@rubytech/create-maxy-code 0.1.439 → 0.1.440

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-list.js

@@ -1,30 +1,93 @@
 import { callGraph } from "../lib/graph-client.js";
 import { log } from "../lib/log.js";
+/**
+ * Map a caller-supplied `folder` value to the Graph `/me/mailFolders/{id}`
+ * path segment.
+ *
+ * Graph accepts only a well-known token (a single word, no spaces:
+ * `inbox`, `sentitems`, `drafts`, `deleteditems`, `junkemail`, `archive`,
+ * `outbox`) or a real folder id in that segment. A human display name such as
+ * "Sent Items" is neither, so Graph rejects it with "Id is malformed". This
+ * normalizes the full well-known set plus common aliases — case-insensitively
+ * and space-insensitively — to the Graph token. Any value not in the alias
+ * table is assumed to be a raw folder id and returned unchanged (`asRawId`),
+ * preserving the prior pass-through behaviour.
+ */
+export function resolveFolder(folder) {
+    const key = folder.toLowerCase().replace(/\s+/g, "");
+    // Own-key check only: a bare `WELL_KNOWN_ALIASES[key]` would also read
+    // inherited members, so `folder` values like "constructor" or "__proto__"
+    // would resolve to an Object.prototype member instead of passing through as
+    // raw ids.
+    if (Object.hasOwn(WELL_KNOWN_ALIASES, key)) {
+        return { token: WELL_KNOWN_ALIASES[key], asRawId: false };
+    }
+    return { token: folder, asRawId: true };
+}
+// Lookup keys are already lowercased and space-stripped. Inbox maps to the
+// capitalized "Inbox" segment the tool has always used (Graph is
+// case-insensitive on well-known names); the rest map to the lowercase Graph
+// tokens. "" (and whitespace-only) collapses to the key "" → Inbox, folding in
+// the former lone-inbox special case.
+const WELL_KNOWN_ALIASES = {
+    "": "Inbox",
+    inbox: "Inbox",
+    sentitems: "sentitems",
+    sent: "sentitems",
+    drafts: "drafts",
+    deleteditems: "deleteditems",
+    trash: "deleteditems",
+    junkemail: "junkemail",
+    junk: "junkemail",
+    spam: "junkemail",
+    archive: "archive",
+    outbox: "outbox",
+};
 const FIELDS = "id,subject,from,receivedDateTime,bodyPreview,isRead";
 export async function runMailList(config, args) {
     const top = clampTop(args.top, 25);
-    const folder = args.folder ?? "Inbox";
+    const folderIn = args.folder ?? "Inbox";
+    const { token: folderResolved, asRawId } = resolveFolder(folderIn);
     const startMs = Date.now();
-    const result = await callGraph(config, async (client) => {
-        const path = folder.toLowerCase() === "inbox" || folder === ""
-            ? "/me/mailFolders/Inbox/messages"
-            : `/me/mailFolders/${encodeURIComponent(folder)}/messages`;
-        return (await client
-            .api(path)
-            .top(top)
-            .orderby("receivedDateTime DESC")
-            .select(FIELDS)
-            .get());
-    }, { tool: "mail-list" });
-    const items = result.value.map(shapeMessage);
-    log({
-        event: "mail-list",
-        account: config.accountId,
-        folder,
-        count: items.length,
-        elapsedMs: Date.now() - startMs,
-    });
-    return items;
+    try {
+        const result = await callGraph(config, async (client) => {
+            const path = `/me/mailFolders/${encodeURIComponent(folderResolved)}/messages`;
+            return (await client
+                .api(path)
+                .top(top)
+                .orderby("receivedDateTime DESC")
+                .select(FIELDS)
+                .get());
+        }, { tool: "mail-list" });
+        const items = result.value.map(shapeMessage);
+        log({
+            event: "mail-list",
+            op: "resolve",
+            account: config.accountId,
+            folderIn,
+            folderResolved,
+            asRawId,
+            count: items.length,
+            elapsedMs: Date.now() - startMs,
+        });
+        return items;
+    }
+    catch (err) {
+        // callGraph already logged the graph-error line (status/code, e.g. the 400
+        // "Id is malformed"); this line attaches the folder resolution so the
+        // failing input and the token it mapped to are visible on the error path.
+        log({
+            event: "mail-list",
+            op: "resolve",
+            account: config.accountId,
+            folderIn,
+            folderResolved,
+            asRawId,
+            error: err.message,
+            elapsedMs: Date.now() - startMs,
+        });
+        throw err;
+    }
 }
 function shapeMessage(msg) {
     return {

package/payload/platform/plugins/outlook/mcp/dist/tools/mail-list.js.map

@@ -1 +1 @@
-{"version":3,"file":"mail-list.js","sourceRoot":"","sources":["../../src/tools/mail-list.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AA6BpC,MAAM,MAAM,GAAG,qDAAqD,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAyB,EACzB,IAAkB;IAElB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,IAAI,GACR,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE;YAC/C,CAAC,CAAC,gCAAgC;YAClC,CAAC,CAAC,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC;QAC/D,OAAO,CAAC,MAAM,MAAM;aACjB,GAAG,CAAC,IAAI,CAAC;aACT,GAAG,CAAC,GAAG,CAAC;aACR,OAAO,CAAC,uBAAuB,CAAC;aAChC,MAAM,CAAC,MAAM,CAAC;aACd,GAAG,EAAE,CAA8B,CAAC;IACzC,CAAC,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7C,GAAG,CAAC;QACF,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,MAAM,CAAC,SAAS;QACzB,MAAM;QACN,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;KAChC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,GAAe;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI;QAC7C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAE,QAAgB;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1E,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACxB,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"mail-list.js","sourceRoot":"","sources":["../../src/tools/mail-list.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAYpC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,uEAAuE;IACvE,0EAA0E;IAC1E,4EAA4E;IAC5E,WAAW;IACX,IAAI,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,2EAA2E;AAC3E,iEAAiE;AACjE,6EAA6E;AAC7E,+EAA+E;AAC/E,sCAAsC;AACtC,MAAM,kBAAkB,GAA2B;IACjD,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,IAAI,EAAE,WAAW;IACjB,MAAM,EAAE,QAAQ;IAChB,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,cAAc;IACrB,SAAS,EAAE,WAAW;IACtB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;CACjB,CAAC;AAwBF,MAAM,MAAM,GAAG,qDAAqD,CAAC;AAErE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAyB,EACzB,IAAkB;IAElB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,MAAM,EACN,KAAK,EAAE,MAAM,EAAE,EAAE;YACf,MAAM,IAAI,GAAG,mBAAmB,kBAAkB,CAAC,cAAc,CAAC,WAAW,CAAC;YAC9E,OAAO,CAAC,MAAM,MAAM;iBACjB,GAAG,CAAC,IAAI,CAAC;iBACT,GAAG,CAAC,GAAG,CAAC;iBACR,OAAO,CAAC,uBAAuB,CAAC;iBAChC,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,EAAE,CAA8B,CAAC;QACzC,CAAC,EACD,EAAE,IAAI,EAAE,WAAW,EAAE,CACtB,CAAC;QAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC7C,GAAG,CAAC;YACF,KAAK,EAAE,WAAW;YAClB,EAAE,EAAE,SAAS;YACb,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,sEAAsE;QACtE,0EAA0E;QAC1E,GAAG,CAAC;YACF,KAAK,EAAE,WAAW;YAClB,EAAE,EAAE,SAAS;YACb,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ;YACR,cAAc;YACd,OAAO;YACP,KAAK,EAAG,GAAa,CAAC,OAAO;YAC7B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;SAChC,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,GAAe;IACnC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI;QAC7C,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QACnD,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB,EAAE,QAAgB;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1E,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACxB,IAAI,KAAK,GAAG,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/payload/platform/plugins/outlook/references/graph-surfaces.md

@@ -6,7 +6,21 @@ Microsoft Graph endpoints used by each tool, with the response shape and the fie
 
 **Endpoint (Inbox):** `GET /me/mailFolders/Inbox/messages?$top={N}&$orderby=receivedDateTime DESC&$select=id,subject,from,receivedDateTime,bodyPreview,isRead`
 
-**Endpoint (other folder):** `GET /me/mailFolders/{folderId-or-displayName}/messages?...`
+**Endpoint (other folder):** `GET /me/mailFolders/{well-known-token-or-folderId}/messages?...`
+
+The `folder` arg is normalized before the path is built. Graph's `{id}` segment accepts only a well-known token (single word, no spaces) or a real folder id — a display name like "Sent Items" is rejected with "Id is malformed". The tool maps the full well-known set plus common aliases, case- and space-insensitively, to the Graph token:
+
+| Input (any case/spacing) | Graph token |
+|---|---|
+| `Inbox`, `` (empty) | `Inbox` |
+| `Sent Items`, `sent` | `sentitems` |
+| `Drafts` | `drafts` |
+| `Deleted Items`, `trash` | `deleteditems` |
+| `Junk Email`, `junk`, `spam` | `junkemail` |
+| `Archive` | `archive` |
+| `Outbox` | `outbox` |
+
+Any value not in this table is treated as a raw folder id and passed through unchanged. A custom folder's display name (e.g. "Projects") is therefore not resolved — resolving custom folders by name would need a `/me/mailFolders` lookup and is out of scope.
 
 **Returned shape:**
 ```typescript

package/payload/platform/scripts/__tests__/account-schema-owned-dirs.test.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# Tests the plugin-declared account-owned-dir merge/reconcile lib: a brand that
+# ships a plugin declaring an owned top-level dir gets it unioned into the
+# account SCHEMA.md allowed-top-level set; a brand without the plugin does not;
+# the merge is idempotent; the reconcile check reports present before/after.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PLAT_SCRIPTS="$SCRIPT_DIR/.."
+REAL_PROJECT_DIR="$(cd "$PLAT_SCRIPTS/.." && pwd)"
+REAL_TEMPLATE="$REAL_PROJECT_DIR/templates/account-schema/SCHEMA.md"
+REAL_PREMIUM="$(cd "$REAL_PROJECT_DIR/.." && pwd)/premium-plugins"
+PASS=0; FAIL=0; FAILED=()
+assert_grep()   { if printf '%s' "$2" | grep -qF "$1"; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected to find [$1]"); fi; }
+assert_nogrep() { if printf '%s' "$2" | grep -qF "$1"; then FAIL=$((FAIL+1)); FAILED+=("$3: expected NOT to find [$1]"); else PASS=$((PASS+1)); fi; }
+assert_eq()     { if [ "$1" = "$2" ]; then PASS=$((PASS+1)); else FAIL=$((FAIL+1)); FAILED+=("$3: expected [$2] got [$1]"); fi; }
+
+. "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.sh"
+
+# Build a fake platform tree at $T/platform whose premium sibling is a symlink to
+# the real premium-plugins (so the real sitedesk-job PLUGIN.md is exercised).
+make_tree() { # $1=ships (json array literal)
+  local T; T="$(mktemp -d)"
+  mkdir -p "$T/platform/plugins" "$T/platform/config" "$T/platform/templates/account-schema"
+  ln -s "$REAL_PREMIUM" "$T/premium-plugins"
+  cp "$REAL_TEMPLATE" "$T/platform/templates/account-schema/SCHEMA.md"
+  printf '{"installDir":"test-brand","shipsPremiumBundles":%s}\n' "$1" > "$T/platform/config/brand.json"
+  echo "$T"
+}
+make_account() { # $1=tree
+  local A; A="$(mktemp -d)"
+  cp "$1/platform/templates/account-schema/SCHEMA.md" "$A/SCHEMA.md"
+  printf '{"accountId":"x","role":"house"}\n' > "$A/account.json"
+  echo "$A"
+}
+
+# --- sitedesk-shipping brand: quoting added ---
+T_SD="$(make_tree '["sitedesk"]')"; A_SD="$(make_account "$T_SD")"
+export PROJECT_DIR="$T_SD/platform"
+OUT="$(merge_owned_dirs_into_schema "$A_SD")"
+assert_grep "op=seed-owned-dirs" "$OUT" "sd-seed-log"
+assert_grep "added=quoting" "$OUT" "sd-added-quoting"
+ALLOWED="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_SD/SCHEMA.md")"
+assert_grep "quoting" "$ALLOWED" "sd-allowlist-has-quoting"
+assert_grep "Plugin-owned top-level workspaces" "$(cat "$A_SD/SCHEMA.md")" "sd-descriptive-section"
+assert_grep "plugin-owned-dirs:start" "$(cat "$A_SD/SCHEMA.md")" "sd-marker"
+
+# --- idempotency: second merge is byte-identical ---
+BEFORE="$(shasum "$A_SD/SCHEMA.md" | awk '{print $1}')"
+OUT2="$(merge_owned_dirs_into_schema "$A_SD")"
+AFTER="$(shasum "$A_SD/SCHEMA.md" | awk '{print $1}')"
+assert_eq "$AFTER" "$BEFORE" "idempotent-second-merge"
+assert_grep "added=none" "$OUT2" "sd-second-added-none"
+
+# --- non-sitedesk brand: no quoting ---
+T_MX="$(make_tree '[]')"; A_MX="$(make_account "$T_MX")"
+export PROJECT_DIR="$T_MX/platform"
+merge_owned_dirs_into_schema "$A_MX" >/dev/null
+ALLOWED_MX="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_MX/SCHEMA.md")"
+assert_nogrep "quoting" "$ALLOWED_MX" "mx-no-quoting"
+assert_nogrep "Plugin-owned top-level workspaces" "$(cat "$A_MX/SCHEMA.md")" "mx-no-section"
+
+# --- reconcile: present=false on bare schema, present=true after merge ---
+A_RC="$(make_account "$T_SD")"
+export PROJECT_DIR="$T_SD/platform"
+RC_BEFORE="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_RC")"
+assert_grep "ownedDir=quoting present=false" "$RC_BEFORE" "rc-present-false"
+merge_owned_dirs_into_schema "$A_RC" >/dev/null
+RC_AFTER="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" reconcile "$A_RC")"
+assert_grep "ownedDir=quoting present=true" "$RC_AFTER" "rc-present-true"
+
+# --- sweep: backfills every account with an account.json ---
+ACCTS="$(mktemp -d)"; mkdir -p "$ACCTS/a1"
+cp "$T_SD/platform/templates/account-schema/SCHEMA.md" "$ACCTS/a1/SCHEMA.md"
+printf '{"accountId":"a1","role":"client"}\n' > "$ACCTS/a1/account.json"
+SWEEP="$(reconcile_all_accounts_owned_dirs "$ACCTS" 2>&1)"
+assert_grep "op=reconcile" "$SWEEP" "sweep-reconcile-log"
+ALLOWED_A1="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$ACCTS/a1/SCHEMA.md")"
+assert_grep "quoting" "$ALLOWED_A1" "sweep-backfilled-a1"
+
+# --- shape-b: a bundle-root PLUGIN.md declaration is resolved too ---
+# A premium bundle may declare an owned dir in its root PLUGIN.md (depth 1),
+# not only in a sub-plugin manifest (depth 2). Build a fully synthetic tree.
+TB="$(mktemp -d)"
+mkdir -p "$TB/platform/plugins" "$TB/platform/config" "$TB/platform/templates/account-schema"
+mkdir -p "$TB/premium-plugins/acme/plugins/acme-sub"
+cp "$REAL_TEMPLATE" "$TB/platform/templates/account-schema/SCHEMA.md"
+printf '{"installDir":"acme-brand","shipsPremiumBundles":["acme"]}\n' > "$TB/platform/config/brand.json"
+printf -- '---\nname: acme\naccount-owned-dirs: [{"dir": "ledger", "description": "Acme ledger."}]\n---\n' > "$TB/premium-plugins/acme/PLUGIN.md"
+printf -- '---\nname: acme-sub\n---\n' > "$TB/premium-plugins/acme/plugins/acme-sub/PLUGIN.md"
+A_TB="$(mktemp -d)"; cp "$TB/platform/templates/account-schema/SCHEMA.md" "$A_TB/SCHEMA.md"
+export PROJECT_DIR="$TB/platform"
+RES_TB="$(PROJECT_DIR="$PROJECT_DIR" python3 "$PLAT_SCRIPTS/lib/account-schema-owned-dirs.py" resolve)"
+assert_grep "ledger" "$RES_TB" "shapeb-resolve-ledger"
+assert_grep "\"plugin\": \"acme\"" "$RES_TB" "shapeb-owner-is-bundle"
+merge_owned_dirs_into_schema "$A_TB" >/dev/null
+ALLOWED_TB="$(awk '/^```allowed-top-level$/{f=1;next} /^```$/{f=0} f' "$A_TB/SCHEMA.md")"
+assert_grep "ledger" "$ALLOWED_TB" "shapeb-allowlist-has-ledger"
+
+echo "PASS=$PASS FAIL=$FAIL"
+if [ "$FAIL" -ne 0 ]; then printf '%s\n' "${FAILED[@]}"; exit 1; fi

package/payload/platform/scripts/lib/account-schema-owned-dirs.py

@@ -0,0 +1,207 @@
+#!/usr/bin/env python3
+"""Resolve plugin-declared account-owned top-level dirs for the brand and merge
+them into an account's SCHEMA.md.
+
+A plugin declares owned top-level account dirs in its PLUGIN.md frontmatter:
+
+    account-owned-dirs: [{"dir": "quoting", "description": "..."}]
+
+The owned-dir set for a brand is the union declared by every platform plugin
+($PROJECT_DIR/plugins/*/PLUGIN.md) and every premium sub-plugin of a bundle the
+brand ships ($PREMIUM_ROOT/<bundle>/plugins/*/PLUGIN.md, gated by brand.json
+shipsPremiumBundles). Reads PROJECT_DIR from the environment.
+"""
+import json, os, re, sys
+
+MARK_START = "<!-- plugin-owned-dirs:start -->"
+MARK_END = "<!-- plugin-owned-dirs:end -->"
+
+
+def _project_dir():
+    pd = os.environ.get("PROJECT_DIR", "")
+    if not pd:
+        sys.stderr.write("account-schema-owned-dirs: PROJECT_DIR unset\n")
+        sys.exit(1)
+    return os.path.normpath(pd)
+
+
+def _read_brand(project_dir):
+    path = os.path.join(project_dir, "config", "brand.json")
+    if not os.path.isfile(path):
+        return "unknown", []
+    try:
+        with open(path) as f:
+            b = json.load(f)
+        return (b.get("installDir") or "unknown"), list(b.get("shipsPremiumBundles") or [])
+    except Exception:
+        return "unknown", []
+
+
+def _parse_plugin_md(path):
+    """Return (name, [ {dir, description} ]) from a PLUGIN.md, or (None, [])."""
+    try:
+        with open(path) as f:
+            text = f.read()
+    except Exception:
+        return None, []
+    m = re.match(r"^---\n(.*?)\n---", text, re.DOTALL)
+    if not m:
+        return None, []
+    fm = m.group(1)
+    name = None
+    nm = re.search(r"^name:\s*(.+)$", fm, re.MULTILINE)
+    if nm:
+        name = nm.group(1).strip().strip('"').strip("'")
+    owned = []
+    om = re.search(r"^account-owned-dirs:\s*(.+)$", fm, re.MULTILINE)
+    if om:
+        try:
+            raw = json.loads(om.group(1).strip())
+            for e in raw:
+                d = (e.get("dir") or "").strip()
+                if d:
+                    owned.append({"dir": d, "description": (e.get("description") or "").strip()})
+        except Exception:
+            pass
+    return name, owned
+
+
+def _plugin_md_paths(project_dir):
+    paths = []
+    plugins_root = os.path.join(project_dir, "plugins")
+    if os.path.isdir(plugins_root):
+        for entry in sorted(os.listdir(plugins_root)):
+            p = os.path.join(plugins_root, entry, "PLUGIN.md")
+            if os.path.isfile(p):
+                paths.append(p)
+    _brand, ships = _read_brand(project_dir)
+    premium_root = os.path.join(os.path.dirname(project_dir), "premium-plugins")
+    for bundle in ships:
+        bundle_dir = os.path.join(premium_root, bundle)
+        # Bundle-root manifest (shape b): premium-plugins/<bundle>/PLUGIN.md.
+        root_md = os.path.join(bundle_dir, "PLUGIN.md")
+        if os.path.isfile(root_md):
+            paths.append(root_md)
+        # Sub-plugin manifests (shape a): premium-plugins/<bundle>/plugins/*/PLUGIN.md.
+        subs = os.path.join(bundle_dir, "plugins")
+        if not os.path.isdir(subs):
+            continue
+        for entry in sorted(os.listdir(subs)):
+            p = os.path.join(subs, entry, "PLUGIN.md")
+            if os.path.isfile(p):
+                paths.append(p)
+    return paths
+
+
+def resolve(project_dir):
+    """Union of owned-dir declarations. First declarer of a dir wins its owner
+    label + description."""
+    seen = {}
+    order = []
+    for path in _plugin_md_paths(project_dir):
+        name, owned = _parse_plugin_md(path)
+        for e in owned:
+            if e["dir"] in seen:
+                continue
+            seen[e["dir"]] = {"dir": e["dir"], "description": e["description"], "plugin": name or "unknown"}
+            order.append(e["dir"])
+    return [seen[d] for d in order]
+
+
+def _allowed_block(text):
+    """Return (list_of_entries, start_idx, end_idx) for the fenced
+    allowed-top-level block. end_idx is the closing-fence line index."""
+    lines = text.split("\n")
+    start = None
+    for i, ln in enumerate(lines):
+        if ln.strip() == "```allowed-top-level":
+            start = i
+            break
+    if start is None:
+        return None, None, None
+    for j in range(start + 1, len(lines)):
+        if lines[j].strip() == "```":
+            return [l for l in lines[start + 1:j] if l.strip()], start, j
+    return None, None, None
+
+
+def _strip_region(text):
+    if MARK_START not in text:
+        return text
+    pre = text.split(MARK_START, 1)[0]
+    post = ""
+    if MARK_END in text:
+        post = text.split(MARK_END, 1)[1]
+    return (pre.rstrip("\n") + "\n" + post.lstrip("\n")).rstrip("\n") + "\n"
+
+
+def merge(project_dir, account_dir):
+    brand, _ = _read_brand(project_dir)
+    owned = resolve(project_dir)
+    schema_path = os.path.join(account_dir, "SCHEMA.md")
+    if not os.path.isfile(schema_path):
+        print(f"brand={brand} added=none")
+        return
+    with open(schema_path) as f:
+        text = f.read()
+    entries, start, end = _allowed_block(text)
+    added = []
+    if entries is not None:
+        present = set(entries)
+        lines = text.split("\n")
+        insert = []
+        for e in owned:
+            if e["dir"] not in present:
+                insert.append(e["dir"])
+                added.append(e["dir"])
+        if insert:
+            lines[end:end] = insert
+            text = "\n".join(lines)
+    # Regenerate the descriptive region wholesale (idempotent).
+    text = _strip_region(text)
+    if owned:
+        region = [MARK_START, "## Plugin-owned top-level workspaces", "",
+                  "A plugin that owns a top-level workspace declares it. The internal",
+                  "structure is owned by that plugin's tools and recreated on the next",
+                  "write. Never reorganise it.", ""]
+        for e in owned:
+            desc = e["description"] or f"Owned by the {e['plugin']} plugin."
+            region.append(f"- `{e['dir']}/` — {desc}")
+        region.append(MARK_END)
+        text = text.rstrip("\n") + "\n\n" + "\n".join(region) + "\n"
+    with open(schema_path, "w") as f:
+        f.write(text)
+    print(f"brand={brand} added={','.join(added) if added else 'none'}")
+
+
+def reconcile(project_dir, account_dir):
+    brand, _ = _read_brand(project_dir)
+    owned = resolve(project_dir)
+    schema_path = os.path.join(account_dir, "SCHEMA.md")
+    present = set()
+    if os.path.isfile(schema_path):
+        with open(schema_path) as f:
+            entries, _s, _e = _allowed_block(f.read())
+        present = set(entries or [])
+    for e in owned:
+        is_present = "true" if e["dir"] in present else "false"
+        print(f"brand={brand} plugin={e['plugin']} ownedDir={e['dir']} present={is_present}")
+
+
+def main():
+    if len(sys.argv) < 2:
+        sys.exit("usage: account-schema-owned-dirs.py {resolve|merge|reconcile} [account_dir]")
+    cmd = sys.argv[1]
+    pd = _project_dir()
+    if cmd == "resolve":
+        print(json.dumps(resolve(pd)))
+    elif cmd == "merge":
+        merge(pd, sys.argv[2])
+    elif cmd == "reconcile":
+        reconcile(pd, sys.argv[2])
+    else:
+        sys.exit(f"unknown command: {cmd}")
+
+
+if __name__ == "__main__":
+    main()

package/payload/platform/scripts/lib/account-schema-owned-dirs.sh

@@ -0,0 +1,33 @@
+# account-schema-owned-dirs.sh — merge plugin-declared owned top-level dirs into
+# an account's SCHEMA.md, and reconcile every account at install time.
+#
+# Requires PROJECT_DIR exported by the caller. Sourced by provision-account-dir.sh
+# and setup-account.sh.
+
+_ACCT_SCHEMA_LIB_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_ACCT_SCHEMA_PY="$_ACCT_SCHEMA_LIB_DIR/account-schema-owned-dirs.py"
+
+# merge_owned_dirs_into_schema <account_dir>
+# Unions the brand's declared owned dirs into <account_dir>/SCHEMA.md and logs
+# the seam. Idempotent.
+merge_owned_dirs_into_schema() {
+  local _acct="$1"
+  local _out
+  _out="$(PROJECT_DIR="$PROJECT_DIR" python3 "$_ACCT_SCHEMA_PY" merge "$_acct" 2>/dev/null)"
+  echo "  [acct-schema] op=seed-owned-dirs ${_out}"
+}
+
+# reconcile_all_accounts_owned_dirs <accounts_dir>
+# Standing check + backfill: for every account dir with an account.json, log the
+# pre-merge present state of each declared owned dir, then merge (backfill).
+reconcile_all_accounts_owned_dirs() {
+  local _accts="$1"
+  [ -d "$_accts" ] || return 0
+  local _acct
+  for _acct in "$_accts"/*/; do
+    [ -f "$_acct/account.json" ] || continue
+    PROJECT_DIR="$PROJECT_DIR" python3 "$_ACCT_SCHEMA_PY" reconcile "$_acct" 2>/dev/null \
+      | while IFS= read -r _line; do echo "  [acct-schema] op=reconcile ${_line}"; done
+    merge_owned_dirs_into_schema "$_acct"
+  done
+}

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -15,6 +15,9 @@
 #   SCRIPT_DIR     — the platform/scripts dir (for lib bootstraps)
 #   USERS_FILE     — $HOME/<brand.configDir>/users.json (owner stamp; optional)
 
+# Owned-dir schema merge (plugin-declared top-level account dirs).
+. "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/account-schema-owned-dirs.sh"
+
 provision_account_dir() {
   local ACCOUNT_DIR="$1"
   local ACCOUNT_ID="$2"
@@ -38,6 +41,10 @@ provision_account_dir() {
   fi
   echo "  [acct-schema] seeded dirs=$_seeded"
 
+  # Merge brand-shipped plugin-declared owned top-level dirs into the freshly
+  # seeded SCHEMA.md so the guard admits them (e.g. quoting/ on SiteDesk).
+  merge_owned_dirs_into_schema "$ACCOUNT_DIR"
+
   # Claude Code discovers project-level .claude/ relative to the nearest .git
   # root. Without a .git in the account dir it traverses up to ~/maxy/.git and
   # misses accountDir/.claude/. Initialise a repo so the account dir IS the root.

package/payload/platform/scripts/setup-account.sh

@@ -53,3 +53,13 @@ USERS_FILE="$USERS_FILE" resolve_and_sweep_account_dir
 # designation (migrating a legacy unlabelled account in the same step).
 export TEMPLATES_DIR PROJECT_DIR SCRIPT_DIR USERS_FILE
 provision_account_dir "$ACCOUNT_DIR" "$ACCOUNT_ID" "house"
+
+# ------------------------------------------------------------------
+# 3. Reconcile plugin-declared owned top-level dirs across every account
+# ------------------------------------------------------------------
+# Standing check + durable backfill: every account under data/accounts/ gets the
+# brand's plugin-declared owned dirs unioned into its SCHEMA.md. Runs on every
+# install so a re-provision cannot drop a previously-added owned dir.
+# reconcile_all_accounts_owned_dirs is available because provision-account-dir.sh
+# (sourced above) sources the owned-dir lib.
+reconcile_all_accounts_owned_dirs "$ACCOUNTS_DIR"

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA+BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAu6FpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AA+BzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAkCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAy6FpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -2293,10 +2293,12 @@ export function buildHttpApp(deps) {
             : undefined;
         // Task 682 — per-session userId override. Server-resolved by the UI from the
         // authoritative users.json/account.json (never message content) and shape-
-        // validated here the same way as personId. Task 1573 — absent for owner
-        // self-phone and any unbound sender; USER_ID is then the authenticated
-        // adminUserId when present, else empty. The boot owner is no longer a
-        // fallback at this layer (see resolveSpawnUserId).
+        // validated here the same way as personId. Task 1573 — absent for a non-owner
+        // unbound sender; USER_ID is then the authenticated adminUserId when present,
+        // else empty. The boot owner is no longer a fallback at this layer (see
+        // resolveSpawnUserId). Task 1575 — the UI resolves an owner self-phone to the
+        // owner userId and sends it here as body.userId, so the owner's own-phone
+        // channel session carries the owner userId via this override (not empty).
         const overrideUserId = typeof body.userId === 'string' && body.userId.length > 0 && body.userId.length <= 128
             ? body.userId
             : undefined;