@rubytech/create-maxy-code 0.1.437 → 0.1.439

package/payload/platform/services/claude-session-manager/dist/redundant-operator-seat-audit.js

@@ -0,0 +1,127 @@
+// Task 1568 — standing redundant-operator-seat audit. A role:"client" sub-account
+// carries exactly one identity node, its business owner (AdminUser{role:'owner'}).
+// Any other AdminUser{accountId} on a client account is a redundant operator seat:
+// since Task 999 admin access is install-wide, so the seat grants nothing an
+// install-wide admin does not already have, and it fragments identity. admin-add
+// no longer creates one going forward; this periodic read is the only signal for
+// seats persisted before that fix, because a redundant seat emits no error and
+// does not reproduce on demand. Detector only — removal is a deliberate
+// remediation (Task 1569), never an automatic timer-driven delete.
+//
+// admin-add seats carry no au.role (role 'admin' lives on the ADMIN_OF edge), so
+// the predicate is not-the-owner rather than a role:'admin' match. Best-effort by
+// construction: a Neo4j-unreachable read logs `op=unavailable` rather than
+// crashing the manager (Neo4j may not be up at boot). Shape mirrors
+// rootless-client-audit.ts: a pure predicate + formatter (unit-tested) + an
+// impure collector + a start/stop factory whose setInterval is unref'd.
+import neo4j from 'neo4j-driver';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+const TAG = '[identity-audit]';
+/** The redundant-seat invariant, read side: an AdminUser on a client account is a
+ *  redundant operator seat unless it is the owner. admin-add seats carry no
+ *  au.role, so the predicate is not-the-owner, never a role:'admin' match. */
+export function isRedundantOperatorSeat(role) {
+    return (role ?? '').trim() !== 'owner';
+}
+/** One alarm line per flagged seat; ids truncated to 8 for readability. */
+export function formatRedundantSeatLine(f) {
+    return `${TAG} op=redundant-operator-seat account=${f.accountId.slice(0, 8)} adminUserId=${f.adminUserId.slice(0, 8)}`;
+}
+/** Return every non-owner AdminUser seated on the given client accounts. One
+ *  round-trip: the cypher returns all AdminUser{accountId} rows for the client
+ *  ids and the not-owner filter is applied in JS (same predicate the audit
+ *  exposes). Empty input issues no query. */
+export async function auditRedundantOperatorSeats(session, clientIds) {
+    if (clientIds.length === 0)
+        return [];
+    const res = await session.run(`UNWIND $ids AS id
+     MATCH (au:AdminUser {accountId: id})
+     RETURN id AS accountId, coalesce(au.userId, '') AS adminUserId, au.role AS role`, { ids: clientIds });
+    const findings = [];
+    for (const rec of res.records) {
+        if (isRedundantOperatorSeat(rec.get('role'))) {
+            findings.push({
+                accountId: String(rec.get('accountId')),
+                adminUserId: String(rec.get('adminUserId')),
+            });
+        }
+    }
+    return findings;
+}
+/** Enumerate role:"client" accountIds under the accounts root (filesystem). */
+function clientAccountIds(accountsRoot) {
+    let entries;
+    try {
+        entries = readdirSync(accountsRoot);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const entry of entries) {
+        const cfgPath = join(accountsRoot, entry, 'account.json');
+        if (!existsSync(cfgPath))
+            continue;
+        try {
+            const cfg = JSON.parse(readFileSync(cfgPath, 'utf-8'));
+            if (cfg.role === 'client')
+                out.push(entry);
+        }
+        catch {
+            // unparseable account.json — excluded
+        }
+    }
+    return out;
+}
+/** Run one audit pass and log an alarm line per flagged seat. Best-effort Neo4j:
+ *  absent env or an unreachable/erroring read logs `op=unavailable` and never
+ *  throws. A clean pass logs a single `op=ok` line so the audit's own liveness is
+ *  visible. */
+export async function emitRedundantOperatorSeatAudit(deps) {
+    if (!deps.neo4jUri || !deps.neo4jPassword) {
+        deps.logger(`${TAG} op=unavailable reason=no-neo4j-env`);
+        return;
+    }
+    const driver = neo4j.driver(deps.neo4jUri, neo4j.auth.basic(deps.neo4jUser, deps.neo4jPassword));
+    const session = driver.session();
+    try {
+        const findings = await auditRedundantOperatorSeats(session, clientAccountIds(deps.accountsRoot));
+        if (findings.length === 0) {
+            deps.logger(`${TAG} op=ok redundant-operator-seats=0`);
+            return;
+        }
+        for (const f of findings)
+            deps.logger(formatRedundantSeatLine(f));
+    }
+    catch (err) {
+        deps.logger(`${TAG} op=unavailable reason=${err instanceof Error ? err.message : String(err)}`);
+    }
+    finally {
+        await session.close();
+        await driver.close();
+    }
+}
+/** Standing periodic audit. Unref'd interval so it never holds the process open;
+ *  each tick re-emits best-effort. */
+export function createRedundantOperatorSeatAudit(deps) {
+    let timer = null;
+    return {
+        start() {
+            if (timer)
+                return;
+            timer = setInterval(() => {
+                void emitRedundantOperatorSeatAudit(deps);
+            }, deps.intervalMs);
+            if (typeof timer.unref === 'function')
+                timer.unref();
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=redundant-operator-seat-audit.js.map

package/payload/platform/services/claude-session-manager/dist/redundant-operator-seat-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redundant-operator-seat-audit.js","sourceRoot":"","sources":["../src/redundant-operator-seat-audit.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,6EAA6E;AAC7E,iFAAiF;AACjF,iFAAiF;AACjF,+EAA+E;AAC/E,wEAAwE;AACxE,mEAAmE;AACnE,EAAE;AACF,iFAAiF;AACjF,kFAAkF;AAClF,2EAA2E;AAC3E,oEAAoE;AACpE,4EAA4E;AAC5E,wEAAwE;AAExE,OAAO,KAAK,MAAM,cAAc,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,GAAG,GAAG,kBAAkB,CAAA;AAc9B;;8EAE8E;AAC9E,MAAM,UAAU,uBAAuB,CAAC,IAAmB;IACzD,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO,CAAA;AACxC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,CAAuB;IAC7D,OAAO,GAAG,GAAG,uCAAuC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;AACxH,CAAC;AAED;;;6CAG6C;AAC7C,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAyB,EACzB,SAAmB;IAEnB,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACrC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3B;;qFAEiF,EACjF,EAAE,GAAG,EAAE,SAAS,EAAE,CACnB,CAAA;IACD,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAkB,CAAC,EAAE,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC;gBACZ,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACvC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;aAC5C,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,CAAC,CAAA;QACzD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAQ;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAuB,CAAA;YAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAUD;;;eAGe;AACf,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,IAA4B;IAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,qCAAqC,CAAC,CAAA;QACxD,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAA;IAChG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;QAChG,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,mCAAmC,CAAC,CAAA;YACtD,OAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAA;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA;QACrB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;AACH,CAAC;AAOD;sCACsC;AACtC,MAAM,UAAU,gCAAgC,CAC9C,IAAqD;IAErD,IAAI,KAAK,GAA0B,IAAI,CAAA;IACvC,OAAO;QACL,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,KAAK,8BAA8B,CAAC,IAAI,CAAC,CAAA;YAC3C,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;QACtD,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/tool-registration-drift.d.ts

@@ -0,0 +1,57 @@
+export type ToolRegistrationDriftReason = 'not-installed' | 'no-mcpServers-manifest' | 'dist-missing';
+/** The generated-manifest disposition of one tool-plugin on disk. A tool-plugin
+ *  declares tools and ships an mcp/ directory (an mcpServers descriptor in the
+ *  tool surface) — the plugins whose server must mount for their tools to be
+ *  callable, whether admin- or specialist-facing. */
+export interface ToolPluginManifestState {
+    manifestPresent: boolean;
+    hasMcpServers: boolean;
+    distPresent: boolean;
+}
+export interface ToolRegistrationDriftDefect {
+    accountId: string;
+    /** Tool-plugin dir name as it appears in account.json enabledPlugins. */
+    plugin: string;
+    /** The MCP server the mounted plugin would expose (== plugin dir name). */
+    expectedServer: string;
+    reason: ToolRegistrationDriftReason;
+}
+export interface ToolRegistrationDriftResult {
+    ok: boolean;
+    defects: ToolRegistrationDriftDefect[];
+    /** Count of (account, tool-plugin) pairs checked. */
+    inspected: number;
+}
+/** Classify one tool-plugin's manifest state into a drift reason, or null when
+ *  the server would mount (manifest present, carries mcpServers, dist on disk). */
+export declare function classifyToolRegistration(state: ToolPluginManifestState): ToolRegistrationDriftReason | null;
+/** Cross-check each account's enabled tool-plugins against their generated
+ *  manifests. `toolPlugins` maps a tool-plugin dir name to its on-disk manifest
+ *  state; an enabledPlugins entry absent from that map is not a tool-plugin
+ *  (platform non-tool plugin, skill-only premium sub, leaked foreign sub) and is
+ *  out of scope here. */
+export declare function assertToolRegistrationDrift(accounts: ReadonlyArray<{
+    accountId: string;
+    enabledPlugins: readonly string[];
+}>, toolPlugins: ReadonlyMap<string, ToolPluginManifestState>): ToolRegistrationDriftResult;
+/** Index plugin dirs across the roots, keyed by dir basename — the same key
+ *  loadToolSurface and account.json enabledPlugins use. Platform plugins live at
+ *  `<root>/<name>`; premium subs at `<premiumRoot>/<bundle>/plugins/<sub>`;
+ *  standalone premium bundles at `<premiumRoot>/<bundle>`. */
+export declare function indexPluginDirs(pluginRoots: readonly string[]): Map<string, string>;
+/** Read the generated-manifest state of every named tool-plugin. A name with no
+ *  dir on disk is reported as manifestPresent:false (→ not-installed), so a
+ *  tool-plugin that vanished from disk is still surfaced rather than skipped. A
+ *  present-but-corrupt manifest reads as manifestPresent:true, hasMcpServers:
+ *  false (→ no-mcpServers-manifest).
+ *
+ *  A tool-plugin whose `mcp:` server is a shared `platform/lib/<name>` binary
+ *  rather than a plugin-local `mcp/` dir (e.g. `graph`, served by
+ *  `platform/lib/graph-mcp`) is EXCLUDED from the result — the manifest
+ *  generator only emits `mcpServers` for plugins that ship a plugin-local `mcp/`
+ *  (its `hasMcp` predicate), so a shared-lib plugin's generated manifest carries
+ *  no `mcpServers` by architecture, not by a `skip` flag. Judging it by the
+ *  generated-manifest criterion would false-FATAL on every boot. This mirrors
+ *  the generator's `hasMcp` check exactly. */
+export declare function readToolPluginManifestStates(pluginRoots: readonly string[], toolPluginNames: Iterable<string>): Map<string, ToolPluginManifestState>;
+//# sourceMappingURL=tool-registration-drift.d.ts.map

package/payload/platform/services/claude-session-manager/dist/tool-registration-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registration-drift.d.ts","sourceRoot":"","sources":["../src/tool-registration-drift.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,2BAA2B,GACnC,eAAe,GACf,wBAAwB,GACxB,cAAc,CAAA;AAElB;;;qDAGqD;AACrD,MAAM,WAAW,uBAAuB;IACtC,eAAe,EAAE,OAAO,CAAA;IACxB,aAAa,EAAE,OAAO,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAA;IACjB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,2BAA2B,CAAA;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,2BAA2B,EAAE,CAAA;IACtC,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;mFACmF;AACnF,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,uBAAuB,GAC7B,2BAA2B,GAAG,IAAI,CAKpC;AAED;;;;yBAIyB;AACzB,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,aAAa,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,EACjF,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,uBAAuB,CAAC,GACxD,2BAA2B,CAe7B;AAED;;;8DAG8D;AAC9D,wBAAgB,eAAe,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkCnF;AAED;;;;;;;;;;;;;8CAa8C;AAC9C,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,GAChC,GAAG,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAmCtC"}

package/payload/platform/services/claude-session-manager/dist/tool-registration-drift.js

@@ -0,0 +1,147 @@
+// Boot-time tool-availability reconciliation. Maxy enables a tool-bearing plugin
+// per account (account.json enabledPlugins) and the plugin's PLUGIN.md declares
+// tools plus an `mcp:` block — but only the GENERATED `.claude-plugin/plugin.json`
+// mcpServers block makes Claude Code spawn the server. A plugin on
+// `mcp-manifest: skip` keeps its PLUGIN.md `mcp:` block (so the source-level
+// `mcp-allowlist-without-server` gate passes) while the generator drops mcpServers
+// from the artifact CC consumes — the server never mounts and every tool it owns
+// is "listed but not live", silent until an operator complains. This module names
+// that gap at manager boot.
+//
+// Twin of skill-registration-drift.ts (which does the same for a sub-plugin's
+// SKILLS). Like that check this one does NOT refuse boot — an unmounted
+// tool-plugin must not brick the whole install; the manager logs a standing
+// FATAL line per defect and continues (Task 1574).
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+/** Classify one tool-plugin's manifest state into a drift reason, or null when
+ *  the server would mount (manifest present, carries mcpServers, dist on disk). */
+export function classifyToolRegistration(state) {
+    if (!state.manifestPresent)
+        return 'not-installed';
+    if (!state.hasMcpServers)
+        return 'no-mcpServers-manifest';
+    if (!state.distPresent)
+        return 'dist-missing';
+    return null;
+}
+/** Cross-check each account's enabled tool-plugins against their generated
+ *  manifests. `toolPlugins` maps a tool-plugin dir name to its on-disk manifest
+ *  state; an enabledPlugins entry absent from that map is not a tool-plugin
+ *  (platform non-tool plugin, skill-only premium sub, leaked foreign sub) and is
+ *  out of scope here. */
+export function assertToolRegistrationDrift(accounts, toolPlugins) {
+    const defects = [];
+    let inspected = 0;
+    for (const account of accounts) {
+        for (const plugin of account.enabledPlugins) {
+            const state = toolPlugins.get(plugin);
+            if (!state)
+                continue; // not a tool-plugin on disk — out of scope
+            inspected += 1;
+            const reason = classifyToolRegistration(state);
+            if (reason) {
+                defects.push({ accountId: account.accountId, plugin, expectedServer: plugin, reason });
+            }
+        }
+    }
+    return { ok: defects.length === 0, defects, inspected };
+}
+/** Index plugin dirs across the roots, keyed by dir basename — the same key
+ *  loadToolSurface and account.json enabledPlugins use. Platform plugins live at
+ *  `<root>/<name>`; premium subs at `<premiumRoot>/<bundle>/plugins/<sub>`;
+ *  standalone premium bundles at `<premiumRoot>/<bundle>`. */
+export function indexPluginDirs(pluginRoots) {
+    const out = new Map();
+    const addIfPlugin = (name, dir) => {
+        if (name.startsWith('.'))
+            return;
+        try {
+            if (!statSync(dir).isDirectory())
+                return;
+        }
+        catch {
+            return;
+        }
+        if (existsSync(join(dir, 'PLUGIN.md')))
+            out.set(name, dir);
+    };
+    for (const root of pluginRoots) {
+        let entries;
+        try {
+            entries = readdirSync(root);
+        }
+        catch {
+            continue;
+        }
+        for (const name of entries) {
+            const dir = join(root, name);
+            addIfPlugin(name, dir); // platform plugin / standalone premium bundle
+            const subDir = join(dir, 'plugins'); // premium bundle subs
+            if (existsSync(subDir)) {
+                let subs;
+                try {
+                    subs = readdirSync(subDir);
+                }
+                catch {
+                    subs = [];
+                }
+                for (const sub of subs)
+                    addIfPlugin(sub, join(subDir, sub));
+            }
+        }
+    }
+    return out;
+}
+/** Read the generated-manifest state of every named tool-plugin. A name with no
+ *  dir on disk is reported as manifestPresent:false (→ not-installed), so a
+ *  tool-plugin that vanished from disk is still surfaced rather than skipped. A
+ *  present-but-corrupt manifest reads as manifestPresent:true, hasMcpServers:
+ *  false (→ no-mcpServers-manifest).
+ *
+ *  A tool-plugin whose `mcp:` server is a shared `platform/lib/<name>` binary
+ *  rather than a plugin-local `mcp/` dir (e.g. `graph`, served by
+ *  `platform/lib/graph-mcp`) is EXCLUDED from the result — the manifest
+ *  generator only emits `mcpServers` for plugins that ship a plugin-local `mcp/`
+ *  (its `hasMcp` predicate), so a shared-lib plugin's generated manifest carries
+ *  no `mcpServers` by architecture, not by a `skip` flag. Judging it by the
+ *  generated-manifest criterion would false-FATAL on every boot. This mirrors
+ *  the generator's `hasMcp` check exactly. */
+export function readToolPluginManifestStates(pluginRoots, toolPluginNames) {
+    const dirs = indexPluginDirs(pluginRoots);
+    const out = new Map();
+    for (const name of toolPluginNames) {
+        const dir = dirs.get(name);
+        if (!dir) {
+            out.set(name, { manifestPresent: false, hasMcpServers: false, distPresent: false });
+            continue;
+        }
+        // Mirror generate-plugin-manifests.mjs `hasMcp`: only a plugin-local mcp/
+        // dir yields a generated mcpServers block. Shared-lib-server plugins are a
+        // different mount architecture, out of this gate's remit.
+        const hasLocalMcp = existsSync(join(dir, 'mcp', 'dist', 'index.js')) ||
+            existsSync(join(dir, 'mcp', 'package.json'));
+        if (!hasLocalMcp)
+            continue;
+        const manifestPath = join(dir, '.claude-plugin', 'plugin.json');
+        const manifestPresent = existsSync(manifestPath);
+        let hasMcpServers = false;
+        if (manifestPresent) {
+            try {
+                const parsed = JSON.parse(readFileSync(manifestPath, 'utf-8'));
+                hasMcpServers =
+                    !!parsed.mcpServers &&
+                        typeof parsed.mcpServers === 'object' &&
+                        !Array.isArray(parsed.mcpServers) &&
+                        Object.keys(parsed.mcpServers).length > 0;
+            }
+            catch {
+                /* corrupt manifest → hasMcpServers stays false → no-mcpServers-manifest */
+            }
+        }
+        const distPresent = existsSync(join(dir, 'mcp', 'dist', 'index.js'));
+        out.set(name, { manifestPresent, hasMcpServers, distPresent });
+    }
+    return out;
+}
+//# sourceMappingURL=tool-registration-drift.js.map

package/payload/platform/services/claude-session-manager/dist/tool-registration-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-registration-drift.js","sourceRoot":"","sources":["../src/tool-registration-drift.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,gFAAgF;AAChF,mFAAmF;AACnF,mEAAmE;AACnE,6EAA6E;AAC7E,mFAAmF;AACnF,iFAAiF;AACjF,kFAAkF;AAClF,4BAA4B;AAC5B,EAAE;AACF,8EAA8E;AAC9E,wEAAwE;AACxE,4EAA4E;AAC5E,mDAAmD;AAEnD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAiChC;mFACmF;AACnF,MAAM,UAAU,wBAAwB,CACtC,KAA8B;IAE9B,IAAI,CAAC,KAAK,CAAC,eAAe;QAAE,OAAO,eAAe,CAAA;IAClD,IAAI,CAAC,KAAK,CAAC,aAAa;QAAE,OAAO,wBAAwB,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,cAAc,CAAA;IAC7C,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;yBAIyB;AACzB,MAAM,UAAU,2BAA2B,CACzC,QAAiF,EACjF,WAAyD;IAEzD,MAAM,OAAO,GAAkC,EAAE,CAAA;IACjD,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACrC,IAAI,CAAC,KAAK;gBAAE,SAAQ,CAAC,2CAA2C;YAChE,SAAS,IAAI,CAAC,CAAA;YACd,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;YAC9C,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AACzD,CAAC;AAED;;;8DAG8D;AAC9D,MAAM,UAAU,eAAe,CAAC,WAA8B;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAA;IACrC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,GAAW,EAAQ,EAAE;QACtD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAM;QAChC,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;gBAAE,OAAM;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAM;QACR,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC5D,CAAC,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC5B,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA,CAAC,8CAA8C;YACrE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA,CAAC,sBAAsB;YAC1D,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,IAAI,IAAc,CAAA;gBAClB,IAAI,CAAC;oBACH,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,IAAI,GAAG,EAAE,CAAA;gBACX,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,IAAI;oBAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;;;;;;8CAa8C;AAC9C,MAAM,UAAU,4BAA4B,CAC1C,WAA8B,EAC9B,eAAiC;IAEjC,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAA;IACtD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAC1B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;YACnF,SAAQ;QACV,CAAC;QACD,0EAA0E;QAC1E,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,WAAW,GACf,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAA;QAC9C,IAAI,CAAC,WAAW;YAAE,SAAQ;QAC1B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAA;QAC/D,MAAM,eAAe,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;QAChD,IAAI,aAAa,GAAG,KAAK,CAAA;QACzB,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAA6B,CAAA;gBAC1F,aAAa;oBACX,CAAC,CAAC,MAAM,CAAC,UAAU;wBACnB,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;wBACrC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;wBACjC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAqC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;YAC7E,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;QACpE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/payload/server/{chunk-LMLVOZ6G.js → chunk-UGPQCVIW.js}

@@ -2774,7 +2774,8 @@ function rowIds(users) {
 function appendUsersAuditLine(audit, fields) {
   const sess = audit.session ? ` session=${id8(audit.session)}` : "";
   const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
-  const line = `[users-audit] action=${fields.action} actor=${actor}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
+  const targetFields = audit.target !== void 0 ? ` target=${audit.target.includes("-") ? id8(audit.target) : audit.target} explicitUserId=${audit.explicitUserId ? "true" : "false"}` : "";
+  const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
 `;
   try {
     mkdirSync2(dirname(audit.logFile), { recursive: true, mode: 448 });
@@ -4515,7 +4516,7 @@ async function findRecentConversation(visitorId, accountId, agentSlug, maxAgeHou
     await session.close();
   }
 }
-async function createNewAdminConversation(userId, accountId, cacheKey2, adminName, preMintedSessionId) {
+async function createNewAdminConversation(userId, accountId, cacheKey2, preMintedSessionId) {
   if (!userId || !cacheKey2 || !accountId) {
     console.error(`[admin/conversation-write] schema-violation userId=${userId ? "set" : "EMPTY"} cacheKey=${cacheKey2 ? "set" : "EMPTY"} accountId=${accountId ? "set" : "EMPTY"}`);
     return null;
@@ -4528,7 +4529,6 @@ async function createNewAdminConversation(userId, accountId, cacheKey2, adminNam
        WITH existing IS NULL AS adminUserCreated
        MERGE (au:AdminUser {userId: $userId})
        ON CREATE SET au.accountId = $accountId,
-                     au.name = COALESCE($adminName, 'Admin'),
                      au.createdAt = datetime(),
                      au.scope = 'admin'
        CREATE (c:Conversation:AdminConversation {
@@ -4543,7 +4543,7 @@ async function createNewAdminConversation(userId, accountId, cacheKey2, adminNam
          updatedAt: datetime()
        })-[:STARTED_BY]->(au)
        RETURN adminUserCreated`,
-      { sessionId, accountId, userId, adminName: adminName ?? null }
+      { sessionId, accountId, userId }
     );
     const adminUserCreated = result.records[0]?.get("adminUserCreated") === true;
     cacheSessionId(cacheKey2, sessionId);
@@ -5113,14 +5113,15 @@ async function getUserTimezone(accountId, userId) {
     await session.close();
   }
 }
-async function loadAdminUserName(accountId, userId) {
+async function loadAdminUserName(userId) {
   const session = getSession();
   try {
     const result = await session.run(
-      `MATCH (au:AdminUser {userId: $userId})-[:OWNS]->(p:Person {accountId: $accountId})
+      `MATCH (au:AdminUser {userId: $userId})-[:OWNS]->(p:Person)
+       WHERE p.accountId = au.accountId
        RETURN p.givenName AS givenName, p.familyName AS familyName, p.avatar AS avatar
        LIMIT 1`,
-      { accountId, userId }
+      { userId }
     );
     if (result.records.length === 0) {
       return { source: "fallback", reason: "no-person-node" };
@@ -5142,33 +5143,6 @@ async function loadAdminUserName(accountId, userId) {
     await session.close();
   }
 }
-async function loadAdminDisplayIdentity(accountId, userId) {
-  const session = getSession();
-  try {
-    const result = await session.run(
-      `MATCH (au:AdminUser {userId: $userId})
-       OPTIONAL MATCH (au)-[:OWNS]->(p:Person {accountId: $accountId})
-       RETURN au.name AS name, p.avatar AS avatar
-       LIMIT 1`,
-      { accountId, userId }
-    );
-    if (result.records.length === 0) {
-      return { source: "fallback", reason: "no-admin-user" };
-    }
-    const name = result.records[0].get("name");
-    const avatar = result.records[0].get("avatar");
-    if (!name || name.trim().length === 0) {
-      return { source: "fallback", reason: "no-name" };
-    }
-    const trimmedAvatar = avatar && avatar.trim().length > 0 ? avatar.trim() : null;
-    return { source: "admin-user", name: name.trim(), avatar: trimmedAvatar };
-  } catch (err) {
-    console.error(`[admin-identity] loadAdminDisplayIdentity failed: ${err instanceof Error ? err.message : String(err)}`);
-    return { source: "fallback", reason: "neo4j-unreachable" };
-  } finally {
-    await session.close();
-  }
-}
 async function loadPersonNameByElementId(accountId, personId) {
   const session = getSession();
   try {
@@ -5226,9 +5200,9 @@ async function writeAdminUserAndPerson(params) {
        // on the operator's first memory write. Mirrors seed-neo4j.sh:175-181
        // and the sibling writers (neo4j-store.ts:537,:931). COALESCE on MATCH
        // preserves an already-stamped node.
-       ON CREATE SET au.name = $fullName, au.createdAt = $now,
+       ON CREATE SET au.createdAt = $now,
                      au.accountId = $accountId, au.role = 'owner'
-       ON MATCH SET au.name = $fullName, au.updatedAt = $now,
+       ON MATCH SET au.updatedAt = $now,
                     au.accountId = COALESCE(au.accountId, $accountId),
                     au.role = COALESCE(au.role, 'owner')
        WITH au
@@ -5274,7 +5248,7 @@ async function writeAdminUserAndPerson(params) {
        }
        RETURN reused, profileIsNew, elementId(p) AS personElementId,
               p.givenName AS givenName, p.familyName AS familyName`,
-      { userId, fullName: trimmed, accountId, givenName, familyName, now, personEmbedding, serverTimezone }
+      { userId, accountId, givenName, familyName, now, personEmbedding, serverTimezone }
     );
     if (result.records.length === 0) {
       throw new Error("writeAdminUserAndPerson: no record returned");
@@ -6020,7 +5994,6 @@ export {
   renameConversation,
   getUserTimezone,
   loadAdminUserName,
-  loadAdminDisplayIdentity,
   loadPersonNameByElementId,
   writeAdminUserAndPerson,
   loadUserProfile,

package/payload/server/maxy-edge.js

@@ -16,7 +16,7 @@ import {
   sanitizeClientCorrId,
   vncLog,
   websockifyLog
-} from "./chunk-LMLVOZ6G.js";
+} from "./chunk-UGPQCVIW.js";
 import "./chunk-PFF6I7KP.js";
 
 // server/edge.ts

package/payload/server/server.js

@@ -70,7 +70,6 @@ import {
   linkConversationTranscript,
   listAdminSessions,
   listValidAccounts,
-  loadAdminDisplayIdentity,
   loadAdminUserName,
   loadPersonNameByElementId,
   loadUserProfile,
@@ -112,7 +111,7 @@ import {
   vncLog,
   walkPremiumBundles,
   writeAdminUserAndPerson
-} from "./chunk-LMLVOZ6G.js";
+} from "./chunk-UGPQCVIW.js";
 import {
   __commonJS,
   __toESM
@@ -8567,7 +8566,7 @@ app3.get("/", requireAdminSession, async (c) => {
         }
         const auid = adminUserIdBySession.get(row.sessionId);
         if (auid) {
-          const resolved = await loadAdminUserName(scopeAccountId, auid);
+          const resolved = await loadAdminUserName(auid);
           if (resolved.source === "neo4j") {
             row.personName = resolved.joined;
             adminNameCount += 1;
@@ -9071,7 +9070,7 @@ app4.get("/conversations", requireAdminSession, async (c) => {
         return;
       }
       const idRes = classifyAdminUserId(users, admins, senderId);
-      const nameRes = idRes.kind === "resolved" ? await loadAdminUserName(account.accountId, idRes.userId) : null;
+      const nameRes = idRes.kind === "resolved" ? await loadAdminUserName(idRes.userId) : null;
       const { name, reason } = resolveOperatorDisplay(idRes, nameRes);
       if (reason) console.error(`[wa-reader] op=operator-unresolved senderId=${senderId} reason=${reason}`);
       nameBySender.set(senderId, name);
@@ -11492,7 +11491,8 @@ function formatAuditRowIds(userIds) {
 function appendUsersAuditLine(audit, fields) {
   const sess = audit.session ? ` session=${id8(audit.session)}` : "";
   const actor = audit.actor.includes("-") ? id8(audit.actor) : audit.actor;
-  const line = `[users-audit] action=${fields.action} actor=${actor}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
+  const targetFields = audit.target !== void 0 ? ` target=${audit.target.includes("-") ? id8(audit.target) : audit.target} explicitUserId=${audit.explicitUserId ? "true" : "false"}` : "";
+  const line = `[users-audit] action=${fields.action} actor=${actor}${targetFields}${sess} field=${fields.field} rowsBefore=${fields.rowsBefore} rowsAfter=${fields.rowsAfter} ts=${(/* @__PURE__ */ new Date()).toISOString()}
 `;
   try {
     mkdirSync5(dirname7(audit.logFile), { recursive: true, mode: 448 });
@@ -12233,13 +12233,13 @@ var client_error_default = app10;
 // server/routes/admin/session.ts
 import { randomUUID as randomUUID8 } from "crypto";
 async function resolveUserIdentity(accountId, userId) {
-  const result = await loadAdminDisplayIdentity(accountId, userId);
-  if (result.source === "admin-user") {
-    console.log(`[admin-identity] userName-source=admin-user userId=${userId.slice(0, 8)} accountId=${accountId.slice(0, 8)} name=${result.name} avatar=${result.avatar ? "present" : "absent"}`);
-    return { userName: result.name, avatar: result.avatar };
+  const result = await loadAdminUserName(userId);
+  if (result.source === "neo4j") {
+    console.log(`[admin-identity] userName-source=person userId=${userId.slice(0, 8)} accountId=${accountId.slice(0, 8)} name=${result.joined} avatar=${result.avatar ? "present" : "absent"}`);
+    return { userName: result.joined, avatar: result.avatar };
   }
   console.log(`[admin-identity] userName-source=fallback reason=${result.reason} userId=${userId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
-  const userName = result.reason === "neo4j-unreachable" ? "Owner" : void 0;
+  const userName = result.reason === "neo4j-unreachable" ? void 0 : null;
   return { userName, avatar: null };
 }
 async function createAdminSession(accountId, thinkingView, userId, userName, role, avatar) {
@@ -12247,7 +12247,7 @@ async function createAdminSession(accountId, thinkingView, userId, userName, rol
   const effectiveThinkingView = thinkingView ?? account?.config.thinkingView ?? "default";
   const signedSessionToken = randomUUID8();
   const cacheKey = fingerprintSessionKey(signedSessionToken);
-  registerSession(cacheKey, "admin", accountId, void 0, userId, userName, role);
+  registerSession(cacheKey, "admin", accountId, void 0, userId, userName ?? void 0, role);
   if (userId) setWantsPriorConversation(cacheKey);
   const businessName = await fetchAccountName(accountId) || void 0;
   let initialSessionId = null;
@@ -12324,7 +12324,7 @@ app11.get("/", async (c) => {
     const resolved = await resolveUserIdentity(accountId, restoredUserId);
     restoredUserName = resolved.userName;
     restoredAvatar = resolved.avatar;
-    if (resolved.userName !== void 0) {
+    if (typeof resolved.userName === "string") {
       registerSession(cacheKey, "admin", accountId, void 0, restoredUserId, resolved.userName, role ?? void 0);
     }
   }
@@ -13476,7 +13476,7 @@ async function resolveOwnerProfileBlock(accountId, userId) {
 async function resolveAuthenticatedName(accountId, userId) {
   if (!userId) return void 0;
   try {
-    const res = await loadAdminUserName(accountId, userId);
+    const res = await loadAdminUserName(userId);
     return res.source === "neo4j" ? res.joined : void 0;
   } catch (err) {
     console.error(
@@ -18381,7 +18381,6 @@ app34.post("/", requireAdminSession, async (c) => {
             adminUserId,
             convAccountId,
             `session:${plan.sessionId}`,
-            authenticatedName,
             plan.sessionId
           );
           console.log(
@@ -22002,8 +22001,8 @@ import { join as join34 } from "path";
 var ADMIN_ROLE2 = "admin";
 var WEBCHAT_CHANNEL2 = "webchat";
 var SESSION_META_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.meta\.json$/i;
-var defaultResolveName = async (accountId, userId) => {
-  const res = await loadAdminUserName(accountId, userId);
+var defaultResolveName = async (_accountId, userId) => {
+  const res = await loadAdminUserName(userId);
   return res.source === "neo4j" && res.joined.length > 0 ? res.joined : null;
 };
 async function readRaw2(path2) {