo4jAuth(port = DEFAULT_NEO4J_PORT, dataDir = "/var/lib/neo4j") {
+function resetNeo4jAuth(port = DEFAULT_NEO4J_PORT, dataDir = "/var/lib/neo4j", platform = "linux") {
     const password = randomBytes(24).toString("base64url");
     const dedicated = port !== DEFAULT_NEO4J_PORT;
-    const serviceName = dedicated ? `neo4j-${BRAND.hostname}` : "neo4j";
-    console.log(`  Resetting Neo4j auth with fresh password (${serviceName})...`);
-    spawnSync("sudo", ["systemctl", "stop", serviceName], { stdio: "inherit" });
-    // Clear the system database (stores auth/roles) and dbms auth config.
-    // The neo4j user database (graph data) is preserved.
-    // set-initial-password only works before the system DB's first start,
-    // so we must delete it to make Neo4j treat the next start as initial.
-    spawnSync("sudo", ["rm", "-rf",
+    // Clear the system database (stores auth/roles) and dbms auth config so the
+    // next start is treated as initial and set-initial-password takes. The neo4j
+    // user database (graph data) is preserved.
+    const clearPaths = [
         `${dataDir}/data/dbms`,
         `${dataDir}/data/databases/system`,
         `${dataDir}/data/transactions/system`,
-    ], { stdio: "inherit" });
-    if (dedicated) {
-        const confDir = `/etc/neo4j-${BRAND.hostname}`;
-        // sudo env VAR=val passes the variable through sudo's env_reset
-        spawnSync("sudo", ["env", `NEO4J_CONF=${confDir}`, "neo4j-admin", "dbms", "set-initial-password", "--", password], {
-            stdio: "inherit",
-        });
+    ];
+    if (platform === "darwin") {
+        // Homebrew Neo4j runs under a user launchd agent (brew services) and its
+        // datadir is user-owned — no systemctl, no sudo. This branch handles the
+        // shared (default-brand) instance. Dedicated brands (realagent-code etc.)
+        // set NEO4J_DEDICATED, but their dedicated provisioning (setupDedicatedNeo4j)
+        // is Linux-only and aborts a dedicated-brand darwin install upstream, so a
+        // non-default port never reaches here — see Task 1396 for darwin dedicated
+        // support.
+        console.log("  Resetting Neo4j auth with fresh password (brew services)...");
+        spawnSync("brew", ["services", "stop", "neo4j"], { stdio: "inherit" });
+        spawnSync("rm", ["-rf", ...clearPaths], { stdio: "inherit" });
+        shell("neo4j-admin", ["dbms", "set-initial-password", "--", password], { redact: true });
+        const brewStart = spawnSync("brew", ["services", "start", "neo4j"], { stdio: "inherit" });
+        if (brewStart.status !== 0) {
+            throw new Error(`brew services start neo4j failed (exit ${brewStart.status}) during auth reset — Neo4j must be running before the brand server starts`);
+        }
+        logFile(`  [neo4j-darwin-auth-reset] datadir=${dataDir} service=brew-services sudo=false`);
     }
     else {
-        console.log("  [privileged] neo4j-admin dbms");
-        shell("neo4j-admin", ["dbms", "set-initial-password", "--", password], { sudo: true, redact: true });
+        const serviceName = dedicated ? `neo4j-${BRAND.hostname}` : "neo4j";
+        console.log(`  Resetting Neo4j auth with fresh password (${serviceName})...`);
+        spawnSync("sudo", ["systemctl", "stop", serviceName], { stdio: "inherit" });
+        spawnSync("sudo", ["rm", "-rf", ...clearPaths], { stdio: "inherit" });
+        if (dedicated) {
+            const confDir = `/etc/neo4j-${BRAND.hostname}`;
+            // sudo env VAR=val passes the variable through sudo's env_reset
+            spawnSync("sudo", ["env", `NEO4J_CONF=${confDir}`, "neo4j-admin", "dbms", "set-initial-password", "--", password], {
+                stdio: "inherit",
+            });
+        }
+        else {
+            console.log("  [privileged] neo4j-admin dbms");
+            shell("neo4j-admin", ["dbms", "set-initial-password", "--", password], { sudo: true, redact: true });
+        }
+        console.log("  [privileged] systemctl start");
+        shell("systemctl", ["start", serviceName], { sudo: true });
     }
-    console.log("  [privileged] systemctl start");
-    shell("systemctl", ["start", serviceName], { sudo: true });
     console.log("  Waiting for Neo4j to start...");
     for (let i = 0; i < 15; i++) {
         const check = spawnSync("cypher-shell", [
@@ -1228,7 +1343,15 @@ function ensureNeo4jPassword() {
     const persistentPasswordFile = join(persistDir, ".neo4j-password");
     // Dedicated instances have their own auth database — password checks and resets
     // must target the dedicated port and data directory, not the shared instance.
-    const dataDir = NEO4J_DEDICATED ? `/var/lib/neo4j-${BRAND.hostname}` : "/var/lib/neo4j";
+    // On darwin the datadir lives under the Homebrew prefix and is user-owned.
+    const platform = requireSupportedPlatform(process.platform);
+    const dataDir = resolveNeo4jDataDir({
+        platform,
+        brewPrefix: platform === "darwin" ? resolveBrewPrefix() : "",
+        dedicated: NEO4J_DEDICATED,
+        hostname: BRAND.hostname,
+    });
+    logFile(`[create-maxy] neo4j-datadir=${dataDir} platform=${platform}`);
     // 1. Same-brand check: if our own password file exists and works, done (upgrade path).
     if (existsSync(passwordFile)) {
         const existingPassword = readFileSync(passwordFile, "utf-8").trim();
@@ -1255,7 +1378,7 @@ function ensureNeo4jPassword() {
         console.log("  Neo4j has existing data. Resetting auth only (data preserved)...");
         logFile(`  Neo4j auth reset — clearing dbms auth in ${dataDir}, preserving databases + transactions`);
     }
-    const password = resetNeo4jAuth(NEO4J_PORT, dataDir);
+    const password = resetNeo4jAuth(NEO4J_PORT, dataDir, platform);
     writeFileSync(passwordFile, password, { mode: 0o600 });
     mkdirSync(persistDir, { recursive: true });
     writeFileSync(persistentPasswordFile, password, { mode: 0o600 });
@@ -2521,6 +2644,39 @@ function buildPlatform() {
         }
         console.log(`  Installing claude-session-manager dependencies (${csmDir})...`);
         shellRetry("npm", ["install", "--omit=dev", ...NPM_NET_FLAGS], { cwd: csmDir }, 3, 15);
+        // Task 1395 gap 3 — on darwin node-pty ships uncompiled. Its install script
+        // is `node scripts/prebuild.js || node-gyp rebuild`; on this platform
+        // prebuild.js exits 0 without placing a binary, so `node-gyp rebuild` never
+        // runs and every PTY spawn fails `posix_spawnp failed`. `npm rebuild` just
+        // re-runs the same broken script — proven inert. The fix is to invoke
+        // `node-gyp rebuild` DIRECTLY in node-pty's resolved directory, bypassing
+        // prebuild.js. node-pty hoists to the platform workspace root, so resolve
+        // its real location rather than assuming csmDir. Xcode Command Line Tools
+        // are the prerequisite. Blocker, not warning: no addon means no session
+        // ever spawns.
+        if (process.platform === "darwin") {
+            const nodePtyCandidates = [
+                join(INSTALL_DIR, "platform", "node_modules", "node-pty"),
+                join(csmDir, "node_modules", "node-pty"),
+            ];
+            const nodePtyDir = nodePtyCandidates.find((d) => existsSync(d));
+            if (!nodePtyDir) {
+                throw new Error(`node-pty not found after install (looked in ${nodePtyCandidates.join(", ")}). ` +
+                    `The platform / claude-session-manager npm install did not place it.`);
+            }
+            console.log(`  Rebuilding node-pty native addon (darwin, ${nodePtyDir})...`);
+            const rebuilt = spawnSync("npx", ["--yes", "node-gyp", "rebuild"], { cwd: nodePtyDir, stdio: "inherit", timeout: 300_000 });
+            const nodePtyRelease = join(nodePtyDir, "build", "Release");
+            const ptyNode = join(nodePtyRelease, "pty.node");
+            const spawnHelper = join(nodePtyRelease, "spawn-helper");
+            const built = existsSync(ptyNode) && existsSync(spawnHelper);
+            logFile(`  [create-maxy] node-pty build=${built ? "rebuilt" : "failed"} exit=${rebuilt.status ?? "null"} dir=${nodePtyDir} pty.node=${existsSync(ptyNode)} spawn-helper=${existsSync(spawnHelper)}`);
+            if (!built) {
+                throw new Error(`node-pty native addon missing after node-gyp rebuild in ${nodePtyDir} ` +
+                    `(pty.node=${existsSync(ptyNode)} spawn-helper=${existsSync(spawnHelper)}). ` +
+                    `Install Xcode Command Line Tools (xcode-select --install) and re-run.`);
+            }
+        }
     }
     // (maxy-code, Task 677 P2) — whatsapp-channel service has its own
     // package.json declaring @modelcontextprotocol/sdk. It ships dist/ +
@@ -3182,8 +3338,20 @@ function installServiceDarwin() {
                 envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `${key}=${value}\n`;
             }
         }
+        // Task 1395 gap 4 — pin the canonical claude path (resolved in phase 3) so
+        // every runtime spawn under launchd uses the logged-in binary, not whichever
+        // the bare launchd PATH resolves first. Written only when resolved; an unset
+        // CLAUDE_BIN makes runtime callers fall back to bare `claude` on PATH.
+        const canonicalClaude = RESOLVED_CLAUDE_BIN ?? resolveCanonicalClaudeBin();
+        if (canonicalClaude) {
+            const re = /^CLAUDE_BIN=.*$/m;
+            if (re.test(envContent))
+                envContent = envContent.replace(re, `CLAUDE_BIN=${canonicalClaude}`);
+            else
+                envContent = envContent.trimEnd() + (envContent.length > 0 ? "\n" : "") + `CLAUDE_BIN=${canonicalClaude}\n`;
+        }
         writeFileSync(envPath, envContent);
-        logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude`);
+        logFile(`  .env: DISPLAY_MODE=${DISPLAY_MODE}, EMBED_MODEL=${EMBED_MODEL}, EMBED_DIMENSIONS=${EMBED_DIMS}, NEO4J_URI=bolt://localhost:${NEO4J_PORT}, PORT=${PORT}, MAXY_UI_INTERNAL_PORT=${PORT} (darwin-collapsed), CLAUDE_SESSION_MANAGER_PORT=${BRAND.claudeSessionManagerPort}, HOSTNAME=0.0.0.0, ACCOUNT_ID=${installAccountId.slice(0, 8)}…, CLAUDE_CONFIG_DIR=${persistDir}/.claude, CLAUDE_BIN=${canonicalClaude ?? "unresolved(PATH)"}`);
     }
     catch (err) {
         console.error(`  WARNING: failed to write .env to ${envPath}: ${err instanceof Error ? err.message : String(err)}`);
@@ -3245,6 +3413,66 @@ function installServiceDarwin() {
         logFile(`  [create-maxy] launchd-plist=${path} loaded=false exit=${bootstrap.status}`);
         throw new Error(`launchctl bootstrap ${gui()} ${path} failed (exit ${bootstrap.status}): ${stderr}`);
     }
+    // Task 1395 gap 2 — the claude-session-manager. On Linux it is a separate
+    // systemd user unit (buildClaudeSessionManagerUnitFile) the brand unit
+    // Requires=; darwin authored no such unit, so nothing listened on the manager
+    // port and every session spawn returned `manager-unreachable`. Author a second
+    // LaunchAgent mirroring the Linux unit: a wrapper sources .env + the
+    // manager-only vars, then execs `node dist/index.js`.
+    const smLabel = `${launchdLabel()}-claude-session-manager`;
+    const smPlistPath = join(launchAgentsDir(), `${smLabel}.plist`);
+    const smWrapperPath = join(persistDir, "claude-session-manager-wrapper.sh");
+    writeFileSync(smWrapperPath, buildSessionManagerWrapper({
+        envPath,
+        installDir: INSTALL_DIR,
+        nodeBin,
+        persistDir,
+        brandPort: PORT,
+    }));
+    chmodSync(smWrapperPath, 0o755);
+    const smPlist = renderPlist({
+        label: smLabel,
+        programArguments: ["/bin/bash", smWrapperPath],
+        stdoutPath: join(logsDir, "server.log"),
+        stderrPath: join(logsDir, "server.log"),
+        keepAlive: true,
+        runAtLoad: true,
+        workingDirectory: `${INSTALL_DIR}/platform/services/claude-session-manager`,
+    });
+    writeFileSync(smPlistPath, smPlist);
+    logFile(`  ${smPlistPath} written (${smPlist.length} bytes)`);
+    spawnSync("launchctl", ["bootout", `${gui()}/${smLabel}`], { stdio: "pipe" });
+    const smBootstrap = spawnSync("launchctl", ["bootstrap", gui(), smPlistPath], {
+        stdio: "pipe",
+        encoding: "utf-8",
+        timeout: 15_000,
+    });
+    if (smBootstrap.status === 0) {
+        console.log(`  [launchd] bootstrap ${gui()}/${smLabel} ok`);
+        logFile(`  [create-maxy] launchd-plist=${smLabel} loaded=true`);
+    }
+    else {
+        const smStderr = (smBootstrap.stderr ?? "").trim();
+        console.error(`  [launchd] bootstrap ${smLabel} returned ${smBootstrap.status}: ${smStderr}`);
+        logFile(`  [create-maxy] launchd-plist=${smLabel} loaded=false exit=${smBootstrap.status}`);
+        throw new Error(`launchctl bootstrap ${smLabel} failed (exit ${smBootstrap.status}): ${smStderr}`);
+    }
+    // Health-probe the manager (/healthz) so a silent boot failure surfaces at
+    // install time, not at first session spawn as `manager-unreachable`.
+    console.log("  Waiting for session manager...");
+    let smUp = false;
+    for (let i = 0; i < 15; i++) {
+        const probe = spawnSync("curl", ["-sf", `http://127.0.0.1:${BRAND.claudeSessionManagerPort}/healthz`, "-o", "/dev/null"], { timeout: 3000 });
+        if (probe.status === 0) {
+            smUp = true;
+            break;
+        }
+        spawnSync("sleep", ["2"]);
+    }
+    logFile(`  [create-maxy] session-manager-health=${smUp ? "ok" : "timeout"} port=${BRAND.claudeSessionManagerPort}`);
+    if (!smUp) {
+        console.log(`  Session manager not yet healthy on ${BRAND.claudeSessionManagerPort} — check ${join(logsDir, "server.log")}.`);
+    }
     // Wait for the server to come up.
     console.log("  Waiting for web server...");
     let webServerUp = false;

package/dist/launchd-plist.js

@@ -26,16 +26,32 @@ function xmlEscape(s) {
         .replace(/'/g, "'");
 }
 /**
- * Render a launchd LaunchAgent plist as XML. Pure: same input → same output
- * forever. The caller writes this to `~/Library/LaunchAgents/<label>.plist`
- * with mode 0644 and then runs `launchctl bootstrap gui/$UID <path>`.
- *
- * The output is the canonical plist 1.0 form launchd accepts — XML preamble,
- * PLIST PUBLIC DOCTYPE, <plist version="1.0"> wrapping a single <dict>. Key
- * order inside the dict mirrors Apple's LaunchAgent examples for grep-ability:
- * Label, ProgramArguments, StandardOutPath, StandardErrorPath, [WorkingDirectory,]
- * KeepAlive, RunAtLoad.
+ * Bash wrapper for the darwin claude-session-manager LaunchAgent (Task 1395
+ * gap 2). launchd has no systemd `EnvironmentFile=`/`Environment=` analogue, so
+ * the wrapper sources the brand `.env` and then exports the manager-only vars
+ * the Linux systemd unit (buildClaudeSessionManagerUnitFile) sets that `.env`
+ * omits — CLAUDE_SESSION_MANAGER_PERSIST_DIR, PLATFORM_ROOT, MAXY_BRAND_PORT,
+ * PLATFORM_PORT. NEO4J_PASSWORD self-resolves from `<persistDir>/.neo4j-password`
+ * (as on Linux); the Pi-only CDP/VNC display vars are deliberately excluded —
+ * darwin runs no display stack.
  */
+export function buildSessionManagerWrapper(o) {
+    const managerDir = `${o.installDir}/platform/services/claude-session-manager`;
+    return [
+        "#!/bin/bash",
+        "# generated by create-maxy installServiceDarwin() — Task 1395 gap 2.",
+        "# Sources .env then exports the manager-only vars the Linux systemd unit",
+        "# sets that .env omits, and execs the claude-session-manager.",
+        `set -a; [ -f "${o.envPath}" ] && . "${o.envPath}"; set +a`,
+        `export CLAUDE_SESSION_MANAGER_PERSIST_DIR="${o.persistDir}"`,
+        `export PLATFORM_ROOT="${o.installDir}/platform"`,
+        `export MAXY_BRAND_PORT="${o.brandPort}"`,
+        `export PLATFORM_PORT="${o.brandPort}"`,
+        `cd "${managerDir}"`,
+        `exec ${o.nodeBin} dist/index.js`,
+        "",
+    ].join("\n");
+}
 export function renderPlist(spec) {
     const lines = [];
     lines.push(`<?xml version="1.0" encoding="UTF-8"?>`);

package/dist/neo4j-datadir.js

@@ -0,0 +1,15 @@
+// Pure resolution of the Neo4j data directory the installer resets auth against.
+// No spawnSync, no fs — the caller injects the brew prefix (from `brew --prefix`)
+// on darwin. Peer of the other install decision helpers.
+//
+// darwin: Homebrew installs Neo4j's datadir at `<brew prefix>/var/neo4j`
+//   (/usr/local on Intel, /opt/homebrew on Apple Silicon), user-owned. Only the
+//   shared instance exists on darwin — dedicated (systemd) instances are Linux
+//   only — so `dedicated` is not consulted here.
+// linux: /var/lib/neo4j (shared) or /var/lib/neo4j-<hostname> (dedicated).
+export function resolveNeo4jDataDir(input) {
+    if (input.platform === "darwin") {
+        return `${input.brewPrefix}/var/neo4j`;
+    }
+    return input.dedicated ? `/var/lib/neo4j-${input.hostname}` : "/var/lib/neo4j";
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.388",
+  "version": "0.1.391",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/config/brand.json

@@ -56,7 +56,7 @@
     "core": ["admin", "memory", "docs", "cloudflare", "anthropic", "workflows", "work", "scheduling", "email", "contacts", "projects", "prompt-optimiser", "browser"],
     "defaultEnabled": ["business-assistant", "sales"],
     "available": ["connector", "telegram", "deep-research", "whatsapp", "replicate", "linkedin-import", "notion-import", "obsidian-import", "x-import", "slides"],
-    "excluded": []
+    "excluded": ["joblogic"]
   },
 
   "externalPlugins": [

package/payload/platform/plugins/.claude-plugin/marketplace.json

@@ -64,11 +64,6 @@
       "source": "./graph-viewer",
       "version": "0.1.0"
     },
-    {
-      "name": "joblogic",
-      "source": "./joblogic",
-      "version": "0.1.0"
-    },
     {
       "name": "linkedin-extension",
       "source": "./linkedin-extension",

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:ca771c68e3f7a68883043ba838fc2dd07004d77ac08f3326f2f60a9b7bc62be0
+content-hash: sha256:11f2a3458fb6227490d33fcf54f859595c215184dbb78051484df353b6fbf227
 brand: maxy-code
 product-name: Maxy
 ---
@@ -539,7 +539,7 @@ Source: https://docs.getmaxy.com/install/macos.md
 
 # Installing Maxy Code on macOS
 
-End-to-end install for a fresh macOS account on Apple Silicon (M-series). Every command is copy-pasteable and uses auto-yes flags so nothing prompts interactively.
+End-to-end install for a fresh macOS account on Apple Silicon (M-series) or Intel (x86_64). Every command is copy-pasteable and uses auto-yes flags so nothing prompts interactively.
 
 The doc is brand-aware. Examples use the default brand `maxy-code`; substitute `realagent-code` (or any other brand under `maxy-code/brands/`) wherever you want a parallel install. Each brand is fully isolated — its own persist directory, its own LaunchAgent, its own admin UI port, its own `CLAUDE_CONFIG_DIR`.
 
@@ -549,7 +549,7 @@ The doc is brand-aware. Examples use the default brand `maxy-code`; substitute `
 ## Requirements
 
 - macOS 14 (Sonoma) or newer. The installer refuses to run on 13 and below; you will see `[create-maxy] platform=darwin macos=… — refusing: macOS 14+ required`.
-- Apple Silicon (M1/M2/M3/M4). Intel Macs are not part of the supported matrix — the installer pins `node@22` from Homebrew's Apple Silicon cellar (`/opt/homebrew`) and other paths assume that prefix.
+- Apple Silicon (M1/M2/M3/M4) or Intel (x86_64). The installer resolves the Node binary and Homebrew prefix at install time and stamps a runtime `PATH` of `/opt/homebrew/bin:/usr/local/bin:$PATH`, so both the Apple Silicon cellar (`/opt/homebrew`) and the Intel cellar (`/usr/local`) work.
 - Admin (sudo) account. The installer asks for your password once when it sets the system hostname via `scutil`; everything else runs unprivileged.
 - A working internet connection — Homebrew, npm, and Cloudflare endpoints are all reached during install.
 
@@ -567,7 +567,7 @@ brew link --overwrite --force node@22
 node --version
 ```
 
-Node from the system PATH must resolve to `/opt/homebrew/opt/node@22/bin/node`. If `which node` points anywhere else, fix the PATH before continuing — the installer reads node from `PATH` and a 20.x binary will trip the engines check.
+Node from the system PATH must resolve to Homebrew's `node@22` (`/opt/homebrew/opt/node@22/bin/node` on Apple Silicon, `/usr/local/opt/node@22/bin/node` on Intel). If `which node` points anywhere else, fix the PATH before continuing — the installer reads node from `PATH` and a 20.x binary will trip the engines check.
 
 ## 2. Run the installer
 
@@ -2012,6 +2012,8 @@ Source: https://docs.getmaxy.com/joblogic.md
 
 # JobLogic
 
+> **Status: Suspended.** This connector is not shipped on any brand. Its skill triggers on the generic word "jobs", which collides with SiteDesk's `Job` graph node and mis-routes every generic jobs question to a connector that ships inert. It is excluded from every brand payload (`plugins.excluded`), and the installer de-registers it on any install that still carries it. The source stays in-tree; re-introduction reverts the exclusion and reworks the trigger surface under a future task. Everything below describes the connector as designed, for when it is re-introduced.
+
 Connect JobLogic, the field-service management system, so the agent can read and update your jobs end to end — customers, sites, jobs, engineers, visits, quotes, invoices, assets, and timesheets — over JobLogic's REST API.
 
 This connector is built for one team that already runs JobLogic as its system of record. Your field staff send a voice note or message to Maxy from the field; Maxy works out what they mean and makes the JobLogic update for them. Your staff never touch the JobLogic API themselves, so only Maxy's own connection talks to JobLogic.
@@ -2590,7 +2592,7 @@ either is a regression.
 | `/session-rc-spawn` | POST `{ sessionId?, name? }`. Fire-and-forget `claude --remote-control [name] [--session-id <sid>]`. Present `sessionId` resumes; absent starts a fresh session (also used by the sidebar's "New session" button — it no longer opens claude.ai/code directly). Proxies to the manager's `/rc-spawn`, which waits up to **60 s** (raised from 12 s) for the spawned PTY to bind and returns `{ spawnedPid, sessionId, bridgeSessionId, slug, outcome, reason }`. For a webchat-bound spawn (every admin-gated host's "New session", returning a same-origin `/chat?session=<id>` target — `resolveRcSpawnOutcome` → `sameOrigin:true`) the Sidebar navigates the **current** tab via `window.location.assign`, replacing the dashboard in place (back returns to it); only a claude.ai/code slug (`sameOrigin:false`, the bare-admin resume bridge, never a new-session outcome) navigates a separately-opened tab. On `timeout` or `spawn-failed` it shows an error modal (reason + sessionId) and **never** opens a bare claude.ai/code tab. The new process registers itself as its own Remote Control entry in claude.ai/code. | `POST /` |
 | `/claude-sessions` | **Spawn surface only**. `POST /` is the Sidebar new-session-with-prompt path, cookie-auth only (the recorder loopback caller was removed; LinkedIn ingest moved to `/rc-spawn`). The former UI-facing handlers (SSE row feed, list, resume, stop, rename, archive, delete, `/:id/meta`, `/:id/input`, `/:id/log`) were removed — the maxy dashboard no longer manages or displays sessions. | `POST /` |
 
-**Admin session management moved entirely to claude's own interfaces** (claude.ai/code, claude desktop). A manager-owned per-account `claude rc --spawn same-dir` daemon registers the device as a Remote Control target there; the composer creates / resumes / stops / renames / archives / deletes sessions, with model + permission-mode applied at inception. The model lever is `account.json.adminModel` → `CLAUDE_CONFIG_DIR/settings.json "model"`, written by the daemon supervisor at boot; the reasoning-effort lever is `account.json.effort` → `settings.json "effortLevel"` (accepted values `low|medium|high|xhigh`; any other value, e.g. legacy `"auto"`, leaves the key unset so claude's own default governs), written by the same read-merge-write at boot. A third inception lever, permission mode, is added: `account.json.adminPermissionMode` → `settings.json "permissions.defaultMode"` (the 5 composer-writable modes `default|acceptEdits|plan|auto|bypassPermissions`; `dontAsk` is out of scope). Unlike model/effort (top-level keys), this lever **deep-merges** the nested `permissions.defaultMode`, owning only that key and preserving sibling `permissions` keys (allow/deny/…) — what the binary and the spawn lifeline actually read. **For admin sessions, permission mode is fixed (Bypass) and not operator-chosen, while model and effort ARE operator-chosen at launch** via the composer's `+` new-session popover — a radio model list (Opus / Sonnet / Haiku) plus a 5-stop Faster→Smarter effort slider (Low / Medium / High / Extra / Max, where `max` applies via the `--effort` argv rather than `settings.json`); the popover description lives in `.docs/admin-webchat-native-channel.md`. Absent a pick (and on every resume), the daemon-pinned defaults govern: the `/chat` composer *footer* carries no live re-seat pickers — `rc-daemon.ts` pins settings.json `model`/`effortLevel`/`permissions.defaultMode` to `claude-opus-4-8[1m]` / `medium` / `bypassPermissions` regardless of `account.json` (read by the rc-spawn webchat path), and `pty-spawner.ts` forces the claude.ai/code PTY `--permission-mode` to `bypassPermissions` for `role=admin`. Public sessions are fixed to `claude-sonnet-5` (the `/public-spawn` chokepoint + `buildPublicWebchatSpawnRequest`), keeping `dontAsk`. The composer footer instead renders a **read-only** params row (mode · model · effort labels) plus a context-window usage figure (`pct% · ~used/~window`), all sourced from the session pointer; the full path is in `.docs/admin-webchat-native-channel.md`. The composer cannot re-seat a session, so the "no transcript" 400 on a brand-new chat is unreachable; the `/api/admin/session-reseat` + `/api/webchat/settings` routes and the dashboard re-seat form stay as off-composer surfaces. When the live session runs in `default` ("Ask permissions") mode, a tool the agent attempts that needs approval surfaces an Allow/Deny card in the composer (tool, description, argument preview); a click sends the verdict over Claude Code's channel permission relay and the tool runs or is refused — webchat is the only interactive ask surface (WhatsApp stays text-only; Telegram has no agent channel). Beyond the composer, the maxy admin UI keeps a single "New session" link (`https://claude.ai/code`, opens in a new tab) and no separate session list, viewer, controls, or model/mode picker. The daemon supervisor lives at [`platform/services/claude-session-manager/src/rc-daemon.ts`](../../../services/claude-session-manager/src/rc-daemon.ts). The `/session-defaults` route and `SpawnPreference` node were deleted with the picker. `/new-session-failure`, `/new-session-submit`, and `/claude-capabilities` are now orphaned (consumed only by the deleted NewSessionModal) — see [`.tasks/501`](../../../.tasks/) for their removal.
+**Admin session management moved entirely to claude's own interfaces** (claude.ai/code, claude desktop). A manager-owned per-account `claude rc --spawn same-dir` daemon registers the device as a Remote Control target there; the composer creates / resumes / stops / renames / archives / deletes sessions, with model + permission-mode applied at inception. The model lever is `account.json.adminModel` → `CLAUDE_CONFIG_DIR/settings.json "model"`, written by the daemon supervisor at boot; the reasoning-effort lever is `account.json.effort` → `settings.json "effortLevel"` (accepted values `low|medium|high|xhigh`; any other value, e.g. legacy `"auto"`, leaves the key unset so claude's own default governs), written by the same read-merge-write at boot. A third inception lever, permission mode, is added: `account.json.adminPermissionMode` → `settings.json "permissions.defaultMode"` (the 5 composer-writable modes `default|acceptEdits|plan|auto|bypassPermissions`; `dontAsk` is out of scope). Unlike model/effort (top-level keys), this lever **deep-merges** the nested `permissions.defaultMode`, owning only that key and preserving sibling `permissions` keys (allow/deny/…) — what the binary and the spawn lifeline actually read. **For admin sessions, permission mode is fixed (Bypass) and not operator-chosen, while model and effort ARE operator-chosen at launch** via the composer's `+` new-session popover — a radio model list (Opus / Sonnet / Haiku) plus a 5-stop Faster→Smarter effort slider (Low / Medium / High / Extra / Max, where `max` applies via the `--effort` argv rather than `settings.json`); the popover description lives in `.docs/admin-webchat-native-channel.md`. Absent a pick (and on every resume), the daemon-pinned defaults govern: the `/chat` composer *footer* carries no live re-seat pickers — `rc-daemon.ts` pins settings.json `model`/`effortLevel`/`permissions.defaultMode` to `claude-opus-4-8[1m]` / `medium` / `bypassPermissions` regardless of `account.json` (read by the rc-spawn webchat path), and `pty-spawner.ts` forces the claude.ai/code PTY `--permission-mode` to `bypassPermissions` for `role=admin`. Public sessions are fixed to `claude-sonnet-5` (the `/public-spawn` chokepoint + `buildPublicWebchatSpawnRequest`), keeping `dontAsk`. **WhatsApp admin sessions override the daemon default:** the `/rc-spawn` handler pins `claude-sonnet-5` / `--effort max` / `bypassPermissions` for a `role=admin` WhatsApp spawn (constants `WHATSAPP_ADMIN_MODEL`/`WHATSAPP_ADMIN_EFFORT` in `http-server.ts`), pushing `--model`/`--effort` on both the fresh spawn and every resume so the params hold for the session's whole life. The override is scoped to sessions *born* under it: a fresh WhatsApp admin spawn stamps its classification sidecar `model=claude-sonnet-5`, and a resume re-asserts Sonnet/max only when that stamp is present — so a WhatsApp session created before this change (sidecar `model=null`) finishes its life on the Opus/medium default. Webchat and Telegram admin sessions are unaffected; public WhatsApp inbound never spawns. The composer footer instead renders a **read-only** params row (mode · model · effort labels) plus a context-window usage figure (`pct% · ~used/~window`), all sourced from the session pointer; the full path is in `.docs/admin-webchat-native-channel.md`. The composer cannot re-seat a session, so the "no transcript" 400 on a brand-new chat is unreachable; the `/api/admin/session-reseat` + `/api/webchat/settings` routes and the dashboard re-seat form stay as off-composer surfaces. When the live session runs in `default` ("Ask permissions") mode, a tool the agent attempts that needs approval surfaces an Allow/Deny card in the composer (tool, description, argument preview); a click sends the verdict over Claude Code's channel permission relay and the tool runs or is refused — webchat is the only interactive ask surface (WhatsApp stays text-only; Telegram has no agent channel). Beyond the composer, the maxy admin UI keeps a single "New session" link (`https://claude.ai/code`, opens in a new tab) and no separate session list, viewer, controls, or model/mode picker. The daemon supervisor lives at [`platform/services/claude-session-manager/src/rc-daemon.ts`](../../../services/claude-session-manager/src/rc-daemon.ts). The `/session-defaults` route and `SpawnPreference` node were deleted with the picker. `/new-session-failure`, `/new-session-submit`, and `/claude-capabilities` are now orphaned (consumed only by the deleted NewSessionModal) — see [`.tasks/501`](../../../.tasks/) for their removal.
 
 **Row title resolution.** Both the sidebar (`/sidebar-sessions`) and the manager's own row payload resolve a row's title in the same order: operator rename → Claude Code `ai-title` → first non-CLI user message → 8-char sessionId prefix. The operator-rename tier is the on-disk `<accountDir>/session-titles.json` (the manager's `UserTitleStore`), keyed by the CC sessionId — the sidebar reads that same file, so a write to the store lights up both surfaces with one write.
 
@@ -2647,6 +2649,23 @@ it is account-scoped by a graph-ownership check (the attachmentId must map to a
 partition. Resolution emits `[admin/sidebar-artefacts] download-resolved via=…`;
 a web/transient doc with no persisted file is `not-downloadable reason=no-persisted-file`.
 
+**Outbound file-delivery account scope (WhatsApp / Telegram).** When the agent
+sends a file to a channel — WhatsApp `reply-document` or `SendUserFile`, Telegram
+`SendUserFile` — the delivery core validates the file path against a single
+account directory (`<DATA_ROOT>/accounts/<maxyAccountId>/`) and rejects anything
+outside it. That validation scope is the sender's **effective session account**:
+the account the session runs in, which for a WhatsApp account-manager routed to a
+client sub-account is the gate-resolved sub-account (where the session's files
+live), and for every other sender is the house account. It is **not** the
+house/channel-routing account from `resolvePlatformAccountId()` (that helper
+stays the inbound-persistence scope only). WhatsApp threads the effective account
+from the inbound gate through the per-sender doc context (reply-document) and the
+native file follower (`SendUserFile`); Telegram has no account-manager routing,
+so the session's own spawn account is the scope. A rejected delivery logs
+`[whatsapp:outbound] document REJECTED … reason=outside_account_directory
+maxyAccountId=<scope>` (and the Telegram twin), so a wrong-account mismatch is
+greppable from the log alone.
+
 **`/data` File panel — refresh and reload-survival.** The panel listing is a
 snapshot from its last fetch, so a file an agent writes (or an upload/delete
 elsewhere) leaves stale rows and timestamps until something re-fetches. A

package/payload/platform/plugins/docs/references/admin-session.md

@@ -102,6 +102,10 @@ The metadata pane surfaces two distinct identifier values. The three-id model wa
 | `sessionId` | Claude's session. Two phases: bridge suffix (`session_xxx`, the URL segment in `claude.ai/code/<session_xxx>`, set when claude prints the `/remote-control` URL) and JSONL basename UUID (claude's intrinsic id on disk, bound when the first turn flushes the JSONL). Both phases coexist on a live row after URL capture; the manager wire emits the bridge form when set, falling back to the JSONL basename in the pre-URL-capture window. The resolver routes either phase to the same row, so callers never need to choose. | `sessionId` (collapsed from the earlier three-field surface `sessionId` + `claudeSessionId` + `bridgeSessionId`) | `sessionId=` |
 | `accountId` | Account / workspace UUID. For the admin channel, the value the manager carries as `senderId` IS the accountId; for non-admin channels the same wire field carries a phone / email / chat-id (the channel-level sender), so its log key on those paths is still `senderId=`. | `senderId` (channel-agnostic) | `accountId=` in admin-flow emit sites; `senderId=` in channel-bridge sites |
 
+## Per-session usage & cost metering
+
+Each session row carries a usage icon (Lucide `Gauge`) that opens a modal with a per-day table: active time (thinking / messaging / tool use), token classes, and estimated GBP cost for Opus 4.8 and Sonnet 4.6, plus a TOTAL row. The modal fetches `GET /api/admin/session-usage?sessionId=<uuid>`, which proxies the manager's `GET /:sessionId/metering`. The admin agent reaches the identical table through the work-plugin MCP tool `session-metering` (loopback to the same endpoint) — one deterministic core, two adapters, byte-identical data. The full model, pricing provenance, and caveats (span ≠ active; cache-read dominates cost; tokens are turn-level with thinking redacted; Sonnet is a tokenizer-adjusted estimate; `cache_creation` priced at the 5-minute rate) are in [`session-metering.md`](../../../.docs/session-metering.md).
+
 ## Memory MCP write-path outcome lines
 
 Every write-path tool in the memory plugin MCP emits one structured line per invocation to `server.log` via the loopback `/api/admin/log-ingest` route. The operator can answer "did this write succeed?" from a single greppable surface — no need to cross-reference the per-process `mcp-memory-stderr-<date>.log`.