@rubytech/create-maxy-code 0.1.443 → 0.1.445

package/payload/platform/lib/storage-broker/src/cf-exec.ts

@@ -0,0 +1,73 @@
+// The only place the account-wide Cloudflare credential is used to touch
+// Cloudflare. Every method injects the house token into the child env and shells
+// wrangler. `run` is injectable so the wiring is unit-testable without wrangler.
+
+import { execFile } from "node:child_process";
+import type { HouseCredential } from "./house-credential.js";
+
+export type RunFn = (
+  cmd: string,
+  args: string[],
+  env: Record<string, string>,
+) => Promise<{ stdout: string }>;
+
+export interface CfExec {
+  d1List(): Promise<{ name: string; uuid: string }[]>;
+  d1Create(name: string): Promise<{ uuid: string }>;
+  d1Query(name: string, sql: string): Promise<unknown>;
+  r2List(): Promise<{ name: string }[]>;
+  r2Create(name: string): Promise<void>;
+}
+
+const defaultRun: RunFn = (cmd, args, env) =>
+  new Promise((resolve, reject) => {
+    execFile(cmd, args, { env }, (err, stdout, stderr) => {
+      if (err) {
+        reject(new Error(`${cmd} ${args.join(" ")} failed: ${err.message}\n${stderr}`));
+        return;
+      }
+      resolve({ stdout: stdout.toString() });
+    });
+  });
+
+function parseJson(raw: string, context: string): unknown {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`storage-broker: ${context} returned non-JSON output: ${raw}`);
+  }
+}
+
+export function makeCfExec(cred: HouseCredential, run: RunFn = defaultRun): CfExec {
+  const env = {
+    ...process.env,
+    CLOUDFLARE_API_TOKEN: cred.apiToken,
+    CLOUDFLARE_ACCOUNT_ID: cred.accountId,
+  } as Record<string, string>;
+
+  return {
+    async d1List() {
+      const { stdout } = await run("wrangler", ["d1", "list", "--json"], env);
+      return parseJson(stdout, "d1 list") as { name: string; uuid: string }[];
+    },
+    async d1Create(name) {
+      const { stdout } = await run("wrangler", ["d1", "create", name, "--json"], env);
+      return parseJson(stdout, "d1 create") as { uuid: string };
+    },
+    async d1Query(name, sql) {
+      const { stdout } = await run(
+        "wrangler",
+        ["d1", "execute", name, "--remote", "--json", "--command", sql],
+        env,
+      );
+      return parseJson(stdout, "d1 execute");
+    },
+    async r2List() {
+      const { stdout } = await run("wrangler", ["r2", "bucket", "list", "--json"], env);
+      return parseJson(stdout, "r2 bucket list") as { name: string }[];
+    },
+    async r2Create(name) {
+      await run("wrangler", ["r2", "bucket", "create", name], env);
+    },
+  };
+}

package/payload/platform/lib/storage-broker/src/house-credential.ts

@@ -0,0 +1,32 @@
+// Reads the single account-wide Cloudflare credential from the house-only
+// config directory. This file is the one place the account-wide capability
+// lives; sub-account spawns never source it. Parses KEY=value lines without
+// polluting process.env (same discipline as reconcile-bookings' readEnvFile).
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export interface HouseCredential {
+  apiToken: string;
+  accountId: string;
+}
+
+export function readHouseCredential(platformRoot: string): HouseCredential {
+  const path = join(platformRoot, "config", "cloudflare-house.env");
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    throw new Error(`storage-broker: house credential not found at ${path}`);
+  }
+  const env: Record<string, string> = {};
+  for (const line of raw.split("\n")) {
+    const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (m) env[m[1]] = m[2].trim();
+  }
+  const apiToken = env.CLOUDFLARE_API_TOKEN;
+  const accountId = env.CLOUDFLARE_ACCOUNT_ID;
+  if (!apiToken) throw new Error(`storage-broker: CLOUDFLARE_API_TOKEN missing in ${path}`);
+  if (!accountId) throw new Error(`storage-broker: CLOUDFLARE_ACCOUNT_ID missing in ${path}`);
+  return { apiToken, accountId };
+}

package/payload/platform/lib/storage-broker/src/index.ts

@@ -0,0 +1,14 @@
+// storage-broker: the per-account Cloudflare D1/R2 isolation core.
+//
+// The lib is pure and dependency-free at runtime: it opens no Neo4j connection
+// and shells no process on its own. Consumers inject a SessionLike (the ui
+// route uses neo4j-store's getSession; the remediation entry opens its own
+// driver) and, for cf-exec, a RunFn. That keeps every unit testable in
+// isolation and the isolation logic auditable in one place.
+
+export * from "./authorize.js";
+export * from "./registry.js";
+export * from "./house-credential.js";
+export * from "./cf-exec.js";
+export * from "./audit.js";
+export * from "./remediate.js";

package/payload/platform/lib/storage-broker/src/registry.ts

@@ -0,0 +1,85 @@
+// The ownership registry: which account owns which Cloudflare storage resource.
+//
+// Written with raw cypher MERGE stamped with system provenance, mirroring the
+// house-level seedAccountGraphRoot path in the admin plugin. It deliberately
+// does NOT go through graph-write's writeNodeWithEdges: that primitive's
+// accountId floor rejects a write whose props.accountId differs from the
+// writer process's ACCOUNT_ID, and the broker runs house-level, writing nodes
+// owned by many different sub-accounts. The owning accountId here is always the
+// trusted header value the service resolved, never an agent argument.
+
+// A minimal shape of a neo4j-driver Session, so this lib carries no runtime or
+// type dependency on neo4j-driver (mirrors the SeedSessionLike pattern used in
+// platform/plugins/admin/mcp/src/tools/account-lifecycle.ts).
+// Uses PromiseLike (not Promise) and get(): any so that a real neo4j-driver
+// Session — whose run() returns a Result (a PromiseLike, and whose records are
+// driver Records) — is structurally assignable under both v5 and v6 without a
+// cast at the call site.
+export interface SessionLike {
+  run(
+    cypher: string,
+    params?: Record<string, unknown>,
+  ): PromiseLike<{ records: Array<{ get(key: string): any }> }>;
+}
+
+export type ResourceKind = "d1" | "r2";
+
+export interface StorageResource {
+  accountId: string;
+  kind: ResourceKind;
+  name: string;
+  cfResourceId: string;
+}
+
+export async function registerResource(
+  session: SessionLike,
+  r: StorageResource,
+): Promise<void> {
+  // MERGE on (kind, name) — the ownership key. On a shared Cloudflare account a
+  // storage name maps to exactly one owner, so the write key must match the
+  // resolveOwner lookup key; keying on accountId too would let two accounts hold
+  // a node for the same name and make ownership ambiguous. accountId is set only
+  // ON CREATE and never overwritten ON MATCH, so a register can never silently
+  // reassign an existing resource to a different account.
+  await session.run(
+    `MERGE (r:StorageResource {kind: $kind, name: $name})
+       ON CREATE SET r.accountId = $accountId,
+                     r.createdByAgent = 'system',
+                     r.createdBySource = 'storage-broker',
+                     r.cfResourceId = $cfResourceId
+       ON MATCH SET  r.cfResourceId = $cfResourceId`,
+    { accountId: r.accountId, kind: r.kind, name: r.name, cfResourceId: r.cfResourceId },
+  );
+}
+
+export async function resolveOwner(
+  session: SessionLike,
+  kind: ResourceKind,
+  name: string,
+): Promise<string | null> {
+  const res = await session.run(
+    `MATCH (r:StorageResource {kind: $kind, name: $name})
+       RETURN r.accountId AS accountId LIMIT 1`,
+    { kind, name },
+  );
+  return res.records.length ? (res.records[0].get("accountId") as string) : null;
+}
+
+export async function listResources(
+  session: SessionLike,
+  accountId: string,
+  kind: ResourceKind,
+): Promise<StorageResource[]> {
+  const res = await session.run(
+    `MATCH (r:StorageResource {accountId: $accountId, kind: $kind})
+       RETURN r.name AS name, r.cfResourceId AS cfResourceId
+       ORDER BY r.name`,
+    { accountId, kind },
+  );
+  return res.records.map((rec) => ({
+    accountId,
+    kind,
+    name: rec.get("name") as string,
+    cfResourceId: rec.get("cfResourceId") as string,
+  }));
+}

package/payload/platform/lib/storage-broker/src/remediate.ts

@@ -0,0 +1,31 @@
+// The testable core of the operator-run remediation. The mapping from existing
+// resource name to owning account is operator-authored, and validation fails
+// closed on any resource absent from it: ownership is a recorded fact, never a
+// name-prefix guess. Token stripping removes every account-wide credential from
+// a sub-account secrets file while preserving everything else verbatim.
+
+export interface MappingResult {
+  ok: boolean;
+  missing: string[];
+}
+
+// Account-wide credentials stripped from a sub-account's cloudflare.env.
+// CLOUDFLARE_ACCOUNT_ID is intentionally kept: it is an identifier, not a
+// credential, and does not grant access on its own.
+const STRIP_KEYS = ["CLOUDFLARE_API_TOKEN", "CF_PAGES_D1_TOKEN", "CF_PAGES_TOKEN"];
+
+export function validateMapping(
+  enumerated: string[],
+  mapping: Record<string, string>,
+): MappingResult {
+  const missing = enumerated.filter((name) => !(name in mapping));
+  return { ok: missing.length === 0, missing };
+}
+
+export function stripAccountWideTokens(contents: string): string {
+  const kept = contents.split("\n").filter((line) => {
+    const key = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)=/)?.[1];
+    return !(key && STRIP_KEYS.includes(key));
+  });
+  return kept.join("\n");
+}

package/payload/platform/lib/storage-broker/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}

package/payload/platform/package.json

@@ -6,8 +6,8 @@
     "services/*"
   ],
   "scripts": {
-    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
-    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json",
+    "build": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json && tsc -p services/claude-session-manager/tsconfig.json && tsc -p services/whatsapp-channel/tsconfig.json && tsc -p services/webchat-channel/tsconfig.json && tsc -p services/telegram-channel/tsconfig.json && NODE_OPTIONS='--max-old-space-size=8192' tsc -b plugins/*/mcp/tsconfig.json",
+    "build:lib": "tsc -p lib/models/tsconfig.json && tsc -p lib/mcp-stderr-tee/tsconfig.json && tsc -p lib/mcp-spawn-tee/tsconfig.json && tsc -p lib/mcp-lifeline/tsconfig.json && tsc -p lib/mcp-eager/tsconfig.json && tsc -p lib/account-enumeration/tsconfig.json && tsc -p lib/account-scope/tsconfig.json && tsc -p lib/graph-write/tsconfig.json && tsc -p lib/embed-client/tsconfig.json && tsc -p lib/graph-mcp/tsconfig.json && tsc -p lib/graph-trash/tsconfig.json && tsc -p lib/active-rules/tsconfig.json && tsc -p lib/admin-conversation-purge/tsconfig.json && tsc -p lib/graph-search/tsconfig.json && tsc -p lib/graph-style/tsconfig.json && tsc -p lib/device-url/tsconfig.json && tsc -p lib/brand-templating/tsconfig.json && tsc -p lib/entitlement/tsconfig.json && tsc -p lib/task-secrets/tsconfig.json && tsc -p lib/admins-write/tsconfig.json && tsc -p lib/admin-access-password/tsconfig.json && tsc -p lib/persistent-components/tsconfig.json && tsc -p lib/require-port-env/tsconfig.json && tsc -p lib/aeo-llms-txt-writer/tsconfig.json && tsc -p lib/obsidian-parser/tsconfig.json && tsc -p lib/storage-broker/tsconfig.json",
     "gen:canonical-tools": "node scripts/generate-canonical-tool-names.mjs",
     "build:memory": "tsc -p plugins/memory/mcp/tsconfig.json",
     "build:contacts": "tsc -p plugins/contacts/mcp/tsconfig.json",

package/payload/platform/plugins/.claude-plugin/marketplace.json

@@ -134,6 +134,11 @@
       "source": "./slides",
       "version": "0.1.0"
     },
+    {
+      "name": "storage-broker",
+      "source": "./storage-broker",
+      "version": "0.1.0"
+    },
     {
       "name": "substack-import",
       "source": "./substack-import",

package/payload/platform/plugins/admin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "admin",
-  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId, and also requires the client business owner's real name (ownerName), refusing a blank or the placeholder \"Owner\" and seeding it onto the sub-account's owner AdminUser and owner Person; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder \"Owner\", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
+  "description": "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder \"Owner\" and seeding it onto the sub-account's owner AdminUser and owner Person, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder \"Owner\", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform.",
   "version": "0.1.0",
   "author": {
     "name": "Rubytech LLC"

package/payload/platform/plugins/admin/PLUGIN.md

@@ -1,7 +1,7 @@
 ---
 name: admin
 surface: platform
-description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires a managing house admin (its userId) and refuses without one, recording it as the sub-account's managingAdminUserId, and also requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder "Owner", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
+description: "Platform administration plugin. Provides system-status, public-hostname (deterministic Cloudflare public-URL resolver, single call returning the operator's canonical hostname so agents never guess property names on :CloudflareHostname nodes), admin-hostname (the admin-host twin of public-hostname — resolves the host that serves /calendar and the rest of the admin shell behind sign-in from the same ingress + alias + operator files, so agents point the operator at the admin /calendar URL instead of the public host that 404s it), publish-site (move an extracted static-site tree under <accountDir>/sites/<slug>/, emit one canonical path slug, and refresh llms.txt at the site root — typed refusal taxonomy replaces the prior skill-prose contract), brand-settings, account-manage, capabilities-here (deterministic install-introspection — returns enabledPlugins, tier, models, installed platform + premium specialists, registered Claude Code agent types, and the brand block as a single JSON object; the canonical tool for grounding any claim about what is enabled on the current account), account-update, the multi-account managed-service lifecycle tools (account_list, account_create, account_delete, account_purge, account_channel_routing, account_channel_routing_set — one Rubytech operator hosting N client accounts on one house install; create/delete/purge are operator-only and purge is two-step with a typed confirmation; account_create requires the client business owner's real name (ownerName), refusing a blank or the placeholder "Owner" and seeding it onto the sub-account's owner AdminUser and owner Person, while a managing house admin (its userId) is optional — when supplied it is validated as a live house admin and recorded as the sub-account's managingAdminUserId, and when omitted the sub-account is unmanaged and its passive-intake tasks route to the install's primary admin; account_reassign_admin repoints a client sub-account's managing admin to another live house admin (the repair path for a dangling managingAdminUserId, or to record one on an unmanaged account); account_roster is the canonical per-account identity view — one row per sub-account giving business name, role, the managing house admin resolved to a name with status (assigned/absent/dangling), the business owner from the graph with status (named/nameless), and the WhatsApp account-manager binding if any, each field carrying what it means and does not (managing admin is the responsible house team member not the owner; account manager is WhatsApp routing only with no admin rights), so the agent never stitches admin-list + account.json + whatsapp-config; account_set_owner_name names (or corrects) a client sub-account's business owner by writing the owned Person — the canonical name source — refusing a blank or the placeholder "Owner", the guarded repair for a nameless owner (the standing identity-audit op=nameless-owned-person detector); account_channel_routing_set repoints the install's single WhatsApp/Telegram inbound stream to a different sub-account), admin-add (refuses on a client sub-account, where admin access is already install-wide so a per-operator seat grants nothing — the sub-account's one identity, its business owner, is set at account creation; the house account, where operators hold PIN logins and admins[] rows, is unchanged), admin-remove (refuses to remove a house admin who still manages one or more client sub-accounts, naming them so the operator reassigns each with account_reassign_admin first — never silently orphans them), admin-list, admin-update-pin, agent-list, agent-config-read, logs-read, plugin-read, skill-load (one-call resolve+read for SKILL.md by skill name, the canonical primitive for loading a named skill; plugin-read remains the reader for references/* and PLUGIN.md), skill-search (free-text intent → skill resolver: ranks every plugin skill's SKILL.md name+description against a query and returns the top owners with their canonical skills/<slug>/ path, so intent→skill mapping survives the available-skills menu leaving context after a compaction), store-skill (deterministic write counterpart to plugin-read; persists operator-authored skills as plugin files under the active account), session-reset, session-resume, wifi, and action-approval tools (action-pending, action-approve, action-reject, action-edit) for managing the Maxy platform."
 tools:
   - name: system-status
     publicAllowlist: false

package/payload/platform/plugins/admin/hooks/lib/maxy-mcp-plugins.txt

@@ -13,6 +13,7 @@ outlook
 quickbooks
 replicate
 scheduling
+storage-broker
 telegram
 url-get
 whatsapp

package/payload/platform/plugins/admin/mcp/dist/index.js

@@ -3365,9 +3365,20 @@ eagerTool(server, "account_roster", "Canonical per-account identity roster for t
     const amByAccount = new Map();
     try {
         const internalPort = parseInt(PLATFORM_PORT, 10);
+        // Task 1636 — the config route is house-scoped; forward this operator
+        // session's platform-stamped caller identity so the gate authorises the
+        // read. account_roster is operator-only, so its house session carries
+        // ACCOUNT_ID (+ HOUSE_ADMIN_SCOPE for a non-specialist house admin); the
+        // agent cannot forge either. Absent (e.g. a non-house context) the gate
+        // fails closed and this best-effort column stays null.
+        const scopeHeaders = { "content-type": "application/json" };
+        if (process.env.ACCOUNT_ID)
+            scopeHeaders["x-maxy-caller-account"] = process.env.ACCOUNT_ID;
+        if (process.env.HOUSE_ADMIN_SCOPE)
+            scopeHeaders["x-maxy-house-admin-scope"] = process.env.HOUSE_ADMIN_SCOPE;
         const res = await fetch(`http://127.0.0.1:${internalPort}/api/whatsapp/config`, {
             method: "POST",
-            headers: { "content-type": "application/json" },
+            headers: scopeHeaders,
             body: JSON.stringify({ action: "list-account-managers" }),
             signal: AbortSignal.timeout(5000),
         });
@@ -3405,19 +3416,18 @@ eagerTool(server, "account_roster", "Canonical per-account identity roster for t
     process.stderr.write(`${TAG} op=roster accounts=${accounts.length} nameless-owners=${namelessOwners} absent-mgr=${absentMgr} dangling-mgr=${danglingMgr}\n`);
     return { content: [{ type: "text", text: accounts.length ? `Account roster:\n\n${lines.join("\n")}` : "No accounts found." }] };
 });
-eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES two things: `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator which one before creating); and `ownerName`, the real name of the client business's owner (ask the operator for it — never invent it or reuse the house operator's name). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\" and managingAdminUserId), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser and owner :Person carrying ownerName) so you can populate it immediately. Refuses if adminUserId is missing/not a house admin, or if ownerName is missing/blank/the placeholder \"Owner\". Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
-    adminUserId: z.string().describe("The userId of the house admin who will manage this client sub-account. Must be a current house admin (see admin-list). Required — creation is refused without it."),
+eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this install (managed service). REQUIRES `ownerName`, the real name of the client business's owner (ask the operator for it — never invent it or reuse the house operator's name). OPTIONALLY takes `adminUserId`, the userId of the house team member who will manage this client (get the choices from admin-list; ask the operator, but omit it if the client is run by its owner rather than a house admin). Mints a UUID, scaffolds the account directory (agents, specialists, settings, account.json with role:\"client\", and managingAdminUserId when an admin is named), seeds default plugins, and seeds the account's graph root (a :LocalBusiness plus its owner :AdminUser and owner :Person carrying ownerName) so you can populate it immediately. Refuses if ownerName is missing/blank/the placeholder \"Owner\", or if a supplied adminUserId is not a current house admin. When no managing admin is set, that account's passive-intake tasks route to the install's primary admin. Returns the new accountId. Operator-only; never creates the house sub-account (that is the install itself).", {
+    adminUserId: z.string().optional().describe("The userId of the house admin who will manage this client sub-account. Optional — omit it for a client run by its owner rather than a house admin (its passive-intake tasks then route to the install's primary admin). When supplied, it must be a current house admin (see admin-list) or creation is refused."),
     ownerName: z.string().describe("The real name of the client business's owner. Applied to both the owner AdminUser and owner Person for the new sub-account. Required — creation is refused when missing, blank, or the placeholder \"Owner\". Ask the operator; never reuse the house operator's name."),
 }, async ({ adminUserId, ownerName }) => {
     if (!ACCOUNT_ID)
         return refuseNoAccount("account_create");
-    // Task 1500 — every client sub-account must carry a responsible house admin.
-    // Refuse (tool error, never a silent default) when none is named, or when
-    // the named userId is not a current house admin.
-    if (!adminUserId || !adminUserId.trim()) {
-        process.stderr.write(`[account-lifecycle] op=create-refused reason=no-admin adminUserId=-\n`);
-        return { content: [{ type: "text", text: `account_create refused: name the managing house admin (adminUserId). Call admin-list to see the choices and ask the operator which one manages this client.` }], isError: true };
-    }
+    // Task 1630 — a managing admin is optional. `adminUserId` omitted/blank ⇒ the
+    // sub-account carries no managingAdminUserId and its passive-intake tasks fall
+    // back to the install's primary admin. A supplied adminUserId is normalized
+    // and still validated below (a named-but-wrong admin is an error, not a
+    // fallback — it catches operator typos, matching account_reassign_admin).
+    const managingAdminUserId = adminUserId && adminUserId.trim() ? adminUserId.trim() : undefined;
     // Task 1567 — the business owner's name is a hard precondition of the
     // sub-account. Refuse before any scaffold so a nameless create leaves no
     // partial account directory or rootless graph behind. The same predicate
@@ -3426,10 +3436,9 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         process.stderr.write(`[account-create] op=refused reason=no-owner-name\n`);
         return { content: [{ type: "text", text: `account_create refused: give the client business owner's real name (ownerName). It cannot be blank or the placeholder "Owner". Ask the operator whose business this is.` }], isError: true };
     }
-    const houseAdminUserIds = readHouseAdminUserIds(ACCOUNTS_ROOT);
-    if (!houseAdminUserIds.includes(adminUserId)) {
-        process.stderr.write(`[account-lifecycle] op=create-refused reason=unknown-admin adminUserId=${adminUserId.slice(0, 8)}\n`);
-        return { content: [{ type: "text", text: `account_create refused: ${adminUserId} is not a current house admin. Call admin-list for the valid managing-admin choices.` }], isError: true };
+    if (managingAdminUserId && !readHouseAdminUserIds(ACCOUNTS_ROOT).includes(managingAdminUserId)) {
+        process.stderr.write(`[account-lifecycle] op=create-refused reason=unknown-admin adminUserId=${managingAdminUserId.slice(0, 8)}\n`);
+        return { content: [{ type: "text", text: `account_create refused: ${managingAdminUserId} is not a current house admin. Call admin-list for the valid managing-admin choices, or omit adminUserId to leave the client unmanaged.` }], isError: true };
     }
     const newId = randomUUID();
     try {
@@ -3472,26 +3481,33 @@ eagerTool(server, "account_create", "Provision a new CLIENT sub-account on this
         finally {
             await seedSession.close();
         }
-        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=${dirExists} root-seeded=${rootSeeded} managingAdmin=${adminUserId.slice(0, 8)}\n`);
+        process.stderr.write(`[account-lifecycle] op=create accountId=${newId} dir-exists=${dirExists} root-seeded=${rootSeeded} managingAdmin=${managingAdminUserId ? managingAdminUserId.slice(0, 8) : "-"}\n`);
         if (!rootSeeded) {
             return { content: [{ type: "text", text: `account_create FAILED: graph root not seeded for ${newId} (business+admin read-back failed). The account directory was scaffolded but is rootless — run account_delete ${newId} and retry.` }], isError: true };
         }
-        // Task 1500 — persist the validated managing admin on the new sub-account.
+        // Task 1500/1630 — persist the managing admin on the new sub-account when
+        // one was named. Skipped when adminUserId was omitted: the account is left
+        // unmanaged and its passive-intake tasks fall back to the primary admin.
         // Done after the root seed so a rootless failure never leaves a half-created
         // account claiming a manager. Its own try: at this point the account is
         // fully created and seeded, so a write failure must not be reported as a
         // generic create failure (which would push the operator to retry and
         // orphan a second account). Report the real state — created but unmanaged —
         // with the recovery action.
-        try {
-            setManagingAdmin(ACCOUNTS_ROOT, newId, adminUserId);
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            process.stderr.write(`[account-lifecycle] op=create-admin-write-failed accountId=${newId} error=${msg}\n`);
-            return { content: [{ type: "text", text: `account_create: sub-account ${newId} was created and its graph root seeded, but recording the managing admin failed: ${msg}. The account exists with no managing admin — run account_delete ${newId} and retry.` }], isError: true };
+        if (managingAdminUserId) {
+            try {
+                setManagingAdmin(ACCOUNTS_ROOT, newId, managingAdminUserId);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`[account-lifecycle] op=create-admin-write-failed accountId=${newId} error=${msg}\n`);
+                return { content: [{ type: "text", text: `account_create: sub-account ${newId} was created and its graph root seeded, but recording the managing admin failed: ${msg}. The account exists with no managing admin — run account_reassign_admin ${newId} <adminUserId> to record one.` }], isError: true };
+            }
         }
-        return { content: [{ type: "text", text: `Created client sub-account ${newId}, managed by admin ${adminUserId}. Switch to it from the sub-account picker to work in its data.` }] };
+        const managedNote = managingAdminUserId
+            ? `managed by admin ${managingAdminUserId}`
+            : `with no managing admin (its passive-intake tasks route to the primary admin; use account_reassign_admin to assign one)`;
+        return { content: [{ type: "text", text: `Created client sub-account ${newId}, ${managedNote}. Switch to it from the sub-account picker to work in its data.` }] };
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);