@rubytech/create-maxy-code 0.1.404 → 0.1.406

package/dist/__tests__/launchd-plist.test.js

@@ -10,7 +10,19 @@
 // package so `node --test dist/__tests__/*.test.js` picks it up after build.
 import test from "node:test";
 import assert from "node:assert/strict";
-import { renderPlist, buildSessionManagerWrapper, buildHeartbeatWrapper } from "../launchd-plist.js";
+import { renderPlist, buildSessionManagerWrapper, buildHeartbeatWrapper, buildNeo4jWrapper } from "../launchd-plist.js";
+test("neo4j wrapper exports NEO4J_CONF, prepends brew bins, execs neo4j console", () => {
+    const w = buildNeo4jWrapper({ confDir: "/Users/x/.realagent-code/neo4j/conf", brewPrefix: "/usr/local" });
+    assert.match(w, /^#!\/bin\/bash/);
+    assert.match(w, /export NEO4J_CONF="\/Users\/x\/\.realagent-code\/neo4j\/conf"/);
+    assert.match(w, /export PATH="\/usr\/local\/bin:\/usr\/local\/sbin:\$PATH"/);
+    assert.match(w, /exec \/usr\/local\/bin\/neo4j console\n$/);
+});
+test("neo4j wrapper honours the Apple Silicon brew prefix", () => {
+    const w = buildNeo4jWrapper({ confDir: "/Users/x/.sitedesk-code/neo4j/conf", brewPrefix: "/opt/homebrew" });
+    assert.match(w, /export PATH="\/opt\/homebrew\/bin:\/opt\/homebrew\/sbin:\$PATH"/);
+    assert.match(w, /exec \/opt\/homebrew\/bin\/neo4j console\n$/);
+});
 // ---------------------------------------------------------------------------
 // Standard render — every required field present, no escaping needed.
 // ---------------------------------------------------------------------------

package/dist/__tests__/neo4j-darwin-dedicated.test.js

@@ -0,0 +1,52 @@
+// Contract grid for the pure darwin dedicated-Neo4j resolvers. No fs/spawn —
+// the wrapper in index.ts (setupDedicatedNeo4jDarwin / resetNeo4jAuth) owns the
+// mkdir/cp/sed/launchctl. Runs via Node's built-in test runner.
+import test from "node:test";
+import assert from "node:assert/strict";
+import { resolveDarwinDedicatedNeo4jPaths, resolveDarwinDedicatedNeo4jConfKeys, } from "../neo4j-darwin-dedicated.js";
+test("paths derive the full per-brand neo4j tree + brew source/bins", () => {
+    const p = resolveDarwinDedicatedNeo4jPaths({ persistDir: "/Users/x/.realagent-code", brewPrefix: "/usr/local" });
+    assert.deepEqual(p, {
+        home: "/Users/x/.realagent-code/neo4j",
+        dataDir: "/Users/x/.realagent-code/neo4j/data",
+        confDir: "/Users/x/.realagent-code/neo4j/conf",
+        logsDir: "/Users/x/.realagent-code/neo4j/logs",
+        runDir: "/Users/x/.realagent-code/neo4j/run",
+        pluginsDir: "/Users/x/.realagent-code/neo4j/plugins",
+        importDir: "/Users/x/.realagent-code/neo4j/import",
+        srcConfDir: "/usr/local/opt/neo4j/libexec/conf",
+        neo4jBin: "/usr/local/bin/neo4j",
+        neo4jAdminBin: "/usr/local/bin/neo4j-admin",
+    });
+});
+test("home equals resolveNeo4jDataDir's darwin-dedicated root (reset-auth parity)", () => {
+    // resetNeo4jAuth clears `${dataDir}/data/...`, where its dataDir arg is `home`.
+    const p = resolveDarwinDedicatedNeo4jPaths({ persistDir: "/Users/x/.realagent-code", brewPrefix: "/usr/local" });
+    assert.equal(p.dataDir, `${p.home}/data`);
+});
+test("Apple Silicon prefix flows into src conf + bins", () => {
+    const p = resolveDarwinDedicatedNeo4jPaths({ persistDir: "/Users/x/.sitedesk-code", brewPrefix: "/opt/homebrew" });
+    assert.equal(p.srcConfDir, "/opt/homebrew/opt/neo4j/libexec/conf");
+    assert.equal(p.neo4jBin, "/opt/homebrew/bin/neo4j");
+    assert.equal(p.neo4jAdminBin, "/opt/homebrew/bin/neo4j-admin");
+});
+test("conf keys: bolt/http listen + five absolute directories, http = port-213", () => {
+    const p = resolveDarwinDedicatedNeo4jPaths({ persistDir: "/Users/x/.realagent-code", brewPrefix: "/usr/local" });
+    const keys = resolveDarwinDedicatedNeo4jConfKeys({
+        port: 7688, dataDir: p.dataDir, logsDir: p.logsDir, runDir: p.runDir, pluginsDir: p.pluginsDir, importDir: p.importDir,
+    });
+    assert.deepEqual(keys, [
+        ["server.bolt.listen_address", ":7688"],
+        ["server.http.listen_address", ":7475"],
+        ["server.directories.data", "/Users/x/.realagent-code/neo4j/data"],
+        ["server.directories.logs", "/Users/x/.realagent-code/neo4j/logs"],
+        ["server.directories.run", "/Users/x/.realagent-code/neo4j/run"],
+        ["server.directories.plugins", "/Users/x/.realagent-code/neo4j/plugins"],
+        ["server.directories.import", "/Users/x/.realagent-code/neo4j/import"],
+    ]);
+});
+test("sitedesk port maps http to 7476", () => {
+    const keys = resolveDarwinDedicatedNeo4jConfKeys({ port: 7689, dataDir: "d", logsDir: "l", runDir: "r", pluginsDir: "p", importDir: "i" });
+    assert.equal(keys[0][1], ":7689");
+    assert.equal(keys[1][1], ":7476");
+});

package/dist/__tests__/neo4j-datadir.test.js

@@ -1,14 +1,15 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { resolveNeo4jDataDir } from "../neo4j-datadir.js";
-test("darwin resolves the Homebrew datadir under the brew prefix (Intel + Apple Silicon)", () => {
-    assert.equal(resolveNeo4jDataDir({ platform: "darwin", brewPrefix: "/usr/local", dedicated: false, hostname: "maxy-code" }), "/usr/local/var/neo4j");
-    assert.equal(resolveNeo4jDataDir({ platform: "darwin", brewPrefix: "/opt/homebrew", dedicated: false, hostname: "maxy-code" }), "/opt/homebrew/var/neo4j");
+test("darwin shared resolves the Homebrew datadir under the brew prefix (Intel + Apple Silicon)", () => {
+    assert.equal(resolveNeo4jDataDir({ platform: "darwin", brewPrefix: "/usr/local", dedicated: false, hostname: "maxy-code", persistDir: "/Users/x/.maxy-code" }), "/usr/local/var/neo4j");
+    assert.equal(resolveNeo4jDataDir({ platform: "darwin", brewPrefix: "/opt/homebrew", dedicated: false, hostname: "maxy-code", persistDir: "/Users/x/.maxy-code" }), "/opt/homebrew/var/neo4j");
 });
-test("darwin ignores dedicated — only the shared Homebrew instance exists on darwin", () => {
-    assert.equal(resolveNeo4jDataDir({ platform: "darwin", brewPrefix: "/usr/local", dedicated: true, hostname: "realagent-code" }), "/usr/local/var/neo4j");
+test("darwin dedicated resolves a per-brand datadir under the persist tree", () => {
+    assert.equal(resolveNeo4jDataDir({ platform: "darwin", brewPrefix: "/usr/local", dedicated: true, hostname: "realagent-code", persistDir: "/Users/x/.realagent-code" }), "/Users/x/.realagent-code/neo4j");
+    assert.equal(resolveNeo4jDataDir({ platform: "darwin", brewPrefix: "/opt/homebrew", dedicated: true, hostname: "sitedesk-code", persistDir: "/Users/x/.sitedesk-code" }), "/Users/x/.sitedesk-code/neo4j");
 });
 test("linux shared and dedicated datadirs are unchanged", () => {
-    assert.equal(resolveNeo4jDataDir({ platform: "linux", brewPrefix: "", dedicated: false, hostname: "maxy-code" }), "/var/lib/neo4j");
-    assert.equal(resolveNeo4jDataDir({ platform: "linux", brewPrefix: "", dedicated: true, hostname: "realagent" }), "/var/lib/neo4j-realagent");
+    assert.equal(resolveNeo4jDataDir({ platform: "linux", brewPrefix: "", dedicated: false, hostname: "maxy-code", persistDir: "/root/.maxy-code" }), "/var/lib/neo4j");
+    assert.equal(resolveNeo4jDataDir({ platform: "linux", brewPrefix: "", dedicated: true, hostname: "realagent", persistDir: "/root/.realagent" }), "/var/lib/neo4j-realagent");
 });

package/dist/__tests__/neo4j-teardown.test.js

@@ -8,8 +8,24 @@
 // convention — see peer-brand-detect.test.ts).
 import test from "node:test";
 import assert from "node:assert/strict";
-import { resolveDedicatedNeo4jTeardown, SHARED_NEO4J_PORT } from "../neo4j-teardown.js";
+import { resolveDedicatedNeo4jTeardown, resolveDarwinDedicatedNeo4jTeardown, SHARED_NEO4J_PORT } from "../neo4j-teardown.js";
 const HOST = "sitedesk-code";
+test("darwin dedicated → label + plist + per-brand datadir", () => {
+    const plan = resolveDarwinDedicatedNeo4jTeardown({
+        brandHostname: "sitedesk-code", neo4jPort: 7689, home: "/Users/x", persistDir: "/Users/x/.sitedesk-code",
+    });
+    assert.deepEqual(plan, {
+        label: "com.rubytech.sitedesk-code-neo4j",
+        plistPath: "/Users/x/Library/LaunchAgents/com.rubytech.sitedesk-code-neo4j.plist",
+        dataDir: "/Users/x/.sitedesk-code/neo4j",
+    });
+});
+test("darwin teardown guards: shared 7687 / undefined / empty hostname → null", () => {
+    const base = { home: "/Users/x", persistDir: "/Users/x/.maxy-code" };
+    assert.equal(resolveDarwinDedicatedNeo4jTeardown({ brandHostname: "maxy-code", neo4jPort: 7687, ...base }), null);
+    assert.equal(resolveDarwinDedicatedNeo4jTeardown({ brandHostname: "maxy-code", neo4jPort: undefined, ...base }), null);
+    assert.equal(resolveDarwinDedicatedNeo4jTeardown({ brandHostname: "", neo4jPort: 7689, ...base }), null);
+});
 test("dedicated port → full teardown plan with install-parity names", () => {
     const plan = resolveDedicatedNeo4jTeardown({ brandHostname: HOST, neo4jPort: 7689 });
     assert.notEqual(plan, null);

package/dist/index.js

@@ -16,7 +16,8 @@ import { requireSupportedPlatform, detectPlatform } from "./platform-detect.js";
 import { decideClaudeUpgradePrivilege } from "./claude-upgrade-privilege.js";
 import { resolveNeo4jDataDir } from "./neo4j-datadir.js";
 import { protectCommands, unprotectCommands, lsattrShowsImmutable } from "./install-immutability.js";
-import { renderPlist, buildSessionManagerWrapper, buildHeartbeatWrapper } from "./launchd-plist.js";
+import { renderPlist, buildSessionManagerWrapper, buildHeartbeatWrapper, buildNeo4jWrapper } from "./launchd-plist.js";
+import { resolveDarwinDedicatedNeo4jPaths, resolveDarwinDedicatedNeo4jConfKeys } from "./neo4j-darwin-dedicated.js";
 import { bootstrapLaunchAgent } from "./launchd-bootstrap.js";
 import { enumerateClaudeCandidates, pickCanonicalClaude } from "./claude-bin.js";
 import { installAllBrewPackages } from "./brew-install.js";
@@ -1262,14 +1263,51 @@ function resetNeo4jAuth(port = DEFAULT_NEO4J_PORT, dataDir = "/var/lib/neo4j", p
         `${dataDir}/data/databases/system`,
         `${dataDir}/data/transactions/system`,
     ];
-    if (platform === "darwin") {
-        // Homebrew Neo4j runs under a user launchd agent (brew services) and its
-        // datadir is user-owned — no systemctl, no sudo. This branch handles the
-        // shared (default-brand) instance. Dedicated brands (realagent-code etc.)
-        // set NEO4J_DEDICATED, but their dedicated provisioning (setupDedicatedNeo4j)
-        // is Linux-only and aborts a dedicated-brand darwin install upstream, so a
-        // non-default port never reaches here — see Task 1396 for darwin dedicated
-        // support.
+    if (platform === "darwin" && dedicated) {
+        // Dedicated darwin brand: the per-brand launchd-supervised instance (Task
+        // 1396). No brew services (that is the shared instance) — bootout the
+        // brand's LaunchAgent, clear its auth db (clearPaths are rooted at the
+        // per-brand dataDir), re-seed the password against the per-brand NEO4J_CONF,
+        // and bootstrap the LaunchAgent back. The trailing bolt-port health loop
+        // below already targets `port`.
+        const brewPrefix = resolveBrewPrefix();
+        const persistDir = resolve(process.env.HOME ?? "/", BRAND.configDir);
+        const p = resolveDarwinDedicatedNeo4jPaths({ persistDir, brewPrefix });
+        const label = `${launchdLabel()}-neo4j`;
+        console.log("  Resetting dedicated Neo4j auth (launchd)...");
+        spawnSync("launchctl", ["bootout", `${gui()}/${label}`], { stdio: "pipe" });
+        // launchctl bootout returns once the job leaves the domain, but neo4j does a
+        // graceful multi-second store flush on SIGTERM — so the JVM can still hold
+        // the port (and the store) after bootout returns. Wait for the bolt port to
+        // free before clearing the auth db and re-seeding: set-initial-password only
+        // takes effect against a stopped store, and rm must not race a live flush.
+        // Unlike the Linux sibling's synchronous `systemctl stop`, darwin needs this
+        // explicit wait. Bounded — after 30s, proceed anyway (loud path continues to
+        // the health check below).
+        for (let i = 0; i < 15; i++) {
+            const c = spawnSync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN"], { stdio: "pipe", timeout: 5000 });
+            if (!(c.status === 0 && (c.stdout?.toString() ?? "").includes("LISTEN")))
+                break;
+            spawnSync("sleep", ["2"]);
+        }
+        spawnSync("rm", ["-rf", ...clearPaths], { stdio: "inherit" });
+        const setPw = spawnSync(p.neo4jAdminBin, ["dbms", "set-initial-password", "--", password], {
+            stdio: "inherit",
+            env: { ...process.env, NEO4J_CONF: p.confDir },
+        });
+        if (setPw.status !== 0) {
+            throw new Error(`neo4j-admin set-initial-password failed (exit ${setPw.status}) during dedicated darwin auth reset`);
+        }
+        const plistPath = join(launchAgentsDir(), `${label}.plist`);
+        const boot = bootstrapLaunchAgent((a) => { const r = spawnSync("launchctl", a, { stdio: "pipe", encoding: "utf-8", timeout: 15_000 }); return { status: r.status, stderr: (r.stderr ?? "").toString() }; }, { gui: gui(), label, plistPath, logger: (l) => { console.log(`  ${l}`); logFile(`  ${l}`); } });
+        if (!boot.ok) {
+            throw new Error(`launchctl bootstrap ${label} failed (exit ${boot.bootstrapStatus}) after ${boot.attempts} attempt(s) during dedicated darwin auth reset: ${boot.stderr}`);
+        }
+        logFile(`  [neo4j-darwin-auth-reset] dedicated datadir=${dataDir} conf=${p.confDir} label=${label}`);
+    }
+    else if (platform === "darwin") {
+        // Shared (default-brand) darwin instance under brew services — user-owned
+        // datadir, no systemctl, no sudo.
         console.log("  Resetting Neo4j auth with fresh password (brew services)...");
         spawnSync("brew", ["services", "stop", "neo4j"], { stdio: "inherit" });
         spawnSync("rm", ["-rf", ...clearPaths], { stdio: "inherit" });
@@ -1351,6 +1389,7 @@ function ensureNeo4jPassword() {
         brewPrefix: platform === "darwin" ? resolveBrewPrefix() : "",
         dedicated: NEO4J_DEDICATED,
         hostname: BRAND.hostname,
+        persistDir,
     });
     logFile(`[create-maxy] neo4j-datadir=${dataDir} platform=${platform}`);
     // 1. Same-brand check: if our own password file exists and works, done (upgrade path).
@@ -1408,6 +1447,16 @@ function installNeo4j() {
         // step ends after `brew install neo4j` + initial-password seeding so the
         // payload deploy step finds the shared password file.
         installAllBrewPackages(["neo4j"], logFile);
+        if (NEO4J_DEDICATED) {
+            // Dedicated brands get their own launchd-supervised instance in
+            // setupDedicatedNeo4j() (darwin branch, next in the pipeline). Do NOT seed
+            // or start the shared brew instance here — that would bind a pointless
+            // 7687 and seed a shared password the dedicated path never uses. The brew
+            // binary install above is all a dedicated brand needs from this step.
+            logFile("  [neo4j-darwin] dedicated brand — brew binary installed; dedicated instance provisioned in setupDedicatedNeo4j()");
+            console.log("  Neo4j installed (Homebrew). Dedicated instance will be provisioned next.");
+            return;
+        }
         // Generate strong random password — stored in persistent location (~/{configDir}/)
         const password = randomBytes(24).toString("base64url");
         const persistDir = resolve(process.env.HOME ?? "/root", BRAND.configDir);
@@ -1510,6 +1559,124 @@ function peerBrandUsingSystemUnit() {
         peerEnvContents,
     });
 }
+/**
+ * Darwin dedicated Neo4j (Task 1396): a per-brand launchd-supervised instance
+ * sharing the brew neo4j binary, isolated under `~/.<brand>/neo4j/`. Proven
+ * approach — the brew `neo4j` wrapper force-sets NEO4J_HOME, so isolation is
+ * driven entirely by a per-brand NEO4J_CONF whose server.directories.* are all
+ * absolute (including run, which keeps this instance's pidfile off the shared
+ * one). Copies the brew default conf, delete-then-appends the per-brand keys
+ * (verifying exactly one active line each, the same guard as the Linux path),
+ * seeds the password on first install, writes + bootstraps the LaunchAgent, and
+ * health-checks the brand's bolt port. Idempotent: reruns re-apply conf state and
+ * re-bootstrap without rotating an existing password. Never touches the shared
+ * brew instance on 7687.
+ */
+function setupDedicatedNeo4jDarwin() {
+    const brewPrefix = resolveBrewPrefix();
+    const persistDir = resolve(process.env.HOME ?? "/", BRAND.configDir);
+    const p = resolveDarwinDedicatedNeo4jPaths({ persistDir, brewPrefix });
+    const label = `${launchdLabel()}-neo4j`;
+    const confPath = `${p.confDir}/neo4j.conf`;
+    const confExists = existsSync(confPath);
+    for (const dir of [p.dataDir, p.logsDir, p.runDir, p.pluginsDir, p.importDir, p.confDir]) {
+        mkdirSync(dir, { recursive: true });
+    }
+    if (!confExists) {
+        console.log(`  Setting up dedicated Neo4j for ${BRAND.productName} on bolt://localhost:${NEO4J_PORT}...`);
+        if (!existsSync(p.srcConfDir)) {
+            throw new Error(`Brew Neo4j default conf not found at ${p.srcConfDir}. Is Neo4j installed via Homebrew?`);
+        }
+        // Seed the per-brand conf from the brew default (neo4j.conf + the logs xml).
+        cpSync(p.srcConfDir, p.confDir, { recursive: true });
+    }
+    else {
+        console.log(`  Dedicated Neo4j for ${BRAND.productName} already configured at ${p.confDir} — re-applying per-brand state`);
+    }
+    // Delete-then-append each per-brand key. The brew default ships some directory
+    // keys twice (a commented default plus an active /usr/local/var line), so
+    // delete-all-then-append guarantees exactly one active line. BSD sed needs the
+    // empty in-place suffix argument (`-i ''`).
+    const keys = resolveDarwinDedicatedNeo4jConfKeys({
+        port: NEO4J_PORT, dataDir: p.dataDir, logsDir: p.logsDir, runDir: p.runDir, pluginsDir: p.pluginsDir, importDir: p.importDir,
+    });
+    for (const [key, value] of keys) {
+        const keyRe = key.replace(/\./g, "\\.");
+        spawnSync("sed", ["-i", "", `/^#\\{0,1\\}${keyRe}=/d`, confPath], { stdio: "inherit" });
+        appendFileSync(confPath, `${key}=${value}\n`);
+    }
+    // Verify exactly one active line per key — n!=1 aborts BEFORE bootstrap.
+    const activeCounts = [];
+    for (const [key] of keys) {
+        const r = spawnSync("grep", ["-c", `^${key}=`, confPath], { stdio: "pipe" });
+        const n = parseInt((r.stdout?.toString() ?? "0").trim(), 10) || 0;
+        activeCounts.push(`${key}:${n}`);
+        if (n !== 1) {
+            const msg = `[neo4j-conf] FATAL ${key} active_count=${n} in ${confPath}`;
+            console.error(`  ${msg}`);
+            logFile(`  ${msg}`);
+            throw new Error(msg);
+        }
+    }
+    logFile(`  [neo4j-conf] keys_active=${activeCounts.join(",")}`);
+    if (!confExists) {
+        // Set the initial password before first start (first install only — rotating
+        // on a rerun would brick an existing DB whose password is already stored).
+        const password = randomBytes(24).toString("base64url");
+        mkdirSync(persistDir, { recursive: true });
+        writeFileSync(join(persistDir, ".neo4j-password"), password, { mode: 0o600 });
+        const cfgDir = resolve(INSTALL_DIR, "platform/config");
+        mkdirSync(cfgDir, { recursive: true });
+        writeFileSync(join(cfgDir, ".neo4j-password"), password, { mode: 0o600 });
+        const setPw = spawnSync(p.neo4jAdminBin, ["dbms", "set-initial-password", "--", password], {
+            stdio: "inherit",
+            env: { ...process.env, NEO4J_CONF: p.confDir },
+        });
+        if (setPw.status !== 0) {
+            throw new Error(`neo4j-admin set-initial-password failed (exit ${setPw.status}) for dedicated darwin instance`);
+        }
+    }
+    // Write the wrapper + plist and bootstrap the LaunchAgent (bounded retry on the
+    // transient launchctl EIO, same helper installServiceDarwin uses).
+    const wrapperPath = join(persistDir, "neo4j-wrapper.sh");
+    writeFileSync(wrapperPath, buildNeo4jWrapper({ confDir: p.confDir, brewPrefix }));
+    chmodSync(wrapperPath, 0o755);
+    const plist = renderPlist({
+        label,
+        programArguments: ["/bin/bash", wrapperPath],
+        stdoutPath: `${p.logsDir}/neo4j-console.log`,
+        stderrPath: `${p.logsDir}/neo4j-console.log`,
+        keepAlive: true,
+        runAtLoad: true,
+        workingDirectory: p.home,
+    });
+    mkdirSync(launchAgentsDir(), { recursive: true });
+    const plistPath = join(launchAgentsDir(), `${label}.plist`);
+    writeFileSync(plistPath, plist);
+    logFile(`  ${plistPath} written (${plist.length} bytes)`);
+    const boot = bootstrapLaunchAgent((a) => { const r = spawnSync("launchctl", a, { stdio: "pipe", encoding: "utf-8", timeout: 15_000 }); return { status: r.status, stderr: (r.stderr ?? "").toString() }; }, { gui: gui(), label, plistPath, logger: (l) => { console.log(`  ${l}`); logFile(`  ${l}`); } });
+    if (!boot.ok) {
+        throw new Error(`launchctl bootstrap ${label} failed (exit ${boot.bootstrapStatus}) after ${boot.attempts} attempt(s): ${boot.stderr}`);
+    }
+    // Health-check the brand's bolt port — loud failure, no silent fallback to the
+    // shared instance (matches the Linux dedicated bind check).
+    console.log(`  Waiting for dedicated Neo4j on port ${NEO4J_PORT}...`);
+    let up = false;
+    for (let i = 0; i < 20; i++) {
+        const c = spawnSync("lsof", ["-nP", `-iTCP:${NEO4J_PORT}`, "-sTCP:LISTEN"], { stdio: "pipe", timeout: 5000 });
+        if (c.status === 0 && (c.stdout?.toString() ?? "").includes("LISTEN")) {
+            up = true;
+            break;
+        }
+        spawnSync("sleep", ["2"]);
+    }
+    if (!up) {
+        logFile(`  Neo4j dedicated (darwin): failed to bind port ${NEO4J_PORT}`);
+        throw new Error(`Dedicated Neo4j ${label} did not bind bolt://localhost:${NEO4J_PORT} within 40s. Check ${p.logsDir}/neo4j-console.log`);
+    }
+    logFile(`  Neo4j dedicated (darwin): conf=${p.confDir} data=${p.dataDir} label=${label} bolt=:${NEO4J_PORT}`);
+    console.log(`  Dedicated Neo4j ready on bolt://localhost:${NEO4J_PORT}`);
+}
 /**
  * Create a dedicated Neo4j instance for this brand when NEO4J_DEDICATED is true.
  * Produces: separate config dir, data dir, log dir, systemd service, and password.
@@ -1526,6 +1693,13 @@ function peerBrandUsingSystemUnit() {
 function setupDedicatedNeo4j() {
     if (!NEO4J_DEDICATED)
         return;
+    // darwin has no systemd/apt neo4j — provision a per-brand launchd-supervised
+    // instance instead (Task 1396). Linux falls through to the systemd body below.
+    const platform = requireSupportedPlatform(process.platform);
+    if (platform === "darwin") {
+        setupDedicatedNeo4jDarwin();
+        return;
+    }
     const brandSuffix = BRAND.hostname; // e.g., "realagent"
     const confDir = `/etc/neo4j-${brandSuffix}`;
     const dataDir = `/var/lib/neo4j-${brandSuffix}`;

package/dist/launchd-plist.js

@@ -75,6 +75,27 @@ export function buildHeartbeatWrapper(o) {
         "",
     ].join("\n");
 }
+/**
+ * Bash wrapper for the darwin dedicated-Neo4j LaunchAgent (Task 1396). The
+ * launchd analogue of the Linux dedicated neo4j systemd unit. The brew `neo4j`
+ * wrapper force-sets NEO4J_HOME to the Cellar, so per-brand isolation is driven
+ * entirely by NEO4J_CONF — the per-brand conf's absolute server.directories.*
+ * (including run) keep the data and pidfile off the shared instance. PATH gets
+ * the brew prefix bins so the neo4j launcher's `java` resolves under the bare
+ * launchd PATH.
+ */
+export function buildNeo4jWrapper(o) {
+    return [
+        "#!/bin/bash",
+        "# generated by create-maxy setupDedicatedNeo4jDarwin().",
+        "# Exports NEO4J_CONF (per-brand conf → isolated data/run) and prepends the",
+        "# brew prefix bins so java resolves, then execs the brew-wrapped neo4j.",
+        `export NEO4J_CONF="${o.confDir}"`,
+        `export PATH="${o.brewPrefix}/bin:${o.brewPrefix}/sbin:$PATH"`,
+        `exec ${o.brewPrefix}/bin/neo4j console`,
+        "",
+    ].join("\n");
+}
 export function renderPlist(spec) {
     const lines = [];
     lines.push(`<?xml version="1.0" encoding="UTF-8"?>`);

package/dist/neo4j-darwin-dedicated.js

@@ -0,0 +1,39 @@
+// Pure path + conf-key resolution for the darwin dedicated Neo4j instance
+// (Task 1396). No fs, no spawn — the caller (setupDedicatedNeo4jDarwin in
+// index.ts) wraps these with mkdir/cp/sed/launchctl. Mirrors neo4j-datadir.ts /
+// launchd-plist.ts: inputs in, decision out.
+//
+// The darwin dedicated instance shares the brew neo4j binary but is isolated by
+// a per-brand NEO4J_CONF whose server.directories.* are ALL absolute (including
+// run, so its pidfile never collides with the shared instance — the brew wrapper
+// force-sets NEO4J_HOME, so the Linux NEO4J_HOME trick is unavailable here).
+export function resolveDarwinDedicatedNeo4jPaths(input) {
+    const home = `${input.persistDir}/neo4j`;
+    return {
+        home,
+        dataDir: `${home}/data`,
+        confDir: `${home}/conf`,
+        logsDir: `${home}/logs`,
+        runDir: `${home}/run`,
+        pluginsDir: `${home}/plugins`,
+        importDir: `${home}/import`,
+        srcConfDir: `${input.brewPrefix}/opt/neo4j/libexec/conf`,
+        neo4jBin: `${input.brewPrefix}/bin/neo4j`,
+        neo4jAdminBin: `${input.brewPrefix}/bin/neo4j-admin`,
+    };
+}
+/** The conf keys to delete-then-append into the per-brand neo4j.conf. Order is
+ *  stable for grep-ability. httpPort = port - 213 preserves the 7687/7474 offset
+ *  (matching the Linux dedicated path). */
+export function resolveDarwinDedicatedNeo4jConfKeys(input) {
+    const httpPort = input.port - 213;
+    return [
+        ["server.bolt.listen_address", `:${input.port}`],
+        ["server.http.listen_address", `:${httpPort}`],
+        ["server.directories.data", input.dataDir],
+        ["server.directories.logs", input.logsDir],
+        ["server.directories.run", input.runDir],
+        ["server.directories.plugins", input.pluginsDir],
+        ["server.directories.import", input.importDir],
+    ];
+}

package/dist/neo4j-datadir.js

@@ -2,14 +2,18 @@
 // No spawnSync, no fs — the caller injects the brew prefix (from `brew --prefix`)
 // on darwin. Peer of the other install decision helpers.
 //
-// darwin: Homebrew installs Neo4j's datadir at `<brew prefix>/var/neo4j`
-//   (/usr/local on Intel, /opt/homebrew on Apple Silicon), user-owned. Only the
-//   shared instance exists on darwin — dedicated (systemd) instances are Linux
-//   only — so `dedicated` is not consulted here.
+// darwin shared: Homebrew installs Neo4j's datadir at `<brew prefix>/var/neo4j`
+//   (/usr/local on Intel, /opt/homebrew on Apple Silicon), user-owned.
+// darwin dedicated: a per-brand launchd-supervised instance isolated under the
+//   brand persist tree at `<persistDir>/neo4j` (Task 1396). The brew `neo4j`
+//   wrapper force-sets NEO4J_HOME, so isolation is driven by a per-brand
+//   NEO4J_CONF with absolute server.directories.*; this root is the data home
+//   that the conf's `server.directories.data=<root>/data` and resetNeo4jAuth's
+//   `${root}/data/...` clear paths both derive from.
 // linux: /var/lib/neo4j (shared) or /var/lib/neo4j-<hostname> (dedicated).
 export function resolveNeo4jDataDir(input) {
     if (input.platform === "darwin") {
-        return `${input.brewPrefix}/var/neo4j`;
+        return input.dedicated ? `${input.persistDir}/neo4j` : `${input.brewPrefix}/var/neo4j`;
     }
     return input.dedicated ? `/var/lib/neo4j-${input.hostname}` : "/var/lib/neo4j";
 }

package/dist/neo4j-teardown.js

@@ -43,3 +43,18 @@ export function resolveDedicatedNeo4jTeardown(args) {
         logDir: `/var/log/neo4j-${brandHostname}`,
     };
 }
+export function resolveDarwinDedicatedNeo4jTeardown(args) {
+    const { brandHostname, neo4jPort, home, persistDir } = args;
+    if (neo4jPort === undefined)
+        return null;
+    if (neo4jPort === SHARED_NEO4J_PORT)
+        return null;
+    if (!brandHostname)
+        return null;
+    const label = `com.rubytech.${brandHostname}-neo4j`;
+    return {
+        label,
+        plistPath: `${home}/Library/LaunchAgents/${label}.plist`,
+        dataDir: `${persistDir}/neo4j`,
+    };
+}

package/dist/uninstall.js

@@ -5,7 +5,7 @@ import { homedir } from "node:os";
 import { createInterface } from "node:readline";
 import { removeBrandStanza, hasAnyBrandStanza } from "./samba-provision.js";
 import { stripCronBlock } from "./cron-registration.js";
-import { resolveDedicatedNeo4jTeardown } from "./neo4j-teardown.js";
+import { resolveDedicatedNeo4jTeardown, resolveDarwinDedicatedNeo4jTeardown, SHARED_NEO4J_PORT } from "./neo4j-teardown.js";
 import { KNOWN_BRAND_HOSTNAMES } from "./known-brands.js";
 const HOME = homedir();
 const PAYLOAD_DIR = resolve(import.meta.dirname, "../payload");
@@ -80,13 +80,18 @@ function launchdLabel() {
 }
 /** Every LaunchAgent label installServiceDarwin() creates for this brand: the
  *  main server, the claude-session-manager (Task 1395), and the scheduling
- *  heartbeat (Task 1403). Uninstall boots out and removes all three. */
+ *  heartbeat (Task 1403). A non-default (dedicated) brand also runs the
+ *  per-brand Neo4j LaunchAgent (Task 1396). Uninstall boots out and removes all. */
 function darwinLaunchdLabels() {
-    return [
+    const labels = [
         launchdLabel(),
         `${launchdLabel()}-claude-session-manager`,
         `${launchdLabel()}-heartbeat`,
     ];
+    if ((BRAND.neo4jPort ?? SHARED_NEO4J_PORT) !== SHARED_NEO4J_PORT) {
+        labels.push(`${launchdLabel()}-neo4j`);
+    }
+    return labels;
 }
 function plistPathFor(label) {
     return resolve(HOME, "Library/LaunchAgents", `${label}.plist`);
@@ -483,12 +488,33 @@ function removeAppDirs() {
 // ---------------------------------------------------------------------------
 function removeNeo4jData() {
     log("5", "Removing Neo4j data...");
-    // This function's teardown is Linux-shaped: `sudo systemctl daemon-reload`
-    // and `sudo rm -rf /var/lib/neo4j/*`. On darwin that raises a spurious sudo
-    // prompt and logs a FAILED. Skip here (Task 1403); darwin Neo4j data teardown
-    // belongs to Task 1396 (dedicated Neo4j on darwin).
+    // darwin: a dedicated brand's Neo4j is a per-brand launchd instance under
+    // ~/.<brand>/neo4j (Task 1396). Its LaunchAgent was already booted out in
+    // stopServices() via darwinLaunchdLabels(); here we remove the plist and the
+    // per-brand home. Never touch the shared brew instance under
+    // <brewPrefix>/var/neo4j — the teardown resolver returns null for a shared
+    // (7687), unreadable, or hostname-less brand.
+    if (isDarwin()) {
+        const plan = resolveDarwinDedicatedNeo4jTeardown({
+            brandHostname: BRAND.hostname,
+            neo4jPort: readNeo4jPortFromEnv() ?? BRAND.neo4jPort,
+            home: HOME,
+            persistDir: resolve(HOME, BRAND.configDir),
+        });
+        if (plan) {
+            rmSync(plan.plistPath, { force: true });
+            rmSync(plan.dataDir, { recursive: true, force: true });
+            console.log(`  Removed dedicated Neo4j (${plan.label}) + datadir`);
+        }
+        else {
+            console.log("  Neo4j: shared instance — left in place.");
+        }
+        return;
+    }
+    // Linux teardown below is systemd-shaped (`sudo systemctl daemon-reload`,
+    // `sudo rm -rf /var/lib/neo4j*`).
     if (!isLinux()) {
-        console.log("  Not Linux — skipping.");
+        console.log("  Unsupported platform — skipping.");
         return;
     }
     // Brand isolation: remove only THIS brand's Neo4j data. Shared

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.404",
+  "version": "0.1.406",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/skills/platform-architecture/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: platform-architecture
 description: Use when grounding any documented-surface claim about what Maxy ships — plugins, skills, specialists, install/deploy flows, internals. This is the install catalogue, not evidence of what is enabled on the current account. For install state on this account, call `capabilities-here`; for documented surface, cite the `Source:` URL inline.
-content-hash: sha256:55075f40e6c0ae401f2b98548b0e707b2274f48553193c33a96fd2bd9a2e231b
+content-hash: sha256:69d2ec47598e75fac6f763994a077fd39ccda77767ddb90404dac2d556f5791c
 brand: maxy-code
 product-name: Maxy
 ---
@@ -605,7 +605,7 @@ To run, for example, `realagent-code` alongside the default install, repeat step
 npx -y @rubytech/create-realagent-code@latest
 ```
 
-The persist directory becomes `$HOME/.realagent-code`, the LaunchAgent becomes `com.rubytech.realagent-code`, and the admin URL switches to `http://realagent-code.local:<port>`. Every brand has its own isolated tree — there is no shared state, and `CLAUDE_CONFIG_DIR` is always `$HOME/.<brand>/.claude` for that brand, never the default `~/.claude`.
+The persist directory becomes `$HOME/.realagent-code`, the LaunchAgent becomes `com.rubytech.realagent-code`, and the admin URL switches to `http://realagent-code.local:<port>`. Because a non-default brand runs its own Neo4j on a dedicated bolt port (`realagent-code` → 7688, `sitedesk-code` → 7689; the default `maxy-code` keeps 7687), the installer provisions a second, isolated Neo4j supervised by its own LaunchAgent `com.rubytech.realagent-code-neo4j`, with data under `$HOME/.realagent-code/neo4j/`. That instance shares the Homebrew `neo4j` binary but reads a per-brand config, so the default brand's shared Neo4j on 7687 is left untouched. Every brand has its own isolated tree — there is no shared state, and `CLAUDE_CONFIG_DIR` is always `$HOME/.<brand>/.claude` for that brand, never the default `~/.claude`.
 
 ## 3. Confirm the LaunchAgent is up
 

package/payload/platform/plugins/scheduling/PLUGIN.md

@@ -129,6 +129,8 @@ An `action` invokes one pre-encoded MCP tool with no reasoning. When a due event
 
 An event carries **either** an `action` **or** an `agentDispatch`, never both — setting one clears the other. Agent dispatch is stored as `agentChannel`, `agentDestination`, `agentPrompt`. Use `schedule-update` with `agentDispatch` to modify or `agentDispatch: null` to clear. On WhatsApp, a destination bound as an account-manager scopes the spawned session to its sub-account; on Telegram the session runs on the house account.
 
+A WhatsApp `agentDispatch` destination may therefore be an account manager, not only an admin phone — this is the supported way to send a manager a proactive or scheduled WhatsApp message. The reply is delivered over the house's paired line regardless of which sub-account the session is scoped to; socket ownership never restricts which number the dispatch can reach.
+
 Dispatch results are recorded on the Event node (`lastDispatchResult`, `lastDispatchAt`) exactly as for tool actions. Every heartbeat tick also audits stored agent dispatches and logs `[schedule-audit] op=stale-dispatch` for any whose destination has stopped being an admin or whose bound sub-account is gone, so a binding that rots between scheduling and firing is surfaced before it mis-dispatches.
 
 ## Reconciling public bookings (D1 → graph)

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/agent-dispatch-manager-grounding.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-dispatch-manager-grounding.test.d.ts.map

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/agent-dispatch-manager-grounding.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-dispatch-manager-grounding.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/agent-dispatch-manager-grounding.test.ts"],"names":[],"mappings":""}

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/agent-dispatch-manager-grounding.test.js

@@ -0,0 +1,19 @@
+// Task 1435 — content-presence gate for the scheduling side of the WhatsApp
+// deliverability grounding. `isValidAgentDestination` accepts an account
+// manager (adminPhones OR accountManagers), so scheduled dispatch is the
+// supported way to reach a manager. PLUGIN.md must say so plainly, and deliver-
+// over-the-house-line must be stated, so the agent cites it instead of inventing
+// a line-ownership restriction. Mirrors time-resolve-description.test.ts.
+import { describe, it, expect } from "vitest";
+import { readFileSync } from "fs";
+import { resolve } from "path";
+const PLUGIN = readFileSync(resolve(__dirname, "../../../PLUGIN.md"), "utf8");
+describe("agent-dispatch account-manager grounding", () => {
+    it("PLUGIN.md states a WhatsApp dispatch destination may be an account manager", () => {
+        expect(PLUGIN).toContain("A WhatsApp `agentDispatch` destination may therefore be an account manager");
+    });
+    it("PLUGIN.md states delivery is over the house line regardless of scope", () => {
+        expect(PLUGIN).toContain("socket ownership never restricts which number the dispatch can reach");
+    });
+});
+//# sourceMappingURL=agent-dispatch-manager-grounding.test.js.map

package/payload/platform/plugins/scheduling/mcp/dist/__tests__/agent-dispatch-manager-grounding.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-dispatch-manager-grounding.test.js","sourceRoot":"","sources":["../../src/__tests__/agent-dispatch-manager-grounding.test.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,gFAAgF;AAChF,iFAAiF;AACjF,0EAA0E;AAC1E,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAE/B,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,EAAE,MAAM,CAAC,CAAC;AAE9E,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,4EAA4E,CAC7E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CACtB,sEAAsE,CACvE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/payload/platform/plugins/whatsapp/mcp/dist/__tests__/deliverability-grounding.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deliverability-grounding.test.d.ts.map

package/payload/platform/plugins/whatsapp/mcp/dist/__tests__/deliverability-grounding.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliverability-grounding.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/deliverability-grounding.test.ts"],"names":[],"mappings":""}